Mac: Look for issuer in a certificate chain instead of subject

Mac: Look for issuer in a certificate chain instead of subject

If the CA does not send us intermediate certificates, we may not be able to
build a chain up to the relevant issuer. Instead, search the chain for
certificates with just the correct issuer.

R=wtc
BUG=50980
TEST=X509CertificateTest.IsIssuedBy

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=54780

[wtc, 2010-08-02 18:59:40]

LGTM.  Nice catch!

This bug is probably worth a bug report.

[davidben, 2010-08-03 01:05:54]

And here's a unit test. I'll send to the try bots when there's a green revision
that contains the certs I added.

[wtc, 2010-08-03 01:26:58]

LGTM.

http://codereview.chromium.org/3052035/diff/4001/5002
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/3052035/diff/4001/5002#newcode636
net/base/x509_certificate_unittest.cc:636: #if defined(OS_MACOSX)
Is this unit test ifdef'd with OS_MACOSX because
the IsIssuedBy method is defined for OS_MACOSX only?

http://codereview.chromium.org/3052035/diff/4001/5002#newcode645
net/base/x509_certificate_unittest.cc:645: CertPrincipal mit_principal;
Nit: mit_principal => mit_issuer
     foaf_principal => foaf_issuer
Or you can use "name" instead of "issuer".

I don't lke the CertPrincipal type name.
It probably should be renamed CertName.
In ASN.1, this type is called "Name".

[wtc, 2010-08-03 03:25:54]

http://codereview.chromium.org/3052035/diff/4001/5001
File net/base/x509_certificate_mac.cc (right):

http://codereview.chromium.org/3052035/diff/4001/5001#newcode864
net/base/x509_certificate_mac.cc:864: if
(cert->issuer().Matches(valid_issuers[j]))
No wonder this bug looks familiar to me.

I noted this bug when I reviewed this code before.
See my last comment in
http://codereview.chromium.org/1128008