Allow the constructed certificate chain to be returned in CertVerifyResult

net/base/x509_chain_mac.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_chain.h"
 
 #include <Security/Security.h>
 
 #include "base/logging.h"
 #include "base/scoped_cftyperef.h"
@@ skipping 272 matching lines @@
   if (status)
     return NetErrorFromOSStatus(status);
   CFArrayRef completed_chain = NULL;
   CSSM_TP_APPLE_EVIDENCE_INFO* chain_info;
   status = SecTrustGetResult(trust_ref, &trust_result, &completed_chain,
                              &chain_info);
   if (status)
     return NetErrorFromOSStatus(status);
   scoped_cftyperef<CFArrayRef> scoped_completed_chain(completed_chain);
 
+  // Copy the certificate chain, regardless of the results, if requested.
+  if (flags & VERIFY_RETURN_CHAIN) {
+    X509Certificate::OSCertHandles intermediates;
+    for (CFIndex i = 1, count = CFArrayGetCount(completed_chain); i < count;
+         ++i) {
+      intermediates.push_back(reinterpret_cast<SecCertificateRef>(
+          const_cast<void*>(CFArrayGetValueAtIndex(completed_chain, i))));
+    }
+
+    SecCertificateRef server_cert = reinterpret_cast<SecCertificateRef>(
+        const_cast<void*>(CFArrayGetValueAtIndex(completed_chain, 0)));
+    verify_result->certificate = X509Certificate::CreateFromHandle(
+        server_cert, intermediates);
+  }
+
   // Evaluate the results
   OSStatus cssm_result;
   bool got_certificate_error = false;
   switch (trust_result) {
     case kSecTrustResultUnspecified:
     case kSecTrustResultProceed:
       // Certificate chain is valid and trusted ("unspecified" indicates that
       // the user has not explicitly set a trust setting)
       break;
 
@@ skipping 106 matching lines @@
       }
     }
   }
 
   return OK;
 }
 
 }  // namespace x509_chain
 
 }  // namespace net