Allow the constructed certificate chain to be returned in CertVerifyResult

net/base/x509_chain_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_chain.h"
 
 #include <cert.h>
 #include <nss.h>
 #include <prerror.h>
 #include <secerr.h>
@@ skipping 124 matching lines @@
     case SEC_ERROR_POLICY_VALIDATION_FAILED:
       return CERT_STATUS_INVALID;
     default:
       return 0;
   }
 }
 
 // Saves some information about the certificate chain cert_list in
 // *verify_result.  The caller MUST initialize *verify_result before calling
 // this function.
-// Note that cert_list[0] is the end entity certificate and cert_list doesn't
-// contain the root CA certificate.
-void GetCertChainInfo(CERTCertList* cert_list,
+// Note that cert_list[0] is the end entity certificate
+void GetCertChainInfo(int flags,
+                      CERTCertList* cert_list,
+                      CERTCertificate* trust_anchor,
                       CertVerifyResult* verify_result) {
   // NOTE: Using a NSS library before 3.12.3.1 will crash below.  To see the
   // NSS version currently in use:
   // 1. use ldd on the chrome executable for NSS's location (ie. libnss3.so*)
   // 2. use ident libnss3.so* for the library's version
   DCHECK(cert_list);
+  bool return_chain = !!(flags & x509_chain::VERIFY_RETURN_CHAIN);
+  X509Certificate::OSCertHandles intermediates;
   int i = 0;
   for (CERTCertListNode* node = CERT_LIST_HEAD(cert_list);
        !CERT_LIST_END(node, cert_list);
        node = CERT_LIST_NEXT(node), i++) {
     SECAlgorithmID& signature = node->cert->signature;
     SECOidTag oid_tag = SECOID_FindOIDTag(&signature.algorithm);
     switch (oid_tag) {
       case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION:
         verify_result->has_md5 = true;
         if (i != 0)
           verify_result->has_md5_ca = true;
         break;
       case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION:
         verify_result->has_md2 = true;
         if (i != 0)
           verify_result->has_md2_ca = true;
         break;
       case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:
         verify_result->has_md4 = true;
         break;
       default:
         break;
     }
+
+    if (return_chain && i != 0)
+      intermediates.push_back(node->cert);
+  }
+
+  if (return_chain) {
+    if (trust_anchor)
+      intermediates.push_back(trust_anchor);
+    verify_result->certificate = X509Certificate::CreateFromHandle(
+        CERT_LIST_HEAD(cert_list)->cert, intermediates);
   }
 }
 
 // Forward declarations.
 SECStatus RetryPKIXVerifyCertWithWorkarounds(
     X509Certificate::OSCertHandle cert_handle, int num_policy_oids,
     std::vector<CERTValInParam>* cvin, CERTValOutParam* cvout);
 SECOidTag GetFirstCertPolicy(X509Certificate::OSCertHandle cert_handle);
 
 // Call CERT_PKIXVerifyCert for the cert_handle.
@@ skipping 297 matching lines @@
                                          hostname.c_str());
   if (status != SECSuccess)
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
 
   // Make sure that the cert is valid now.
   SECCertTimeValidity validity = CERT_CheckCertValidTimes(
       certificate->os_cert_handle(), PR_Now(), PR_TRUE);
   if (validity != secCertTimeValid)
     verify_result->cert_status |= CERT_STATUS_DATE_INVALID;
 
-  CERTValOutParam cvout[3];
+  CERTValOutParam cvout[4];
   int cvout_index = 0;
-  // We don't need the trust anchor for the first PKIXVerifyCert call.
   cvout[cvout_index].type = cert_po_certList;
   cvout[cvout_index].value.pointer.chain = NULL;
   int cvout_cert_list_index = cvout_index;
   cvout_index++;
+  cvout[cvout_index].type = cert_po_trustAnchor;
+  cvout[cvout_index].value.pointer.cert = NULL;
+  int cvout_trust_anchor_index = cvout_index;
+  cvout_index++;
   cvout[cvout_index].type = cert_po_end;
   ScopedCERTValOutParam scoped_cvout(cvout);
 
   bool check_revocation = (flags & VERIFY_REV_CHECKING_ENABLED);
   if (check_revocation) {
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
   } else {
     // EV requires revocation checking.
     flags &= ~VERIFY_EV_CERT;
   }
@@ skipping 10 matching lines @@
       err = SEC_ERROR_EXPIRED_CERTIFICATE;
     int cert_status = MapCertErrorToCertStatus(err);
     if (cert_status) {
       verify_result->cert_status |= cert_status;
       return MapCertStatusToNetError(verify_result->cert_status);
     }
     // |err| is not a certificate error.
     return MapSecurityError(err);
   }
 
-  GetCertChainInfo(cvout[cvout_cert_list_index].value.pointer.chain,
+  GetCertChainInfo(flags, cvout[cvout_cert_list_index].value.pointer.chain,
+                   cvout[cvout_trust_anchor_index].value.pointer.cert,
                    verify_result);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   if ((flags & VERIFY_EV_CERT) && VerifyEV(certificate))
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 }  // namespace x509_chain
 
 }  // namespace net