Allow the constructed certificate chain to be returned in CertVerifyResult

net/base/x509_chain_win.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_chain.h"
 
 #include "base/logging.h"
 #include "base/utf_string_conversions.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
@@ skipping 239 matching lines @@
         }
       }
     }
   }
   return false;
 }
 
 // Saves some information about the certificate chain chain_context in
 // *verify_result.  The caller MUST initialize *verify_result before calling
 // this function.
-void GetCertChainInfo(PCCERT_CHAIN_CONTEXT chain_context,
+void GetCertChainInfo(int flags,
+                      PCCERT_CHAIN_CONTEXT chain_context,
                       CertVerifyResult* verify_result) {
   PCERT_SIMPLE_CHAIN first_chain = chain_context->rgpChain[0];
   int num_elements = first_chain->cElement;
   PCERT_CHAIN_ELEMENT* element = first_chain->rgpElement;
 
   // Each chain starts with the end entity certificate (i = 0) and ends with
   // the root CA certificate (i = num_elements - 1).  Do not inspect the
   // signature algorithm of the root CA certificate because the signature on
   // the trust anchor is not important.
   for (int i = 0; i < num_elements - 1; ++i) {
     PCCERT_CONTEXT cert = element[i]->pCertContext;
     const char* algorithm = cert->pCertInfo->SignatureAlgorithm.pszObjId;
     if (strcmp(algorithm, szOID_RSA_MD5RSA) == 0) {
       // md5WithRSAEncryption: 1.2.840.113549.1.1.4
       verify_result->has_md5 = true;
       if (i != 0)
         verify_result->has_md5_ca = true;
     } else if (strcmp(algorithm, szOID_RSA_MD2RSA) == 0) {
       // md2WithRSAEncryption: 1.2.840.113549.1.1.2
       verify_result->has_md2 = true;
       if (i != 0)
         verify_result->has_md2_ca = true;
     } else if (strcmp(algorithm, szOID_RSA_MD4RSA) == 0) {
       // md4WithRSAEncryption: 1.2.840.113549.1.1.3
       verify_result->has_md4 = true;
     }
   }
+
+  bool return_chain = !!(flags & x509_chain::VERIFY_RETURN_CHAIN);
+  X509Certificate::OSCertHandles intermediates;
+  for (int i = 1; return_chain && i < num_elements; ++i) {
+    PCCERT_CONTEXT cert = element[i]->pCertContext;
+    intermediates.push_back(cert);
+  }
+
+  if (return_chain && num_elements > 0) {
+    verify_result->certificate = X509Certificate::CreateFromHandle(
+        element[0]->pCertContext, intermediates);
+  }
 }
 
 ///////////////////////////////////////////////////////////////////////////
 //
 // Functions used by X509Certificate::IsEV
 //
 ///////////////////////////////////////////////////////////////////////////
 
 // Constructs a certificate chain starting from the end certificate
 // 'cert_context', matching any of the certificate policies.
@@ skipping 181 matching lines @@
            &chain_para,
            chain_flags,
            NULL,  // reserved
            &chain_context)) {
     X509Certificate::FreeOSCertListHandle(cert_list);
     return MapSecurityError(GetLastError());
   }
   X509Certificate::FreeOSCertListHandle(cert_list);
   ScopedCertChainContext scoped_chain_context(chain_context);
 
-  GetCertChainInfo(chain_context, verify_result);
+  GetCertChainInfo(flags, chain_context, verify_result);
 
   verify_result->cert_status |= MapCertChainErrorStatusToCertStatus(
       chain_context->TrustStatus.dwErrorStatus);
 
   // Treat certificates signed using broken signature algorithms as invalid.
   if (verify_result->has_md4)
     verify_result->cert_status |= CERT_STATUS_INVALID;
 
   // Flag certificates signed using weak signature algorithms.
   if (verify_result->has_md2)
@@ skipping 90 matching lines @@
 
   // TODO(ukai): combine regular cert verification and EV cert verification.
   if ((flags & VERIFY_EV_CERT) && VerifyEV(certificate))
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 }  // namespace x509_chain
 
 }  // namespace net