X509CertificateNSS::Verify should honor the VERIFY_REV_CHECKING_ENABLED...

X509Certificate::Verify should honor the
VERIFY_REV_CHECKING_ENABLED flag.  This allows us to enable
part of the X509CertificateTest.PaypalNullCertParsing test
for Linux because the test disables revocation checking,
thereby avoiding the overly strict assertion in nss_ocsp.cc.

Enable cert_pi_useAIACertFetch to fetch missing
intermediate CA certificates.

Handle a non-certificate error reported by PKIXVerifyCert.

R=ukai
BUG=none
TEST=none

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=30585

[wtc, 2009-10-26 23:43:12]

http://codereview.chromium.org/333033/diff/1/3
File net/base/x509_certificate_nss.cc (right):

http://codereview.chromium.org/333033/diff/1/3#newcode405
Line 405: 
The cert_pi_useAIACertFetch change here is independent of the
rest of the CL.  cert_pi_useAIACertFetch is documented at
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/certdb/c...

http://codereview.chromium.org/333033/diff/1/2
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/333033/diff/1/2#newcode679
Line 679: int flags = 0;
Note that the VERIFY_REV_CHECKING_ENABLED flag is not
specified, so revocation checking is disabled, and the code in
nss_ocsp.cc won't be executed.

[ukai, 2009-10-27 09:26:06]

http://codereview.chromium.org/333033/diff/1/3
File net/base/x509_certificate_nss.cc (right):

http://codereview.chromium.org/333033/diff/1/3#newcode412
Line 412: cvin[cvin_index].type = cert_pi_useAIACertFetch;
build failure? we might need latest version of NSS library to compile?
http://build.chromium.org/buildbot/try-server/builders/linux/builds/5081/step...

[wtc, 2009-10-27 23:08:25]

Thanks for the review and for checking the try build results.

I won't check in this CL until all the buildbot and trybot
machines have been updated to NSS 3.12.3 or later.

I tested my code with NSS 3.12.0 at runtime, and it failed
a NOTREACHED() assertion.  So I added code to handle a
non-certificate error reported by PKIXVerifyCert.  Please
review the new Patch Set.

[ukai, 2009-10-28 08:34:48]

LGTM