X509CertificateNSS::Verify should honor the VERIFY_REV_CHECKING_ENABLED...

net/base/x509_certificate_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 // Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
 // until NSS 3.12.2 comes out and we update to it.
 #define Lock FOO_NSS_Lock
 #include <cert.h>
@@ skipping 102 matching lines @@
 
  private:
   CERTValOutParam* cvout_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedCERTValOutParam);
 };
 
 // Map PORT_GetError() return values to our network error codes.
 int MapSecurityError(int err) {
   switch (err) {
+    case SEC_ERROR_INVALID_ARGS:
+      return ERR_INVALID_ARGUMENT;
     case SEC_ERROR_INVALID_TIME:
     case SEC_ERROR_EXPIRED_CERTIFICATE:
       return ERR_CERT_DATE_INVALID;
     case SEC_ERROR_UNKNOWN_ISSUER:
     case SEC_ERROR_UNTRUSTED_ISSUER:
     case SEC_ERROR_CA_CERT_INVALID:
     case SEC_ERROR_UNTRUSTED_CERT:
       return ERR_CERT_AUTHORITY_INVALID;
     case SEC_ERROR_REVOKED_CERTIFICATE:
       return ERR_CERT_REVOKED;
@@ skipping 196 matching lines @@
   }
   PORT_FreeArena(arena, PR_FALSE);
 }
 
 // Call CERT_PKIXVerifyCert for the cert_handle.
 // Verification results are stored in an array of CERTValOutParam.
 // If policy_oids is not NULL and num_policy_oids is positive, policies
 // are also checked.
 // Caller must initialize cvout before calling this function.
 SECStatus PKIXVerifyCert(X509Certificate::OSCertHandle cert_handle,
+                         bool check_revocation,
                          const SECOidTag* policy_oids,
                          int num_policy_oids,
                          CERTValOutParam* cvout) {
-  bool use_crl = true;
-  bool use_ocsp = true;
+  bool use_crl = check_revocation;
+  bool use_ocsp = check_revocation;
 
   PRUint64 revocation_method_flags =
       CERT_REV_M_DO_NOT_TEST_USING_THIS_METHOD |
       CERT_REV_M_ALLOW_NETWORK_FETCHING |
       CERT_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE |
       CERT_REV_M_IGNORE_MISSING_FRESH_INFO |
       CERT_REV_M_STOP_TESTING_ON_FRESH_INFO;
   PRUint64 revocation_method_independent_flags =
       CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST;
   if (policy_oids && num_policy_oids > 0) {
@@ skipping 41 matching lines @@
 
   revocation_flags.chainTests.number_of_defined_methods =
       arraysize(method_flags);
   revocation_flags.chainTests.cert_rev_flags_per_method = method_flags;
   revocation_flags.chainTests.number_of_preferred_methods =
       arraysize(preferred_revocation_methods);
   revocation_flags.chainTests.preferred_methods = preferred_revocation_methods;
   revocation_flags.chainTests.cert_rev_method_independent_flags =
       revocation_method_independent_flags;
 
-  CERTValInParam cvin[3];
+  CERTValInParam cvin[4];
   int cvin_index = 0;
   // No need to set cert_pi_trustAnchors here.
-  // TODO(ukai): use cert_pi_useAIACertFetch (new feature in NSS 3.12.1).
   cvin[cvin_index].type = cert_pi_revocationFlags;
   cvin[cvin_index].value.pointer.revocation = &revocation_flags;
   cvin_index++;
+  cvin[cvin_index].type = cert_pi_useAIACertFetch;
+  cvin[cvin_index].value.scalar.b = PR_TRUE;
+  cvin_index++;
   std::vector<SECOidTag> policies;
   if (policy_oids && num_policy_oids > 0) {
     cvin[cvin_index].type = cert_pi_policyOID;
     cvin[cvin_index].value.arraySize = num_policy_oids;
     cvin[cvin_index].value.array.oids = policy_oids;
     cvin_index++;
   }
   cvin[cvin_index].type = cert_pi_end;
 
   return CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
@@ skipping 94 matching lines @@
   CERTValOutParam cvout[3];
   int cvout_index = 0;
   // We don't need the trust anchor for the first PKIXVerifyCert call.
   cvout[cvout_index].type = cert_po_certList;
   cvout[cvout_index].value.pointer.chain = NULL;
   int cvout_cert_list_index = cvout_index;
   cvout_index++;
   cvout[cvout_index].type = cert_po_end;
   ScopedCERTValOutParam scoped_cvout(cvout);
 
-  verify_result->cert_status |= net::CERT_STATUS_REV_CHECKING_ENABLED;
-  status = PKIXVerifyCert(cert_handle_, NULL, 0, cvout);
+  bool check_revocation = (flags & VERIFY_REV_CHECKING_ENABLED);
+  if (check_revocation) {
+    verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
+  } else {
+    // EV requires revocation checking.
+    flags &= ~VERIFY_EV_CERT;
+  }
+  status = PKIXVerifyCert(cert_handle_, check_revocation, NULL, 0, cvout);
   if (status != SECSuccess) {
     int err = PORT_GetError();
     LOG(ERROR) << "CERT_PKIXVerifyCert for " << hostname
                << " failed err=" << err;
     // CERT_PKIXVerifyCert rerports the wrong error code for
     // expired certificates (NSS bug 491174)
     if (err == SEC_ERROR_CERT_NOT_VALID &&
         (verify_result->cert_status & CERT_STATUS_DATE_INVALID) != 0)
       err = SEC_ERROR_EXPIRED_CERTIFICATE;
-    verify_result->cert_status |= MapCertErrorToCertStatus(err);
-    return MapCertStatusToNetError(verify_result->cert_status);
+    int cert_status = MapCertErrorToCertStatus(err);
+    if (cert_status) {
+      verify_result->cert_status |= cert_status;
+      return MapCertStatusToNetError(verify_result->cert_status);
+    }
+    // |err| is not a certificate error.
+    return MapSecurityError(err);
   }
 
   GetCertChainInfo(cvout[cvout_cert_list_index].value.pointer.chain,
                    verify_result);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   if ((flags & VERIFY_EV_CERT) && VerifyEV())
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
@@ skipping 12 matching lines @@
   CERTValOutParam cvout[3];
   int cvout_index = 0;
   cvout[cvout_index].type = cert_po_trustAnchor;
   cvout[cvout_index].value.pointer.cert = NULL;
   int cvout_trust_anchor_index = cvout_index;
   cvout_index++;
   cvout[cvout_index].type = cert_po_end;
   ScopedCERTValOutParam scoped_cvout(cvout);
 
   SECStatus status = PKIXVerifyCert(cert_handle_,
+                                    true,
                                     metadata->GetPolicyOIDs(),
                                     metadata->NumPolicyOIDs(),
                                     cvout);
   if (status != SECSuccess)
     return false;
 
   CERTCertificate* root_ca =
       cvout[cvout_trust_anchor_index].value.pointer.cert;
   if (root_ca == NULL)
     return false;
@@ skipping 36 matching lines @@
   DCHECK(0 != cert->derCert.len);
 
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, sha1.data,
                               cert->derCert.data, cert->derCert.len);
   DCHECK(rv == SECSuccess);
 
   return sha1;
 }
 
 }  // namespace net