Fixes the remaining net_unittests for OpenSSL, with the exceptions

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 407 matching lines @@
 
   for (OSCertHandles::const_iterator it = intermediate_ca_certs_.begin();
        it != intermediate_ca_certs_.end(); ++it) {
     if (!sk_X509_push(intermediates.get(), *it))
       return ERR_OUT_OF_MEMORY;
   }
   int rv = X509_STORE_CTX_init(ctx.get(), cert_store(),
                                cert_handle_, intermediates.get());
   CHECK_EQ(1, rv);
 
-  if (X509_verify_cert(ctx.get()) == 1) {
-    return OK;
+  if (X509_verify_cert(ctx.get()) != 1) {
+    int x509_error = X509_STORE_CTX_get_error(ctx.get());
+    int cert_status = MapCertErrorToCertStatus(x509_error);
+    LOG(ERROR) << "X509 Verification error "
+        << X509_verify_cert_error_string(x509_error)
+        << " : " << x509_error
+        << " : " << X509_STORE_CTX_get_error_depth(ctx.get())
+        << " : " << cert_status;
+    verify_result->cert_status |= cert_status;
+    return MapCertStatusToNetError(verify_result->cert_status);

[wtc, 2010/12/01 22:50:05]

Nit: you can remove this return statement.  If you fall
through, the return statement on line 441 will take care
of this case.

[joth, 2010/12/02 17:12:01]

Done.

   }
 
-  int x509_error = X509_STORE_CTX_get_error(ctx.get());
-  int cert_status = MapCertErrorToCertStatus(x509_error);
-  LOG(ERROR) << "X509 Verification error "
-      << X509_verify_cert_error_string(x509_error)
-      << " : " << x509_error
-      << " : " << X509_STORE_CTX_get_error_depth(ctx.get())
-      << " : " << cert_status;
-  verify_result->cert_status |= cert_status;
-  return MapCertStatusToNetError(verify_result->cert_status);
+  if (IsCertStatusError(verify_result->cert_status))
+    return MapCertStatusToNetError(verify_result->cert_status);
+
+  return OK;
 }
 
 // static
 bool X509Certificate::IsSameOSCert(X509Certificate::OSCertHandle a,
                                    X509Certificate::OSCertHandle b) {
   DCHECK(a && b);
   if (a == b)
     return true;
 
   // X509_cmp only checks the fingerprint, but we want to compare the whole
   // DER data. Encoding it from OSCertHandle is an expensive operation, so we
   // cache the DER (if not already cached via X509_set_ex_data).
   DERCache der_cache_a, der_cache_b;
 
   return GetDERAndCacheIfNeeded(a, &der_cache_a) &&
       GetDERAndCacheIfNeeded(b, &der_cache_b) &&
       der_cache_a.data_length == der_cache_b.data_length &&
       memcmp(der_cache_a.data, der_cache_b.data, der_cache_a.data_length) == 0;
 }
 
 } // namespace net