net: allow EV indication on Windows when the local OCSP/CRL cache is stale.

net/base/x509_certificate_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #define PRArenaPool PLArenaPool  // Required by <blapi.h>.
 #include <blapi.h>  // Implement CalculateChainFingerprint() with NSS.
 
 #include "base/lazy_instance.h"
@@ skipping 897 matching lines @@
     // statuses from the offline checks so we squash this error.
     verify_result->cert_status &= ~CERT_STATUS_UNABLE_TO_CHECK_REVOCATION;
   }
 
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   AppendPublicKeyHashes(chain_context, &verify_result->public_key_hashes);
   verify_result->is_issued_by_known_root = IsIssuedByKnownRoot(chain_context);
 
-  if (ev_policy_oid && CheckEV(chain_context, ev_policy_oid))
+  if (ev_policy_oid && CheckEV(chain_context, flags, ev_policy_oid))
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 // static
 bool X509Certificate::GetDEREncoded(X509Certificate::OSCertHandle cert_handle,
                                     std::string* encoded) {
   if (!cert_handle->pbCertEncoded || !cert_handle->cbCertEncoded)
     return false;
   encoded->assign(reinterpret_cast<char*>(cert_handle->pbCertEncoded),
                   cert_handle->cbCertEncoded);
   return true;
 }
 
 // Returns true if the certificate is an extended-validation certificate.
 //
 // This function checks the certificatePolicies extensions of the
 // certificates in the certificate chain according to Section 7 (pp. 11-12)
 // of the EV Certificate Guidelines Version 1.0 at
 // http://cabforum.org/EV_Certificate_Guidelines.pdf.
 bool X509Certificate::CheckEV(PCCERT_CHAIN_CONTEXT chain_context,
+                              int flags,
                               const char* policy_oid) const {
   DCHECK_NE(static_cast<DWORD>(0), chain_context->cChain);
   // If the cert doesn't match any of the policies, the
   // CERT_TRUST_IS_NOT_VALID_FOR_USAGE bit (0x10) in
   // chain_context->TrustStatus.dwErrorStatus is set.
   DWORD error_status = chain_context->TrustStatus.dwErrorStatus;
-  DWORD info_status = chain_context->TrustStatus.dwInfoStatus;
+
+  if (!(flags & VERIFY_REV_CHECKING_ENABLED)) {
+    // If online revocation checking is disabled then we will have still
+    // requested that the revocation cache be checked. However, that will often
+    // cause the following two error bits to be set. Since they are expected,

[wtc, 2012/03/08 00:55:26]

It would be nice to say what those two error bits mean in
this case (the local OCSP/CRL cache is stale).

In this case, we won't show the EV badge unless we get a
fresh "good" status from either the CRL set or online
revocation checking, right?

+    // we mask them away.
+    error_status &= ~(CERT_TRUST_IS_OFFLINE_REVOCATION |
+                      CERT_TRUST_REVOCATION_STATUS_UNKNOWN);
+  }
   if (!chain_context->cChain || error_status != CERT_TRUST_NO_ERROR)
     return false;
 
   // Check the end certificate simple chain (chain_context->rgpChain[0]).
   // If the end certificate's certificatePolicies extension contains the
   // EV policy OID of the root CA, return true.
   PCERT_CHAIN_ELEMENT* element = chain_context->rgpChain[0]->rgpElement;
   int num_elements = chain_context->rgpChain[0]->cElement;
   if (num_elements < 2)
     return false;
@@ skipping 171 matching lines @@
       *type = kPublicKeyTypeECDH;
       break;
     default:
       *type = kPublicKeyTypeUnknown;
       *size_bits = 0;
       break;
   }
 }
 
 }  // namespace net