Route OCSP stapling through CertVerifier.

net/cert/cert_verify_proc_win.cc

Index: net/cert/cert_verify_proc_win.cc
diff --git a/net/cert/cert_verify_proc_win.cc b/net/cert/cert_verify_proc_win.cc
index 13a337bfe2f54fa5a826b09642f5a6807eda741f..6e10d653ef725bce97f7a6cd838b191d737b5e08 100644
--- a/net/cert/cert_verify_proc_win.cc
+++ b/net/cert/cert_verify_proc_win.cc
@@ -559,9 +559,19 @@ bool CertVerifyProcWin::SupportsAdditionalTrustAnchors() const {
   return false;
 }
 
+bool CertVerifyProcWin::SupportsOCSPStapling() const {
+  // CERT_OCSP_RESPONSE_PROP_ID is only implemented on Vista+, but it can be
+  // set on Windows XP without error. There is some overhead from the server
+  // sending the OCSP response if it supports the extension, for the subset of
+  // XP clients who will request it but be unable to use it, but this is an
+  // acceptable trade-off for simplicity of implementation.
+  return true;
+}
+
 int CertVerifyProcWin::VerifyInternal(
     X509Certificate* cert,
     const std::string& hostname,
+    const std::string& ocsp_response,
     int flags,
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
@@ -570,6 +580,20 @@ int CertVerifyProcWin::VerifyInternal(
   if (!cert_handle)
     return ERR_UNEXPECTED;
 
+  // Attach the OCSP response to the certificate.
+  if (!ocsp_response.empty()) {
+    CRYPT_DATA_BLOB ocsp_response_blob;
+    ocsp_response_blob.cbData = ocsp_response.size();
+    ocsp_response_blob.pbData =
+        reinterpret_cast<BYTE*>(const_cast<char*>(ocsp_response.data()));
+    BOOL ok = CertSetCertificateContextProperty(
+        cert_handle, CERT_OCSP_RESPONSE_PROP_ID,
+        CERT_SET_PROPERTY_IGNORE_PERSIST_ERROR_FLAG, &ocsp_response_blob);
+    if (!ok) {
+      VLOG(1) << "Failed to set OCSP response property: " << GetLastError();
+    }
+  }

[Ryan Sleevi, 2015/04/22 22:53:37]

Move this down to line 659 and your problems go away

[davidben, 2015/04/23 01:02:32]

Done.

+
   // Build and validate certificate chain.
   CERT_CHAIN_PARA chain_para;
   memset(&chain_para, 0, sizeof(chain_para));