Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/cert_verify_proc_mac.cc

Index: net/base/cert_verify_proc_mac.cc
diff --git a/net/base/cert_verify_proc_mac.cc b/net/base/cert_verify_proc_mac.cc
index 49798b5afd00d28dedddb298d21e0bef15ab5bfc..2cbffef8a23fa554e3710fa23acb144bdde3703b 100644
--- a/net/base/cert_verify_proc_mac.cc
+++ b/net/base/cert_verify_proc_mac.cc
@@ -157,6 +157,7 @@ OSStatus CreateTrustPolicies(const std::string& hostname,
   // revocation preference.
   status = x509_util::CreateRevocationPolicies(
       (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED),
+      (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY),

[wtc, 2012/08/16 23:28:03]

We pass
  (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)
as this argument, but this argument is named enable_ev_checking
as opposed to enable_revocation_checking_ev_only. This is a little
confusing.

I think the enable_ev_checking argument does mean "enable EV checking". Perhaps
a comment here would be useful.
(We only set VERIFY_REV_CHECKING_ENABLED_EV_ONLY if VERIFY_EV_CERT is true.)

[Ryan Sleevi, 2012/08/16 23:55:30]

Just to make sure - you're asking for a comment here in addition to the comment
at the CreateRevocationPolicies?

I would rather refine the comment there if you think this is confusing.

[wtc, 2012/08/17 00:34:44]

Yes, I was asking for an extra comment here, at the call
site, to explain the seemingly mismatch between
  (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)
and
  enable_ev_checking

But it is fine to not add more comments.

       local_policies);
   if (status)
     return status;
@@ -380,6 +381,8 @@ int CertVerifyProcMac::VerifyInternal(X509Certificate* cert,
   tp_action_data.ActionFlags = CSSM_TP_ACTION_FETCH_CERT_FROM_NET |
                                CSSM_TP_ACTION_TRUST_SETTINGS;
 
+  // Note: For EV certificates, the Apple TP will handle setting these flags
+  // as part of EV evaluation.
   if (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED) {
     // Require a positive result from an OCSP responder or a CRL (or both)
     // for every certificate in the chain. The Apple TP automatically
@@ -564,6 +567,8 @@ int CertVerifyProcMac::VerifyInternal(X509Certificate* cert,
           if (CFDictionaryContainsKey(ev_dict,
                                       kSecEVOrganizationName)) {
             verify_result->cert_status |= CERT_STATUS_IS_EV;
+            if (flags & X509Certificate::VERIFY_REV_CHECKING_ENABLED_EV_ONLY)
+              verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
           }
         }
       }