Use LOAD_VERIFY_EV_CERT to verify EV-ness in Verify()....

net/base/x509_certificate_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include "base/logging.h"
 #include "base/pickle.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
@@ skipping 410 matching lines @@
       // characters, so we can use WideToASCII here.
       if (alt_name->rgAltEntry[i].dwAltNameChoice == CERT_ALT_NAME_DNS_NAME)
         dns_names->push_back(WideToASCII(alt_name->rgAltEntry[i].pwszDNSName));
     }
   }
   if (dns_names->empty())
     dns_names->push_back(subject_.common_name);
 }
 
 int X509Certificate::Verify(const std::string& hostname,
-                            bool rev_checking_enabled,
+                            int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
 
   // Build and validate certificate chain.
 
   CERT_CHAIN_PARA chain_para;
   memset(&chain_para, 0, sizeof(chain_para));
   chain_para.cbSize = sizeof(chain_para);
   // TODO(wtc): consider requesting the usage szOID_PKIX_KP_SERVER_AUTH
   // or szOID_SERVER_GATED_CRYPTO or szOID_SGC_NETSCAPE
   chain_para.RequestedUsage.dwType = USAGE_MATCH_TYPE_AND;
   chain_para.RequestedUsage.Usage.cUsageIdentifier = 0;
   chain_para.RequestedUsage.Usage.rgpszUsageIdentifier = NULL;  // LPSTR*
   // We can set CERT_CHAIN_RETURN_LOWER_QUALITY_CONTEXTS to get more chains.
-  DWORD flags = CERT_CHAIN_CACHE_END_CERT;
-  if (rev_checking_enabled) {
+  DWORD chain_flags = CERT_CHAIN_CACHE_END_CERT;
+  if (flags & VERIFY_REV_CHECKING_ENABLED) {
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
-    flags |= CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
+    chain_flags |= CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
   } else {
-    flags |= CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY;
+    chain_flags |= CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY;
+    // EV requires revocation checking.
+    flags &= ~VERIFY_EV_CERT;
   }
   PCCERT_CHAIN_CONTEXT chain_context;
   if (!CertGetCertificateChain(
            NULL,  // default chain engine, HCCE_CURRENT_USER
            cert_handle_,
            NULL,  // current system time
            cert_handle_->hCertStore,  // search this store
            &chain_para,
-           flags,
+           chain_flags,
            NULL,  // reserved
            &chain_context)) {
     return MapSecurityError(GetLastError());
   }
   ScopedCertChainContext scoped_chain_context(chain_context);
 
   GetCertChainInfo(chain_context, verify_result);
 
   verify_result->cert_status |= MapCertChainErrorStatusToCertStatus(
       chain_context->TrustStatus.dwErrorStatus);
@@ skipping 75 matching lines @@
       }
     }
   }
 
   // TODO(wtc): Suppress CERT_STATUS_NO_REVOCATION_MECHANISM for now to be
   // compatible with WinHTTP, which doesn't report this error (bug 3004).
   verify_result->cert_status &= ~CERT_STATUS_NO_REVOCATION_MECHANISM;
 
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
+
+  // TODO(ukai): combine regular cert verification and EV cert verification.
+  if ((flags & VERIFY_EV_CERT) && VerifyEV())
+    verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 // Returns true if the certificate is an extended-validation certificate.
 //
-// The certificate has already been verified by the HTTP library.  cert_status
-// represents the result of that verification.  This function performs
-// additional checks of the certificatePolicies extensions of the certificates
-// in the certificate chain according to Section 7 (pp. 11-12) of the EV
-// Certificate Guidelines Version 1.0 at
+// This function checks the certificatePolicies extensions of the
+// certificates in the certificate chain according to Section 7 (pp. 11-12)
+// of the EV Certificate Guidelines Version 1.0 at
 // http://cabforum.org/EV_Certificate_Guidelines.pdf.
-bool X509Certificate::IsEV(int cert_status) const {
-  if (net::IsCertStatusError(cert_status) ||
-      (cert_status & net::CERT_STATUS_REV_CHECKING_ENABLED) == 0)
-    return false;
-
+bool X509Certificate::VerifyEV() const {
   net::EVRootCAMetadata* metadata = net::EVRootCAMetadata::GetInstance();
 
   PCCERT_CHAIN_CONTEXT chain_context = ConstructCertChain(cert_handle_,
       metadata->GetPolicyOIDs(), metadata->NumPolicyOIDs());
   if (!chain_context)
     return false;
   ScopedCertChainContext scoped_chain_context(chain_context);
 
   DCHECK(chain_context->cChain != 0);
   // If the cert doesn't match any of the policies, the
@@ skipping 61 matching lines @@
   DWORD sha1_size = sizeof(sha1.data);
   rv = CryptHashCertificate(NULL, CALG_SHA1, 0, cert->pbCertEncoded,
                             cert->cbCertEncoded, sha1.data, &sha1_size);
   DCHECK(rv && sha1_size == sizeof(sha1.data));
   if (!rv)
     memset(sha1.data, 0, sizeof(sha1.data));
   return sha1;
 }
 
 }  // namespace net