Use LOAD_VERIFY_EV_CERT to verify EV-ness in Verify()....

net/base/x509_certificate_win.cc

Index: net/base/x509_certificate_win.cc
===================================================================
--- net/base/x509_certificate_win.cc	(revision 19005)
+++ net/base/x509_certificate_win.cc	(working copy)
@@ -428,7 +428,7 @@
 }
 
 int X509Certificate::Verify(const std::string& hostname,
-                            bool rev_checking_enabled,
+                            int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
 
@@ -443,12 +443,14 @@
   chain_para.RequestedUsage.Usage.cUsageIdentifier = 0;
   chain_para.RequestedUsage.Usage.rgpszUsageIdentifier = NULL;  // LPSTR*
   // We can set CERT_CHAIN_RETURN_LOWER_QUALITY_CONTEXTS to get more chains.
-  DWORD flags = CERT_CHAIN_CACHE_END_CERT;
-  if (rev_checking_enabled) {
+  DWORD chain_flags = CERT_CHAIN_CACHE_END_CERT;
+  if (flags & VERIFY_REV_CHECKING_ENABLED) {
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
-    flags |= CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
+    chain_flags |= CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
   } else {
-    flags |= CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY;
+    chain_flags |= CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY;
+    // EV requires revocation checking.
+    flags &= ~VERIFY_EV_CERT;
   }
   PCCERT_CHAIN_CONTEXT chain_context;
   if (!CertGetCertificateChain(
@@ -457,7 +459,7 @@
            NULL,  // current system time
            cert_handle_->hCertStore,  // search this store
            &chain_para,
-           flags,
+           chain_flags,
            NULL,  // reserved
            &chain_context)) {
     return MapSecurityError(GetLastError());
@@ -553,22 +555,20 @@
 
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
+
+  // TODO(ukai): combine regular cert verification and EV cert verification.
+  if ((flags & VERIFY_EV_CERT) && VerifyEV())
+    verify_result->cert_status |= CERT_STATUS_IS_EV;
   return OK;
 }
 
 // Returns true if the certificate is an extended-validation certificate.
 //
-// The certificate has already been verified by the HTTP library.  cert_status
-// represents the result of that verification.  This function performs
-// additional checks of the certificatePolicies extensions of the certificates
-// in the certificate chain according to Section 7 (pp. 11-12) of the EV
-// Certificate Guidelines Version 1.0 at
+// This function checks the certificatePolicies extensions of the
+// certificates in the certificate chain according to Section 7 (pp. 11-12)
+// of the EV Certificate Guidelines Version 1.0 at
 // http://cabforum.org/EV_Certificate_Guidelines.pdf.
-bool X509Certificate::IsEV(int cert_status) const {
-  if (net::IsCertStatusError(cert_status) ||
-      (cert_status & net::CERT_STATUS_REV_CHECKING_ENABLED) == 0)
-    return false;
-
+bool X509Certificate::VerifyEV() const {
   net::EVRootCAMetadata* metadata = net::EVRootCAMetadata::GetInstance();
 
   PCCERT_CHAIN_CONTEXT chain_context = ConstructCertChain(cert_handle_,