CertVerifyProcMac: Add Keychain re-ordering hack, check CRLsets in path pruning loop.

net/data/ssl/certificates/tripadvisor-verisign-chain.pem

Index: net/data/ssl/certificates/tripadvisor-verisign-chain.pem
diff --git a/net/data/ssl/certificates/tripadvisor-verisign-chain.pem b/net/data/ssl/certificates/tripadvisor-verisign-chain.pem
new file mode 100644
index 0000000000000000000000000000000000000000..b7d053f42f803d8d1b7de656ac851d5490238293
--- /dev/null
+++ b/net/data/ssl/certificates/tripadvisor-verisign-chain.pem
@@ -0,0 +1,221 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7c:46:cc:1b:4b:12:11:53:90:2a:cc:8b:7a:4d:95:c7
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 EV SSL CA - G3
+        Validity
+            Not Before: Feb 17 00:00:00 2016 GMT
+            Not After : Apr  2 23:59:59 2018 GMT
+        Subject: 1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware, C=US, ST=Massachusetts, L=Newton/businessCategory=Private Organization/serialNumber=3175592, O=TripAdvisor LLC, OU=IT, CN=www.tripadvisor.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:d5:ba:39:ca:90:9f:83:6c:ee:e6:ad:44:81:01:
+                    de:6e:2c:6f:9e:41:33:41:af:57:2d:0d:7d:f8:92:
+                    a7:a1:7b:60:33:77:fd:1c:b6:ca:65:2a:0f:32:51:
+                    a2:46:d7:50:9a:7a:73:4f:e3:d9:5c:84:dd:e5:87:
+                    1b:59:d1:e9:28:24:9e:c2:9e:78:15:77:61:7e:b1:
+                    6c:c2:29:0f:1d:7e:55:e7:4b:5d:27:f8:91:73:65:
+                    44:6b:30:71:04:dd:3a:59:ba:21:0d:74:4e:2c:92:
+                    3a:29:e4:c8:12:dc:d7:a9:b2:f4:1f:65:86:bc:c1:
+                    7e:c5:b0:c2:ef:a6:d4:b1:c8:75:a4:7c:0c:43:5f:
+                    79:ee:bb:f4:04:a4:88:57:0e:f1:2c:df:2d:e0:6d:
+                    37:5d:78:8a:fc:9c:20:e7:46:8e:b6:e3:7b:35:80:
+                    bf:76:9e:d0:ec:45:e7:7d:71:2e:e2:56:77:c4:fd:
+                    50:37:69:a6:9c:44:95:aa:07:e6:11:c5:ba:12:93:
+                    0f:49:b4:44:ac:8b:a2:be:e3:d4:2b:a3:92:98:10:
+                    e8:51:8b:0b:3b:f6:c5:a6:66:9c:16:05:6f:65:56:
+                    6a:a9:fa:93:0c:87:11:9c:22:a1:9c:5f:bc:7f:9f:
+                    4b:dc:5b:28:3b:ef:b3:1e:83:1b:18:b9:02:f3:c8:
+                    18:7d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:www.tripadvisor.com, DNS:tripadvisor.com
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 CRL Distribution Points: 
+                URI:http://sr.symcb.com/sr.crl
+
+            X509v3 Certificate Policies: 
+                Policy: 2.16.840.1.113733.1.7.23.6
+                  CPS: https://d.symcb.com/cps
+                  User Notice:
+                    Explicit Text: https://d.symcb.com/rpa
+                Policy: 2.23.140.1.1
+
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Authority Key Identifier: 
+                keyid:01:59:AB:E7:DD:3A:0B:59:A6:64:63:D6:CF:20:07:57:D5:91:E7:6A
+
+            Authority Information Access: 
+                OCSP - URI:http://sr.symcd.com
+                CA Issuers - URI:http://sr.symcb.com/sr.crt
+
+            1.3.6.1.4.1.11129.2.4.2: 
+                [HEX DUMP]:0482016A0168007600DDEB1D2B7A0D4FA6208B81AD8168707E2E8E9D01D55C888D3D11C4CDB6ECBECC00000152EFA352B800000403004730450220084438A3CA1C0EB2216F3D2D7060893D85DEA1A9381978383A5B8A58D38E216E022100AC13863C7B699573D7802F058D512AE78E898179FD70D4EE37384ED7E8DE799B007600A4B90990B418581487BB13A2CC67700A3C359804F91BDFB8E377CD0EC80DDC1000000152EFA352CB00000403004730450221008D3B0D6275B41A26C1E54FD51B6215463672940F8442ECC6FA5A32E7C710D6E1022034606AF0C0FA24EEACF55B85EED66FDD466DDB84D6DC759AB61680240DD6F82300760068F698F81F6482BE3A8CEEB9281D4CFC71515D6793D444D10A67ACBB4F4FFBC400000152EFA352DB0000040300473045022100FE46B75EF8616827AFDACFA73CC017FDF93268B2C34DACF0C764A73D0A44EE750220743C1CC75BB648B71A51943A6BC0EE4B464330EA1371E78CF429C06AA883D224
+    Signature Algorithm: sha256WithRSAEncryption
+        15:a2:27:7f:1c:e6:d7:02:74:c9:ab:77:dd:bf:75:f3:3a:27:
+        6c:f5:4a:f6:43:d5:e0:db:c7:1d:12:57:a4:dd:a8:c6:f0:66:
+        ae:2d:df:bd:b4:43:cd:fa:e2:09:6a:fd:d0:55:b6:a5:d8:ef:
+        43:34:71:1c:25:f8:ab:1b:09:63:d7:53:e7:97:70:ad:e4:60:
+        72:92:35:18:3d:44:b2:a1:14:7b:af:52:14:e2:ed:e4:aa:72:
+        05:99:ee:0b:e3:65:15:58:93:36:81:7a:6e:41:b1:df:5e:52:
+        47:f6:59:2c:2f:32:ff:73:74:0b:cd:54:16:26:55:68:f3:b8:
+        f4:00:18:8e:a8:cf:25:f6:34:46:9b:d9:39:50:ff:0a:a2:65:
+        a1:b4:b8:04:67:eb:47:36:90:e0:bf:d3:71:12:84:04:d0:43:
+        fe:37:e3:c0:cb:7f:1b:2b:83:36:e6:40:a7:a4:4c:90:7e:8a:
+        b2:c0:22:d2:b7:09:53:94:9b:51:80:cc:17:37:06:d8:e3:8b:
+        ee:ac:4a:dc:4c:27:ee:01:28:10:79:dc:47:16:b6:72:90:8b:
+        a5:46:33:74:e2:fa:d8:b6:5f:20:5b:3c:1c:94:48:40:70:c8:
+        2c:13:e3:ea:98:84:b5:92:e8:25:d1:84:a4:17:df:14:5b:1e:
+        8e:85:f4:3a
+-----BEGIN CERTIFICATE-----
+MIIG6TCCBdGgAwIBAgIQfEbMG0sSEVOQKsyLek2VxzANBgkqhkiG9w0BAQsFADB3
+MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd
+BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxKDAmBgNVBAMTH1N5bWFudGVj
+IENsYXNzIDMgRVYgU1NMIENBIC0gRzMwHhcNMTYwMjE3MDAwMDAwWhcNMTgwNDAy
+MjM1OTU5WjCB3DETMBEGCysGAQQBgjc8AgEDEwJVUzEZMBcGCysGAQQBgjc8AgEC
+DAhEZWxhd2FyZTELMAkGA1UEBhMCVVMxFjAUBgNVBAgMDU1hc3NhY2h1c2V0dHMx
+DzANBgNVBAcMBk5ld3RvbjEdMBsGA1UEDxMUUHJpdmF0ZSBPcmdhbml6YXRpb24x
+EDAOBgNVBAUTBzMxNzU1OTIxGDAWBgNVBAoMD1RyaXBBZHZpc29yIExMQzELMAkG
+A1UECwwCSVQxHDAaBgNVBAMME3d3dy50cmlwYWR2aXNvci5jb20wggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVujnKkJ+DbO7mrUSBAd5uLG+eQTNBr1ct
+DX34kqehe2Azd/0ctsplKg8yUaJG11CaenNP49lchN3lhxtZ0ekoJJ7CnngVd2F+
+sWzCKQ8dflXnS10n+JFzZURrMHEE3TpZuiENdE4skjop5MgS3NepsvQfZYa8wX7F
+sMLvptSxyHWkfAxDX3nuu/QEpIhXDvEs3y3gbTddeIr8nCDnRo6243s1gL92ntDs
+Red9cS7iVnfE/VA3aaacRJWqB+YRxboSkw9JtESsi6K+49Qro5KYEOhRiws79sWm
+ZpwWBW9lVmqp+pMMhxGcIqGcX7x/n0vcWyg777MegxsYuQLzyBh9AgMBAAGjggMJ
+MIIDBTAvBgNVHREEKDAmghN3d3cudHJpcGFkdmlzb3IuY29tgg90cmlwYWR2aXNv
+ci5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6g
+HIYaaHR0cDovL3NyLnN5bWNiLmNvbS9zci5jcmwwbwYDVR0gBGgwZjBbBgtghkgB
+hvhFAQcXBjBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAl
+BggrBgEFBQcCAjAZDBdodHRwczovL2Quc3ltY2IuY29tL3JwYTAHBgVngQwBATAd
+BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUAVmr5906
+C1mmZGPWzyAHV9WR52owVwYIKwYBBQUHAQEESzBJMB8GCCsGAQUFBzABhhNodHRw
+Oi8vc3Iuc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8vc3Iuc3ltY2IuY29t
+L3NyLmNydDCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFoAHYA3esdK3oNT6Ygi4Gt
+gWhwfi6OnQHVXIiNPRHEzbbsvswAAAFS76NSuAAABAMARzBFAiAIRDijyhwOsiFv
+PS1wYIk9hd6hqTgZeDg6W4pY044hbgIhAKwThjx7aZVz14AvBY1RKueOiYF5/XDU
+7jc4Ttfo3nmbAHYApLkJkLQYWBSHuxOizGdwCjw1mAT5G9+443fNDsgN3BAAAAFS
+76NSywAABAMARzBFAiEAjTsNYnW0GibB5U/VG2IVRjZylA+EQuzG+loy58cQ1uEC
+IDRgavDA+iTurPVbhe7Wb91GbduE1tx1mrYWgCQN1vgjAHYAaPaY+B9kgr46jO65
+KB1M/HFRXWeT1ETRCmesu09P+8QAAAFS76NS2wAABAMARzBFAiEA/ka3XvhhaCev
+2s+nPMAX/fkyaLLDTazwx2SnPQpE7nUCIHQ8HMdbtki3GlGUOmvA7ktGQzDqE3Hn
+jPQpwGqog9IkMA0GCSqGSIb3DQEBCwUAA4IBAQAVoid/HObXAnTJq3fdv3XzOids
+9Ur2Q9Xg28cdElek3ajG8GauLd+9tEPN+uIJav3QVbal2O9DNHEcJfirGwlj11Pn
+l3Ct5GBykjUYPUSyoRR7r1IU4u3kqnIFme4L42UVWJM2gXpuQbHfXlJH9lksLzL/
+c3QLzVQWJlVo87j0ABiOqM8l9jRGm9k5UP8KomWhtLgEZ+tHNpDgv9NxEoQE0EP+
+N+PAy38bK4M25kCnpEyQfoqywCLStwlTlJtRgMwXNwbY44vurErcTCfuASgQedxH
+FrZykIulRjN04vrYtl8gWzwclEhAcMgsE+PqmIS1kugl0YSkF98UWx6OhfQ6
+-----END CERTIFICATE-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7e:e1:4a:6f:6f:ef:f2:d3:7f:3f:ad:65:4d:3a:da:b4
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
+        Validity
+            Not Before: Oct 31 00:00:00 2013 GMT
+            Not After : Oct 30 23:59:59 2023 GMT
+        Subject: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 EV SSL CA - G3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:d8:a1:65:74:23:e8:2b:64:e2:32:d7:33:37:3d:
+                    8e:f5:34:16:48:dd:4f:7f:87:1c:f8:44:23:13:8e:
+                    fb:11:d8:44:5a:18:71:8e:60:16:26:92:9b:fd:17:
+                    0b:e1:71:70:42:fe:bf:fa:1c:c0:aa:a3:a7:b5:71:
+                    e8:ff:18:83:f6:df:10:0a:13:62:c8:3d:9c:a7:de:
+                    2e:3f:0c:d9:1d:e7:2e:fb:2a:ce:c8:9a:7f:87:bf:
+                    d8:4c:04:15:32:c9:d1:cc:95:71:a0:4e:28:4f:84:
+                    d9:35:fb:e3:86:6f:94:53:e6:72:8a:63:67:2e:be:
+                    69:f6:f7:6e:8e:9c:60:04:eb:29:fa:c4:47:42:d2:
+                    78:98:e3:ec:0b:a5:92:dc:b7:9a:bd:80:64:2b:38:
+                    7c:38:09:5b:66:f6:2d:95:7a:86:b2:34:2e:85:9e:
+                    90:0e:5f:b7:5d:a4:51:72:46:70:13:bf:67:f2:b6:
+                    a7:4d:14:1e:6c:b9:53:ee:23:1a:4e:8d:48:55:43:
+                    41:b1:89:75:6a:40:28:c5:7d:dd:d2:6e:d2:02:19:
+                    2f:7b:24:94:4b:eb:f1:1a:a9:9b:e3:23:9a:ea:fa:
+                    33:ab:0a:2c:b7:f4:60:08:dd:9f:1c:cd:dd:2d:01:
+                    66:80:af:b3:2f:29:1d:23:b8:8a:e1:a1:70:07:0c:
+                    34:0f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            Authority Information Access: 
+                OCSP - URI:http://s2.symcb.com
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Certificate Policies: 
+                Policy: X509v3 Any Policy
+                  CPS: http://www.symauth.com/cps
+                  User Notice:
+                    Explicit Text: http://www.symauth.com/rpa
+
+            X509v3 CRL Distribution Points: 
+                URI:http://s1.symcb.com/pca3-g5.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Alternative Name: 
+                DirName:/CN=SymantecPKI-1-533
+            X509v3 Subject Key Identifier: 
+                01:59:AB:E7:DD:3A:0B:59:A6:64:63:D6:CF:20:07:57:D5:91:E7:6A
+            X509v3 Authority Key Identifier: 
+                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
+
+    Signature Algorithm: sha256WithRSAEncryption
+        42:01:55:7b:d0:16:1a:5d:58:e8:bb:9b:a8:4d:d7:f3:d7:eb:
+        13:94:86:d6:7f:21:0b:47:bc:57:9b:92:5d:4f:05:9f:38:a4:
+        10:7c:cf:83:be:06:43:46:8d:08:bc:6a:d7:10:a6:fa:ab:af:
+        2f:61:a8:63:f2:65:df:7f:4c:88:12:88:4f:b3:69:d9:ff:27:
+        c0:0a:97:91:8f:56:fb:89:c4:a8:bb:92:2d:1b:73:b0:c6:ab:
+        36:f4:96:6c:20:08:ef:0a:1e:66:24:45:4f:67:00:40:c8:07:
+        54:74:33:3b:a6:ad:bb:23:9f:66:ed:a2:44:70:34:fb:0e:ea:
+        01:fd:cf:78:74:df:a7:ad:55:b7:5f:4d:f6:d6:3f:e0:86:ce:
+        24:c7:42:a9:13:14:44:35:4b:b6:df:c9:60:ac:0c:7f:d9:93:
+        21:4b:ee:9c:e4:49:02:98:d3:60:7b:5c:bc:d5:30:2f:07:ce:
+        44:42:c4:0b:99:fe:e6:9f:fc:b0:78:86:51:6d:d1:2c:9d:c6:
+        96:fb:85:82:bb:04:2f:f7:62:80:ef:62:da:7f:f6:0e:ac:90:
+        b8:56:bd:79:3f:f2:80:6e:a3:d9:b9:0f:5d:3a:07:1d:91:93:
+        86:4b:29:4c:e1:dc:b5:e1:e0:33:9d:b3:cb:36:91:4b:fe:a1:
+        b4:ee:f0:f9
+-----BEGIN CERTIFICATE-----
+MIIFKzCCBBOgAwIBAgIQfuFKb2/v8tN/P61lTTratDANBgkqhkiG9w0BAQsFADCB
+yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
+ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
+U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
+ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
+aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB3MQsw
+CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNV
+BAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxKDAmBgNVBAMTH1N5bWFudGVjIENs
+YXNzIDMgRVYgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDYoWV0I+grZOIy1zM3PY71NBZI3U9/hxz4RCMTjvsR2ERaGHGOYBYmkpv9
+FwvhcXBC/r/6HMCqo6e1cej/GIP23xAKE2LIPZyn3i4/DNkd5y77Ks7Imn+Hv9hM
+BBUyydHMlXGgTihPhNk1++OGb5RT5nKKY2cuvmn2926OnGAE6yn6xEdC0niY4+wL
+pZLct5q9gGQrOHw4CVtm9i2VeoayNC6FnpAOX7ddpFFyRnATv2fytqdNFB5suVPu
+IxpOjUhVQ0GxiXVqQCjFfd3SbtICGS97JJRL6/EaqZvjI5rq+jOrCiy39GAI3Z8c
+zd0tAWaAr7MvKR0juIrhoXAHDDQPAgMBAAGjggFdMIIBWTAvBggrBgEFBQcBAQQj
+MCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zMi5zeW1jYi5jb20wEgYDVR0TAQH/BAgw
+BgEB/wIBADBlBgNVHSAEXjBcMFoGBFUdIAAwUjAmBggrBgEFBQcCARYaaHR0cDov
+L3d3dy5zeW1hdXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5z
+eW1hdXRoLmNvbS9ycGEwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3MxLnN5bWNi
+LmNvbS9wY2EzLWc1LmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwx
+GjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTMzMB0GA1UdDgQWBBQBWavn3ToLWaZk
+Y9bPIAdX1ZHnajAfBgNVHSMEGDAWgBR/02Wnwt3su/AwCfNDOfoCrzMxMzANBgkq
+hkiG9w0BAQsFAAOCAQEAQgFVe9AWGl1Y6LubqE3X89frE5SG1n8hC0e8V5uSXU8F
+nzikEHzPg74GQ0aNCLxq1xCm+quvL2GoY/Jl339MiBKIT7Np2f8nwAqXkY9W+4nE
+qLuSLRtzsMarNvSWbCAI7woeZiRFT2cAQMgHVHQzO6atuyOfZu2iRHA0+w7qAf3P
+eHTfp61Vt19N9tY/4IbOJMdCqRMURDVLtt/JYKwMf9mTIUvunORJApjTYHtcvNUw
+LwfORELEC5n+5p/8sHiGUW3RLJ3GlvuFgrsEL/digO9i2n/2DqyQuFa9eT/ygG6j
+2bkPXToHHZGThkspTOHcteHgM52zyzaRS/6htO7w+Q==
+-----END CERTIFICATE-----