[not for commit] CertVerifyProcMac logging

net/cert/cert_verify_proc_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 497 matching lines @@
   }
 
   ~OSXKnownRootHelper() {}
 
   std::set<SHA256HashValue, SHA256HashValueLessThan> known_roots_;
 };
 
 base::LazyInstance<OSXKnownRootHelper>::Leaky g_known_roots =
     LAZY_INSTANCE_INITIALIZER;
 
+void log_cert(const void* value, void* context) {
+  SecCertificateRef cert_ref =
+      reinterpret_cast<SecCertificateRef>(const_cast<void*>(value));
+  // SHA256HashValue hash = X509Certificate::CalculateFingerprint256(cert_ref);
+  scoped_refptr<X509Certificate> cert =
+      X509Certificate::CreateFromHandle(cert_ref, {});
+  LOG(INFO) << cert->subject().GetDisplayName();
+}
+
+void LogChain(CFArrayRef chain) {
+  CFRange range = {0, CFArrayGetCount(chain)};
+  CFArrayApplyFunction(chain, range, log_cert, NULL);
+}
+
 }  // namespace
 
 CertVerifyProcMac::CertVerifyProcMac() {}
 
 CertVerifyProcMac::~CertVerifyProcMac() {}
 
 bool CertVerifyProcMac::SupportsAdditionalTrustAnchors() const {
   return false;
 }
 
 bool CertVerifyProcMac::SupportsOCSPStapling() const {
   // TODO(rsleevi): Plumb an OCSP response into the Mac system library.
   // https://crbug.com/430714
   return false;
 }
 
 int CertVerifyProcMac::VerifyInternal(
     X509Certificate* cert,
     const std::string& hostname,
     const std::string& ocsp_response,
     int flags,
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
+  LOG(INFO) << "CertVerifyProcMac::VerifyInternal starting for " << hostname;
   ScopedCFTypeRef<CFArrayRef> trust_policies;
   OSStatus status = CreateTrustPolicies(hostname, flags, &trust_policies);
   if (status)
     return NetErrorFromOSStatus(status);
 
   // Create and configure a SecTrustRef, which takes our certificate(s)
   // and our SSL SecPolicyRef. SecTrustCreateWithCertificates() takes an
   // array of certificates, the first of which is the certificate we're
   // verifying, and the subsequent (optional) certificates are used for
   // chain building.
@@ skipping 55 matching lines @@
   //
   // This does cause a performance hit for these users, but only in cases where
   // OS X is building weaker chains than desired, or when it would otherwise
   // fail the connection.
   while (CFArrayGetCount(cert_array) > 0) {
     ScopedCFTypeRef<SecTrustRef> temp_ref;
     SecTrustResultType temp_trust_result = kSecTrustResultDeny;
     ScopedCFTypeRef<CFArrayRef> temp_chain;
     CSSM_TP_APPLE_EVIDENCE_INFO* temp_chain_info = NULL;
 
+    LOG(INFO) << "Trying chain of " << CFArrayGetCount(cert_array) << " certs:";
+    LogChain(cert_array);
     int rv = BuildAndEvaluateSecTrustRef(cert_array, trust_policies, flags,
                                          &temp_ref, &temp_trust_result,
                                          &temp_chain, &temp_chain_info);
+    LOG(INFO) << "rv = " << rv;
     if (rv != OK)
       return rv;
 
     bool untrusted = (temp_trust_result != kSecTrustResultUnspecified &&
                       temp_trust_result != kSecTrustResultProceed);
     bool weak_chain = false;
     if (CFArrayGetCount(temp_chain) == 0) {
       // If the chain is empty, it cannot be trusted or have recoverable
       // errors.
       DCHECK(untrusted);
       DCHECK_NE(kSecTrustResultRecoverableTrustFailure, temp_trust_result);
     } else {
       CertVerifyResult temp_verify_result;
       bool leaf_is_weak = false;
       GetCertChainInfo(temp_chain, temp_chain_info, &temp_verify_result,
                        &leaf_is_weak);
       weak_chain = !leaf_is_weak &&
                    (temp_verify_result.has_md2 || temp_verify_result.has_md4 ||
                     temp_verify_result.has_md5 || temp_verify_result.has_sha1);
+      LOG(INFO) << "verified chain:";
+      LogChain(temp_chain);
     }
+    LOG(INFO) << "untrusted = " << untrusted << " weak_chain = " << weak_chain;
     // Set the result to the current chain if:
     // - This is the first verification attempt. This ensures that if
     //   everything is awful (e.g. it may just be an untrusted cert), that
     //   what is reported is exactly what was sent by the server
     // - If the current chain is trusted, and the old chain was not trusted,
     //   then prefer this chain. This ensures that if there is at least a
     //   valid path to a trust anchor, it's preferred over reporting an error.
     // - If the current chain is trusted, and the old chain is trusted, but
     //   the old chain contained weak algorithms while the current chain only
     //   contains strong algorithms, then prefer the current chain over the
     //   old chain.
     //
     // Note: If the leaf certificate itself is weak, then the only
     // consideration is whether or not there is a trusted chain. That's
     // because no amount of path discovery will fix a weak leaf.
     if (!trust_ref || (!untrusted && (candidate_untrusted ||
                                       (candidate_weak && !weak_chain)))) {
       trust_ref = temp_ref;
       trust_result = temp_trust_result;
       completed_chain = temp_chain;
       chain_info = temp_chain_info;
 
       candidate_untrusted = untrusted;
       candidate_weak = weak_chain;
     }
     // Short-circuit when a current, trusted chain is found.
-    if (!untrusted && !weak_chain)
+    if (!untrusted && !weak_chain) {
+      LOG(INFO) << "found a trusted, non-weak chain";
       break;
+    }
     CFArrayRemoveValueAtIndex(cert_array, CFArrayGetCount(cert_array) - 1);
   }
 
   if (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED)
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
 
   if (crl_set && !CheckRevocationWithCRLSet(completed_chain, crl_set))
     verify_result->cert_status |= CERT_STATUS_REVOKED;
 
   if (CFArrayGetCount(completed_chain) > 0) {
@@ skipping 157 matching lines @@
       }
     }
   }
 
   return OK;
 }
 
 }  // namespace net
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"