[not for commit] CertVerifyProcMac logging

net/cert/cert_verify_proc_mac.cc

Index: net/cert/cert_verify_proc_mac.cc
diff --git a/net/cert/cert_verify_proc_mac.cc b/net/cert/cert_verify_proc_mac.cc
index 07a49a234b0103594aa4673eb3a7506c0e9eaa53..eab3571ba12271d2c7cdd854a161a11f3fe41a7a 100644
--- a/net/cert/cert_verify_proc_mac.cc
+++ b/net/cert/cert_verify_proc_mac.cc
@@ -515,6 +515,20 @@ class OSXKnownRootHelper {
 base::LazyInstance<OSXKnownRootHelper>::Leaky g_known_roots =
     LAZY_INSTANCE_INITIALIZER;
 
+void log_cert(const void* value, void* context) {
+  SecCertificateRef cert_ref =
+      reinterpret_cast<SecCertificateRef>(const_cast<void*>(value));
+  // SHA256HashValue hash = X509Certificate::CalculateFingerprint256(cert_ref);
+  scoped_refptr<X509Certificate> cert =
+      X509Certificate::CreateFromHandle(cert_ref, {});
+  LOG(INFO) << cert->subject().GetDisplayName();
+}
+
+void LogChain(CFArrayRef chain) {
+  CFRange range = {0, CFArrayGetCount(chain)};
+  CFArrayApplyFunction(chain, range, log_cert, NULL);
+}
+
 }  // namespace
 
 CertVerifyProcMac::CertVerifyProcMac() {}
@@ -539,6 +553,7 @@ int CertVerifyProcMac::VerifyInternal(
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
+  LOG(INFO) << "CertVerifyProcMac::VerifyInternal starting for " << hostname;
   ScopedCFTypeRef<CFArrayRef> trust_policies;
   OSStatus status = CreateTrustPolicies(hostname, flags, &trust_policies);
   if (status)
@@ -614,9 +629,12 @@ int CertVerifyProcMac::VerifyInternal(
     ScopedCFTypeRef<CFArrayRef> temp_chain;
     CSSM_TP_APPLE_EVIDENCE_INFO* temp_chain_info = NULL;
 
+    LOG(INFO) << "Trying chain of " << CFArrayGetCount(cert_array) << " certs:";
+    LogChain(cert_array);
     int rv = BuildAndEvaluateSecTrustRef(cert_array, trust_policies, flags,
                                          &temp_ref, &temp_trust_result,
                                          &temp_chain, &temp_chain_info);
+    LOG(INFO) << "rv = " << rv;
     if (rv != OK)
       return rv;
 
@@ -636,7 +654,10 @@ int CertVerifyProcMac::VerifyInternal(
       weak_chain = !leaf_is_weak &&
                    (temp_verify_result.has_md2 || temp_verify_result.has_md4 ||
                     temp_verify_result.has_md5 || temp_verify_result.has_sha1);
+      LOG(INFO) << "verified chain:";
+      LogChain(temp_chain);
     }
+    LOG(INFO) << "untrusted = " << untrusted << " weak_chain = " << weak_chain;
     // Set the result to the current chain if:
     // - This is the first verification attempt. This ensures that if
     //   everything is awful (e.g. it may just be an untrusted cert), that
@@ -663,8 +684,10 @@ int CertVerifyProcMac::VerifyInternal(
       candidate_weak = weak_chain;
     }
     // Short-circuit when a current, trusted chain is found.
-    if (!untrusted && !weak_chain)
+    if (!untrusted && !weak_chain) {
+      LOG(INFO) << "found a trusted, non-weak chain";
       break;
+    }
     CFArrayRemoveValueAtIndex(cert_array, CFArrayGetCount(cert_array) - 1);
   }