Clang format slam.

net/cert/cert_verify_proc_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_win.h"
 
 #include <string>
 #include <vector>
 
 #include "base/memory/scoped_ptr.h"
@@ skipping 56 matching lines @@
 typedef scoped_ptr<const CERT_CONTEXT, FreeCertContextFunctor>
     ScopedPCCERT_CONTEXT;
 
 //-----------------------------------------------------------------------------
 
 int MapSecurityError(SECURITY_STATUS err) {
   // There are numerous security error codes, but these are the ones we thus
   // far find interesting.
   switch (err) {
     case SEC_E_WRONG_PRINCIPAL:  // Schannel
-    case CERT_E_CN_NO_MATCH:  // CryptoAPI
+    case CERT_E_CN_NO_MATCH:     // CryptoAPI
       return ERR_CERT_COMMON_NAME_INVALID;
     case SEC_E_UNTRUSTED_ROOT:  // Schannel
     case CERT_E_UNTRUSTEDROOT:  // CryptoAPI
       return ERR_CERT_AUTHORITY_INVALID;
     case SEC_E_CERT_EXPIRED:  // Schannel
-    case CERT_E_EXPIRED:  // CryptoAPI
+    case CERT_E_EXPIRED:      // CryptoAPI
       return ERR_CERT_DATE_INVALID;
     case CRYPT_E_NO_REVOCATION_CHECK:
       return ERR_CERT_NO_REVOCATION_MECHANISM;
     case CRYPT_E_REVOCATION_OFFLINE:
       return ERR_CERT_UNABLE_TO_CHECK_REVOCATION;
     case CRYPT_E_REVOKED:  // Schannel and CryptoAPI
       return ERR_CERT_REVOKED;
     case SEC_E_CERT_UNKNOWN:
     case CERT_E_ROLE:
       return ERR_CERT_INVALID;
@@ skipping 16 matching lines @@
   }
 }
 
 // Map the errors in the chain_context->TrustStatus.dwErrorStatus returned by
 // CertGetCertificateChain to our certificate status flags.
 int MapCertChainErrorStatusToCertStatus(DWORD error_status) {
   CertStatus cert_status = 0;
 
   // We don't include CERT_TRUST_IS_NOT_TIME_NESTED because it's obsolete and
   // we wouldn't consider it an error anyway
-  const DWORD kDateInvalidErrors = CERT_TRUST_IS_NOT_TIME_VALID |
-                                   CERT_TRUST_CTL_IS_NOT_TIME_VALID;
+  const DWORD kDateInvalidErrors =
+      CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_CTL_IS_NOT_TIME_VALID;
   if (error_status & kDateInvalidErrors)
     cert_status |= CERT_STATUS_DATE_INVALID;
 
   const DWORD kAuthorityInvalidErrors = CERT_TRUST_IS_UNTRUSTED_ROOT |
                                         CERT_TRUST_IS_EXPLICIT_DISTRUST |
                                         CERT_TRUST_IS_PARTIAL_CHAIN;
   if (error_status & kAuthorityInvalidErrors)
     cert_status |= CERT_STATUS_AUTHORITY_INVALID;
 
   if ((error_status & CERT_TRUST_REVOCATION_STATUS_UNKNOWN) &&
       !(error_status & CERT_TRUST_IS_OFFLINE_REVOCATION))
     cert_status |= CERT_STATUS_NO_REVOCATION_MECHANISM;
 
   if (error_status & CERT_TRUST_IS_OFFLINE_REVOCATION)
     cert_status |= CERT_STATUS_UNABLE_TO_CHECK_REVOCATION;
 
   if (error_status & CERT_TRUST_IS_REVOKED)
     cert_status |= CERT_STATUS_REVOKED;
 
-  const DWORD kWrongUsageErrors = CERT_TRUST_IS_NOT_VALID_FOR_USAGE |
-                                  CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE;
+  const DWORD kWrongUsageErrors =
+      CERT_TRUST_IS_NOT_VALID_FOR_USAGE | CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE;
   if (error_status & kWrongUsageErrors) {
     // TODO(wtc): Should we add CERT_STATUS_WRONG_USAGE?
     cert_status |= CERT_STATUS_INVALID;
   }
 
   if (error_status & CERT_TRUST_IS_NOT_SIGNATURE_VALID) {
     // Check for a signature that does not meet the OS criteria for strong
     // signatures.
     // Note: These checks may be more restrictive than the current weak key
     // criteria implemented within CertVerifier, such as excluding SHA-1 or
     // excluding RSA keys < 2048 bits. However, if the user has configured
     // these more stringent checks, respect that configuration and err on the
     // more restrictive criteria.
     if (error_status & CERT_TRUST_HAS_WEAK_SIGNATURE) {
       cert_status |= CERT_STATUS_WEAK_KEY;
     } else {
       cert_status |= CERT_STATUS_INVALID;
     }
   }
 
   // The rest of the errors.
   const DWORD kCertInvalidErrors =
-      CERT_TRUST_IS_CYCLIC |
-      CERT_TRUST_INVALID_EXTENSION |
+      CERT_TRUST_IS_CYCLIC | CERT_TRUST_INVALID_EXTENSION |
       CERT_TRUST_INVALID_POLICY_CONSTRAINTS |
       CERT_TRUST_INVALID_BASIC_CONSTRAINTS |
       CERT_TRUST_INVALID_NAME_CONSTRAINTS |
       CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID |
       CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT |
       CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT |
       CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT |
       CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT |
       CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY |
       CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT;
@@ skipping 67 matching lines @@
                   reinterpret_cast<wchar_t*>(rdn_attr->Value.pbData);
               for (DWORD k = 0; k < num_wchars; ++k) {
                 if (common_name[k] == L'\0')
                   return true;
               }
               break;
             }
             // Array of ints (32-bit).
             case CERT_RDN_UNIVERSAL_STRING: {
               DWORD num_ints = rdn_attr->Value.cbData / 4;
-              int* common_name =
-                  reinterpret_cast<int*>(rdn_attr->Value.pbData);
+              int* common_name = reinterpret_cast<int*>(rdn_attr->Value.pbData);
               for (DWORD k = 0; k < num_ints; ++k) {
                 if (common_name[k] == 0)
                   return true;
               }
               break;
             }
             default:
               NOTREACHED();
               break;
           }
@@ skipping 28 matching lines @@
   if (chain_context->cChain == 0)
     return;
 
   PCERT_SIMPLE_CHAIN first_chain = chain_context->rgpChain[0];
   int num_elements = first_chain->cElement;
   PCERT_CHAIN_ELEMENT* element = first_chain->rgpElement;
 
   PCCERT_CONTEXT verified_cert = NULL;
   std::vector<PCCERT_CONTEXT> verified_chain;
 
-  bool has_root_ca = num_elements > 1 &&
-      !(chain_context->TrustStatus.dwErrorStatus &
-          CERT_TRUST_IS_PARTIAL_CHAIN);
+  bool has_root_ca =
+      num_elements > 1 &&
+      !(chain_context->TrustStatus.dwErrorStatus & CERT_TRUST_IS_PARTIAL_CHAIN);
 
   // Each chain starts with the end entity certificate (i = 0) and ends with
   // either the root CA certificate or the last available intermediate. If a
   // root CA certificate is present, do not inspect the signature algorithm of
   // the root CA certificate because the signature on the trust anchor is not
   // important.
   if (has_root_ca) {
     // If a full chain was constructed, regardless of whether it was trusted,
     // don't inspect the root's signature algorithm.
     num_elements -= 1;
@@ skipping 18 matching lines @@
       // md4WithRSAEncryption: 1.2.840.113549.1.1.3
       verify_result->has_md4 = true;
     }
   }
 
   if (verified_cert) {
     // Add the root certificate, if present, as it was not added above.
     if (has_root_ca)
       verified_chain.push_back(element[num_elements]->pCertContext);
     verify_result->verified_cert =
-          X509Certificate::CreateFromHandle(verified_cert, verified_chain);
+        X509Certificate::CreateFromHandle(verified_cert, verified_chain);
   }
 }
 
 // Decodes the cert's certificatePolicies extension into a CERT_POLICIES_INFO
 // structure and stores it in *output.
 void GetCertPoliciesInfo(
     PCCERT_CONTEXT cert,
     scoped_ptr<CERT_POLICIES_INFO, base::FreeDeleter>* output) {
   PCERT_EXTENSION extension = CertFindExtension(szOID_CERT_POLICIES,
                                                 cert->pCertInfo->cExtension,
@@ skipping 115 matching lines @@
 
     base::StringPiece der_bytes(
         reinterpret_cast<const char*>(cert->pbCertEncoded),
         cert->cbCertEncoded);
     base::StringPiece spki_bytes;
     if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes))
       continue;
 
     HashValue sha1(HASH_VALUE_SHA1);
     base::SHA1HashBytes(reinterpret_cast<const uint8*>(spki_bytes.data()),
-                        spki_bytes.size(), sha1.data());
+                        spki_bytes.size(),
+                        sha1.data());
     hashes->push_back(sha1);
 
     HashValue sha256(HASH_VALUE_SHA256);
     crypto::SHA256HashString(spki_bytes, sha256.data(), crypto::kSHA256Length);
     hashes->push_back(sha256);
   }
 }
 
 // Returns true if the certificate is an extended-validation certificate.
 //
@@ skipping 25 matching lines @@
   // Check the end certificate simple chain (chain_context->rgpChain[0]).
   // If the end certificate's certificatePolicies extension contains the
   // EV policy OID of the root CA, return true.
   PCERT_CHAIN_ELEMENT* element = chain_context->rgpChain[0]->rgpElement;
   int num_elements = chain_context->rgpChain[0]->cElement;
   if (num_elements < 2)
     return false;
 
   // Look up the EV policy OID of the root CA.
   PCCERT_CONTEXT root_cert = element[num_elements - 1]->pCertContext;
-  SHA1HashValue fingerprint =
-      X509Certificate::CalculateFingerprint(root_cert);
+  SHA1HashValue fingerprint = X509Certificate::CalculateFingerprint(root_cert);
   EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance();
   return metadata->HasEVPolicyOID(fingerprint, policy_oid);
 }
 
 }  // namespace
 
-CertVerifyProcWin::CertVerifyProcWin() {}
+CertVerifyProcWin::CertVerifyProcWin() {
+}
 
-CertVerifyProcWin::~CertVerifyProcWin() {}
+CertVerifyProcWin::~CertVerifyProcWin() {
+}
 
 bool CertVerifyProcWin::SupportsAdditionalTrustAnchors() const {
   return false;
 }
 
 int CertVerifyProcWin::VerifyInternal(
     X509Certificate* cert,
     const std::string& hostname,
     int flags,
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
   PCCERT_CONTEXT cert_handle = cert->os_cert_handle();
   if (!cert_handle)
     return ERR_UNEXPECTED;
 
   // Build and validate certificate chain.
   CERT_CHAIN_PARA chain_para;
   memset(&chain_para, 0, sizeof(chain_para));
   chain_para.cbSize = sizeof(chain_para);
   // ExtendedKeyUsage.
   // We still need to request szOID_SERVER_GATED_CRYPTO and szOID_SGC_NETSCAPE
   // today because some certificate chains need them.  IE also requests these
   // two usages.
-  static const LPSTR usage[] = {
-    szOID_PKIX_KP_SERVER_AUTH,
-    szOID_SERVER_GATED_CRYPTO,
-    szOID_SGC_NETSCAPE
-  };
+  static const LPSTR usage[] = {szOID_PKIX_KP_SERVER_AUTH,
+                                szOID_SERVER_GATED_CRYPTO, szOID_SGC_NETSCAPE};
   chain_para.RequestedUsage.dwType = USAGE_MATCH_TYPE_OR;
   chain_para.RequestedUsage.Usage.cUsageIdentifier = arraysize(usage);
   chain_para.RequestedUsage.Usage.rgpszUsageIdentifier =
       const_cast<LPSTR*>(usage);
 
   // Get the certificatePolicies extension of the certificate.
   scoped_ptr<CERT_POLICIES_INFO, base::FreeDeleter> policies_info;
   LPSTR ev_policy_oid = NULL;
   if (flags & CertVerifier::VERIFY_EV_CERT) {
     GetCertPoliciesInfo(cert_handle, &policies_info);
@@ skipping 34 matching lines @@
   // certificate.
   ScopedHCERTCHAINENGINE chain_engine(NULL);
   if (TestRootCerts::HasInstance())
     chain_engine.reset(TestRootCerts::GetInstance()->GetChainEngine());
 
   ScopedPCCERT_CONTEXT cert_list(cert->CreateOSCertChainForCert());
   PCCERT_CHAIN_CONTEXT chain_context;
   // IE passes a non-NULL pTime argument that specifies the current system
   // time.  IE passes CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT as the
   // chain_flags argument.
-  if (!CertGetCertificateChain(
-           chain_engine,
-           cert_list.get(),
-           NULL,  // current system time
-           cert_list->hCertStore,
-           &chain_para,
-           chain_flags,
-           NULL,  // reserved
-           &chain_context)) {
+  if (!CertGetCertificateChain(chain_engine,
+                               cert_list.get(),
+                               NULL,  // current system time
+                               cert_list->hCertStore,
+                               &chain_para,
+                               chain_flags,
+                               NULL,  // reserved
+                               &chain_context)) {
     verify_result->cert_status |= CERT_STATUS_INVALID;
     return MapSecurityError(GetLastError());
   }
 
   CRLSetResult crl_set_result = kCRLSetUnknown;
   if (crl_set)
     crl_set_result = CheckRevocationWithCRLSet(chain_context, crl_set);
 
   if (crl_set_result == kCRLSetRevoked) {
     verify_result->cert_status |= CERT_STATUS_REVOKED;
   } else if (crl_set_result == kCRLSetUnknown &&
              (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED_EV_ONLY) &&
-             !rev_checking_enabled &&
-             ev_policy_oid != NULL) {
+             !rev_checking_enabled && ev_policy_oid != NULL) {
     // We don't have fresh information about this chain from the CRLSet and
     // it's probably an EV certificate. Retry with online revocation checking.
     rev_checking_enabled = true;
     chain_flags &= ~CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY;
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
 
     CertFreeCertificateChain(chain_context);
-    if (!CertGetCertificateChain(
-             chain_engine,
-             cert_list.get(),
-             NULL,  // current system time
-             cert_list->hCertStore,
-             &chain_para,
-             chain_flags,
-             NULL,  // reserved
-             &chain_context)) {
+    if (!CertGetCertificateChain(chain_engine,
+                                 cert_list.get(),
+                                 NULL,  // current system time
+                                 cert_list->hCertStore,
+                                 &chain_para,
+                                 chain_flags,
+                                 NULL,  // reserved
+                                 &chain_context)) {
       verify_result->cert_status |= CERT_STATUS_INVALID;
       return MapSecurityError(GetLastError());
     }
   }
 
   if (chain_context->TrustStatus.dwErrorStatus &
       CERT_TRUST_IS_NOT_VALID_FOR_USAGE) {
     ev_policy_oid = NULL;
     chain_para.RequestedIssuancePolicy.Usage.cUsageIdentifier = 0;
     chain_para.RequestedIssuancePolicy.Usage.rgpszUsageIdentifier = NULL;
     CertFreeCertificateChain(chain_context);
-    if (!CertGetCertificateChain(
-             chain_engine,
-             cert_list.get(),
-             NULL,  // current system time
-             cert_list->hCertStore,
-             &chain_para,
-             chain_flags,
-             NULL,  // reserved
-             &chain_context)) {
+    if (!CertGetCertificateChain(chain_engine,
+                                 cert_list.get(),
+                                 NULL,  // current system time
+                                 cert_list->hCertStore,
+                                 &chain_para,
+                                 chain_flags,
+                                 NULL,  // reserved
+                                 &chain_context)) {
       verify_result->cert_status |= CERT_STATUS_INVALID;
       return MapSecurityError(GetLastError());
     }
   }
 
   CertVerifyResult temp_verify_result = *verify_result;
   GetCertChainInfo(chain_context, verify_result);
   if (!verify_result->is_issued_by_known_root &&
       (flags & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS)) {
     *verify_result = temp_verify_result;
 
     rev_checking_enabled = true;
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
     chain_flags &= ~CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY;
 
     CertFreeCertificateChain(chain_context);
-    if (!CertGetCertificateChain(
-             chain_engine,
-             cert_list.get(),
-             NULL,  // current system time
-             cert_list->hCertStore,
-             &chain_para,
-             chain_flags,
-             NULL,  // reserved
-             &chain_context)) {
+    if (!CertGetCertificateChain(chain_engine,
+                                 cert_list.get(),
+                                 NULL,  // current system time
+                                 cert_list->hCertStore,
+                                 &chain_para,
+                                 chain_flags,
+                                 NULL,  // reserved
+                                 &chain_context)) {
       verify_result->cert_status |= CERT_STATUS_INVALID;
       return MapSecurityError(GetLastError());
     }
     GetCertChainInfo(chain_context, verify_result);
 
     if (chain_context->TrustStatus.dwErrorStatus &
         CERT_TRUST_IS_OFFLINE_REVOCATION) {
       verify_result->cert_status |= CERT_STATUS_REVOKED;
     }
   }
@@ skipping 24 matching lines @@
   memset(&policy_para, 0, sizeof(policy_para));
   policy_para.cbSize = sizeof(policy_para);
   policy_para.dwFlags = 0;
   policy_para.pvExtraPolicyPara = &extra_policy_para;
 
   CERT_CHAIN_POLICY_STATUS policy_status;
   memset(&policy_status, 0, sizeof(policy_status));
   policy_status.cbSize = sizeof(policy_status);
 
   if (!CertVerifyCertificateChainPolicy(
-           CERT_CHAIN_POLICY_SSL,
-           chain_context,
-           &policy_para,
-           &policy_status)) {
+          CERT_CHAIN_POLICY_SSL, chain_context, &policy_para, &policy_status)) {
     return MapSecurityError(GetLastError());
   }
 
   if (policy_status.dwError) {
-    verify_result->cert_status |= MapNetErrorToCertStatus(
-        MapSecurityError(policy_status.dwError));
+    verify_result->cert_status |=
+        MapNetErrorToCertStatus(MapSecurityError(policy_status.dwError));
   }
 
   // TODO(wtc): Suppress CERT_STATUS_NO_REVOCATION_MECHANISM for now to be
   // compatible with WinHTTP, which doesn't report this error (bug 3004).
   verify_result->cert_status &= ~CERT_STATUS_NO_REVOCATION_MECHANISM;
 
   // Perform hostname verification independent of
   // CertVerifyCertificateChainPolicy.
   if (!cert->VerifyNameMatch(hostname,
                              &verify_result->common_name_fallback_used)) {
@@ skipping 15 matching lines @@
     return MapCertStatusToNetError(verify_result->cert_status);
 
   if (ev_policy_oid &&
       CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) {
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
   return OK;
 }
 
 }  // namespace net