Work around the NSS bugs in the AIA certificate fetch code by retrying...

net/base/x509_certificate_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
-// Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
-// until NSS 3.12.2 comes out and we update to it.
-#define Lock FOO_NSS_Lock
 #include <cert.h>
 #include <pk11pub.h>
+#include <prerror.h>
 #include <prtime.h>
 #include <secder.h>
 #include <secerr.h>
 #include <sechash.h>
 #include <sslerr.h>
-#undef Lock
 
 #include "base/logging.h"
 #include "base/pickle.h"
 #include "base/time.h"
 #include "base/nss_init.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/ev_root_ca_metadata.h"
 #include "net/base/net_errors.h"
 
@@ skipping 85 matching lines @@
 
  private:
   CERTValOutParam* cvout_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedCERTValOutParam);
 };
 
 // Map PORT_GetError() return values to our network error codes.
 int MapSecurityError(int err) {
   switch (err) {
+    case PR_DIRECTORY_LOOKUP_ERROR:  // DNS lookup error.
+      return ERR_NAME_NOT_RESOLVED;
     case SEC_ERROR_INVALID_ARGS:
       return ERR_INVALID_ARGUMENT;
     case SEC_ERROR_INVALID_TIME:
     case SEC_ERROR_EXPIRED_CERTIFICATE:
       return ERR_CERT_DATE_INVALID;
     case SEC_ERROR_UNKNOWN_ISSUER:
     case SEC_ERROR_UNTRUSTED_ISSUER:
     case SEC_ERROR_CA_CERT_INVALID:
     case SEC_ERROR_UNTRUSTED_CERT:
       return ERR_CERT_AUTHORITY_INVALID;
@@ skipping 271 matching lines @@
   revocation_flags.chainTests.preferred_methods = preferred_revocation_methods;
   revocation_flags.chainTests.cert_rev_method_independent_flags =
       revocation_method_independent_flags;
 
   CERTValInParam cvin[4];
   int cvin_index = 0;
   // No need to set cert_pi_trustAnchors here.
   cvin[cvin_index].type = cert_pi_revocationFlags;
   cvin[cvin_index].value.pointer.revocation = &revocation_flags;
   cvin_index++;
-  cvin[cvin_index].type = cert_pi_useAIACertFetch;
-  cvin[cvin_index].value.scalar.b = PR_TRUE;
-  cvin_index++;
   std::vector<SECOidTag> policies;
   if (policy_oids && num_policy_oids > 0) {
     cvin[cvin_index].type = cert_pi_policyOID;
     cvin[cvin_index].value.arraySize = num_policy_oids;
     cvin[cvin_index].value.array.oids = policy_oids;
     cvin_index++;
   }
+  // Add cert_pi_useAIACertFetch last so we can easily remove it from the
+  // cvin array in the workaround below.
+  cvin[cvin_index].type = cert_pi_useAIACertFetch;
+  cvin[cvin_index].value.scalar.b = PR_TRUE;
+  cvin_index++;
   cvin[cvin_index].type = cert_pi_end;
 
-  return CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
-                             cvin, cvout, NULL);
+  SECStatus rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
+                                     cvin, cvout, NULL);
+  if (rv != SECSuccess) {
+    // cert_pi_useAIACertFetch can't handle a CA issuers access location that
+    // is an LDAP URL with an empty host name (NSS bug 528741).  If cert fetch
+    // fails because of a network error, it also causes CERT_PKIXVerifyCert
+    // to report the network error rather than SEC_ERROR_UNKNOWN_ISSUER.  To
+    // work around these NSS bugs, we retry without cert_pi_useAIACertFetch.
+    int nss_error = PORT_GetError();
+    if (nss_error == SEC_ERROR_INVALID_ARGS || !IS_SEC_ERROR(nss_error)) {
+      cvin_index--;
+      DCHECK_EQ(cvin[cvin_index].type, cert_pi_useAIACertFetch);
+      cvin[cvin_index].type = cert_pi_end;
+      rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
+                               cvin, cvout, NULL);
+    }
+  }
+  return rv;
 }
 
 bool CheckCertPolicies(X509Certificate::OSCertHandle cert_handle,
                        SECOidTag ev_policy_tag) {
   SECItem policy_ext;
   SECStatus rv = CERT_FindCertExtension(
       cert_handle, SEC_OID_X509_CERTIFICATE_POLICIES, &policy_ext);
   if (rv != SECSuccess) {
     LOG(ERROR) << "Cert has no policies extension.";
     return false;
@@ skipping 196 matching lines @@
   DCHECK(0 != cert->derCert.len);
 
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, sha1.data,
                               cert->derCert.data, cert->derCert.len);
   DCHECK(rv == SECSuccess);
 
   return sha1;
 }
 
 }  // namespace net