Include both certificate chains in invalid cert reporting

net/ssl/ssl_info.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_INFO_H_
 #define NET_SSL_SSL_INFO_H_
 
 #include <vector>
 
 #include "base/memory/ref_counted.h"
@@ skipping 30 matching lines @@
   void Reset();
 
   bool is_valid() const { return cert.get() != NULL; }
 
   // Adds the specified |error| to the cert status.
   void SetCertError(int error);
 
   // The SSL certificate.
   scoped_refptr<X509Certificate> cert;
 
+  // The SSL certificate with unverified certificate chain as sent by
+  // the server.
+  scoped_refptr<X509Certificate> unverified_server_cert;

[Ryan Sleevi, 2015/02/25 23:15:41]

the _server_ seems redundant here.

[Ryan Sleevi, 2015/02/25 23:15:41]

There's a problem here, which is that HttpResponseInfo contains an SSLInfo

HttpResponseInfo is our entry point into a responses information, and it's also
a stable object persisted to disk. That is, when synthesizing responses from the
cache, all of an HttpResponseInfo must be filled "as if" it was received over
the network.

This creates a problem, in that
1) Existing cached resources won't contain this information
2) We'll now have to start caching these unverified certs to disk (in addition
to the verified cert) in order to meet the //net API contracts that disk-served
resources are 'as good as' their from-the-network counterparts.

Thus, |unverified_server_cert| can be NULL, and a fair bit of the rest of the CL
falls over on the assumption that it must never be null.

+
   // Bitmask of status info of |cert|, representing, for example, known errors
   // and extended validation (EV) status.
   // See cert_status_flags.h for values.
   CertStatus cert_status;
 
   // The security strength, in bits, of the SSL cipher suite.
   // 0 means the connection is not encrypted.
   // -1 means the security strength is unknown.
   int security_bits;
 
@@ skipping 25 matching lines @@
   std::string pinning_failure_log;
 
   // List of SignedCertificateTimestamps and their corresponding validation
   // status.
   SignedCertificateTimestampAndStatusList signed_certificate_timestamps;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_INFO_H_