Return specific cert verification errors on Android

net/base/cert_verify_proc_android.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc_android.h"
 
 #include <string>
 #include <vector>
 
 #include "base/logging.h"
+#include "net/android/cert_verify_result_android.h"
 #include "net/android/network_library.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_certificate.h"
 
 namespace net {
 
 namespace {
 
 // Returns true if the certificate verification call was successful (regardless
 // of its result), i.e. if |verify_result| was set. Otherwise returns false.
 bool VerifyFromAndroidTrustManager(const std::vector<std::string>& cert_bytes,
                                    CertVerifyResult* verify_result) {
   // TODO(joth): Fetch the authentication type from SSL rather than hardcode.
-  bool verified = true;
-  android::VerifyResult result =
+  android::CertVerifyResultAndroid android_result =
       android::VerifyX509CertChain(cert_bytes, "RSA");
-  switch (result) {
+  switch (android_result) {
+    case android::VERIFY_FAILED:
+      return false;
     case android::VERIFY_OK:
       break;
     case android::VERIFY_NO_TRUSTED_ROOT:
       verify_result->cert_status |= CERT_STATUS_AUTHORITY_INVALID;
       break;
-    case android::VERIFY_INVOCATION_ERROR:
-      verified = false;
+    case android::VERIFY_EXPIRED:
+    case android::VERIFY_NOT_YET_VALID:
+      verify_result->cert_status |= CERT_STATUS_DATE_INVALID;
+      break;
+    case android::VERIFY_UNABLE_TO_PARSE:
+      verify_result->cert_status |= CERT_STATUS_INVALID;
       break;
     default:
+      NOTREACHED();
       verify_result->cert_status |= CERT_STATUS_INVALID;
       break;
   }
-  return verified;
+  return true;
 }
 
 bool GetChainDEREncodedBytes(X509Certificate* cert,
                              std::vector<std::string>* chain_bytes) {
   X509Certificate::OSCertHandle cert_handle = cert->os_cert_handle();
   X509Certificate::OSCertHandles cert_handles =
       cert->GetIntermediateCertificates();
 
   // Make sure the peer's own cert is the first in the chain, if it's not
   // already there.
@@ skipping 42 matching lines @@
 
   // Until the required support is available in the platform, we don't know if
   // the trust root at the end of the chain was standard or user-added, so we
   // mark all correctly verified certificates as issued by a known root.
   verify_result->is_issued_by_known_root = true;
 
   return OK;
 }
 
 }  // namespace net