net: fallback to online revocation checks for EV status when CRLSet has expired.

net/base/x509_certificate_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 #include <time.h>
@@ skipping 669 matching lines @@
     base::StringPiece spki_bytes;
     if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes))
       continue;
 
     SHA1Fingerprint hash;
     CC_SHA1(spki_bytes.data(), spki_bytes.size(), hash.data);
     hashes->push_back(hash);
   }
 }
 
 bool CheckRevocationWithCRLSet(CFArrayRef chain, CRLSet* crl_set) {

[wtc, 2012/03/16 00:33:10]

Just curious: why does this function return bool here and in
x509_certificate_win.cc, but return CRLSetResult in
x509_certificate_nss.cc?

[agl, 2012/03/20 20:02:19]

Probably a mistake that I should clean up. Originally some plans included more
granular processing in the x509_certificate_*.cc files and NSS was the first one
that I wrote. In the end, a bool was sufficient however.

   if (CFArrayGetCount(chain) == 0)
     return true;
 
   // We iterate from the root certificate down to the leaf, keeping track of
   // the issuer's SPKI at each step.
   std::string issuer_spki_hash;
   for (CFIndex i = CFArrayGetCount(chain) - 1; i >= 0; i--) {
     SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(chain, i)));
 
@@ skipping 24 matching lines @@
     if (result != CRLSet::REVOKED && !issuer_spki_hash.empty())
       result = crl_set->CheckSerial(serial, issuer_spki_hash);
 
     issuer_spki_hash = spki_hash;
 
     switch (result) {
       case CRLSet::REVOKED:
         return false;
       case CRLSet::UNKNOWN:
       case CRLSet::GOOD:
-      case CRLSet::CRL_SET_EXPIRED:
         continue;
       default:
         NOTREACHED();
         return false;
     }
   }
 
   return true;
 }
 
@@ skipping 880 matching lines @@
       *type = kPublicKeyTypeDH;
       break;
     default:
       *type = kPublicKeyTypeUnknown;
       *size_bits = 0;
       break;
   }
 }
 
 }  // namespace net