net: fallback to online revocation checks for EV status when CRLSet has expired.

net/base/x509_certificate.cc

Index: net/base/x509_certificate.cc
diff --git a/net/base/x509_certificate.cc b/net/base/x509_certificate.cc
index a4ae89b74f297041c0a08c9c45d32ec337d3b485..9ea23cc8e1e2d2a0634aaf851cbc17ddac542b14 100644
--- a/net/base/x509_certificate.cc
+++ b/net/base/x509_certificate.cc
@@ -25,6 +25,7 @@
 #include "googleurl/src/url_canon_ip.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
+#include "net/base/crl_set.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/base/pem_tokenizer.h"
@@ -605,6 +606,12 @@ int X509Certificate::Verify(const std::string& hostname,
     return ERR_CERT_REVOKED;
   }
 
+  // If we were asked to attempt EV verification and we are missing a CRLSet,
+  // or if the CRLSet has expired, then we enable online revocation checks. If
+  // the online check fails, we wont show the EV status.

[wtc, 2012/03/16 00:33:10]

Nit: wont => won't

It may be a good idea to document that we could optimize and
only enable online checks if the cert is likely to be an EV
cert, but since it is uncommon to have an expired CRLSet,
it is fine to not optimize.

[agl, 2012/03/20 20:02:19]

Done
Done.

+  if ((flags & VERIFY_EV_CERT) && (!crl_set || crl_set->IsExpired()))

[Ryan Sleevi, 2012/03/16 00:50:52]

Comment nit: In past reviews, I've been dinged for using first person like "we",
since it's very easy to use passive voice here, and it's not really
we-the-people so much as this-is-the-code.

Hardly a big deal, but...

// If EV verification is requested and no CRLSet is present,
// or the supplied CRLSet has expired, enable online
// revocation checks. If the revocation checks fail, do not
// mark the certificate as EV.

[agl, 2012/03/20 20:02:19]

Have de-we'ed the comment.

+    flags |= VERIFY_REV_CHECKING_ENABLED;
+
   int rv = VerifyInternal(hostname, flags, crl_set, verify_result);
 
   // This check is done after VerifyInternal so that VerifyInternal can fill in