net: add ability to distinguish user-added root CAs.

net/base/x509_certificate.cc

Index: net/base/x509_certificate.cc
diff --git a/net/base/x509_certificate.cc b/net/base/x509_certificate.cc
index 089bf096ff396fd10686af7250db78ef969eb105..525595bdd5733567e13abc5db20788fde6a71b3c 100644
--- a/net/base/x509_certificate.cc
+++ b/net/base/x509_certificate.cc
@@ -8,10 +8,13 @@
 #include <string>
 #include <vector>
 
+#include <stdlib.h>

[wtc, 2011/04/06 04:28:38]

Nit: the C system header <stdlib.h> should be listed before
C++ system headers.

[agl, 2011/04/06 19:02:02]

Done.

+
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram.h"
+#include "base/sha1.h"
 #include "base/string_piece.h"
 #include "base/string_util.h"
 #include "base/time.h"
@@ -528,4 +531,17 @@ bool X509Certificate::IsBlacklisted() const {
   return false;
 }
 
+static int CompareSHA1Hashes(const void* a, const void* b) {

[wtc, 2011/04/06 04:28:38]

Move this file scope static function to the unnamed namespace
above, on lines 23-119.  Add a comment to note that this is a
comparison function for bsearch.

[agl, 2011/04/06 19:02:02]

Done.

+  return memcmp(a, b, base::SHA1_LENGTH);
+}
+
+// static
+bool X509Certificate::IsSHA1HashInSortedArray(const uint8 hash[20],
+                                              const uint8* array,
+                                              unsigned bytelen) {

[wtc, 2011/04/06 04:28:38]

The name of the third parameter should match its name in
the declaration (array_byte_len).

This function should be listed after VerifyNameMatch, to
match the declaration order in the header file.

[agl, 2011/04/06 19:02:02]

Done.
Have moved after IsBlacklisted() in the .h file in order to make it private.

+  const unsigned arraylen = bytelen / base::SHA1_LENGTH;
+  return NULL != bsearch(hash, array, arraylen, base::SHA1_LENGTH,
+                         CompareSHA1Hashes);
+}
+
 }  // namespace net