net: enable CRL sets behind a command line flag.

net/base/crl_set.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_CRL_SET_H_
 #define NET_BASE_CRL_SET_H_
 #pragma once
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/string_piece.h"
 #include "base/time.h"
 #include "net/base/net_export.h"
 
 namespace net {
 
 // A CRLSet is a structure that lists the serial numbers of revoked
 // certificates from a number of issuers where issuers are identified by the
 // SHA256 of their SubjectPublicKeyInfo.
 class NET_EXPORT CRLSet : public base::RefCountedThreadSafe<CRLSet> {
  public:
   enum Result {
     REVOKED,  // the certificate should be rejected.
-    UNKNOWN,  // there was an error in processing.
+    UNKNOWN,  // the CRL for the certificate is not included in the set.
     GOOD,  // the certificate is not listed.
   };
 
   ~CRLSet();
 
   // Parse parses the bytes in |data| and, on success, puts a new CRLSet in
   // |out_crl_set| and returns true.
   static bool Parse(base::StringPiece data,
                     scoped_refptr<CRLSet>* out_crl_set);
 
@@ skipping 49 matching lines @@
   // crls_index_by_issuer_ maps from issuer SPKI hashes to the index in |crls_|
   // where the information for that issuer can be found. We have both |crls_|
   // and |crls_index_by_issuer_| because, when applying a delta update, we need
   // to identify a CRL by index.
   std::map<std::string, size_t> crls_index_by_issuer_;
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_CRL_SET_H_