net: retain leading zero bytes in X.509 serial numbers.

net/base/x509_certificate.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 #pragma once
 
 #include <string.h>
 
@@ skipping 400 matching lines @@
                              const std::vector<std::string>& cert_san_ip_addrs);
 
   // Performs the platform-dependent part of the Verify() method, verifiying
   // this certificate against the platform's root CA certificates.
   //
   // Parameters and return value are as per Verify().
   int VerifyInternal(const std::string& hostname,
                      int flags,
                      CertVerifyResult* verify_result) const;
 
-  // The serial number, DER encoded.
-  // NOTE: keep this method private, used by IsBlacklisted only.  To simplify
-  // IsBlacklisted, we strip the leading 0 byte of a serial number, used to
-  // encode a positive DER INTEGER (a signed type) with a most significant bit
-  // of 1.  Other code must not use this method for general purpose until this
-  // is fixed.
+  // The serial number, DER encoded, possibly including leading 00 bytes.

[wtc, 2011/10/25 21:14:44]

Nit: "a leading 00 byte" might be better because one leading
zero byte is enough to make the INTEGER positive.

[agl, 2011/10/28 20:29:07]

Done.

+  // NOTE: keep this method private, used by IsBlacklisted only.

[wtc, 2011/10/25 21:14:44]

We can remove this NOTE now (i.e., this method can become
public if necessary) because it preserves the leading 0 bytes
required for DER encoding of ASN.1 INTEGER.

[agl, 2011/10/28 20:29:07]

Done.

   const std::string& serial_number() const { return serial_number_; }
 
   // IsBlacklisted returns true if this certificate is explicitly blacklisted.
   bool IsBlacklisted() const;
 
   // IsPublicKeyBlacklisted returns true iff one of |public_key_hashes| (which
   // are SHA1 hashes of SubjectPublicKeyInfo structures) is explicitly blocked.
   static bool IsPublicKeyBlacklisted(
       const std::vector<SHA1Fingerprint>& public_key_hashes);
 
@@ skipping 44 matching lines @@
   // (Marked mutable because it's used in a const method.)
   mutable base::Lock verification_lock_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_