Parse individual X.509 name components on Windows, rather than their stringified form

net/base/x509_cert_types_mac.cc

Index: net/base/x509_cert_types_mac.cc
diff --git a/net/base/x509_cert_types_mac.cc b/net/base/x509_cert_types_mac.cc
index 8fb0d8db632a041fb69e6b50ea84b5faf65e16c1..7174c99ede4720a2617ef97e77b101c19f05cff4 100644
--- a/net/base/x509_cert_types_mac.cc
+++ b/net/base/x509_cert_types_mac.cc
@@ -16,6 +16,25 @@ namespace net {
 
 namespace {
 
+// The BER encoding of 0.9.2342.19200300.100.1.25.
+// On 10.6 and later this is available as CSSMOID_DomainComponent, which is an
+// external symbol from Security.framework. However, it appears that Apple's
+// implementation improperly encoded this on 10.6+, and even still is

[wtc, 2011/12/01 23:59:41]

Would be nice to include Apple's improper encoding of this OID
here.  Don't worry about it if it's too much work.

+// unavailable on 10.5, so simply including the raw BER here.
+//
+// Note: CSSM is allowed to store CSSM_OIDs in any arbitrary format desired,
+// as long as the symbols are properly exposed. The fact that Apple's
+// implementation stores it in BER is an internal implementation detail
+// observed by studying libsecurity_cssm.
+const uint8 kDomainComponentData[] = {
+  0x09, 0x92, 0x26, 0x89, 0x93, 0xF2, 0x2C, 0x64, 0x01, 0x19
+};
+
+const CSSM_OID kDomainComponent = {

[wtc, 2011/12/01 23:59:41]

Nit: kDomainComponent => kDomainComponentOID
                      or kOIDDomainComponent

+    arraysize(kDomainComponentData),
+    const_cast<uint8*>(kDomainComponentData)
+};
+
 const CSSM_OID* kOIDs[] = {
     &CSSMOID_CommonName,
     &CSSMOID_LocalityName,
@@ -24,8 +43,8 @@ const CSSM_OID* kOIDs[] = {
     &CSSMOID_StreetAddress,
     &CSSMOID_OrganizationName,
     &CSSMOID_OrganizationalUnitName,
-    &CSSMOID_DNQualifier      // This should be "DC" but is undoubtedly wrong.
-};                            // TODO(avi): Find the right OID.
+    &kDomainComponent,
+};
 
 // The following structs and templates work with Apple's very arcane and under-
 // documented SecAsn1Parser API, which is apparently the same as NSS's ASN.1