Refactor TransportSecurityState.

net/base/x509_certificate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 #pragma once
 
 #include <string.h>
 
@@ skipping 29 matching lines @@
 
 namespace crypto {
 class RSAPrivateKey;
 }  // namespace crypto
 
 namespace net {
 
 class CRLSet;
 class CertVerifyResult;
 
+// In the future there will be a generic Fingerprint type, with at least two
+// implementations: SHA1 and SHA256. See http://crbug.com/117914. Until that
+// work is done (in a separate patch) this typedef bridges the gap.
+typedef SHA1Fingerprint Fingerprint;
+
+typedef std::vector<Fingerprint> FingerprintVector;

[Ryan Sleevi, 2012/03/28 00:50:32]

Both of these belong in x509_cert_types.h.

[palmer, 2012/04/10 23:25:51]

Done.

+
 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
 
 // X509Certificate represents a X.509 certificate, which is comprised a
 // particular identity or end-entity certificate, such as an SSL server
 // identity or an SSL client certificate, and zero or more intermediate
 // certificates that may be used to build a path to a root certificate.
 class NET_EXPORT X509Certificate
     : public base::RefCountedThreadSafe<X509Certificate> {
  public:
   // An OSCertHandle is a handle to a certificate object in the underlying
@@ skipping 153 matching lines @@
   // 1. Encryption without authentication and thus vulnerable to
   //    man-in-the-middle attacks.
   // 2. Self-signed certificates cannot be revoked.
   //
   // Use this certificate only after the above risks are acknowledged.
   static X509Certificate* CreateSelfSigned(crypto::RSAPrivateKey* key,
                                            const std::string& subject,
                                            uint32 serial_number,
                                            base::TimeDelta valid_duration);
 
+  // Parses |cert|'s Subject Public Key Info structure, hashes it,

[Ryan Sleevi, 2012/03/28 00:50:32]

nit: 
// Compute the SHA1Fingerprint of the Subject Public Key Info
// for |cert|. On success, stores the fingerprint in
// |fingerprint| and returns true.

[palmer, 2012/04/10 23:25:51]

Done.

+  // populates |fingerprint|, and returns true. Returns false if there are
+  // any parse errors.
+  static bool GetPublicKeyHash(const OSCertHandle& cert,
+                               SHA1Fingerprint* fingerprint);
+
   // Appends a representation of this object to the given pickle.
   void Persist(Pickle* pickle);
 
   // The serial number, DER encoded, possibly including a leading 00 byte.
   const std::string& serial_number() const { return serial_number_; }
 
   // The subject of the certificate.  For HTTPS server certificates, this
   // represents the web server.  The common name of the subject should match
   // the host name of the web server.
   const CertPrincipal& subject() const { return subject_; }
@@ skipping 278 matching lines @@
   // based on the type of the certificate.
   std::string default_nickname_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_