Implement the ability to whitelist certs from specific issuers

net/cert/cert_verify_proc_whitelist-inc.cc

+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// THIS FILE IS NOT MEANT TO BE COMPILED SEPARATELY.
+
+// PublicKeyWhitelist contains a SHA-256 SPKI hash and a pointer to an array
+// of SHA-256 certificate hashes that have been publicly disclosed and
+// whitelisted.
+struct PublicKeyWhitelist {
+  uint8 public_key[crypto::kSHA256Length];
+  const uint8 (*whitelist)[crypto::kSHA256Length];
+  size_t whitelist_size;
+};
+
+// CNNIC whitelisted EV certs.
+static const uint8 kWhitelistCNNICEV[][crypto::kSHA256Length] = {
+  {0x00},
+};
+
+// CNNIC whitelisted DV certs.
+static const uint8 kWhitelistCNNIC[][crypto::kSHA256Length] = {
+  {0x00},
+};
+
+static const PublicKeyWhitelist kWhitelistedIssuers[] = {
+  // C=CN, O=China Internet Network Information Center,
+  // CN=China Internet Network Information Center EV Certificates Root
+  // Expires: August 31 2030.
+  {
+    { 0x9d, 0xd5, 0x5f, 0xc5, 0x73, 0xf5, 0x46, 0xcb,
+      0x6a, 0x38, 0x31, 0xd1, 0x11, 0x2d, 0x87, 0x10,
+      0xa6, 0xf4, 0xf8, 0x2d, 0xc8, 0x7f, 0x5f, 0xae,
+      0x9d, 0x3a, 0x1a, 0x02, 0x8d, 0xd3, 0x6e, 0x4b },
+    kWhitelistCNNICEV,
+    arraysize(kWhitelistCNNICEV),
+  },
+  // C=CN, O=CNNIC, CN=CNNIC ROOT
+  // Expires: April 16 2027.
+  {
+    { 0x1f, 0x42, 0x24, 0xce, 0xc8, 0x4f, 0xc9, 0x9c,
+      0xed, 0x88, 0x1f, 0xf6, 0xfc, 0xfd, 0x3e, 0x21,
+      0xf8, 0xc5, 0x19, 0xc5, 0x47, 0xaa, 0x6a, 0x5d,
+      0xd3, 0xde, 0x24, 0x73, 0x02, 0xce, 0x50, 0xd1 },
+    kWhitelistCNNIC,
+    arraysize(kWhitelistCNNIC),
+  }
+};