Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/ev_root_ca_metadata.cc

Index: net/base/ev_root_ca_metadata.cc
diff --git a/net/base/ev_root_ca_metadata.cc b/net/base/ev_root_ca_metadata.cc
index 301732f86060a2a7cb506799caa0e5123123afc9..d8f1bc5ae77463d28b299433346eaacb9d89c5e8 100644
--- a/net/base/ev_root_ca_metadata.cc
+++ b/net/base/ev_root_ca_metadata.cc
@@ -320,26 +320,23 @@ EVRootCAMetadata* EVRootCAMetadata::GetInstance() {
 }
 
 #if defined(USE_NSS)
+bool EVRootCAMetadata::IsEVPolicyOID(PolicyOID policy_oid) const {
+  return policy_oid != SEC_OID_UNKNOWN &&

[wtc, 2012/08/16 23:17:39]

Nit: If policy_oid is SEC_OID_UNKNOWN, it cannot possibly in
policy_oids_, right?  We should be able to omit the
policy_oid != SEC_OID_UNKNOWN test.

[Ryan Sleevi, 2012/08/16 23:26:31]

Fair enough

+         policy_oids_.find(policy_oid) != policy_oids_.end();
+}
 
-bool EVRootCAMetadata::GetPolicyOIDsForCA(
+bool EVRootCAMetadata::HasEVPolicyOID(
     const SHA1Fingerprint& fingerprint,
-    std::vector<PolicyOID>* policy_oids) const {
+    PolicyOID policy_oid) const {
   PolicyOIDMap::const_iterator iter = ev_policy_.find(fingerprint);
   if (iter == ev_policy_.end())
     return false;
   for (std::vector<PolicyOID>::const_iterator
        j = iter->second.begin(); j != iter->second.end(); ++j) {
-    policy_oids->push_back(*j);
+    if (*j == policy_oid)
+      return true;
   }
-  return true;
-}
-
-const EVRootCAMetadata::PolicyOID* EVRootCAMetadata::GetPolicyOIDs() const {
-  return &policy_oids_[0];
-}
-
-int EVRootCAMetadata::NumPolicyOIDs() const {
-  return policy_oids_.size();
+  return false;
 }
 
 bool EVRootCAMetadata::AddEVCA(const SHA1Fingerprint& fingerprint,
@@ -352,7 +349,7 @@ bool EVRootCAMetadata::AddEVCA(const SHA1Fingerprint& fingerprint,
     return false;
 
   ev_policy_[fingerprint].push_back(oid);
-  policy_oids_.push_back(oid);
+  policy_oids_.insert(oid);
 
   return true;
 }
@@ -363,12 +360,7 @@ bool EVRootCAMetadata::RemoveEVCA(const SHA1Fingerprint& fingerprint) {
     return false;
   PolicyOID oid = it->second[0];
   ev_policy_.erase(it);
-
-  std::vector<PolicyOID>::iterator it2 = std::find(
-      policy_oids_.begin(), policy_oids_.end(), oid);
-  if (it2 == policy_oids_.end())
-    return false;
-  policy_oids_.erase(it2);
+  policy_oids_.erase(oid);

[wtc, 2012/08/16 23:17:39]

Is it possible to detect that 'oid' is not in policy_oids_
and return false in that case?  The original code does not.
Not sure if that's important.

[Ryan Sleevi, 2012/08/16 23:26:31]

If the fingerprint is found, then it must be in policy_oids_ (line 352)

This is only used by unit tests, and the only place it'd get tricky is if two
different fingerprints used the same OID set. I don't think we support that
though (which may or may not be a bug for the main code, but is fine for unit
tests)

   return true;
 }
 
@@ -491,7 +483,7 @@ EVRootCAMetadata::EVRootCAMetadata() {
       }
 
       ev_policy_[metadata.fingerprint].push_back(policy);
-      policy_oids_.push_back(policy);
+      policy_oids_.insert(policy);
     }
   }
 #endif