SSLCertRequestInfo: Add |valid_cas| and |valid_key_types|

net/base/x509_certificate.cc

Index: net/base/x509_certificate.cc
diff --git a/net/base/x509_certificate.cc b/net/base/x509_certificate.cc
index 29b11a8cdfccfd83e616c1190bfad5b09cd95581..bf0650e84ecf3b6bfcfa3c850c1e198d8a2946e2 100644
--- a/net/base/x509_certificate.cc
+++ b/net/base/x509_certificate.cc
@@ -25,6 +25,8 @@
 #include "googleurl/src/url_canon_ip.h"
 #include "net/base/net_util.h"
 #include "net/base/pem_tokenizer.h"
+#include "net/base/ssl_cert_request_info.h"
+#include "net/base/x509_cert_types.h"
 
 namespace net {
 
@@ -698,4 +700,21 @@ X509Certificate::~X509Certificate() {
   }
 }
 
+#if !defined(USE_OPENSSL)
+bool X509Certificate::IsValidClientCertificate(
+    const SSLCertRequestInfo& cert_info) {
+  DCHECK(cert_info.no_client_certs == false);

[Ryan Sleevi, 2012/12/11 21:30:24]

While this impl is NACKed, as a style nit, this DCHECK style is discouraged.

DCHECK_EQ(false, cert_info.no_client_certs)

which quickly reveals it's better as

DCHECK(!cert_info.no_client_certs);

[digit1, 2012/12/11 23:05:31]

Oh thanks, point taken, will do.

+
+  // Check that the current certificate matches the critera supplied in
+  // a CertificateRequest message.
+  const std::vector<scoped_refptr<X509Certificate> >& client_certs =
+      cert_info.client_certs;
+  for (size_t i = 0; i < client_certs.size(); ++i) {
+    if (Equals(client_certs[i])) {
+      return true;
+    }
+  }
+  return false;
+#endif  // !USE_OPENSSL
+
 }  // namespace net