Record UMA metrics for Must-Staple certificates on private roots

net/cert/asn1_util.h

Index: net/cert/asn1_util.h
diff --git a/net/cert/asn1_util.h b/net/cert/asn1_util.h
index 23bc2d2cf9039487381fbb4eb0746c06932b25fa..7887b46c4976686e541b452dce7d2b73efd1f274 100644
--- a/net/cert/asn1_util.h
+++ b/net/cert/asn1_util.h
@@ -43,6 +43,14 @@ NET_EXPORT_PRIVATE bool ExtractCRLURLsFromDERCert(
     base::StringPiece cert,
     std::vector<base::StringPiece>* urls_out);
 
+// HasTLSFeatureExtensions parses the DER encoded certificate in |cert|

[eroman, 2016/10/21 01:49:23]

typo: HasTLSFeatureExtension

[estark, 2016/10/21 02:11:29]

Done.

+// and extracts the TLS feature extension
+// (https://tools.ietf.org/html/rfc7633) if present. On successful

[eroman, 2016/10/21 01:49:22]

Thanks for including the RFC reference in the comment.

+// return, |*has_tls_feature_extension| to true if the TLS feature

[eroman, 2016/10/21 01:49:23]

Can you re-work the wording on this? Feels like something is missing.

[estark, 2016/10/21 02:11:29]

Done.

+// extension was present and false otherwise.
+NET_EXPORT_PRIVATE bool HasTLSFeatureExtension(base::StringPiece cert,

[eroman, 2016/10/21 01:49:22]

API question: Instead of two bool outputs, can the API be:
   bool HasTLSFeatureExtension(base::StringPiece)

The meaning of false here would now include any failures parsing -- which for
the consumers I don't think is of particular interest, nor for that matter is
likely to be reached.

WDYT?

[estark, 2016/10/21 02:11:29]

Yeah, I think that'll work. Done.

+                                               bool* has_tls_feature_extension);
+
 } // namespace asn1
 
 } // namespace net