net: add ability to distinguish user-added root CAs.

net/base/x509_certificate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <map>
 #include <string>
 #include <vector>
 
+#include <stdlib.h>

[wtc, 2011/04/06 04:28:38]

Nit: the C system header <stdlib.h> should be listed before
C++ system headers.

[agl, 2011/04/06 19:02:02]

Done.

+
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram.h"
+#include "base/sha1.h"
 #include "base/string_piece.h"
 #include "base/string_util.h"
 #include "base/time.h"
 #include "net/base/pem_tokenizer.h"
 
 namespace net {
 
 namespace {
 
 // Returns true if this cert fingerprint is the null (all zero) fingerprint.
@@ skipping 496 matching lines @@
       if (memcmp(kSerials[i], serial_number_.data(), kSerialBytes) == 0) {
         UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", i, kNumSerials);
         return true;
       }
     }
   }
 
   return false;
 }
 
+static int CompareSHA1Hashes(const void* a, const void* b) {

[wtc, 2011/04/06 04:28:38]

Move this file scope static function to the unnamed namespace
above, on lines 23-119.  Add a comment to note that this is a
comparison function for bsearch.

[agl, 2011/04/06 19:02:02]

Done.

+  return memcmp(a, b, base::SHA1_LENGTH);
+}
+
+// static
+bool X509Certificate::IsSHA1HashInSortedArray(const uint8 hash[20],
+                                              const uint8* array,
+                                              unsigned bytelen) {

[wtc, 2011/04/06 04:28:38]

The name of the third parameter should match its name in
the declaration (array_byte_len).

This function should be listed after VerifyNameMatch, to
match the declaration order in the header file.

[agl, 2011/04/06 19:02:02]

Done.
Have moved after IsBlacklisted() in the .h file in order to make it private.

+  const unsigned arraylen = bytelen / base::SHA1_LENGTH;
+  return NULL != bsearch(hash, array, arraylen, base::SHA1_LENGTH,
+                         CompareSHA1Hashes);
+}
+
 }  // namespace net