net: add ability to distinguish user-added root CAs.

net/base/x509_certificate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
+#include <stdlib.h>
+
 #include <map>
 #include <string>
 #include <vector>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram.h"
+#include "base/sha1.h"
 #include "base/string_piece.h"
 #include "base/string_util.h"
 #include "base/time.h"
 #include "net/base/pem_tokenizer.h"
 
 namespace net {
 
 namespace {
 
 // Returns true if this cert fingerprint is the null (all zero) fingerprint.
@@ skipping 81 matching lines @@
     const SHA1Fingerprint& fingerprint) {
   base::AutoLock lock(lock_);
 
   CertMap::iterator pos(cache_.find(fingerprint));
   if (pos == cache_.end())
     return NULL;
 
   return pos->second;
 };
 
+// CompareSHA1Hashes is a helper function for using bsearch() with an array of
+// SHA1 hashes.
+static int CompareSHA1Hashes(const void* a, const void* b) {
+  return memcmp(a, b, base::SHA1_LENGTH);
+}
+
 }  // namespace
 
 bool X509Certificate::LessThan::operator()(X509Certificate* lhs,
                                            X509Certificate* rhs) const {
   if (lhs == rhs)
     return false;
 
   SHA1FingerprintLessThan fingerprint_functor;
   return fingerprint_functor(lhs->fingerprint_, rhs->fingerprint_);
 }
@@ skipping 395 matching lines @@
       if (memcmp(kSerials[i], serial_number_.data(), kSerialBytes) == 0) {
         UMA_HISTOGRAM_ENUMERATION("Net.SSLCertBlacklisted", i, kNumSerials);
         return true;
       }
     }
   }
 
   return false;
 }
 
+// static
+bool X509Certificate::IsSHA1HashInSortedArray(const SHA1Fingerprint& hash,
+                                              const uint8* array,
+                                              size_t array_byte_len) {
+  DCHECK_EQ(0u, array_byte_len % base::SHA1_LENGTH);
+  const unsigned arraylen = array_byte_len / base::SHA1_LENGTH;
+  return NULL != bsearch(hash.data, array, arraylen, base::SHA1_LENGTH,
+                         CompareSHA1Hashes);
+}
+
 }  // namespace net