net: add ability to distinguish user-added root CAs.

net/base/x509_certificate.h

Index: net/base/x509_certificate.h
diff --git a/net/base/x509_certificate.h b/net/base/x509_certificate.h
index 52bb9f1de87f6dccc1abd714b8ab25f973f82a51..daf326279525284b51134f54446981cc81915792 100644
--- a/net/base/x509_certificate.h
+++ b/net/base/x509_certificate.h
@@ -167,7 +167,7 @@ class X509Certificate : public base::RefCountedThreadSafe<X509Certificate> {
   // An example:
   // CN=Michael Wong,O=FooBar Corporation,DC=foobar,DC=com
   //
-  // SECURUITY WARNING
+  // SECURITY WARNING
   //
   // Using self-signed certificates has the following security risks:
   // 1. Encryption without authentication and thus vulnerable to
@@ -323,6 +323,11 @@ class X509Certificate : public base::RefCountedThreadSafe<X509Certificate> {
   // Frees (or releases a reference to) an OS certificate handle.
   static void FreeOSCertHandle(OSCertHandle cert_handle);
 
+  // IsSHA1HashInArray returns true iff |hash| is in |array|, a sorted array of
+  // SHA1 hashes.
+  static bool IsSHA1HashInSortedArray(const uint8 hash[20], const uint8* array,
+                                      unsigned array_byte_len);

[wtc, 2011/04/06 04:28:38]

This method should be private.

You may be able to use the SHA1Fingerprint type, at least
for the first argument.  The static method CalculateFingerprint
should be useful.

Declare array_byte_len as size_t.  (Only NSS uses unsigned int
for lengths, but we're not dealing with NSS here.)

[agl, 2011/04/06 19:02:02]

Done, although this means that the IsIssuedByKnownRoot have to be members of
X509Certificate too.
Done.

+
  private:
   friend class base::RefCountedThreadSafe<X509Certificate>;
   friend class TestRootCerts;  // For unit tests