net: add ability to distinguish user-added root CAs.

net/base/cert_verify_result.h

Index: net/base/cert_verify_result.h
diff --git a/net/base/cert_verify_result.h b/net/base/cert_verify_result.h
index faac17a88b77f12da09994266ac6861a1804bfb1..e36c971e3fbac8ba752b3f07f83f0dd4a421c084 100644
--- a/net/base/cert_verify_result.h
+++ b/net/base/cert_verify_result.h
@@ -1,4 +1,4 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -21,6 +21,7 @@ class CertVerifyResult {
     has_md4 = false;
     has_md5_ca = false;
     has_md2_ca = false;
+    is_issued_by_known_root = false;
   }
 
   // Bitmask of CERT_STATUS_* from net/base/cert_status_flags.h
@@ -32,6 +33,12 @@ class CertVerifyResult {
   bool has_md4;
   bool has_md5_ca;
   bool has_md2_ca;
+
+  // is_issued_by_known_root is true if recognise the root CA as a standard

[wtc, 2011/04/07 05:01:54]

Nit: add "we" before "recognise"?

[agl, 2011/04/07 15:02:49]

Done.

+  // root.  If it isn't then it's probably the case that this certificate was
+  // generated by a MITM proxy whose root has been installed locally. This is
+  // meaningless if the certificate was not trusted.
+  bool is_issued_by_known_root;
 };
 
 }  // namespace net