net: add ability to distinguish user-added root CAs.

net/base/x509_certificate_win.cc

Index: net/base/x509_certificate_win.cc
diff --git a/net/base/x509_certificate_win.cc b/net/base/x509_certificate_win.cc
index a9d66063de864ac5d6bdc649192298ee85328cce..9d94ac9c37c7d4437108ec992d8beea88adbe6ea 100644
--- a/net/base/x509_certificate_win.cc
+++ b/net/base/x509_certificate_win.cc
@@ -9,6 +9,7 @@
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/pickle.h"
+#include "base/sha1.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
@@ -18,6 +19,7 @@
 #include "net/base/net_errors.h"
 #include "net/base/scoped_cert_chain_context.h"
 #include "net/base/test_root_certs.h"
+#include "net/base/x509_certificate_win_known_hashes.h"

[wtc, 2011/04/07 05:01:54]

Typo: hashes => roots

Nit: it may be better to name these headers
x509_certificate_known_roots_win.h and
x509_certificate_known_roots_mac.h, so that
they match the _win.* and _mac.* patterns that
our GYP files can exclude on other platforms.

[agl, 2011/04/07 15:02:49]

Done.

 
 #pragma comment(lib, "crypt32.lib")
 
@@ -504,6 +506,21 @@ void X509Certificate::Initialize() {
     serial_number_ = serial_number_.substr(1, serial_number_.size() - 1);
 }
 
+// IsIssuedByKnownRoot returns true if the given chain is rooted at a root CA
+// which we recognise as a standard root.
+bool X509Certificate::IsIssuedByKnownRoot(PCCERT_CHAIN_CONTEXT chain_context) {
+  PCERT_SIMPLE_CHAIN first_chain = chain_context->rgpChain[0];
+  int num_elements = first_chain->cElement;
+  if (num_elements < 1)
+    return true;
+  PCERT_CHAIN_ELEMENT* element = first_chain->rgpElement;
+  PCCERT_CONTEXT cert = element[num_elements - 1]->pCertContext;
+
+  SHA1Fingerprint hash = CalculateFingerprint(cert);
+  return X509Certificate::IsSHA1HashInSortedArray(
+      hash, &kKnownRootCertSHA1Hashes[0][0], sizeof(kKnownRootCertSHA1Hashes));
+}
+
 // static
 X509Certificate* X509Certificate::CreateFromPickle(const Pickle& pickle,
                                                    void** pickle_iter) {
@@ -782,6 +799,8 @@ int X509Certificate::Verify(const std::string& hostname,
   if (CertSubjectCommonNameHasNull(cert_handle_))
     verify_result->cert_status |= CERT_STATUS_INVALID;
 
+  verify_result->is_issued_by_known_root = IsIssuedByKnownRoot(chain_context);
+
   std::wstring wstr_hostname = ASCIIToWide(hostname);
 
   SSL_EXTRA_CERT_CHAIN_POLICY_PARA extra_policy_para;