Simplify and document X509_supported_extension It doesn't make sense to binary search over a list of 10 entries. Additionally, the compiler is perfectly capable of optimizing a bunch of equality checks (e.g. by turning it into a bitmask), so just let the compiler do what it wants. Change-Id: Ie7cee62d1ddec1ac1e24f483817b9a67aaff369c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64250 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>

diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c
index 32fdb60..e7a9764 100644
--- a/crypto/x509/v3_purp.c
+++ b/crypto/x509/v3_purp.c

@@ -310,43 +310,18 @@
 
 int X509_PURPOSE_get_trust(const X509_PURPOSE *xp) { return xp->trust; }
 
-static int nid_cmp(const void *void_a, const void *void_b) {
-  const int *a = void_a, *b = void_b;
-
-  return *a - *b;
-}
-
 int X509_supported_extension(const X509_EXTENSION *ex) {
-  // This table is a list of the NIDs of supported extensions: that is
-  // those which are used by the verify process. If an extension is
-  // critical and doesn't appear in this list then the verify process will
-  // normally reject the certificate. The list must be kept in numerical
-  // order because it will be searched using bsearch.
-
-  static const int supported_nids[] = {
-      NID_netscape_cert_type,    // 71
-      NID_key_usage,             // 83
-      NID_subject_alt_name,      // 85
-      NID_basic_constraints,     // 87
-      NID_certificate_policies,  // 89
-      NID_ext_key_usage,         // 126
-      NID_policy_constraints,    // 401
-      NID_name_constraints,      // 666
-      NID_policy_mappings,       // 747
-      NID_inhibit_any_policy     // 748
-  };
-
-  int ex_nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex));
-
-  if (ex_nid == NID_undef) {
-    return 0;
-  }
-
-  if (bsearch(&ex_nid, supported_nids, sizeof(supported_nids) / sizeof(int),
-              sizeof(int), nid_cmp) != NULL) {
-    return 1;
-  }
-  return 0;
+  int nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex));
+  return nid == NID_netscape_cert_type ||    //
+         nid == NID_key_usage ||             //
+         nid == NID_subject_alt_name ||      //
+         nid == NID_basic_constraints ||     //
+         nid == NID_certificate_policies ||  //
+         nid == NID_ext_key_usage ||         //
+         nid == NID_policy_constraints ||    //
+         nid == NID_name_constraints ||      //
+         nid == NID_policy_mappings ||       //
+         nid == NID_inhibit_any_policy;
 }
 
 static int setup_dp(X509 *x, DIST_POINT *dp) {

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 449f932..0c8d5df 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h

@@ -4027,7 +4027,16 @@
 
 OPENSSL_EXPORT int X509_check_ca(X509 *x);
 OPENSSL_EXPORT int X509_check_purpose(X509 *x, int id, int ca);
+
+// X509_supported_extension returns one if |ex| is a critical X.509 certificate
+// extension, supported by |X509_verify_cert|, and zero otherwise.
+//
+// Note this function only reports certificate extensions (as opposed to CRL or
+// CRL extensions), and only extensions that are expected to be marked critical.
+// Additionally, |X509_verify_cert| checks for unsupported critical extensions
+// internally, so most callers will not need to call this function separately.
 OPENSSL_EXPORT int X509_supported_extension(const X509_EXTENSION *ex);
+
 OPENSSL_EXPORT int X509_PURPOSE_set(int *p, int purpose);
 OPENSSL_EXPORT int X509_check_issued(X509 *issuer, X509 *subject);
 OPENSSL_EXPORT int X509_check_akid(X509 *issuer, AUTHORITY_KEYID *akid);