Record when certificates signed with md[2,4,5] are encountered when using OpenSSL

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 457 matching lines @@
   X509* verified_cert = NULL;
   std::vector<X509*> verified_chain;
   for (int i = 0; i < sk_X509_num(chain); ++i) {
     X509* cert = sk_X509_value(chain, i);
     if (i == 0) {
       verified_cert = cert;
     } else {
       verified_chain.push_back(cert);
     }
 
+    int sig_alg = OBJ_obj2nid(cert->sig_alg->algorithm);
+    if (sig_alg == NID_md2WithRSAEncryption) {
+      verify_result->has_md2 = true;
+      if (i != 0)
+        verify_result->has_md2_ca = true;
+    } else if (sig_alg == NID_md4WithRSAEncryption) {
+      verify_result->has_md4 = true;

[palmer, 2011/10/25 19:44:48]

Even if we never expect to see it, perhaps we should also check for MD4 CAs and
set true in that case?

[wtc, 2011/10/25 20:37:31]

Thank you for the suggestion.  I should explain why there
is no has_md4_ca.

The reason there are has_md2_ca and has_md5_ca is that
they allow us to disallow MD2 or MD5 CA certificates
first, before disallowing MD2 or MD5 server certificates.

MD4 is more broken than MD2 and MD5 and probably was only
supported by Windows.  Therefore we can directly ban all MD4
certificates.  A two-phase banning isn't necessary.

+    } else if (sig_alg == NID_md5WithRSAEncryption) {
+      verify_result->has_md5 = true;
+      if (i != 0)
+        verify_result->has_md5_ca = true;
+    }
+
     DERCache der_cache;
     if (!GetDERAndCacheIfNeeded(cert, &der_cache))
       continue;
 
     base::StringPiece der_bytes(reinterpret_cast<const char*>(der_cache.data),
                                 der_cache.data_length);
     base::StringPiece spki_bytes;
     if (!asn1::ExtractSPKIFromDERCert(der_bytes, &spki_bytes))
       continue;
 
@@ skipping 65 matching lines @@
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
 }  // namespace net