Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 644 matching lines @@
                                                 Pickle* pickle) {
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
+// static
+void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+                                       size_t* size_bits,
+                                       PublicKeyType* type) {
+  EVP_PKEY* key = X509_get_pubkey(cert_handle);
+  CHECK(key);
+
+  switch (key->type) {
+    case EVP_PKEY_RSA:
+      *type = kPublicKeyTypeRSA;
+      *size_bits = EVP_PKEY_size(key) * 8;
+      break;
+    case EVP_PKEY_DSA:
+      *type = kPublicKeyTypeDSA;
+      *size_bits = EVP_PKEY_size(key) * 8;
+      break;
+    case EVP_PKEY_EC:
+      *type = kPublicKeyTypeECDSA;
+      *size_bits = EVP_PKEY_size(key);

[wtc, 2011/12/13 21:56:18]

It seems strange that EVP_PKEY_size returns a key size in
either bytes or bits depending on the key type.

+      break;
+    case EVP_PKEY_DH:
+      *type = kPublicKeyTypeDH;
+      *size_bits = EVP_PKEY_size(key) * 8;
+      break;
+    default:
+      *type = kPublicKeyTypeUnknown;
+      *size_bits = 0;
+  }
+}
+
 #if defined(OS_ANDROID)
 void X509Certificate::GetChainDEREncodedBytes(
     std::vector<std::string>* chain_bytes) const {
   OSCertHandles cert_handles(intermediate_ca_certs_);
   // Make sure the peer's own cert is the first in the chain, if it's not
   // already there.
   if (cert_handles.empty() || cert_handles[0] != cert_handle_)
     cert_handles.insert(cert_handles.begin(), cert_handle_);
 
   chain_bytes->reserve(cert_handles.size());
   for (OSCertHandles::const_iterator it = cert_handles.begin();
        it != cert_handles.end(); ++it) {
     std::string cert_bytes;
     GetDEREncoded(*it, &cert_bytes);
     chain_bytes->push_back(cert_bytes);
   }
 }
 #endif
 
 }  // namespace net