Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 #pragma once
 
 #include <string.h>
 
@@ skipping 56 matching lines @@
   typedef X509* OSCertHandle;
 #elif defined(USE_NSS)
   typedef struct CERTCertificateStr* OSCertHandle;
 #else
   // TODO(ericroman): not implemented
   typedef void* OSCertHandle;
 #endif
 
   typedef std::vector<OSCertHandle> OSCertHandles;
 
+  enum {
+    NONE,
+    RSA,
+    DSA,
+    ECDSA,
+    DH,

[agl, 2011/11/16 15:57:55]

OTHER?

(For example, ECDH. I wouldn't want code to assume that these are the only valid
key types. It's the sort of thing that might change in the future.)


Later: I see that you're using NONE for OTHER. I think NONE is a misleading
name.

+  } PublicKeyType;
+
   // Predicate functor used in maps when X509Certificate is used as the key.
   class NET_EXPORT LessThan {
    public:
     bool operator() (X509Certificate* lhs,  X509Certificate* rhs) const;
   };
 
   enum VerifyFlags {
     VERIFY_REV_CHECKING_ENABLED = 1 << 0,
     VERIFY_EV_CERT = 1 << 1,
   };
@@ skipping 310 matching lines @@
   static bool GetPEMEncoded(OSCertHandle cert_handle,
                             std::string* pem_encoded);
 
   // Encodes the entire certificate chain (this certificate and any
   // intermediate certificates stored in |intermediate_ca_certs_|) as a series
   // of PEM encoded strings. Returns true if all certificates were encoded,
   // storig the result in |*pem_encoded|, with this certificate stored as
   // the first element.
   bool GetPEMEncodedChain(std::vector<std::string>* pem_encoded) const;
 
+  // Returns the length of the public key in bits.
+  static unsigned int GetPublicKeyLengthInBits(OSCertHandle cert_handle);
+
   // Returns the OSCertHandle of this object. Because of caching, this may
   // differ from the OSCertHandle originally supplied during initialization.
   // Note: On Windows, CryptoAPI may return unexpected results if this handle
   // is used across multiple threads. For more details, see
   // CreateOSCertChainForCert().
   OSCertHandle os_cert_handle() const { return cert_handle_; }
 
   // Returns true if two OSCertHandles refer to identical certificates.
   static bool IsSameOSCert(OSCertHandle a, OSCertHandle b);
 
@@ skipping 142 matching lines @@
   // (Marked mutable because it's used in a const method.)
   mutable base::Lock verification_lock_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_