Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <nss.h>
 #include <pk11pub.h>
@@ skipping 1027 matching lines @@
 }
 
 // static
 bool X509Certificate::WriteOSCertHandleToPickle(OSCertHandle cert_handle,
                                                 Pickle* pickle) {
   return pickle->WriteData(
       reinterpret_cast<const char*>(cert_handle->derCert.data),
       cert_handle->derCert.len);
 }
 
+//static

[agl, 2011/11/16 15:57:55]

space before "static"

+void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+                                       size_t* size_bits,
+                                       PublicKeyType* type) {
+  SECKEYPublicKey* key = CERT_ExtractPublicKey(cert_handle);
+  *size_bits = SECKEY_PublicKeyStrengthInBits(key);
+
+  switch (key->keyType) {
+    case rsaKey:
+      *type = PublicKeyType::RSA;
+      break;
+    case dsaKey:
+      *type = PublicKeyType::DSA;
+      break;
+    case dhKey:
+      *type = PublicKeyType::DH;
+      break;
+    case ecKey:
+      *type = PublicKeyType::ECDSA;
+      break;
+    default:
+      *type = PublicKeyType::NONE;
+  }
+}
+
 }  // namespace net