Refuse to accept certificate chains containing any RSA public key smaller

net/base/x509_certificate_mac.cc

Index: net/base/x509_certificate_mac.cc
===================================================================
--- net/base/x509_certificate_mac.cc	(revision 110129)
+++ net/base/x509_certificate_mac.cc	(working copy)
@@ -1437,4 +1437,55 @@
                            cert_data.Length);
 }
 
+//static

[agl, 2011/11/16 15:57:55]

space before "static"

+void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+                                       size_t* size_bits,
+                                       PublicKeyType* type) {
+  SecKeyRef key;
+  OSStatus status = SecCertificateCopyPublicKey(cert_handle, &key);
+  if (status) {
+    CFRelease(key);
+    NOTREACHED() << "SecCertificateCopyPublicKey failed: " << status;
+    return 0;

[agl, 2011/11/16 15:57:55]

you're returning 0 in a void function (ditto elsewhere).

+  }
+
+  CSSM_KEY* cssm_key;
+  status = SecKeyGetCSSMKey(key, &cssm_key);
+  if (status) {
+    CFRelease(key);
+    NOTREACHED() << "SecKeyGetCSSMKey failed: " << status;
+    return 0;
+  }
+
+  CSSM_KEY_SIZE key_size;
+  status = CSSM_QueryKeySizeInBits(crypto::GetSharedCSPHandle(), NULL, cssm_key,
+                                   &key_size);
+  if (status) {
+    CFRelease(key);
+    NOTREACHED() << "CSSM_QueryKeySizeInBits failed: " << status;
+    return 0;
+  }
+
+  *size_bits = key_size.LogicalKeySizeInBits;
+
+  switch (cssm_key->KeyHeader.AlgorithmId) {
+    case CSSM_ALGID_RSA:
+      *type = PublicKeyType::RSA;
+      break;
+    case CSSM_ALGID_DSA:
+      *type = PublicKeyType::DSA;
+      break;
+    case CSSM_ALGID_ECDSA:
+      *type = PublicKeyType::ECDSA;
+      break;
+    case CSSM_ALGID_DH:
+      *type = PublicKeyType::DH;
+      break;
+    default:
+      *type = PublicKeyType::NONE;
+  }
+
+  CFRelease(key);
+}
+
 }  // namespace net