Reduce Certificate Parsing Strictness

net/cert/internal/signature_algorithm.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/signature_algorithm.h"
 
 #include <utility>
 
 #include "base/numerics/safe_math.h"
 #include "net/der/input.h"
@@ skipping 208 matching lines @@
   return !parser.HasMore();
 }
 
 // Parses an RSA PKCS#1 v1.5 signature algorithm given the DER-encoded
 // "parameters" from the parsed AlgorithmIdentifier, and the hash algorithm
 // that was implied by the AlgorithmIdentifier's OID.
 //
 // Returns a nullptr on failure.
 //
 // RFC 5912 requires that the parameters for RSA PKCS#1 v1.5 algorithms be NULL
-// ("PARAMS TYPE NULL ARE required"):
+// ("PARAMS TYPE NULL ARE required"), however an empty parameter is also
+// allowed for compatibility with non-compliant OCSP responders:
 //
 //     sa-rsaWithSHA1 SIGNATURE-ALGORITHM ::= {
 //      IDENTIFIER sha1WithRSAEncryption
 //      PARAMS TYPE NULL ARE required
 //      HASHES { mda-sha1 }
 //      PUBLIC-KEYS { pk-rsa }
 //      SMIME-CAPS {IDENTIFIED BY sha1WithRSAEncryption }
 //     }
 //
 //     sa-sha256WithRSAEncryption SIGNATURE-ALGORITHM ::= {
@@ skipping 14 matching lines @@
 //
 //     sa-sha512WithRSAEncryption SIGNATURE-ALGORITHM ::= {
 //         IDENTIFIER sha512WithRSAEncryption
 //         PARAMS TYPE NULL ARE required
 //         HASHES { mda-sha512 }
 //         PUBLIC-KEYS { pk-rsa }
 //         SMIME-CAPS { IDENTIFIED BY sha512WithRSAEncryption }
 //     }
 scoped_ptr<SignatureAlgorithm> ParseRsaPkcs1(DigestAlgorithm digest,
                                              const der::Input& params) {
-  if (!IsNull(params))
+  // TODO(svaldez): Add warning about non-strict parsing.
+  if (!IsNull(params) && !IsEmpty(params))
     return nullptr;
 
   return SignatureAlgorithm::CreateRsaPkcs1(digest);
 }
 
 // Parses an ECDSA signature algorithm given the DER-encoded "parameters" from
 // the parsed AlgorithmIdentifier, and the hash algorithm that was implied by
 // the AlgorithmIdentifier's OID.
 //
 // On failure returns a nullptr.
@@ skipping 340 matching lines @@
   return nullptr;
 }
 
 SignatureAlgorithm::SignatureAlgorithm(
     SignatureAlgorithmId algorithm,
     DigestAlgorithm digest,
     scoped_ptr<SignatureAlgorithmParameters> params)
     : algorithm_(algorithm), digest_(digest), params_(std::move(params)) {}
 
 }  // namespace net