Check self-signed certificate names and signatures

net/cert/x509_certificate_ios.cc

Index: net/cert/x509_certificate_ios.cc
diff --git a/net/cert/x509_certificate_ios.cc b/net/cert/x509_certificate_ios.cc
index 553c63a4281a43ba93b7a6298579f9a153f0afeb..7551e52eba4f107bd13c9b3dbc254e7f38ba9169 100644
--- a/net/cert/x509_certificate_ios.cc
+++ b/net/cert/x509_certificate_ios.cc
@@ -468,7 +468,10 @@ bool X509Certificate::IsSelfSigned(OSCertHandle os_cert) {
     return false;
 
   // NOTE: X509_verify() returns 1 in case of success, 0 or -1 on error.
-  return X509_verify(cert.get(), scoped_key.get()) == 1;
+  if (X509_verify(cert.get(), scoped_key.get()) != 1)
+    return false;
+  // NOTE: x509_check_issued returns X509_V_OK in case of success

[Ryan Sleevi, 2016/05/26 07:57:08]

You don't need this NOTE (X509_verify() was the weird API contract)

[estark, 2016/05/26 16:26:51]

FWIW, I think BoringSSL actually just returns 0/1 from X509_verify. (...for now.
that might change.) So line 470 isn't exactly accurate anymore. Maybe it should
be changed to "Historically, OpenSSL's X509_verify returned..." or something
like that?

[Ryan Sleevi, 2016/05/26 16:36:41]

If that's the case (and the API is fixed), we should remove both NOTEs. The NOTE
then was just "OpenSSL APIs are dumb" - if this was fixed in David's BoringSSL
burning run, then we should just "if (!X509_Verify())" and be done with it (and
remove the NOTE)

[estark, 2016/05/27 00:59:13]

I was thinking that we shouldn't remove the comment entirely because there's a
possibility that the BoringSSL API might change back because a caller in CT was
kind of depending on the weird -1/0 return values
(https://bugs.chromium.org/p/boringssl/issues/detail?id=18). Buuut, if and when
we change it back to -1/0/1, we're going to have to audit all the callers to
make sure that everything makes sense, so we can always change it back then. 
So, removing it and doing `if !X509_verify()` SGTM.

[dadrian, 2016/05/27 01:05:02]

Done.

+  return X509_check_issued(cert.get(), cert.get()) == X509_V_OK;
 }
 
 }  // namespace net