[refactor] Extract the CertVerifyResult assignment of has_md2, has_md4,

net/cert/x509_certificate_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 500 matching lines @@
     case CSSM_ALGID_DH:
       *type = kPublicKeyTypeDH;
       break;
     default:
       *type = kPublicKeyTypeUnknown;
       *size_bits = 0;
       break;
   }
 }
 
+X509Certificate::SignatureHashAlgorithm
+X509Certificate::GetSignatureHashAlgorithm(OSCertHandle cert_handle) {
+  x509_util::CSSMCachedCertificate cached_cert;
+  OSStatus status = cached_cert.Init(cert_handle);
+  if (status)
+    return kSignatureHashAlgorithmOther;
+  x509_util::CSSMFieldValue signature_field;

[Ryan Sleevi, 2017/01/05 22:48:24]

suggestion: newline between 526 & 527

[eroman, 2017/01/05 23:36:31]

Done.

+  status =
+      cached_cert.GetField(&CSSMOID_X509V1SignatureAlgorithm, &signature_field);
+  if (status || !signature_field.field())
+    return kSignatureHashAlgorithmOther;
+  // Match the behaviour of OS X system tools and defensively check that
+  // sizes are appropriate. This would indicate a critical failure of the
+  // OS X certificate library, but based on history, it is best to play it
+  // safe.

[Ryan Sleevi, 2017/01/05 22:48:24]

Can delete 532-535. I should have left those as CL review comments. I would
suggest a newline between 531 and 536 though.

[eroman, 2017/01/05 23:36:31]

Done.

+  const CSSM_X509_ALGORITHM_IDENTIFIER* sig_algorithm =
+      signature_field.GetAs<CSSM_X509_ALGORITHM_IDENTIFIER>();
+  if (!sig_algorithm)
+    return kSignatureHashAlgorithmOther;
+
+  const CSSM_OID* alg_oid = &sig_algorithm->algorithm;
+  if (CSSMOIDEqual(alg_oid, &CSSMOID_MD2WithRSA))
+    return kSignatureHashAlgorithmMd2;
+  if (CSSMOIDEqual(alg_oid, &CSSMOID_MD4WithRSA))
+    return kSignatureHashAlgorithmMd4;
+  if (CSSMOIDEqual(alg_oid, &CSSMOID_MD5WithRSA))
+    return kSignatureHashAlgorithmMd5;
+  if (CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithRSA) ||
+      CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithRSA_OIW) ||
+      CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithDSA) ||
+      CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithDSA_CMS) ||
+      CSSMOIDEqual(alg_oid, &CSSMOID_SHA1WithDSA_JDK) ||
+      CSSMOIDEqual(alg_oid, &CSSMOID_ECDSA_WithSHA1)) {
+    return kSignatureHashAlgorithmSha1;
+  }
+
+  return kSignatureHashAlgorithmOther;
+}
+
 // static
 bool X509Certificate::IsSelfSigned(OSCertHandle cert_handle) {
   x509_util::CSSMCachedCertificate cached_cert;
   OSStatus status = cached_cert.Init(cert_handle);
   if (status != noErr)
     return false;
 
   x509_util::CSSMFieldValue subject;
   status = cached_cert.GetField(&CSSMOID_X509V1SubjectNameStd, &subject);
   if (status != CSSM_OK || !subject.field())
@@ skipping 20 matching lines @@
     return false;
 
   if (CSSM_CL_CertVerify(cl_handle, 0, &cert_data, &cert_data, NULL, 0))
     return false;
   return true;
 }
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace net