[refactor] Extract the CertVerifyResult assignment of has_md2, has_md4,

net/cert/x509_certificate.h

Index: net/cert/x509_certificate.h
diff --git a/net/cert/x509_certificate.h b/net/cert/x509_certificate.h
index 613bd09509004301c7d4f4e72d6704733df5c717..25097c03e7f933d072a7ae9892e82d160b48c991 100644
--- a/net/cert/x509_certificate.h
+++ b/net/cert/x509_certificate.h
@@ -80,6 +80,15 @@ class NET_EXPORT X509Certificate
     kPublicKeyTypeECDH
   };
 
+  // Enumeration for weak hashing algorithms.

[Ryan Sleevi, 2017/01/05 22:48:24]

This feels very much like a tighter coupling.

That is, the logical question is "Why should X509Certificate know what's
considered weak or not" - and historically, it hasn't (policy is left to
CertVerifyProc).

Since we're moving this code to X509Certificate, I'm curious whether it makes to
expand this enum (to include the other algorithms), or, simply from a design
standpoint, remove the comments about 'weak' and let it be extended (if needed)

// The digest algorithm used for the certificate's signature.

[eroman, 2017/01/05 23:21:53]

Sure, I will remove the comment about it being "weak" ones.

[eroman, 2017/01/05 23:36:30]

Done.

+  enum SignatureHashAlgorithm {
+    kSignatureHashAlgorithmMd2,
+    kSignatureHashAlgorithmMd4,
+    kSignatureHashAlgorithmMd5,
+    kSignatureHashAlgorithmSha1,
+    kSignatureHashAlgorithmOther,
+  };
+
   enum Format {
     // The data contains a single DER-encoded certificate, or a PEM-encoded
     // DER certificate with the PEM encoding block name of "CERTIFICATE".
@@ -327,6 +336,12 @@ class NET_EXPORT X509Certificate
                                size_t* size_bits,
                                PublicKeyType* type);
 
+  // Returns the hashing algorithm used by |cert_handle|. If the hashing
+  // algorithm is NOT one of the enumerated weak ones, OR the implementation
+  // fails, then will return kSignatureHashAlgorithmOther.

[Ryan Sleevi, 2017/01/05 22:48:24]

// Returns the digest algorithm used in |cert_handle|'s signature.
// If the digest algorithm cannot be determined, or if it is not one
// of the explicitly enumerated values, kSignatureHashAlgorithmOther
// will be returned.
// NOTE: No validation of the signature is performed, and thus invalid
// signatures may result in seemingly meaningful values.

[eroman, 2017/01/05 23:36:30]

Done.

+  static SignatureHashAlgorithm GetSignatureHashAlgorithm(
+      OSCertHandle cert_handle);
+
   // Returns the OSCertHandle of this object. Because of caching, this may
   // differ from the OSCertHandle originally supplied during initialization.
   // Note: On Windows, CryptoAPI may return unexpected results if this handle