Refactor the assignment of CertVerifyResult::has_md2, etc.

net/cert/cert_verify_proc_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 159 matching lines @@
   // revocation preference.
   status = x509_util::CreateRevocationPolicies(
       (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED), local_policies);
   if (status)
     return status;
 
   policies->reset(local_policies.release());
   return noErr;
 }
 
-// Stores the constructed certificate chain |cert_chain| and information about
-// the signature algorithms used into |*verify_result|. If the leaf cert in
-// |cert_chain| contains a weak (MD2, MD4, MD5, SHA-1) signature, stores that
-// in |*leaf_is_weak|. |cert_chain| must not be empty.
-void GetCertChainInfo(CFArrayRef cert_chain,
-                      CSSM_TP_APPLE_EVIDENCE_INFO* chain_info,
-                      CertVerifyResult* verify_result,
-                      bool* leaf_is_weak) {
+// Stores the constructed certificate chain |cert_chain| into
+// |*verify_result|. |cert_chain| must not be empty.
+void CopyCertChainToVerifyResult(CFArrayRef cert_chain,
+                                 CertVerifyResult* verify_result) {
   DCHECK_LT(0, CFArrayGetCount(cert_chain));
 
-  *leaf_is_weak = false;
-  verify_result->has_md2 = false;
-  verify_result->has_md4 = false;
-  verify_result->has_md5 = false;
-  verify_result->has_sha1 = false;
-  verify_result->has_sha1_leaf = false;
-
   SecCertificateRef verified_cert = NULL;
   std::vector<SecCertificateRef> verified_chain;
   for (CFIndex i = 0, count = CFArrayGetCount(cert_chain); i < count; ++i) {
     SecCertificateRef chain_cert = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
     if (i == 0) {
       verified_cert = chain_cert;
     } else {
       verified_chain.push_back(chain_cert);
     }
+  }
+  if (!verified_cert) {
+    NOTREACHED();
+    return;
+  }
+
+  verify_result->verified_cert =
+      X509Certificate::CreateFromHandle(verified_cert, verified_chain);
+}
+
+// Returns true if the intermediates (excluding trusted certificates) use a
+// weak hashing algorithm, but the target does not use a weak hash.
+bool IsWeakChainBasedOnHashingAlgorithms(
+    CFArrayRef cert_chain,
+    CSSM_TP_APPLE_EVIDENCE_INFO* chain_info) {
+  DCHECK_LT(0, CFArrayGetCount(cert_chain));
+
+  bool intermediates_contain_weak_hash = false;
+  bool leaf_uses_weak_hash = false;
+
+  for (CFIndex i = 0, count = CFArrayGetCount(cert_chain); i < count; ++i) {
+    SecCertificateRef chain_cert = reinterpret_cast<SecCertificateRef>(
+        const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
 
     if ((chain_info[i].StatusBits & CSSM_CERT_STATUS_IS_IN_ANCHORS) ||
         (chain_info[i].StatusBits & CSSM_CERT_STATUS_IS_ROOT)) {
       // The current certificate is either in the user's trusted store or is
       // a root (self-signed) certificate. Ignore the signature algorithm for
       // these certificates, as it is meaningless for security. We allow
       // self-signed certificates (i == 0 & IS_ROOT), since we accept that
       // any security assertions by such a cert are inherently meaningless.
       continue;
     }
 
-    bool is_leaf = i == 0;
     X509Certificate::SignatureHashAlgorithm hash_algorithm =
-        FillCertVerifyResultWeakSignature(chain_cert, is_leaf, verify_result);
-    if (is_leaf) {
-      switch (hash_algorithm) {
-        case X509Certificate::kSignatureHashAlgorithmMd2:
-        case X509Certificate::kSignatureHashAlgorithmMd4:
-        case X509Certificate::kSignatureHashAlgorithmMd5:
-        case X509Certificate::kSignatureHashAlgorithmSha1:
-          *leaf_is_weak = true;
-          break;
-        case X509Certificate::kSignatureHashAlgorithmOther:
-          break;
-      }
+        X509Certificate::GetSignatureHashAlgorithm(chain_cert);
+
+    switch (hash_algorithm) {
+      case X509Certificate::kSignatureHashAlgorithmMd2:
+      case X509Certificate::kSignatureHashAlgorithmMd4:
+      case X509Certificate::kSignatureHashAlgorithmMd5:
+      case X509Certificate::kSignatureHashAlgorithmSha1:
+        if (i == 0) {
+          leaf_uses_weak_hash = true;
+        } else {
+          intermediates_contain_weak_hash = true;
+        }
+        break;
+      case X509Certificate::kSignatureHashAlgorithmOther:
+        break;
     }
   }
-  if (!verified_cert) {
-    NOTREACHED();
-    return;
-  }
 
-  verify_result->verified_cert =
-      X509Certificate::CreateFromHandle(verified_cert, verified_chain);
+  return !leaf_uses_weak_hash && intermediates_contain_weak_hash;
 }
 
 using ExtensionsMap = std::map<net::der::Input, net::ParsedExtension>;
 
 // Helper that looks up an extension by OID given a map of extensions.
 bool GetExtensionValue(const ExtensionsMap& extensions,
                        const net::der::Input& oid,
                        net::der::Input* value) {
   auto it = extensions.find(oid);
   if (it == extensions.end())
@@ skipping 556 matching lines @@
       bool untrusted = (temp_trust_result != kSecTrustResultUnspecified &&
                         temp_trust_result != kSecTrustResultProceed) ||
                        crl_result == kCRLSetRevoked;
       bool weak_chain = false;
       if (CFArrayGetCount(temp_chain) == 0) {
         // If the chain is empty, it cannot be trusted or have recoverable
         // errors.
         DCHECK(untrusted);
         DCHECK_NE(kSecTrustResultRecoverableTrustFailure, temp_trust_result);
       } else {
-        CertVerifyResult temp_verify_result;
-        bool leaf_is_weak = false;
-        GetCertChainInfo(temp_chain, temp_chain_info, &temp_verify_result,
-                         &leaf_is_weak);
         weak_chain =
-            !leaf_is_weak &&
-            (temp_verify_result.has_md2 || temp_verify_result.has_md4 ||
-             temp_verify_result.has_md5 || temp_verify_result.has_sha1);
+            IsWeakChainBasedOnHashingAlgorithms(temp_chain, temp_chain_info);
       }
       // Set the result to the current chain if:
       // - This is the first verification attempt. This ensures that if
       //   everything is awful (e.g. it may just be an untrusted cert), that
       //   what is reported is exactly what was sent by the server
       // - If the current chain is trusted, and the old chain was not trusted,
       //   then prefer this chain. This ensures that if there is at least a
       //   valid path to a trust anchor, it's preferred over reporting an error.
       // - If the current chain is trusted, and the old chain is trusted, but
       //   the old chain contained weak algorithms while the current chain only
@@ skipping 24 matching lines @@
       break;
   }
 
   if (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED)
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
 
   if (*completed_chain_crl_result == kCRLSetRevoked)
     verify_result->cert_status |= CERT_STATUS_REVOKED;
 
   if (CFArrayGetCount(completed_chain) > 0) {
-    bool leaf_is_weak_unused = false;
-    GetCertChainInfo(completed_chain, chain_info, verify_result,
-                     &leaf_is_weak_unused);
+    CopyCertChainToVerifyResult(completed_chain, verify_result);
   }
 
   // As of Security Update 2012-002/OS X 10.7.4, when an RSA key < 1024 bits
   // is encountered, CSSM returns CSSMERR_TP_VERIFY_ACTION_FAILED and adds
   // CSSMERR_CSP_UNSUPPORTED_KEY_SIZE as a certificate status. Avoid mapping
   // the CSSMERR_TP_VERIFY_ACTION_FAILED to CERT_STATUS_INVALID if the only
   // error was due to an unsupported key size.
   bool policy_failed = false;
   bool policy_fail_already_mapped = false;
   bool weak_key_or_signature_algorithm = false;
@@ skipping 192 matching lines @@
     // EV cert and it was covered by CRLSets or revocation checking passed.
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
 
   return OK;
 }
 
 }  // namespace net
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"