Add support for MD2, MD4, and MD5 to SignatureAlgorithm.

net/cert/internal/signature_policy.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/signature_policy.h"
 
 #include "base/logging.h"
 #include "net/cert/internal/cert_error_params.h"
 #include "net/cert/internal/cert_errors.h"
 #include "third_party/boringssl/src/include/openssl/obj.h"
@@ skipping 16 matching lines @@
     return false;
   }
   return true;
 }
 
 }  // namespace
 
 bool SignaturePolicy::IsAcceptableSignatureAlgorithm(
     const SignatureAlgorithm& algorithm,
     CertErrors* errors) const {
+  // Don't allow MD2, MD4, or MD5.

[Ryan Sleevi, 2017/03/07 20:26:34]

Is this comment in the wrong place?

+  switch (algorithm.algorithm()) {
+    case SignatureAlgorithmId::Ecdsa:
+    case SignatureAlgorithmId::RsaPss:
+    case SignatureAlgorithmId::RsaPkcs1:
+      break;
+  }

[Ryan Sleevi, 2017/03/07 20:26:34]

It's unclear the purpose of this switch (I suspect to get explicit compiler
errors for new algorithms; if so, spell that out?)

[eroman, 2017/03/07 20:41:06]

Thanks.

I have improved the organization and code duplication.

+
+  switch (algorithm.digest()) {
+    case DigestAlgorithm::Md2:
+    case DigestAlgorithm::Md4:
+    case DigestAlgorithm::Md5:
+      return false;
+
+    case DigestAlgorithm::Sha1:
+    case DigestAlgorithm::Sha256:
+    case DigestAlgorithm::Sha384:
+    case DigestAlgorithm::Sha512:
+      break;
+  }
+
+  if (algorithm.ParamsForRsaPss()) {
+    switch (algorithm.ParamsForRsaPss()->mgf1_hash()) {
+      case DigestAlgorithm::Md2:
+      case DigestAlgorithm::Md4:
+      case DigestAlgorithm::Md5:
+        return false;
+
+      case DigestAlgorithm::Sha1:
+      case DigestAlgorithm::Sha256:
+      case DigestAlgorithm::Sha384:
+      case DigestAlgorithm::Sha512:
+        break;
+    }
+  }
+
   return true;
 }
 
 bool SignaturePolicy::IsAcceptableCurveForEcdsa(int curve_nid,
                                                 CertErrors* errors) const {
   switch (curve_nid) {
     case NID_X9_62_prime256v1:
     case NID_secp384r1:
     case NID_secp521r1:
       return true;
@@ skipping 13 matching lines @@
     : min_rsa_modulus_length_bits_(min_rsa_modulus_length_bits) {}
 
 bool SimpleSignaturePolicy::IsAcceptableModulusLengthForRsa(
     size_t modulus_length_bits,
     CertErrors* errors) const {
   return IsModulusSizeGreaterOrEqual(modulus_length_bits,
                                      min_rsa_modulus_length_bits_, errors);
 }
 
 }  // namespace net