Detect SHA-1 when it appears in certificate chains

net/cert/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_openssl.h"
 
 #include <openssl/x509v3.h>
 
 #include <string>
 #include <vector>
@@ skipping 99 matching lines @@
     }
 
     // Only check the algorithm status for certificates that are not in the
     // trust store.
     if (i < static_cast<size_t>(store_ctx->last_untrusted)) {
       int sig_alg = OBJ_obj2nid(cert->sig_alg->algorithm);
       if (sig_alg == NID_md2WithRSAEncryption) {
         verify_result->has_md2 = true;
       } else if (sig_alg == NID_md4WithRSAEncryption) {
         verify_result->has_md4 = true;
-      } else if (sig_alg == NID_md5WithRSAEncryption) {
+      } else if (sig_alg == NID_md5WithRSAEncryption ||
+                 sig_alg == NID_md5WithRSA) {
         verify_result->has_md5 = true;
+      } else if (sig_alg == NID_sha1WithRSAEncryption ||
+                 sig_alg == NID_dsaWithSHA || sig_alg == NID_dsaWithSHA1 ||
+                 sig_alg == NID_dsaWithSHA1_2 || sig_alg == NID_sha1WithRSA ||

[davidben, 2014/08/28 19:42:08]

Aside: BoringSSL actually can't verify DSA signatures at all right now, and the
DSA-based cipher suites have been removed. If we're using some external
certificate validator, I'm not sure whether or not it would fail the handshake
if the leaf were RSA, but something up the chain was DSA.

Strictly speaking, an SSL implementation shouldn't care in that case, but I
could believe that it would fail trying to parse into an X509* or something.

[Ryan Sleevi, 2014/09/26 20:18:43]

Right, I'm fairly certain it will be an error beforehand.

+                 sig_alg == NID_ecdsa_with_SHA1) {
+        verify_result->has_sha1 = true;
       }
     }
   }
 
   // Set verify_result->verified_cert and
   // verify_result->is_issued_by_known_root.
   if (verified_cert) {
     verify_result->verified_cert =
         X509Certificate::CreateFromHandle(verified_cert, verified_chain);
 
@@ skipping 100 matching lines @@
 
   GetCertChainInfo(ctx.get(), verify_result);
   AppendPublicKeyHashes(ctx.get(), &verify_result->public_key_hashes);
   if (IsCertStatusError(verify_result->cert_status))
     return MapCertStatusToNetError(verify_result->cert_status);
 
   return OK;
 }
 
 }  // namespace net