Detect SHA-1 when it appears in certificate chains

net/cert/cert_verify_proc_nss.cc

Index: net/cert/cert_verify_proc_nss.cc
diff --git a/net/cert/cert_verify_proc_nss.cc b/net/cert/cert_verify_proc_nss.cc
index bd5232cf2821dc186e0672bd3351ae29a38490b9..1236f41dda43036f5a76343710f1cc8938bafaaa 100644
--- a/net/cert/cert_verify_proc_nss.cc
+++ b/net/cert/cert_verify_proc_nss.cc
@@ -203,6 +203,12 @@ void GetCertChainInfo(CERTCertList* cert_list,
       case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:
         verify_result->has_md4 = true;
         break;
+      case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION:
+      case SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE:
+      case SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST:

[davidben, 2014/08/28 19:42:08]

The other cases all list out three DSA OIDs and this only lists one. Poking
around MXR, I also see SEC_OID_BOGUS_DSA_SIGNATURE_WITH_SHA1_DIGEST and
SEC_OID_SDN702_DSA_SIGNATURE.

Looks like...
SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST is NID_dsaWithSHA1
SEC_OID_BOGUS_DSA_SIGNATURE_WITH_SHA1_DIGEST is NID_dsaWithSHA1_2
SEC_OID_SDN702_DSA_SIGNATURE is NID_dsaWithSHA

And then there's SEC_OID_ANSIX9_DSA_SIGNATURE (NID_dsa_2), but that doesn't seem
to specify a hash?

[Ryan Sleevi, 2014/09/26 20:18:42]

None of these come up within NSS. Plus, DSS...

+      case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE:
+        verify_result->has_sha1 = true;
+        break;
       default:
         break;
     }