Check whether or not a certificate is self-signed.

net/cert/x509_certificate_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/bytestring.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
 #include <openssl/sha.h>
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
 
 #include "base/memory/singleton.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/pickle.h"
 #include "base/sha1.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 #include "crypto/openssl_util.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/cert/x509_util_openssl.h"
 
 #if defined(OS_ANDROID)
 #include "base/logging.h"
 #include "net/android/network_library.h"
 #endif
 
 namespace net {
 
 namespace {
 
 typedef crypto::ScopedOpenSSL<GENERAL_NAMES, GENERAL_NAMES_free>::Type
     ScopedGENERAL_NAMES;
+typedef crypto::ScopedOpenSSL<X509, X509_free>::Type ScopedX509;
 
 void CreateOSCertHandlesFromPKCS7Bytes(
     const char* data, int length,
     X509Certificate::OSCertHandles* handles) {
   crypto::EnsureOpenSSLInit();
   crypto::OpenSSLErrStackTracer err_cleaner(FROM_HERE);
 
   CBS der_data;
   CBS_init(&der_data, reinterpret_cast<const uint8_t*>(data), length);
   STACK_OF(X509)* certs = sk_X509_new_null();
@@ skipping 393 matching lines @@
       X509_NAME* issuer = sk_X509_NAME_value(issuer_names.get(), m);
       if (X509_NAME_cmp(issuer, cert_names[n]) == 0) {
         return true;
       }
     }
   }
 
   return false;
 }
 
+// static
+bool X509Certificate::IsSelfSigned(OSCertHandle cert_handle) {
+  std::string der_cert;
+  if (!GetDEREncoded(cert_handle, &der_cert))
+    return false;
+
+  const unsigned char* cert_data =
+      reinterpret_cast<const unsigned char*>(der_cert.data());
+  int cert_data_len = base::checked_cast<int>(der_cert.size());
+  ScopedX509 cert(d2i_X509(NULL, &cert_data, cert_data_len));

[Ryan Sleevi, 2014/10/24 22:56:24]

Why do you do this round-trip? |cert_handle| is an X509*

[palmer, 2014/10/24 23:32:46]

Done.

+  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert_handle));
+  if (!scoped_key)
+    return false;
+  DCHECK(scoped_key.get());

[Ryan Sleevi, 2014/10/24 22:56:24]

Unnecessary - you just handled it on 465/466, so don't DCHECK here

[palmer, 2014/10/24 23:32:46]

Done.

+  EVP_PKEY* key = scoped_key.get();

[Ryan Sleevi, 2014/10/24 22:56:24]

Unnecessary temporary? Just use scoped_key.get() on 471?

[palmer, 2014/10/24 23:32:46]

Done.

+
+  // NOTE: X509_verify() returns 1 in case of success, 0 or -1 on error.
+  return X509_verify(cert.get(), key) == 1;
+}
+
 }  // namespace net