Refactor TransportSecurityState.

net/base/x509_certificate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 #pragma once
 
 #include <string.h>
 
@@ skipping 225 matching lines @@
   const base::Time& valid_expiry() const { return valid_expiry_; }
 
   // The fingerprint of this certificate.
   const SHA1Fingerprint& fingerprint() const { return fingerprint_; }
 
   // The fingerprint of the intermediate CA certificates.
   const SHA1Fingerprint& ca_fingerprint() const {
     return ca_fingerprint_;
   }
 
+  // Parses |cert|'s Subject Public Key Info structure, hashes it, and
+  // returns the hash.
+  const SHA1Fingerprint GetPublicKeyHash() const;

[Ryan Sleevi, 2012/03/15 03:51:15]

No need to "const SHA1Fingerprint" since you're returning a copy/newly allocated
structure (it would only be necessary if it was stored as a member variable)

Although I think you mentioned you were staticizing this, which is good.

[palmer, 2012/03/19 23:37:52]

Done.

+
   // Gets the DNS names in the certificate.  Pursuant to RFC 2818, Section 3.1
   // Server Identity, if the certificate has a subjectAltName extension of
   // type dNSName, this method gets the DNS names in that extension.
   // Otherwise, it gets the common name in the subject field.
   void GetDNSNames(std::vector<std::string>* dns_names) const;
 
   // Gets the subjectAltName extension field from the certificate, if any.
   // For future extension; currently this only returns those name types that
   // are required for HTTP certificate name verification - see VerifyHostname.
   // Unrequired parameters may be passed as NULL.
@@ skipping 298 matching lines @@
   // certificate handle. The format of the certificate stored in |pickle| is
   // not guaranteed to be the same across different underlying cryptographic
   // libraries, nor acceptable to CreateFromBytes(). Returns an invalid
   // handle, NULL, on failure.
   static OSCertHandle ReadOSCertHandleFromPickle(const Pickle& pickle,
                                                  PickleIterator* pickle_iter);
 
   // Writes a single certificate to |pickle|. Returns false on failure.
   static bool WriteOSCertHandleToPickle(OSCertHandle handle, Pickle* pickle);
 
+  // Parses |side_info| as a side pin. If successful, returns true and
+  // appends the hash of the public key that signed |leaf_spki| to
+  // |*out_pub_key_hash|.
+  //
+  // A side pin is a way for a site to sign their public key with a key that
+  // is offline but still controlled by them.
+  //
+  // TODO(agl): Document the format of a side pin.
+  static bool ParseSidePin(const base::StringPiece& leaf_spki,
+                           const base::StringPiece& side_info,
+                           FingerprintVector* out_pub_key_hash);

[Ryan Sleevi, 2012/03/15 03:51:15]

So I think this would be better in TSS (or something like it).

My comment about adding an X509Certificate accessor was related to the
net/socket/ssl_client_socket_nss.cc parsing (which can be a separate CL than
this).

There, I was suggesting something like

static bool GetSidePin(OSCertHandle handle,
                       std::string* side_pin);

Where GetSidePin() handles the locating of the OID in the cert extensions array
(1.3.6.1.4.1.11129.2.1.4) and grabbing that data.

The interpretation of that data can remain in TSS.

[palmer, 2012/03/19 23:37:52]

Done.

[agl, 2012/03/20 22:12:59]

Note: this side pinning stuff was just a roadmap for Moxie to put TACK in. Since
it doesn't look like he's going to be following it, it can just be removed.

[palmer, 2012/03/22 16:39:00]

Done.

+
   // The subject of the certificate.
   CertPrincipal subject_;
 
   // The issuer of the certificate.
   CertPrincipal issuer_;
 
   // This certificate is not valid before |valid_start_|
   base::Time valid_start_;
 
   // This certificate is not valid after |valid_expiry_|
@@ skipping 28 matching lines @@
   // (Marked mutable because it's used in a const method.)
   mutable base::Lock verification_lock_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_