Remove certificates from Channel ID

net/cert/x509_util_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_nss.h"
 
 #include <cert.h>  // Must be included before certdb.h
 #include <certdb.h>
 #include <cryptohi.h>
@@ skipping 58 matching lines @@
   memset(&oid_data, 0, sizeof(oid_data));
   oid_data.oid.data = const_cast<uint8*>(kObCertOID);
   oid_data.oid.len = sizeof(kObCertOID);
   oid_data.offset = SEC_OID_UNKNOWN;
   oid_data.desc = "Origin Bound Certificate";
   oid_data.mechanism = CKM_INVALID_MECHANISM;
   oid_data.supportedExtension = SUPPORTED_CERT_EXTENSION;
   domain_bound_cert_oid_tag_ = SECOID_AddEntry(&oid_data);
   if (domain_bound_cert_oid_tag_ == SEC_OID_UNKNOWN)
     LOG(ERROR) << "OB_CERT OID tag creation failed";
 }

[Ryan Sleevi, 2015/04/15 22:50:02]

This is all now dead code

[nharper, 2015/04/25 02:59:19]

Done.

 
 // Creates a Certificate object that may be passed to the SignCertificate
 // method to generate an X509 certificate.
 // Returns NULL if an error is encountered in the certificate creation
 // process.
 // Caller responsible for freeing returned certificate object.
 CERTCertificate* CreateCertificate(
     SECKEYPublicKey* public_key,
     const std::string& subject,
     uint32 serial_number,
@@ skipping 162 matching lines @@
 
 bool CreateSelfSignedCert(crypto::RSAPrivateKey* key,
                           DigestAlgorithm alg,
                           const std::string& subject,
                           uint32 serial_number,
                           base::Time not_valid_before,
                           base::Time not_valid_after,
                           std::string* der_cert) {
   DCHECK(key);
   DCHECK(!strncmp(subject.c_str(), "CN=", 3U));
   CERTCertificate* cert = CreateCertificate(key->public_key(),

[Ryan Sleevi, 2015/04/15 22:50:02]

Should |CreateCertificate| be folded into this? Does it make sense to have a
distinct function?

[nharper, 2015/04/25 02:59:19]

I like keeping it the way it is. CreateCertificate is a rather lengthy function,
and keeping it as 2 functions separates out the creating a certificate part with
signing the certificate. If CreateCertificate were to be folded in, then it
would also make sense to fold in SignCertificate (since this is the only place
that uses SignCertificate). I think it's cleaner to keep the functions smaller
and more focused, even if it's only being called from one place.

                                             subject,
                                             serial_number,
                                             not_valid_before,
                                             not_valid_after);
   if (!cert)
     return false;
 
   if (!SignCertificate(cert, key->key(), ToSECOid(alg))) {
     CERT_DestroyCertificate(cert);
     return false;
@@ skipping 11 matching lines @@
       crypto::BaseTimeToPRTime(not_valid_before),
       crypto::BaseTimeToPRTime(not_valid_after));
 
   if (!validity)
     return false;
 
   CERT_DestroyValidity(validity);
   return true;
 }
 
-bool CreateChannelIDEC(crypto::ECPrivateKey* key,
-                       DigestAlgorithm alg,
-                       const std::string& domain,
-                       uint32 serial_number,
-                       base::Time not_valid_before,
-                       base::Time not_valid_after,
-                       std::string* der_cert) {
-  DCHECK(key);
-
-  CERTCertificate* cert = CreateCertificate(key->public_key(),
-                                            "CN=anonymous.invalid",
-                                            serial_number,
-                                            not_valid_before,
-                                            not_valid_after);
-
-  if (!cert)
-    return false;
-
-  // Create opaque handle used to add extensions later.
-  void* cert_handle;
-  if ((cert_handle = CERT_StartCertExtensions(cert)) == NULL) {
-    LOG(ERROR) << "Unable to get opaque handle for adding extensions";
-    CERT_DestroyCertificate(cert);
-    return false;
-  }
-
-  // Create SECItem for IA5String encoding.
-  SECItem domain_string_item = {
-    siAsciiString,
-    (unsigned char*)domain.data(),
-    static_cast<unsigned>(domain.size())
-  };
-
-  // IA5Encode and arena allocate SECItem
-  SECItem* asn1_domain_string = SEC_ASN1EncodeItem(
-      cert->arena, NULL, &domain_string_item,
-      SEC_ASN1_GET(SEC_IA5StringTemplate));
-  if (asn1_domain_string == NULL) {
-    LOG(ERROR) << "Unable to get ASN1 encoding for domain in domain_bound_cert"
-                  " extension";
-    CERT_DestroyCertificate(cert);
-    return false;
-  }
-
-  // Add the extension to the opaque handle
-  if (CERT_AddExtension(
-      cert_handle,
-      ChannelIDOIDWrapper::GetInstance()->domain_bound_cert_oid_tag(),
-      asn1_domain_string,
-      PR_TRUE,
-      PR_TRUE) != SECSuccess){
-    LOG(ERROR) << "Unable to add domain bound cert extension to opaque handle";
-    CERT_DestroyCertificate(cert);
-    return false;
-  }
-
-  // Copy extension into x509 cert
-  if (CERT_FinishExtensions(cert_handle) != SECSuccess){
-    LOG(ERROR) << "Unable to copy extension to X509 cert";
-    CERT_DestroyCertificate(cert);
-    return false;
-  }
-
-  if (!SignCertificate(cert, key->key(), ToSECOid(alg))) {
-    CERT_DestroyCertificate(cert);
-    return false;
-  }
-
-  DCHECK(cert->derCert.len);
-  // XXX copied from X509Certificate::GetDEREncoded
-  der_cert->clear();
-  der_cert->append(reinterpret_cast<char*>(cert->derCert.data),
-                   cert->derCert.len);
-  CERT_DestroyCertificate(cert);
-  return true;
-}
-
 #if defined(USE_NSS) || defined(OS_IOS)
 void ParsePrincipal(CERTName* name, CertPrincipal* principal) {
 // Starting in NSS 3.15, CERTGetNameFunc takes a const CERTName* argument.
 #if NSS_VMINOR >= 15
   typedef char* (*CERTGetNameFunc)(const CERTName* name);
 #else
   typedef char* (*CERTGetNameFunc)(CERTName* name);
 #endif
 
   // TODO(jcampan): add business_category and serial_number.
@@ skipping 248 matching lines @@
   }
 
   return new_name;
 }
 
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 } // namespace x509_util
 
 } // namespace net