Remove certificates from Channel ID

net/cert/x509_util_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util_openssl.h"
 
 #include <algorithm>
 #include <openssl/asn1.h>
 
 #include "base/lazy_instance.h"
@@ skipping 146 matching lines @@
   // Sign it with the private key.
   if (!X509_sign(cert, key, md)) {
     LOG(ERROR) << "Could not sign certificate with key.";
     return false;
   }
 
   // Convert it into a DER-encoded string copied to |der_encoded|.
   return DerEncodeCert(cert, der_encoded);
 }
 
-// There is no OpenSSL NID for the 'originBoundCertificate' extension OID yet,
-// so create a global ASN1_OBJECT lazily with the right parameters.
-class DomainBoundOid {
- public:
-  DomainBoundOid() : obj_(OBJ_txt2obj(kDomainBoundOidText, 1)) { CHECK(obj_); }
-
-  ~DomainBoundOid() {
-    if (obj_)
-      ASN1_OBJECT_free(obj_);
-  }
-
-  ASN1_OBJECT* obj() const { return obj_; }
-
- private:
-  static const char kDomainBoundOidText[];
-
-  ASN1_OBJECT* obj_;
-};
-
-// 1.3.6.1.4.1.11129.2.1.6
-// (iso.org.dod.internet.private.enterprises.google.googleSecurity.
-//  certificateExtensions.originBoundCertificate)
-const char DomainBoundOid::kDomainBoundOidText[] = "1.3.6.1.4.1.11129.2.1.6";
-
-ASN1_OBJECT* GetDomainBoundOid() {
-  static base::LazyInstance<DomainBoundOid>::Leaky s_lazy =
-      LAZY_INSTANCE_INITIALIZER;
-  return s_lazy.Get().obj();
-}
-
-
 struct DERCache {
   std::string data;
 };
 
 void DERCache_free(void* parent, void* ptr, CRYPTO_EX_DATA* ad, int idx,
                    long argl, void* argp) {
   DERCache* der_cache = static_cast<DERCache*>(ptr);
   delete der_cache;
 }
 
@@ skipping 44 matching lines @@
   const base::Time kYear10000 = kEpoch +
       base::TimeDelta::FromDays(kDaysFromUnixEpochToYear10000);
 
   if (not_valid_before < kYear0001 || not_valid_before >= kYear10000 ||
       not_valid_after < kYear0001 || not_valid_after >= kYear10000)
     return false;
 
   return true;
 }
 
-bool CreateChannelIDEC(
-    crypto::ECPrivateKey* key,
-    DigestAlgorithm alg,
-    const std::string& domain,
-    uint32 serial_number,
-    base::Time not_valid_before,
-    base::Time not_valid_after,
-    std::string* der_cert) {
-  crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
-  // Create certificate.
-  ScopedX509 cert(CreateCertificate(key->key(),
-                                    alg,
-                                    "CN=anonymous.invalid",
-                                    serial_number,
-                                    not_valid_before,
-                                    not_valid_after));
-  if (!cert.get())
-    return false;
-
-  // Add TLS-Channel-ID extension to the certificate before signing it.
-  // The value must be stored DER-encoded, as a ASN.1 IA5String.
-  ScopedASN1_STRING domain_ia5(ASN1_IA5STRING_new());
-  if (!domain_ia5.get() ||
-      !ASN1_STRING_set(domain_ia5.get(), domain.data(), domain.size()))
-    return false;
-
-  std::string domain_der;
-  int domain_der_len = i2d_ASN1_IA5STRING(domain_ia5.get(), NULL);
-  if (domain_der_len < 0)
-    return false;
-
-  domain_der.resize(domain_der_len);
-  unsigned char* domain_der_data =
-      reinterpret_cast<unsigned char*>(&domain_der[0]);
-  if (i2d_ASN1_IA5STRING(domain_ia5.get(), &domain_der_data) < 0)
-    return false;
-
-  ScopedASN1_OCTET_STRING domain_str(ASN1_OCTET_STRING_new());
-  if (!domain_str.get() ||
-      !ASN1_STRING_set(domain_str.get(), domain_der.data(), domain_der.size()))
-    return false;
-
-  ScopedX509_EXTENSION ext(X509_EXTENSION_create_by_OBJ(
-      NULL, GetDomainBoundOid(), 1 /* critical */, domain_str.get()));
-  if (!ext.get() || !X509_add_ext(cert.get(), ext.get(), -1)) {
-    return false;
-  }
-
-  // Sign and encode it.
-  return SignAndDerEncodeCert(cert.get(), key->key(), alg, der_cert);
-}
-
 bool CreateSelfSignedCert(crypto::RSAPrivateKey* key,
                           DigestAlgorithm alg,
                           const std::string& common_name,
                           uint32 serial_number,
                           base::Time not_valid_before,
                           base::Time not_valid_after,
                           std::string* der_encoded) {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
   ScopedX509 cert(CreateCertificate(key->key(),

[Ryan Sleevi, 2015/04/15 22:50:02]

Ditto here - do we still need a distinct function?

[nharper, 2015/04/25 02:59:19]

See my argument on the other thread for why it's cleaner code to keep
CreateCertificate and SignAndDerEncodeCert around instead of rolling it all up.

                                     alg,
                                     common_name,
                                     serial_number,
                                     not_valid_before,
                                     not_valid_after));
   if (!cert.get())
     return false;
 
   return SignAndDerEncodeCert(cert.get(), key->key(), alg, der_encoded);
 }
@@ skipping 79 matching lines @@
     internal_cache = new_cache.get();
     X509_set_ex_data(x509, x509_der_cache_index, new_cache.release());
   }
   *der_cache = base::StringPiece(internal_cache->data);
   return true;
 }
 
 }  // namespace x509_util
 
 }  // namespace net