Remove net::ParsedCertificate struct.

net/cert/internal/verify_certificate_chain.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include <memory>
 
 #include "base/logging.h"
 #include "net/cert/internal/name_constraints.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/internal/signature_policy.h"
 #include "net/cert/internal/verify_name_match.h"
 #include "net/cert/internal/verify_signed_data.h"
 #include "net/der/input.h"
 #include "net/der/parser.h"
 
 namespace net {
 
 namespace {
 
 // Map from OID to ParsedExtension.
 using ExtensionsMap = std::map<der::Input, ParsedExtension>;
 
 // Describes all parsed properties of a certificate that are relevant for
 // certificate verification.
 struct FullyParsedCert {
-  ParsedCertificate cert;
+  der::Input tbs_certificate_tlv;
+  der::Input signature_algorithm_tlv;
+  der::BitString signature_value;
   ParsedTbsCertificate tbs;
 
   std::unique_ptr<SignatureAlgorithm> signature_algorithm;
 
   // Standard extensions that were parsed.
   bool has_basic_constraints = false;
   ParsedBasicConstraints basic_constraints;
 
   bool has_key_usage = false;
   der::BitString key_usage;
@@ skipping 37 matching lines @@
                                          der::Input* value) {
   der::Parser parser(tlv);
   return parser.ReadTag(der::kSequence, value) && !parser.HasMore();
 }
 
 // Parses an X.509 Certificate fully (including the TBSCertificate and
 // standard extensions), saving all the properties to |out_|.
 WARN_UNUSED_RESULT bool FullyParseCertificate(const der::Input& cert_tlv,
                                               FullyParsedCert* out) {
   // Parse the outer Certificate.
-  if (!ParseCertificate(cert_tlv, &out->cert))
+  if (!ParseCertificate(cert_tlv, &out->tbs_certificate_tlv,
+                        &out->signature_algorithm_tlv, &out->signature_value))
     return false;
 
   // Parse the signature algorithm contained in the Certificate (there is
   // another one in the TBSCertificate, which is checked later by
   // VerifySignatureAlgorithmsMatch)
   out->signature_algorithm =
-      SignatureAlgorithm::CreateFromDer(out->cert.signature_algorithm_tlv);
+      SignatureAlgorithm::CreateFromDer(out->signature_algorithm_tlv);
   if (!out->signature_algorithm)
     return false;
 
   // Parse the TBSCertificate.
-  if (!ParseTbsCertificate(out->cert.tbs_certificate_tlv, &out->tbs))
+  if (!ParseTbsCertificate(out->tbs_certificate_tlv, &out->tbs))
     return false;
 
   // Reset state relating to extensions (which may not get overwritten). This is
   // just a precaution, since in practice |out| will already be default
   // initialize.
   out->has_basic_constraints = false;
   out->has_key_usage = false;
   out->unconsumed_extensions.clear();
   out->subject_alt_names.reset();
   out->has_name_constraints = false;
@@ skipping 127 matching lines @@
 //
 // The spec is not explicit about what "the same algorithm identifier" means.
 // Our interpretation is that the two DER-encoded fields must be byte-for-byte
 // identical.
 //
 // In practice however there are certificates which use different encodings for
 // specifying RSA with SHA1 (different OIDs). This is special-cased for
 // compatibility sake.
 WARN_UNUSED_RESULT bool VerifySignatureAlgorithmsMatch(
     const FullyParsedCert& cert) {
-  const der::Input& alg1_tlv = cert.cert.signature_algorithm_tlv;
+  const der::Input& alg1_tlv = cert.signature_algorithm_tlv;
   const der::Input& alg2_tlv = cert.tbs.signature_algorithm_tlv;
 
   // Ensure that the two DER-encoded signature algorithms are byte-for-byte
   // equal, but make a compatibility concession for RSA with SHA1.
   return alg1_tlv == alg2_tlv || (IsRsaWithSha1SignatureAlgorithm(alg1_tlv) &&
                                   IsRsaWithSha1SignatureAlgorithm(alg2_tlv));
 }
 
 // This function corresponds to RFC 5280 section 6.1.3's "Basic Certificate
 // Processing" procedure.
@@ skipping 14 matching lines @@
         name_constraints_list) {
   // Check that the signature algorithms in Certificate vs TBSCertificate
   // match. This isn't part of RFC 5280 section 6.1.3, but is mandated by
   // sections 4.1.1.2 and 4.1.2.3.
   if (!VerifySignatureAlgorithmsMatch(cert))
     return false;
 
   // Verify the digital signature using the previous certificate's key (RFC
   // 5280 section 6.1.3 step a.1).
   if (!skip_issuer_checks) {
-    if (!VerifySignedData(
-            *cert.signature_algorithm, cert.cert.tbs_certificate_tlv,
-            cert.cert.signature_value, working_spki, signature_policy)) {
+    if (!VerifySignedData(*cert.signature_algorithm, cert.tbs_certificate_tlv,
+                          cert.signature_value, working_spki,
+                          signature_policy)) {
       return false;
     }
   }
 
   // Check the time range for the certificate's validity, ensuring it is valid
   // at |time|.
   // (RFC 5280 section 6.1.3 step a.2)
   if (!VerifyTimeValidity(cert, time))
     return false;
 
@@ skipping 213 matching lines @@
       result->cert_data_.assign(data, data + length);
       result->cert_ =
           der::Input(result->cert_data_.data(), result->cert_data_.size());
       break;
     case DataSource::EXTERNAL_REFERENCE:
       result->cert_ = der::Input(data, length);
       break;
   }
 
   // Parse the certificate to get its name.
-  ParsedCertificate cert;
-  if (!ParseCertificate(result->cert(), &cert))
+  der::Input tbs_certificate_tlv;
+  der::Input signature_algorithm_tlv;
+  der::BitString signature_value;
+  if (!ParseCertificate(result->cert(), &tbs_certificate_tlv,
+                        &signature_algorithm_tlv, &signature_value))
     return nullptr;
 
   ParsedTbsCertificate tbs;
-  if (!ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs))
+  if (!ParseTbsCertificate(tbs_certificate_tlv, &tbs))
     return nullptr;
 
   result->name_ = tbs.subject_tlv;
 
   // TODO(eroman): If adding a self-signed certificate, check that its
   // signature is correct? This check will not otherwise be done during
   // verification.
 
   return result;
 }
@@ skipping 187 matching lines @@
     return false;
 
   // Check if the current root certificate is trusted. If it is then no
   // extra work is needed.
   if (trust_store.IsTrustedCertificate(certs_der_trusted_root->back()))
     return true;
 
   // Otherwise if it is not trusted, check whether its issuer is trusted. If
   // so, make *that* trusted certificate the root. If the issuer is not in
   // the trust store then give up and fail (this is not full path building).
-  ParsedCertificate cert;
+  der::Input tbs_certificate_tlv;
+  der::Input signature_algorithm_tlv;
+  der::BitString signature_value;
   ParsedTbsCertificate tbs;
-  if (!ParseCertificate(certs_der.back(), &cert) ||
-      !ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs)) {
+  if (!ParseCertificate(certs_der.back(), &tbs_certificate_tlv,
+                        &signature_algorithm_tlv, &signature_value) ||
+      !ParseTbsCertificate(tbs_certificate_tlv, &tbs)) {
     return false;
   }
 
   auto trust_anchor = trust_store.FindTrustAnchorByName(tbs.issuer_tlv);
   if (!trust_anchor)
     return false;
   certs_der_trusted_root->push_back(trust_anchor->cert());
   return true;
 }
 
 }  // namespace
 
 bool VerifyCertificateChain(const std::vector<der::Input>& certs_der,
                             const TrustStore& trust_store,
                             const SignaturePolicy* signature_policy,
                             const der::GeneralizedTime& time) {
   // Modify the certificate chain so that its root is a trusted certificate.
   std::vector<der::Input> certs_der_trusted_root;
   if (!BuildSimplePathToTrustAnchor(certs_der, trust_store,
                                     &certs_der_trusted_root)) {
     return false;
   }
 
   // Verify the chain.
   return VerifyCertificateChainAssumingTrustedRoot(
       certs_der_trusted_root, trust_store, signature_policy, time);
 }
 
 }  // namespace net