move X509Certificate::SupportsSSLClientAuth to client_cert_store_mac.cc

net/cert/x509_certificate_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 95 matching lines @@
   OSStatus status = cached_cert.GetField(&CSSMOID_X509V1SerialNumber,
                                          &serial_number);
   if (status || !serial_number.field())
     return std::string();
 
   return std::string(
       reinterpret_cast<const char*>(serial_number.field()->Data),
       serial_number.field()->Length);
 }
 
-// Returns true if |purpose| is listed as allowed in |usage|. This
-// function also considers the "Any" purpose. If the attribute is
-// present and empty, we return false.
-bool ExtendedKeyUsageAllows(const CE_ExtendedKeyUsage* usage,
-                            const CSSM_OID* purpose) {
-  for (unsigned p = 0; p < usage->numPurposes; ++p) {
-    if (CSSMOIDEqual(&usage->purposes[p], purpose))
-      return true;
-    if (CSSMOIDEqual(&usage->purposes[p], &CSSMOID_ExtendedKeyUsageAny))
-      return true;
-  }
-  return false;
-}
-
 // Test that a given |cert_handle| is actually a valid X.509 certificate, and
 // return true if it is.
 //
 // On OS X, SecCertificateCreateFromData() does not return any errors if
 // called with invalid data, as long as data is present. The actual decoding
 // of the certificate does not happen until an API that requires a CSSM
 // handle is called. While SecCertificateGetCLHandle is the most likely
 // candidate, as it performs the parsing, it does not check whether the
 // parsing was actually successful. Instead, SecCertificateGetSubject is
 // used (supported since 10.3), as a means to check that the certificate
@@ skipping 251 matching lines @@
     OSStatus status = SecCertificateGetData(intermediates[i], &cert_data);
     if (status)
       return sha256;
     CC_SHA256_Update(&sha256_ctx, cert_data.Data, cert_data.Length);
   }
   CC_SHA256_Final(sha256.data, &sha256_ctx);
 
   return sha256;
 }
 
-bool X509Certificate::SupportsSSLClientAuth() const {
-  x509_util::CSSMCachedCertificate cached_cert;
-  OSStatus status = cached_cert.Init(cert_handle_);
-  if (status)
-    return false;
-
-  // RFC5280 says to take the intersection of the two extensions.
-  //
-  // Our underlying crypto libraries don't expose
-  // ClientCertificateType, so for now we will not support fixed
-  // Diffie-Hellman mechanisms. For rsa_sign, we need the
-  // digitalSignature bit.
-  //
-  // In particular, if a key has the nonRepudiation bit and not the
-  // digitalSignature one, we will not offer it to the user.
-  x509_util::CSSMFieldValue key_usage;
-  status = cached_cert.GetField(&CSSMOID_KeyUsage, &key_usage);
-  if (status == CSSM_OK && key_usage.field()) {
-    const CSSM_X509_EXTENSION* ext = key_usage.GetAs<CSSM_X509_EXTENSION>();
-    const CE_KeyUsage* key_usage_value =
-        reinterpret_cast<const CE_KeyUsage*>(ext->value.parsedValue);
-    if (!((*key_usage_value) & CE_KU_DigitalSignature))
-      return false;
-  }
-
-  status = cached_cert.GetField(&CSSMOID_ExtendedKeyUsage, &key_usage);
-  if (status == CSSM_OK && key_usage.field()) {
-    const CSSM_X509_EXTENSION* ext = key_usage.GetAs<CSSM_X509_EXTENSION>();
-    const CE_ExtendedKeyUsage* ext_key_usage =
-        reinterpret_cast<const CE_ExtendedKeyUsage*>(ext->value.parsedValue);
-    if (!ExtendedKeyUsageAllows(ext_key_usage, &CSSMOID_ClientAuth))
-      return false;
-  }
-  return true;
-}
-
 CFMutableArrayRef X509Certificate::CreateOSCertChainForCert() const {
   CFMutableArrayRef cert_list =
       CFArrayCreateMutable(kCFAllocatorDefault, 0,
                            &kCFTypeArrayCallBacks);
   if (!cert_list)
     return NULL;
 
   CFArrayAppendValue(cert_list, os_cert_handle());
   for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i)
     CFArrayAppendValue(cert_list, intermediate_ca_certs_[i]);
@@ skipping 104 matching lines @@
     return false;
 
   if (CSSM_CL_CertVerify(cl_handle, 0, &cert_data, &cert_data, NULL, 0))
     return false;
   return true;
 }
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace net