Extract Certificate Transparency SCTs from stapled OCSP responses

net/cert/ct_objects_extractor_nss.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_objects_extractor.h"
 
 #include <cert.h>
 #include <secasn1.h>
 #include <secitem.h>
 #include <secoid.h>
@@ skipping 251 matching lines @@
   std::string encoded;
   if (!X509Certificate::GetDEREncoded(leaf, &encoded))
     return false;
 
   result->Reset();
   result->type = ct::LogEntry::LOG_ENTRY_TYPE_X509;
   result->leaf_certificate.swap(encoded);
   return true;
 }
 
+bool ExtractSCTListFromOCSPResponse(X509Certificate::OSCertHandle leaf,
+                                    const std::string& ocsp_response,
+                                    std::string* sct_list) {
+  DCHECK(leaf);
+  NSSCertWrapper leaf_cert(leaf);
+  sct_list->clear();
+  base::StringPiece serial_number = base::StringPiece(
+      reinterpret_cast<char*>(leaf_cert.cert->serialNumber.data),
+      leaf_cert.cert->serialNumber.len);
+  base::StringPiece ocsp_resp(ocsp_response);

[wtc, 2013/12/03 01:18:06]

Nit: it should be OK to just pass |ocsp_response|.

[ekasper, 2013/12/03 13:50:51]

Done.

+  base::StringPiece sct_list_out;
+  if (!asn1::ExtractSCTExtensionFromOCSPResponse(ocsp_resp,
+                                                 serial_number,
+                                                 &sct_list_out))
+    return false;
+
+  *sct_list = std::string(sct_list_out.data(), sct_list_out.size());

[wtc, 2013/12/03 01:18:06]

Nit: you can use the as_string() method:
  *sct_list = sct_list_out.as_string();

[ekasper, 2013/12/03 13:50:51]

Done.

+  return true;
+}
+
 }  // namespace ct
 
 }  // namespace net