Extract Certificate Transparency SCTs from stapled OCSP responses

net/cert/asn1_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_ASN1_UTIL_H_
 #define NET_CERT_ASN1_UTIL_H_
 
 #include <vector>
 
 #include "base/strings/string_piece.h"
 #include "net/base/net_export.h"
 
 namespace net {
 
 namespace asn1 {
 
 // These are the DER encodings of the tag byte for ASN.1 objects.
 static const unsigned kBOOLEAN = 0x01;
 static const unsigned kINTEGER = 0x02;
 static const unsigned kBITSTRING = 0x03;
 static const unsigned kOCTETSTRING = 0x04;
 static const unsigned kOID = 0x06;
+static const unsigned kENUMERATED = 0x0a;
+static const unsigned kGENERALIZEDTIME = 0x18;
 static const unsigned kSEQUENCE = 0x30;
 
 // These are flags that can be ORed with the above tag numbers.
 static const unsigned kContextSpecific = 0x80;
 static const unsigned kConstructed = 0x20;
 
 // kAny matches any tag value;
 static const unsigned kAny = 0x10000;
 // kOptional denotes an optional element.
 static const unsigned kOptional = 0x20000;
@@ skipping 46 matching lines @@
 //
 // CRLs that use an alternative issuer are also omitted.
 //
 // The nested set of GeneralNames is flattened into a single list because
 // having several CRLs with one location is equivalent to having one CRL with
 // several locations as far as a CRL filter is concerned.
 NET_EXPORT_PRIVATE bool ExtractCRLURLsFromDERCert(
     base::StringPiece cert,
     std::vector<base::StringPiece>* urls_out);
 
+// ExtractSCTExtensionFromOCSPResponse parses the DER encoded OCSP response in
+// |ocsp_response| and extracts the SignedCertificateTimestampList matching the
+// serial number given in |cert_serial_number|. On successful return, the
+// |sct_list_out| is either empty (no response found), or points into
+// |ocsp_response|.
+NET_EXPORT_PRIVATE bool ExtractSCTExtensionFromOCSPResponse(

[Ryan Sleevi, 2013/12/03 21:03:18]

Not LGTM here. We should not be doing this using asn1_util.

asn1_util is only meant to be used over trusted data (eg: validated to some root
of trust). The SCT extraction, by definition, happens before the OCSP validity
checks.

+    base::StringPiece ocsp_response,
+    base::StringPiece cert_serial_number,
+    base::StringPiece* sct_list_out);
+
 } // namespace asn1
 
 } // namespace net
 
 #endif // NET_CERT_ASN1_UTIL_H_