Extract Certificate Transparency SCTs from stapled OCSP responses

net/cert/ct_objects_extractor_nss.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_objects_extractor.h"
 
 #include <cert.h>
 #include <secasn1.h>
 #include <secitem.h>
 #include <secoid.h>
@@ skipping 251 matching lines @@
   std::string encoded;
   if (!X509Certificate::GetDEREncoded(leaf, &encoded))
     return false;
 
   result->Reset();
   result->type = ct::LogEntry::LOG_ENTRY_TYPE_X509;
   result->leaf_certificate.swap(encoded);
   return true;
 }
 
+bool ExtractSCTListFromOCSPResponse(X509Certificate::OSCertHandle leaf,
+                                    const std::string& ocsp_response,
+                                    std::string* sct_list) {
+  DCHECK(leaf);
+  NSSCertWrapper leaf_cert(leaf);

[wtc, 2013/12/03 21:04:25]

Nit: this is an expensive way to get the serial number from the OSCertHandle
|leaf|. NSSCertWrapper will not only decode the certificate but also add it to
NSS's internal hash tables of certificates.

This is OK for now. You can consider copying the first few lines of code from
SeekToSPKI in net/cert/asn1_util.cc. (X509Certificate::GetDEREncoded can be used
to get the DER-encoded certificate.) Also, if you actually have an
X509Certificate object, you can use the serial_number() getter method.

Update: I found that the two callers of this function (the unit test and
ssl_client_socket_nss.cc) have an X509Certificate object. So I suggest that you
change this function to take |cert_serial_number| instead of |leaf| as input,
and change the callers to pass X509Certificate::serial_number() to this
function.

However, having |leaf| gives us more flexibility because we will be able to get
the issuer from |leaf| for more accurate matching.

[ekasper, 2013/12/04 19:25:15]

I wasn't really thinking what I was doing :/

I've changed it to take a serial number and, separately, an issuer.

+  sct_list->clear();
+  base::StringPiece serial_number = base::StringPiece(
+      reinterpret_cast<char*>(leaf_cert.cert->serialNumber.data),
+      leaf_cert.cert->serialNumber.len);
+  base::StringPiece sct_list_out;
+  if (!asn1::ExtractSCTExtensionFromOCSPResponse(ocsp_response,

[Ryan Sleevi, 2013/12/03 21:03:18]

We should be using the NSS ASN.1 functions for this.

[ekasper, 2013/12/04 19:25:15]

Done...

+                                                 serial_number,
+                                                 &sct_list_out))
+    return false;

[wtc, 2013/12/03 21:04:25]

Nit: add curly braces.

+
+  *sct_list = sct_list_out.as_string();
+  return true;
+}
+
 }  // namespace ct
 
 }  // namespace net