Extract Certificate Transparency SCTs from stapled OCSP responses

net/cert/ct_objects_extractor_nss.cc

Index: net/cert/ct_objects_extractor_nss.cc
diff --git a/net/cert/ct_objects_extractor_nss.cc b/net/cert/ct_objects_extractor_nss.cc
index 0f353489e3d33a585dca01befc6006ff00ef28bd..3abc183b775420d0a32952c792909775f3eeecb6 100644
--- a/net/cert/ct_objects_extractor_nss.cc
+++ b/net/cert/ct_objects_extractor_nss.cc
@@ -269,6 +269,25 @@ bool GetX509LogEntry(X509Certificate::OSCertHandle leaf, LogEntry* result) {
   return true;
 }
 
+bool ExtractSCTListFromOCSPResponse(X509Certificate::OSCertHandle leaf,
+                                    const std::string& ocsp_response,
+                                    std::string* sct_list) {
+  DCHECK(leaf);
+  NSSCertWrapper leaf_cert(leaf);

[wtc, 2013/12/03 21:04:25]

Nit: this is an expensive way to get the serial number from the OSCertHandle
|leaf|. NSSCertWrapper will not only decode the certificate but also add it to
NSS's internal hash tables of certificates.

This is OK for now. You can consider copying the first few lines of code from
SeekToSPKI in net/cert/asn1_util.cc. (X509Certificate::GetDEREncoded can be used
to get the DER-encoded certificate.) Also, if you actually have an
X509Certificate object, you can use the serial_number() getter method.

Update: I found that the two callers of this function (the unit test and
ssl_client_socket_nss.cc) have an X509Certificate object. So I suggest that you
change this function to take |cert_serial_number| instead of |leaf| as input,
and change the callers to pass X509Certificate::serial_number() to this
function.

However, having |leaf| gives us more flexibility because we will be able to get
the issuer from |leaf| for more accurate matching.

[ekasper, 2013/12/04 19:25:15]

I wasn't really thinking what I was doing :/

I've changed it to take a serial number and, separately, an issuer.

+  sct_list->clear();
+  base::StringPiece serial_number = base::StringPiece(
+      reinterpret_cast<char*>(leaf_cert.cert->serialNumber.data),
+      leaf_cert.cert->serialNumber.len);
+  base::StringPiece sct_list_out;
+  if (!asn1::ExtractSCTExtensionFromOCSPResponse(ocsp_response,

[Ryan Sleevi, 2013/12/03 21:03:18]

We should be using the NSS ASN.1 functions for this.

[ekasper, 2013/12/04 19:25:15]

Done...

+                                                 serial_number,
+                                                 &sct_list_out))
+    return false;

[wtc, 2013/12/03 21:04:25]

Nit: add curly braces.

+
+  *sct_list = sct_list_out.as_string();
+  return true;
+}
+
 }  // namespace ct
 
 }  // namespace net