1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_ASN1_UTIL_H_ 6 #define NET_CERT_ASN1_UTIL_H_ 7 8 #include <vector> 9 10 #include "base/strings/string_piece.h" 11 #include "net/base/net_export.h" 12 13 namespace net { 14 15 namespace asn1 { 16 17 // These are the DER encodings of the tag byte for ASN.1 objects. 18 static const unsigned kBOOLEAN = 0x01; 19 static const unsigned kINTEGER = 0x02; 20 static const unsigned kBITSTRING = 0x03; 21 static const unsigned kOCTETSTRING = 0x04; 22 static const unsigned kOID = 0x06; 23 static const unsigned kSEQUENCE = 0x30; 24 25 // These are flags that can be ORed with the above tag numbers. 26 static const unsigned kContextSpecific = 0x80; 27 static const unsigned kConstructed = 0x20; 28 29 // kAny matches any tag value; 30 static const unsigned kAny = 0x10000; 31 // kOptional denotes an optional element. 32 static const unsigned kOptional = 0x20000; 33 34 // ParseElement parses a DER encoded ASN1 element from |in|, requiring that 35 // it have the given |tag_value|. It returns true on success. The following 36 // limitations are imposed: 37 // 1) tag numbers > 31 are not permitted. 38 // 2) lengths > 65535 are not permitted. 39 // On successful return: 40 // |in| is advanced over the element 41 // |out| contains the element, including the tag and length bytes. 42 // |out_header_len| contains the length of the tag and length bytes in |out|. 43 // 44 // If |tag_value & kOptional| is true then *out_header_len can be zero after a 45 // true return value if the element was not found. 46 bool ParseElement(base::StringPiece* in, 47 unsigned tag_value, 48 base::StringPiece* out, 49 unsigned *out_header_len); 50 51 // GetElement performs the same actions as ParseElement, except that the header 52 // bytes are not included in the output. 53 // 54 // If |tag_value & kOptional| is true then this function cannot distinguish 55 // between a missing optional element and an empty one. 56 bool GetElement(base::StringPiece* in, 57 unsigned tag_value, 58 base::StringPiece* out); 59 60 // ExtractSPKIFromDERCert parses the DER encoded certificate in |cert| and 61 // extracts the bytes of the SubjectPublicKeyInfo. On successful return, 62 // |spki_out| is set to contain the SPKI, pointing into |cert|. 63 NET_EXPORT_PRIVATE bool ExtractSPKIFromDERCert(base::StringPiece cert, 64 base::StringPiece* spki_out); 65 66 // ExtractSubjectPublicKeyFromSPKI parses the DER encoded SubjectPublicKeyInfo 67 // in |spki| and extracts the bytes of the SubjectPublicKey. On successful 68 // return, |spk_out| is set to contain the public key, pointing into |spki|. 69 NET_EXPORT_PRIVATE bool ExtractSubjectPublicKeyFromSPKI( 70 base::StringPiece spki, 71 base::StringPiece* spk_out); 72 73 // ExtractCRLURLsFromDERCert parses the DER encoded certificate in |cert| and 74 // extracts the URL of each CRL. On successful return, the elements of 75 // |urls_out| point into |cert|. 76 // 77 // CRLs that only cover a subset of the reasons are omitted as the spec 78 // requires that at least one CRL be included that covers all reasons. 79 // 80 // CRLs that use an alternative issuer are also omitted. 81 // 82 // The nested set of GeneralNames is flattened into a single list because 83 // having several CRLs with one location is equivalent to having one CRL with 84 // several locations as far as a CRL filter is concerned. 85 NET_EXPORT_PRIVATE bool ExtractCRLURLsFromDERCert( 86 base::StringPiece cert, 87 std::vector<base::StringPiece>* urls_out); 88 89 } // namespace asn1 90 91 } // namespace net 92 93 #endif // NET_CERT_ASN1_UTIL_H_ 94
