1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef NET_CERT_ASN1_UTIL_H_
6#define NET_CERT_ASN1_UTIL_H_
7
8#include <vector>
9
10#include "base/strings/string_piece.h"
11#include "net/base/net_export.h"
12
13namespace net {
14
15namespace asn1 {
16
17// These are the DER encodings of the tag byte for ASN.1 objects.
18static const unsigned kBOOLEAN = 0x01;
19static const unsigned kINTEGER = 0x02;
20static const unsigned kBITSTRING = 0x03;
21static const unsigned kOCTETSTRING = 0x04;
22static const unsigned kOID = 0x06;
23static const unsigned kENUMERATED = 0x0A;
24static const unsigned kSEQUENCE = 0x30;
25
26// These are flags that can be ORed with the above tag numbers.
27static const unsigned kContextSpecific = 0x80;
28static const unsigned kConstructed = 0x20;
29
30// kAny matches any tag value;
31static const unsigned kAny = 0x10000;
32// kOptional denotes an optional element.
33static const unsigned kOptional = 0x20000;
34
35// ParseElement parses a DER encoded ASN1 element from |in|, requiring that
36// it have the given |tag_value|. It returns true on success. The following
37// limitations are imposed:
38//   1) tag numbers > 31 are not permitted.
39//   2) lengths > 65535 are not permitted.
40// On successful return:
41//   |in| is advanced over the element
42//   |out| contains the element, including the tag and length bytes.
43//   |out_header_len| contains the length of the tag and length bytes in |out|.
44//
45// If |tag_value & kOptional| is true then *out_header_len can be zero after a
46// true return value if the element was not found.
47bool ParseElement(base::StringPiece* in,
48                  unsigned tag_value,
49                  base::StringPiece* out,
50                  unsigned *out_header_len);
51
52// GetElement performs the same actions as ParseElement, except that the header
53// bytes are not included in the output.
54//
55// If |tag_value & kOptional| is true then this function cannot distinguish
56// between a missing optional element and an empty one.
57NET_EXPORT_PRIVATE bool GetElement(base::StringPiece* in,
58                                   unsigned tag_value,
59                                   base::StringPiece* out);
60
61// ExtractSPKIFromDERCert parses the DER encoded certificate in |cert| and
62// extracts the bytes of the SubjectPublicKeyInfo. On successful return,
63// |spki_out| is set to contain the SPKI, pointing into |cert|.
64NET_EXPORT_PRIVATE bool ExtractSPKIFromDERCert(base::StringPiece cert,
65                                               base::StringPiece* spki_out);
66
67// ExtractSubjectPublicKeyFromSPKI parses the DER encoded SubjectPublicKeyInfo
68// in |spki| and extracts the bytes of the SubjectPublicKey. On successful
69// return, |spk_out| is set to contain the public key, pointing into |spki|.
70NET_EXPORT_PRIVATE bool ExtractSubjectPublicKeyFromSPKI(
71    base::StringPiece spki,
72    base::StringPiece* spk_out);
73
74// ExtractCRLURLsFromDERCert parses the DER encoded certificate in |cert| and
75// extracts the URL of each CRL. On successful return, the elements of
76// |urls_out| point into |cert|.
77//
78// CRLs that only cover a subset of the reasons are omitted as the spec
79// requires that at least one CRL be included that covers all reasons.
80//
81// CRLs that use an alternative issuer are also omitted.
82//
83// The nested set of GeneralNames is flattened into a single list because
84// having several CRLs with one location is equivalent to having one CRL with
85// several locations as far as a CRL filter is concerned.
86NET_EXPORT_PRIVATE bool ExtractCRLURLsFromDERCert(
87    base::StringPiece cert,
88    std::vector<base::StringPiece>* urls_out);
89
90} // namespace asn1
91
92} // namespace net
93
94#endif // NET_CERT_ASN1_UTIL_H_
95