1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#ifndef NET_CERT_ASN1_UTIL_H_ 6#define NET_CERT_ASN1_UTIL_H_ 7 8#include <vector> 9 10#include "base/strings/string_piece.h" 11#include "net/base/net_export.h" 12 13namespace net { 14 15namespace asn1 { 16 17// These are the DER encodings of the tag byte for ASN.1 objects. 18static const unsigned kBOOLEAN = 0x01; 19static const unsigned kINTEGER = 0x02; 20static const unsigned kBITSTRING = 0x03; 21static const unsigned kOCTETSTRING = 0x04; 22static const unsigned kOID = 0x06; 23static const unsigned kENUMERATED = 0x0A; 24static const unsigned kSEQUENCE = 0x30; 25 26// These are flags that can be ORed with the above tag numbers. 27static const unsigned kContextSpecific = 0x80; 28static const unsigned kConstructed = 0x20; 29 30// kAny matches any tag value; 31static const unsigned kAny = 0x10000; 32// kOptional denotes an optional element. 33static const unsigned kOptional = 0x20000; 34 35// ParseElement parses a DER encoded ASN1 element from |in|, requiring that 36// it have the given |tag_value|. It returns true on success. The following 37// limitations are imposed: 38// 1) tag numbers > 31 are not permitted. 39// 2) lengths > 65535 are not permitted. 40// On successful return: 41// |in| is advanced over the element 42// |out| contains the element, including the tag and length bytes. 43// |out_header_len| contains the length of the tag and length bytes in |out|. 44// 45// If |tag_value & kOptional| is true then *out_header_len can be zero after a 46// true return value if the element was not found. 47bool ParseElement(base::StringPiece* in, 48 unsigned tag_value, 49 base::StringPiece* out, 50 unsigned *out_header_len); 51 52// GetElement performs the same actions as ParseElement, except that the header 53// bytes are not included in the output. 54// 55// If |tag_value & kOptional| is true then this function cannot distinguish 56// between a missing optional element and an empty one. 57NET_EXPORT_PRIVATE bool GetElement(base::StringPiece* in, 58 unsigned tag_value, 59 base::StringPiece* out); 60 61// ExtractSPKIFromDERCert parses the DER encoded certificate in |cert| and 62// extracts the bytes of the SubjectPublicKeyInfo. On successful return, 63// |spki_out| is set to contain the SPKI, pointing into |cert|. 64NET_EXPORT_PRIVATE bool ExtractSPKIFromDERCert(base::StringPiece cert, 65 base::StringPiece* spki_out); 66 67// ExtractSubjectPublicKeyFromSPKI parses the DER encoded SubjectPublicKeyInfo 68// in |spki| and extracts the bytes of the SubjectPublicKey. On successful 69// return, |spk_out| is set to contain the public key, pointing into |spki|. 70NET_EXPORT_PRIVATE bool ExtractSubjectPublicKeyFromSPKI( 71 base::StringPiece spki, 72 base::StringPiece* spk_out); 73 74// ExtractCRLURLsFromDERCert parses the DER encoded certificate in |cert| and 75// extracts the URL of each CRL. On successful return, the elements of 76// |urls_out| point into |cert|. 77// 78// CRLs that only cover a subset of the reasons are omitted as the spec 79// requires that at least one CRL be included that covers all reasons. 80// 81// CRLs that use an alternative issuer are also omitted. 82// 83// The nested set of GeneralNames is flattened into a single list because 84// having several CRLs with one location is equivalent to having one CRL with 85// several locations as far as a CRL filter is concerned. 86NET_EXPORT_PRIVATE bool ExtractCRLURLsFromDERCert( 87 base::StringPiece cert, 88 std::vector<base::StringPiece>* urls_out); 89 90} // namespace asn1 91 92} // namespace net 93 94#endif // NET_CERT_ASN1_UTIL_H_ 95