Remove unused files from pki This files aren't built and don't build because of a fillins dependency. Change-Id: I3466fb50298922cfb21c9f60950d572df0d64ca8 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/65907 Commit-Queue: Bob Beck <bbe@google.com> Reviewed-by: Bob Beck <bbe@google.com> Auto-Submit: David Benjamin <davidben@google.com>
diff --git a/pki/asn1_util.cc b/pki/asn1_util.cc deleted file mode 100644 index 3c9cef7..0000000 --- a/pki/asn1_util.cc +++ /dev/null
@@ -1,353 +0,0 @@ -// Copyright 2012 The Chromium Authors -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -#include "asn1_util.h" - -#include <optional> -#include "input.h" -#include "parse_certificate.h" -#include "parser.h" - -namespace bssl::asn1 { - -namespace { - -// Parses input |in| which should point to the beginning of a Certificate, and -// sets |*tbs_certificate| ready to parse the Subject. If parsing -// fails, this function returns false and |*tbs_certificate| is left in an -// undefined state. -bool SeekToSubject(der::Input in, der::Parser *tbs_certificate) { - // From RFC 5280, section 4.1 - // Certificate ::= SEQUENCE { - // tbsCertificate TBSCertificate, - // signatureAlgorithm AlgorithmIdentifier, - // signatureValue BIT STRING } - - // TBSCertificate ::= SEQUENCE { - // version [0] EXPLICIT Version DEFAULT v1, - // serialNumber CertificateSerialNumber, - // signature AlgorithmIdentifier, - // issuer Name, - // validity Validity, - // subject Name, - // subjectPublicKeyInfo SubjectPublicKeyInfo, - // ... } - - der::Parser parser(in); - der::Parser certificate; - if (!parser.ReadSequence(&certificate)) { - return false; - } - - // We don't allow junk after the certificate. - if (parser.HasMore()) { - return false; - } - - if (!certificate.ReadSequence(tbs_certificate)) { - return false; - } - - bool unused; - if (!tbs_certificate->SkipOptionalTag( - der::kTagConstructed | der::kTagContextSpecific | 0, &unused)) { - return false; - } - - // serialNumber - if (!tbs_certificate->SkipTag(der::kInteger)) { - return false; - } - // signature - if (!tbs_certificate->SkipTag(der::kSequence)) { - return false; - } - // issuer - if (!tbs_certificate->SkipTag(der::kSequence)) { - return false; - } - // validity - if (!tbs_certificate->SkipTag(der::kSequence)) { - return false; - } - return true; -} - -// Parses input |in| which should point to the beginning of a Certificate, and -// sets |*tbs_certificate| ready to parse the SubjectPublicKeyInfo. If parsing -// fails, this function returns false and |*tbs_certificate| is left in an -// undefined state. -bool SeekToSPKI(der::Input in, der::Parser *tbs_certificate) { - return SeekToSubject(in, tbs_certificate) && - // Skip over Subject. - tbs_certificate->SkipTag(der::kSequence); -} - -// Parses input |in| which should point to the beginning of a -// Certificate. If parsing fails, this function returns false, with -// |*extensions_present| and |*extensions_parser| left in an undefined -// state. If parsing succeeds and extensions are present, this function -// sets |*extensions_present| to true and sets |*extensions_parser| -// ready to parse the Extensions. If extensions are not present, it sets -// |*extensions_present| to false and |*extensions_parser| is left in an -// undefined state. -bool SeekToExtensions(der::Input in, bool *extensions_present, - der::Parser *extensions_parser) { - bool present; - der::Parser tbs_cert_parser; - if (!SeekToSPKI(in, &tbs_cert_parser)) { - return false; - } - - // From RFC 5280, section 4.1 - // TBSCertificate ::= SEQUENCE { - // ... - // subjectPublicKeyInfo SubjectPublicKeyInfo, - // issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, - // subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, - // extensions [3] EXPLICIT Extensions OPTIONAL } - - // subjectPublicKeyInfo - if (!tbs_cert_parser.SkipTag(der::kSequence)) { - return false; - } - // issuerUniqueID - if (!tbs_cert_parser.SkipOptionalTag(der::kTagContextSpecific | 1, - &present)) { - return false; - } - // subjectUniqueID - if (!tbs_cert_parser.SkipOptionalTag(der::kTagContextSpecific | 2, - &present)) { - return false; - } - - std::optional<der::Input> extensions; - if (!tbs_cert_parser.ReadOptionalTag( - der::kTagConstructed | der::kTagContextSpecific | 3, &extensions)) { - return false; - } - - if (!extensions) { - *extensions_present = false; - return true; - } - - // Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension - // Extension ::= SEQUENCE { - // extnID OBJECT IDENTIFIER, - // critical BOOLEAN DEFAULT FALSE, - // extnValue OCTET STRING } - - // |extensions| was EXPLICITly tagged, so we still need to remove the - // ASN.1 SEQUENCE header. - der::Parser explicit_extensions_parser(extensions.value()); - if (!explicit_extensions_parser.ReadSequence(extensions_parser)) { - return false; - } - - if (explicit_extensions_parser.HasMore()) { - return false; - } - - *extensions_present = true; - return true; -} - -// Parse a DER-encoded, X.509 certificate in |cert| and find an extension with -// the given OID. Returns false on parse error or true if the parse was -// successful. |*out_extension_present| will be true iff the extension was -// found. In the case where it was found, |*out_extension| will describe the -// extension, or is undefined on parse error or if the extension is missing. -bool ExtractExtensionWithOID(std::string_view cert, der::Input extension_oid, - bool *out_extension_present, - ParsedExtension *out_extension) { - der::Parser extensions; - bool extensions_present; - if (!SeekToExtensions(der::Input(cert), &extensions_present, &extensions)) { - return false; - } - if (!extensions_present) { - *out_extension_present = false; - return true; - } - - while (extensions.HasMore()) { - der::Input extension_tlv; - if (!extensions.ReadRawTLV(&extension_tlv) || - !ParseExtension(extension_tlv, out_extension)) { - return false; - } - - if (out_extension->oid == extension_oid) { - *out_extension_present = true; - return true; - } - } - - *out_extension_present = false; - return true; -} - -} // namespace - -bool ExtractSubjectFromDERCert(std::string_view cert, - std::string_view *subject_out) { - der::Parser parser; - if (!SeekToSubject(der::Input(cert), &parser)) { - return false; - } - der::Input subject; - if (!parser.ReadRawTLV(&subject)) { - return false; - } - *subject_out = subject.AsStringView(); - return true; -} - -bool ExtractSPKIFromDERCert(std::string_view cert, std::string_view *spki_out) { - der::Parser parser; - if (!SeekToSPKI(der::Input(cert), &parser)) { - return false; - } - der::Input spki; - if (!parser.ReadRawTLV(&spki)) { - return false; - } - *spki_out = spki.AsStringView(); - return true; -} - -bool ExtractSubjectPublicKeyFromSPKI(std::string_view spki, - std::string_view *spk_out) { - // From RFC 5280, Section 4.1 - // SubjectPublicKeyInfo ::= SEQUENCE { - // algorithm AlgorithmIdentifier, - // subjectPublicKey BIT STRING } - // - // AlgorithmIdentifier ::= SEQUENCE { - // algorithm OBJECT IDENTIFIER, - // parameters ANY DEFINED BY algorithm OPTIONAL } - - // Step into SubjectPublicKeyInfo sequence. - der::Parser parser((der::Input(spki))); - der::Parser spki_parser; - if (!parser.ReadSequence(&spki_parser)) { - return false; - } - - // Step over algorithm field (a SEQUENCE). - if (!spki_parser.SkipTag(der::kSequence)) { - return false; - } - - // Extract the subjectPublicKey field. - der::Input spk; - if (!spki_parser.ReadTag(der::kBitString, &spk)) { - return false; - } - *spk_out = spk.AsStringView(); - return true; -} - -bool HasCanSignHttpExchangesDraftExtension(std::string_view cert) { - // kCanSignHttpExchangesDraftOid is the DER encoding of the OID for - // canSignHttpExchangesDraft defined in: - // https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html - static const uint8_t kCanSignHttpExchangesDraftOid[] = { - 0x2B, 0x06, 0x01, 0x04, 0x01, 0xd6, 0x79, 0x02, 0x01, 0x16}; - - bool extension_present; - ParsedExtension extension; - if (!ExtractExtensionWithOID(cert, der::Input(kCanSignHttpExchangesDraftOid), - &extension_present, &extension) || - !extension_present) { - return false; - } - - // The extension should have contents NULL. - static const uint8_t kNull[] = {0x05, 0x00}; - return extension.value == der::Input(kNull); -} - -bool ExtractSignatureAlgorithmsFromDERCert( - std::string_view cert, std::string_view *cert_signature_algorithm_sequence, - std::string_view *tbs_signature_algorithm_sequence) { - // From RFC 5280, section 4.1 - // Certificate ::= SEQUENCE { - // tbsCertificate TBSCertificate, - // signatureAlgorithm AlgorithmIdentifier, - // signatureValue BIT STRING } - - // TBSCertificate ::= SEQUENCE { - // version [0] EXPLICIT Version DEFAULT v1, - // serialNumber CertificateSerialNumber, - // signature AlgorithmIdentifier, - // issuer Name, - // validity Validity, - // subject Name, - // subjectPublicKeyInfo SubjectPublicKeyInfo, - // ... } - - der::Parser parser((der::Input(cert))); - der::Parser certificate; - if (!parser.ReadSequence(&certificate)) { - return false; - } - - der::Parser tbs_certificate; - if (!certificate.ReadSequence(&tbs_certificate)) { - return false; - } - - bool unused; - if (!tbs_certificate.SkipOptionalTag( - der::kTagConstructed | der::kTagContextSpecific | 0, &unused)) { - return false; - } - - // serialNumber - if (!tbs_certificate.SkipTag(der::kInteger)) { - return false; - } - // signature - der::Input tbs_algorithm; - if (!tbs_certificate.ReadRawTLV(&tbs_algorithm)) { - return false; - } - - der::Input cert_algorithm; - if (!certificate.ReadRawTLV(&cert_algorithm)) { - return false; - } - - *cert_signature_algorithm_sequence = cert_algorithm.AsStringView(); - *tbs_signature_algorithm_sequence = tbs_algorithm.AsStringView(); - return true; -} - -bool ExtractExtensionFromDERCert(std::string_view cert, - std::string_view extension_oid, - bool *out_extension_present, - bool *out_extension_critical, - std::string_view *out_contents) { - *out_extension_present = false; - *out_extension_critical = false; - *out_contents = std::string_view(); - - ParsedExtension extension; - if (!ExtractExtensionWithOID(cert, der::Input(extension_oid), - out_extension_present, &extension)) { - return false; - } - if (!*out_extension_present) { - return true; - } - - *out_extension_critical = extension.critical; - *out_contents = extension.value.AsStringView(); - return true; -} - -} // namespace bssl::asn1
diff --git a/pki/asn1_util.h b/pki/asn1_util.h deleted file mode 100644 index 365c6ed..0000000 --- a/pki/asn1_util.h +++ /dev/null
@@ -1,73 +0,0 @@ -// Copyright 2012 The Chromium Authors -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -#ifndef BSSL_PKI_ASN1_UTIL_H_ -#define BSSL_PKI_ASN1_UTIL_H_ - -#include <string_view> -#include "fillins/openssl_util.h" - - - -namespace bssl::asn1 { - -// ExtractSubjectFromDERCert parses the DER encoded certificate in |cert| and -// extracts the bytes of the X.501 Subject. On successful return, |subject_out| -// is set to contain the Subject, pointing into |cert|. -OPENSSL_EXPORT bool ExtractSubjectFromDERCert(std::string_view cert, - std::string_view *subject_out); - -// ExtractSPKIFromDERCert parses the DER encoded certificate in |cert| and -// extracts the bytes of the SubjectPublicKeyInfo. On successful return, -// |spki_out| is set to contain the SPKI, pointing into |cert|. -OPENSSL_EXPORT bool ExtractSPKIFromDERCert(std::string_view cert, - std::string_view *spki_out); - -// ExtractSubjectPublicKeyFromSPKI parses the DER encoded SubjectPublicKeyInfo -// in |spki| and extracts the bytes of the SubjectPublicKey. On successful -// return, |spk_out| is set to contain the public key, pointing into |spki|. -OPENSSL_EXPORT bool ExtractSubjectPublicKeyFromSPKI(std::string_view spki, - std::string_view *spk_out); - -// HasCanSignHttpExchangesDraftExtension parses the DER encoded certificate -// in |cert| and extracts the canSignHttpExchangesDraft extension -// (https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html) -// if present. Returns true if the extension was present, and false if -// the extension was not present or if there was a parsing failure. -OPENSSL_EXPORT bool HasCanSignHttpExchangesDraftExtension( - std::string_view cert); - -// Extracts the two (SEQUENCE) tag-length-values for the signature -// AlgorithmIdentifiers in a DER encoded certificate. Does not use strict -// parsing or validate the resulting AlgorithmIdentifiers. -// -// On success returns true, and assigns |cert_signature_algorithm_sequence| and -// |tbs_signature_algorithm_sequence| to point into |cert|: -// -// * |cert_signature_algorithm_sequence| points at the TLV for -// Certificate.signatureAlgorithm. -// -// * |tbs_signature_algorithm_sequence| points at the TLV for -// TBSCertificate.algorithm. -OPENSSL_EXPORT bool ExtractSignatureAlgorithmsFromDERCert( - std::string_view cert, std::string_view *cert_signature_algorithm_sequence, - std::string_view *tbs_signature_algorithm_sequence); - -// Extracts the contents of the extension (if any) with OID |extension_oid| from -// the DER-encoded, X.509 certificate in |cert|. -// -// Returns false on parse error or true if the parse was successful. Sets -// |*out_extension_present| to whether or not the extension was found. If found, -// sets |*out_extension_critical| to match the extension's "critical" flag, and -// sets |*out_contents| to the contents of the extension (after unwrapping the -// OCTET STRING). -OPENSSL_EXPORT bool ExtractExtensionFromDERCert(std::string_view cert, - std::string_view extension_oid, - bool *out_extension_present, - bool *out_extension_critical, - std::string_view *out_contents); - -} // namespace bssl::asn1 - -#endif // BSSL_PKI_ASN1_UTIL_H_
diff --git a/pki/cert_status_flags.h b/pki/cert_status_flags.h deleted file mode 100644 index cd66547..0000000 --- a/pki/cert_status_flags.h +++ /dev/null
@@ -1,49 +0,0 @@ -// Copyright 2012 The Chromium Authors -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -#ifndef BSSL_PKI_CERT_STATUS_FLAGS_H_ -#define BSSL_PKI_CERT_STATUS_FLAGS_H_ - -#include <stdint.h> -#include "fillins/openssl_util.h" - - - -namespace bssl { - -// Bitmask of status flags of a certificate, representing any errors, as well as -// other non-error status information such as whether the certificate is EV. -typedef uint32_t CertStatus; - -// NOTE: Because these names have appeared in bug reports, we preserve them as -// MACRO_STYLE for continuity, instead of renaming them to kConstantStyle as -// befits most static consts. -#define CERT_STATUS_FLAG(label, value) \ - CertStatus static const CERT_STATUS_##label = value; -#include "cert_status_flags_list.h" -#undef CERT_STATUS_FLAG - -static const CertStatus CERT_STATUS_ALL_ERRORS = 0xFF00FFFF; - -// Returns true if the specified cert status has an error set. -inline bool IsCertStatusError(CertStatus status) { - return (CERT_STATUS_ALL_ERRORS & status) != 0; -} - -// Maps a network error code to the equivalent certificate status flag. If -// the error code is not a certificate error, it is mapped to 0. -// Note: It is not safe to go bssl::CertStatus -> bssl::Error -> -// bssl::CertStatus, as the CertStatus contains more information. Conversely, -// going from bssl::Error -> bssl::CertStatus -> bssl::Error is not a lossy -// function, for the same reason. To avoid incorrect use, this is only exported -// for unittest helpers. -OPENSSL_EXPORT CertStatus MapNetErrorToCertStatus(int error); - -// Maps the most serious certificate error in the certificate status flags -// to the equivalent network error code. -OPENSSL_EXPORT int MapCertStatusToNetError(CertStatus cert_status); - -} // namespace bssl - -#endif // BSSL_PKI_CERT_STATUS_FLAGS_H_
diff --git a/pki/cert_status_flags_list.h b/pki/cert_status_flags_list.h deleted file mode 100644 index d5ab73c..0000000 --- a/pki/cert_status_flags_list.h +++ /dev/null
@@ -1,47 +0,0 @@ -// Copyright 2014 The Chromium Authors -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -// This file intentionally does not have header guards, it's included -// inside a macro to generate enum values. The following line silences a -// presubmit warning that would otherwise be triggered by this: -// no-include-guard-because-multiply-included -// NOLINT(build/header_guard) - -// This is the list of CertStatus flags and their values. -// -// Defines the values using a macro CERT_STATUS_FLAG, -// so it can be expanded differently in some places - -// The possible status bits for CertStatus. -// Bits 0 to 15 are for errors. -CERT_STATUS_FLAG(COMMON_NAME_INVALID, 1 << 0) -CERT_STATUS_FLAG(DATE_INVALID, 1 << 1) -CERT_STATUS_FLAG(AUTHORITY_INVALID, 1 << 2) -// 1 << 3 is reserved for ERR_CERT_CONTAINS_ERRORS (not useful with WinHTTP). -CERT_STATUS_FLAG(NO_REVOCATION_MECHANISM, 1 << 4) -CERT_STATUS_FLAG(UNABLE_TO_CHECK_REVOCATION, 1 << 5) -CERT_STATUS_FLAG(REVOKED, 1 << 6) -CERT_STATUS_FLAG(INVALID, 1 << 7) -CERT_STATUS_FLAG(WEAK_SIGNATURE_ALGORITHM, 1 << 8) -// 1 << 9 was used for CERT_STATUS_NOT_IN_DNS -CERT_STATUS_FLAG(NON_UNIQUE_NAME, 1 << 10) -CERT_STATUS_FLAG(WEAK_KEY, 1 << 11) -// 1 << 12 was used for CERT_STATUS_WEAK_DH_KEY -CERT_STATUS_FLAG(PINNED_KEY_MISSING, 1 << 13) -CERT_STATUS_FLAG(NAME_CONSTRAINT_VIOLATION, 1 << 14) -CERT_STATUS_FLAG(VALIDITY_TOO_LONG, 1 << 15) - -// Bits 16 to 23 are for non-error statuses. -CERT_STATUS_FLAG(IS_EV, 1 << 16) -CERT_STATUS_FLAG(REV_CHECKING_ENABLED, 1 << 17) -// Bit 18 was CERT_STATUS_IS_DNSSEC -CERT_STATUS_FLAG(SHA1_SIGNATURE_PRESENT, 1 << 19) -CERT_STATUS_FLAG(CT_COMPLIANCE_FAILED, 1 << 20) -CERT_STATUS_FLAG(KNOWN_INTERCEPTION_DETECTED, 1 << 21) - -// Bits 24 - 31 are for errors. -CERT_STATUS_FLAG(CERTIFICATE_TRANSPARENCY_REQUIRED, 1 << 24) -CERT_STATUS_FLAG(SYMANTEC_LEGACY, 1 << 25) -CERT_STATUS_FLAG(KNOWN_INTERCEPTION_BLOCKED, 1 << 26) -// Bit 27 was CERT_STATUS_LEGACY_TLS.