Remove some BoringSSL-only X509_CINF functions.

These functions are not in any released version of OpenSSL. The history
is they were added to 1.0.2 beta for CT, but then removed in favor of
i2d_re_X509_tbs. We forked in between the two events.

I'm not sure what the reasoning was upstream's end. I'm thinking:

- X509 currently only captures the serialized TBSCertificate. It might
  be nice to capture the whole Certificate to avoid needing a
  serialization in X509_cmp and make it easier to interop with other
  stacks. (Unclear.) That would require not exporting the X509_CINF
  standalone for serialization.

- The modified bit means, without locking, i2d_X509 is not const or
  thread-safe. We *might* be able to shift the re-encoding to
  i2d_re_X509_tbs, which is already inherently non-const. That requires
  not having X509_CINF_set_modified.

I'm not sure how feasible either of these are, but between that,
upstream alignment, and X509_CINF otherwise being absent from public
accessors, it seems worth removing.

Update-Note: X509_get_cert_info, X509_CINF_set_modified, and
X509_CINF_get_signature are removed. I believe all callers have been
updated. Callers should use i2d_re_X509_tbs, i2d_X509_tbs, and
X509_get0_tbs_sigalg instead.

Change-Id: Ic1906ba383faa7903973cb498402518985dd838c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/46985
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>

crypto/x509/x509_set.c

diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c
index d2d5ea7..7743868 100644
--- a/crypto/x509/x509_set.c
+++ b/crypto/x509/x509_set.c
@@ -72,11 +72,6 @@
     return ASN1_INTEGER_get(x509->cert_info->version);
 }
 
-X509_CINF *X509_get_cert_info(const X509 *x509)
-{
-    return x509->cert_info;
-}
-
 int X509_set_version(X509 *x, long version)
 {
     // TODO(davidben): Reject invalid version numbers.
@@ -239,16 +234,6 @@
     return x->cert_info->signature;
 }
 
-void X509_CINF_set_modified(X509_CINF *cinf)
-{
-    cinf->enc.modified = 1;
-}
-
-const X509_ALGOR *X509_CINF_get_signature(const X509_CINF *cinf)
-{
-    return cinf->signature;
-}
-
 X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x509)
 {
     return x509->cert_info->key;

crypto/x509/x509_test.cc

diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
index 048e9ce..e71cdeb 100644
--- a/crypto/x509/x509_test.cc
+++ b/crypto/x509/x509_test.cc
@@ -1799,7 +1799,8 @@
 
   ASSERT_EQ(static_cast<long>(data_len), i2d_X509(root.get(), nullptr));
 
-  X509_CINF_set_modified(root->cert_info);
+  // Re-encode the TBSCertificate.
+  i2d_re_X509_tbs(root.get(), nullptr);
 
   ASSERT_NE(static_cast<long>(data_len), i2d_X509(root.get(), nullptr));
 }

include/openssl/x509.h

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 3eb7501..949f120 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -529,13 +529,6 @@
                                    const ASN1_BIT_STRING **out_issuer_uid,
                                    const ASN1_BIT_STRING **out_subject_uid);
 
-// X509_get_cert_info returns |x509|'s TBSCertificate structure. Note this
-// function is not const-correct for legacy reasons.
-//
-// This function is deprecated and may be removed in the future. It is not
-// present in OpenSSL and constrains some improvements to the library.
-OPENSSL_EXPORT X509_CINF *X509_get_cert_info(const X509 *x509);
-
 // X509_extract_key is a legacy alias to |X509_get_pubkey|. Use
 // |X509_get_pubkey| instead.
 #define X509_extract_key(x) X509_get_pubkey(x)
@@ -614,22 +607,6 @@
 OPENSSL_EXPORT const STACK_OF(X509_EXTENSION) *X509_CRL_get0_extensions(
     const X509_CRL *crl);
 
-// X509_CINF_set_modified marks |cinf| as modified so that changes will be
-// reflected in serializing the structure.
-//
-// This function is deprecated and may be removed in the future. It is not
-// present in OpenSSL and constrains some improvements to the library.
-OPENSSL_EXPORT void X509_CINF_set_modified(X509_CINF *cinf);
-
-// X509_CINF_get_signature returns the signature algorithm in |cinf|. Note this
-// isn't the signature itself, but the extra copy of the signature algorithm
-// in the TBSCertificate.
-//
-// This function is deprecated and may be removed in the future. It is not
-// present in OpenSSL and constrains some improvements to the library. Use
-// |X509_get0_tbs_sigalg| instead.
-OPENSSL_EXPORT const X509_ALGOR *X509_CINF_get_signature(const X509_CINF *cinf);
-
 // X509_SIG_get0 sets |*out_alg| and |*out_digest| to non-owning pointers to
 // |sig|'s algorithm and digest fields, respectively. Either |out_alg| and
 // |out_digest| may be NULL to skip those fields.