Index: net/cert/ct_policy_enforcer.h |
diff --git a/net/cert/ct_policy_enforcer.h b/net/cert/ct_policy_enforcer.h |
index 8c29da5ecb3a9891ef2be90a55ae873ab61c91d4..6d1178ee31534395e0cc185bdc1f161b9bb9598b 100644 |
--- a/net/cert/ct_policy_enforcer.h |
+++ b/net/cert/ct_policy_enforcer.h |
@@ -7,6 +7,7 @@ |
#include <stddef.h> |
#include "net/base/net_export.h" |
+#include "net/cert/cert_status_flags.h" |
#include "net/log/net_log.h" |
namespace net { |
@@ -20,23 +21,37 @@ class EVCertsWhitelist; |
class X509Certificate; |
-// Class for checking that a given certificate conforms to security-related |
-// policies. |
+// Class for checking that a given certificate conforms to |
+// Certificate-Transparency-related policies. |
+// |
+// There are two methods for checking policies: |
+// DoesConformToCertPolicy() which applies to certificates in general, |
+// and DoesConformToEVPolicy() which applies to EV certificates. |
Ryan Sleevi
2016/01/23 02:08:10
OK, so, a concrete suggestion would be declaring w
estark
2016/01/24 16:47:46
I'm not understanding something... It seems to me
Ryan Sleevi
2016/01/25 22:30:42
Yeah, perhaps "valid" is an overloaded term. See b
|
class NET_EXPORT CTPolicyEnforcer { |
public: |
CTPolicyEnforcer() {} |
virtual ~CTPolicyEnforcer() {} |
- // Returns true if the collection of SCTs for the given certificate |
- // conforms with the CT/EV policy. Conformance details are logged to |
- // |net_log|. |
+ // Returns true if the collection of SCTs for the given |certificate| |
+ // conforms with the CT certificate policy. |
// |cert| is the certificate for which the SCTs apply. |
// |ct_result| must contain the result of verifying any SCTs associated with |
// |cert| prior to invoking this method. |
- virtual bool DoesConformToCTEVPolicy(X509Certificate* cert, |
- const ct::EVCertsWhitelist* ev_whitelist, |
- const ct::CTVerifyResult& ct_result, |
- const BoundNetLog& net_log); |
+ virtual bool DoesConformToCertPolicy(X509Certificate* cert, |
+ const ct::CTVerifyResult& ct_result); |
+ |
+ // Returns true if the collection of SCTs for the given |certificate| |
+ // conforms with the EV certificate policy. Conformance details are |
+ // logged to |net_log|. |
+ // |cert| is the certificate for which the SCTs apply. |
+ // |ct_result| must contain the result of verifying any SCTs associated with |
+ // |cert| prior to invoking this method. |
+ // |ev_whitelist| is a whitelist of EV certificates for which CT policy need |
+ // not apply. |
+ virtual bool DoesConformToEVPolicy(X509Certificate* cert, |
+ const ct::CTVerifyResult& ct_result, |
+ const ct::EVCertsWhitelist* ev_whitelist, |
+ const BoundNetLog& net_log); |
}; |
} // namespace net |