OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 #ifndef NET_CERT_CT_POLICY_ENFORCER_H | 4 #ifndef NET_CERT_CT_POLICY_ENFORCER_H |
5 #define NET_CERT_CT_POLICY_ENFORCER_H | 5 #define NET_CERT_CT_POLICY_ENFORCER_H |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 | 8 |
9 #include "net/base/net_export.h" | 9 #include "net/base/net_export.h" |
10 #include "net/cert/signed_certificate_timestamp.h" | |
10 #include "net/log/net_log.h" | 11 #include "net/log/net_log.h" |
11 | 12 |
12 namespace net { | 13 namespace net { |
13 | 14 |
14 namespace ct { | 15 namespace ct { |
15 | 16 |
16 struct CTVerifyResult; | |
17 class EVCertsWhitelist; | 17 class EVCertsWhitelist; |
18 | 18 |
19 } // namespace ct | 19 } // namespace ct |
20 | 20 |
21 class X509Certificate; | 21 class X509Certificate; |
22 | 22 |
23 // Class for checking that a given certificate conforms to security-related | 23 // Class for checking that a given certificate conforms to security-related |
24 // policies. | 24 // policies. |
25 class NET_EXPORT CTPolicyEnforcer { | 25 class NET_EXPORT CTPolicyEnforcer { |
26 public: | 26 public: |
27 // Information about the connection's compliance with the EV | |
28 // certificate policy. | |
29 enum EVPolicyCompliance { | |
30 // The certificate was not EV, so the EV policy doesn't apply. | |
31 EV_POLICY_DOES_NOT_APPLY = 0, | |
32 // The connection complied with the EV certificate policy by being | |
33 // included on the EV whitelist. | |
34 EV_POLICY_COMPLIES_VIA_WHITELIST, | |
35 // The connection complied with the EV certificate policy by | |
36 // including SCTs that satisfy the policy. | |
37 EV_POLICY_COMPLIES_VIA_SCTS, | |
38 // The connection did not have enough SCTs to retain its EV | |
39 // status. | |
40 EV_POLICY_NOT_ENOUGH_SCTS, | |
41 // The connection did not have diverse enough SCTs to retain its | |
42 // EV status. | |
43 EV_POLICY_NOT_DIVERSE_SCTS, | |
44 // The connection cannot be considered compliant because the build | |
45 // isn't timely and therefore log information might be out of date | |
46 // (for example a log might no longer be considered trustworthy). | |
47 EV_POLICY_BUILD_NOT_TIMELY, | |
48 }; | |
Ryan Sleevi
2016/02/05 02:09:25
The problem I see with this approach is it breaks
haavardm
2016/02/08 12:49:15
For now, Opera will simply inherit the Google poli
| |
49 | |
27 CTPolicyEnforcer() {} | 50 CTPolicyEnforcer() {} |
28 virtual ~CTPolicyEnforcer() {} | 51 virtual ~CTPolicyEnforcer() {} |
29 | 52 |
30 // Returns true if the collection of SCTs for the given certificate | 53 // Returns an enum indicating if the collection of SCTs for the given |
31 // conforms with the CT/EV policy. Conformance details are logged to | 54 // certificate conforms with the CT/EV policy. Conformance details are logged |
32 // |net_log|. | 55 // to |net_log|. |
33 // |cert| is the certificate for which the SCTs apply. | 56 // |cert| is the certificate for which the SCTs apply. |
34 // |ct_result| must contain the result of verifying any SCTs associated with | 57 // |verified_scts| contains any SCTs associated with |cert| that were |
35 // |cert| prior to invoking this method. | 58 // verified prior to invoking this method and found to be valid. |
36 virtual bool DoesConformToCTEVPolicy(X509Certificate* cert, | 59 virtual EVPolicyCompliance DoesConformToCTEVPolicy( |
37 const ct::EVCertsWhitelist* ev_whitelist, | 60 X509Certificate* cert, |
38 const ct::CTVerifyResult& ct_result, | 61 const ct::EVCertsWhitelist* ev_whitelist, |
39 const BoundNetLog& net_log); | 62 const std::vector<scoped_refptr<ct::SignedCertificateTimestamp>>& |
63 verified_scts, | |
estark
2016/01/30 17:03:29
I changed this method to take a list of SCTs inste
Ryan Sleevi
2016/02/05 02:09:25
We should probably simplify this with a using
estark
2016/02/08 08:36:26
Did you mean `using SCTList = std::vector...`? If
| |
64 const BoundNetLog& net_log); | |
40 }; | 65 }; |
41 | 66 |
42 } // namespace net | 67 } // namespace net |
43 | 68 |
44 #endif // NET_CERT_CT_POLICY_ENFORCER_H | 69 #endif // NET_CERT_CT_POLICY_ENFORCER_H |
OLD | NEW |