Adding OCSP Verification

net/cert/internal/parse_ocsp.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PARSE_OCSP_H_
 #define NET_CERT_INTERNAL_PARSE_OCSP_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 259 matching lines @@
 // of caching or performance (RFC 6960, 4.2.2.3), the strictest response is
 // returned (REVOKED > UNKNOWN > GOOD).
 //
 // On failure |out| has an undefined state. Some of its fields may have been
 // updated during parsing, whereas others may not have been changed.
 NET_EXPORT_PRIVATE bool GetOCSPCertStatus(const OCSPResponseData& response_data,
                                           const ParsedCertificate& issuer,
                                           const ParsedCertificate& cert,
                                           OCSPCertStatus* out);
 
+// Verifies that the OCSP Response |response| is signed and has a valid trust
+// path to the issuer |issuer_cert|.

[eroman, 2016/05/02 22:36:51]

Expand the documentation to reference the RFC that this implementation follows
-- presumably RFC 6960.

Also mention this information in the CL description.

[svaldez, 2016/05/04 15:31:20]

Done.

+NET_EXPORT_PRIVATE bool VerifyOCSPResponse(
+    const OCSPResponse& response,
+    const ParsedCertificate& issuer_cert);

[eroman, 2016/05/02 22:36:51]

Please mark this as WARN_UNUSED_RESULT.

In fact I recommend the same for all the other functions in this file...
But especially this one.

[svaldez, 2016/05/04 15:31:20]

Done.

+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSE_OCSP_H_

[eroman, 2016/05/02 22:36:51]

parse_ocsp.h isn't the best name for this file given it handles both parsing and
verification.

At a minimum please add a TODO by VerifyOCSPResponse to clean this up (we will
need to do a file re-organization soon anyway).

[svaldez, 2016/05/04 15:31:20]

Done.