Adding OCSP Verification

net/cert/internal/parse_ocsp.h

Index: net/cert/internal/parse_ocsp.h
diff --git a/net/cert/internal/parse_ocsp.h b/net/cert/internal/parse_ocsp.h
index 63ee3e8e2a5d01d47b03aab7f81be2f1c577943f..7153ff0d494823b68233f721be28ec4721964b15 100644
--- a/net/cert/internal/parse_ocsp.h
+++ b/net/cert/internal/parse_ocsp.h
@@ -277,6 +277,12 @@ NET_EXPORT_PRIVATE bool GetOCSPCertStatus(const OCSPResponseData& response_data,
                                           const ParsedCertificate& cert,
                                           OCSPCertStatus* out);
 
+// Verifies that the OCSP Response |response| is signed and has a valid trust
+// path to the issuer |issuer_cert|.

[eroman, 2016/05/02 22:36:51]

Expand the documentation to reference the RFC that this implementation follows
-- presumably RFC 6960.

Also mention this information in the CL description.

[svaldez, 2016/05/04 15:31:20]

Done.

+NET_EXPORT_PRIVATE bool VerifyOCSPResponse(
+    const OCSPResponse& response,
+    const ParsedCertificate& issuer_cert);

[eroman, 2016/05/02 22:36:51]

Please mark this as WARN_UNUSED_RESULT.

In fact I recommend the same for all the other functions in this file...
But especially this one.

[svaldez, 2016/05/04 15:31:20]

Done.

+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSE_OCSP_H_

[eroman, 2016/05/02 22:36:51]

parse_ocsp.h isn't the best name for this file given it handles both parsing and
verification.

At a minimum please add a TODO by VerifyOCSPResponse to clean this up (we will
need to do a file re-organization soon anyway).

[svaldez, 2016/05/04 15:31:20]

Done.