Implement Expect-Staple

net/cert/expect_staple_report.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_EXPECT_STAPLE_REPORT_H
+#define NET_CERT_EXPECT_STAPLE_REPORT_H
+
+#include <memory>
+
+#include "base/macros.h"
+#include "base/time/time.h"
+#include "net/base/net_export.h"
+#include "net/cert/internal/parse_ocsp.h"
+#include "net/cert/x509_certificate.h"
+
+namespace net {
+
+// An ExpectStapleReport is used to determine if a stapled OCSP response is
+// valid for a given certificate, and contains all the information needed to
+// construct a report payload for sites opting into Expect-Staple.
+class NET_EXPORT ExpectStapleReport {
+ public:
+  ExpectStapleReport();
+  ~ExpectStapleReport();
+
+  // Stores the validity of a single stapled response.
+  struct SingleResult {
+    bool is_date_valid = false;
+    bool is_correct_certificate = false;
+    OCSPCertStatus::Status status = OCSPCertStatus::Status::UNKNOWN;
+  };
+
+  // Represents where during the staple verification an error occurred.
+  enum class StapleError {
+    OK,
+    PARSE_RESPONSE,
+    BAD_RESPONSE,
+    PARSE_RESPONSE_DATA,
+    PARSE_SINGLE_RESPONSE,
+    NO_MATCHING_RESPONSE,
+  };
+
+  // Creates an ExpectStapleReport from an unparsed OCSP response.
+  // This compares the serial number of the certificate, and verifies that
+  // |verify_time| is within thisUpdate and nextUpdate, and that thisUpdate is
+  // at least as recent as |verify_time - max_age|.
+  //
+  // TODO(dadrian): Check issuer and signatures. https://crbug.com/620005
+  static std::unique_ptr<ExpectStapleReport> FromRawOCSPResponse(
+      const std::string& raw_response,
+      const base::Time& verify_time,
+      const base::TimeDelta& max_age,
+      const X509Certificate& server_certificate);
+
+  StapleError staple_error() const { return staple_error_; }
+
+  const std::vector<SingleResult>& stapled_responses() const {
+    return stapled_responses_;
+  }
+

[svaldez, 2016/06/16 11:14:38]

nit: You probably want the accessors in the same order as the variables.

[dadrian, 2016/06/16 19:20:18]

Done.

+  const base::Time& verify_time() const { return verify_time_; }
+
+ private:
+  base::Time verify_time_;
+  StapleError staple_error_;
+  std::vector<SingleResult> stapled_responses_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExpectStapleReport);
+};
+
+}  // namespace net
+
+#endif /* NET_CERT_EXPECT_STAPLE_REPORT_H */