Implement Expect-Staple

net/cert/ocsp_staple.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_OCSP_STAPLE_H
+#define NET_CERT_OCSP_STAPLE_H
+
+#include <memory>
+
+#include "base/macros.h"
+#include "base/time/time.h"
+#include "net/base/net_export.h"
+#include "net/cert/internal/parse_ocsp.h"
+#include "net/cert/x509_certificate.h"
+
+namespace net {
+
+class NET_EXPORT ExpectStapleReport {

[estark, 2016/06/14 02:10:28]

Probably should document this class with a comment above it. Also, typically the
file name would match the class name (expect_staple_report.h).

[dadrian, 2016/06/14 18:40:01]

Done.

+ public:
+  ExpectStapleReport();
+  ~ExpectStapleReport();
+
+  // Stores the validity of a single stapled response.
+  struct SingleResult {
+    bool is_date_valid = false;
+    bool is_correct_certificate = false;
+    OCSPCertStatus::Status status = OCSPCertStatus::Status::UNKNOWN;
+  };
+
+  // Represents where the staple verification an error occured.

[estark, 2016/06/14 02:10:28]

typo; extra "an"?

[dadrian, 2016/06/14 18:40:01]

Done.

+  enum class StapleError {
+    OK = 0,
+    PARSE_RESPONSE = 1,
+    BAD_RESPONSE = 2,
+    PARSE_RESPONSE_DATA = 3,
+    PARSE_SINGLE_RESPONSE = 4,
+    NO_MATCHING_RESPONSE = 5
+  };
+
+  // Creates an ExpectStapleReport from an unparsed OCSP response.
+  // This compares the serial number of the certificate, and verifies that
+  // |verify_time| is within thisUpdate and nextUpdate, and that thisUpdate is
+  // at least as recent as |verify_time - max_age|.
+  //
+  // TODO(dadrian): Check issuer and signatures

[estark, 2016/06/14 02:10:28]

add a bug number please

[dadrian, 2016/06/14 18:40:01]

Done.

+  static std::unique_ptr<ExpectStapleReport> FromRawOCSPResponse(
+      const std::string raw_response,

[estark, 2016/06/14 02:10:28]

pass by reference here

[dadrian, 2016/06/14 18:40:01]

Done.

+      const base::Time& verify_time,
+      const base::TimeDelta& max_age,
+      const X509Certificate& server_certificate);
+
+  StapleError staple_error() const { return staple_error_; }
+
+  const std::vector<SingleResult>& stapled_responses() const {
+    return stapled_responses_;
+  }
+
+  const base::Time& verify_time() const { return verify_time_; }
+
+ private:
+  base::Time verify_time_;
+  StapleError staple_error_;
+  std::vector<SingleResult> stapled_responses_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExpectStapleReport);
+};
+
+}  // namespace net
+
+#endif /* NET_CERT_OCSP_STAPLE_H */