Index: net/cert/expect_staple_report.h |
diff --git a/net/cert/expect_staple_report.h b/net/cert/expect_staple_report.h |
new file mode 100644 |
index 0000000000000000000000000000000000000000..e307d1cbc3123bca704749ecc54b3faeee343a2a |
--- /dev/null |
+++ b/net/cert/expect_staple_report.h |
@@ -0,0 +1,73 @@ |
+// Copyright 2016 The Chromium Authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+#ifndef NET_CERT_EXPECT_STAPLE_REPORT_H |
+#define NET_CERT_EXPECT_STAPLE_REPORT_H |
+ |
+#include <memory> |
+ |
+#include "base/macros.h" |
+#include "base/time/time.h" |
+#include "net/base/net_export.h" |
+#include "net/cert/internal/parse_ocsp.h" |
+#include "net/cert/x509_certificate.h" |
+ |
+namespace net { |
+ |
+// An ExpectStapleReport is used to determine if a stapled OCSP response is |
+// valid for a given certificate, and contains all the information needed to |
+// construct a report payload for sites opting into Expect-Staple. |
+class NET_EXPORT ExpectStapleReport { |
+ public: |
+ ExpectStapleReport(); |
+ ~ExpectStapleReport(); |
+ |
+ // Stores the validity of a single stapled response. |
+ struct SingleResult { |
+ bool is_date_valid = false; |
+ bool is_correct_certificate = false; |
+ OCSPCertStatus::Status status = OCSPCertStatus::Status::UNKNOWN; |
+ }; |
+ |
+ // Represents where during the staple verification an error occurred. |
+ enum class StapleError { |
+ OK, |
+ PARSE_RESPONSE, |
+ BAD_RESPONSE, |
+ PARSE_RESPONSE_DATA, |
+ PARSE_SINGLE_RESPONSE, |
+ NO_MATCHING_RESPONSE, |
+ }; |
+ |
+ // Creates an ExpectStapleReport from an unparsed OCSP response. |
+ // This compares the serial number of the certificate, and verifies that |
+ // |verify_time| is within thisUpdate and nextUpdate, and that thisUpdate is |
+ // at least as recent as |verify_time - max_age|. |
+ // |
+ // TODO(dadrian): Check issuer and signatures. https://crbug.com/620005 |
+ static std::unique_ptr<ExpectStapleReport> FromRawOCSPResponse( |
+ const std::string& raw_response, |
+ const base::Time& verify_time, |
+ const base::TimeDelta& max_age, |
+ const X509Certificate& server_certificate); |
+ |
+ StapleError staple_error() const { return staple_error_; } |
+ |
+ const std::vector<SingleResult>& stapled_responses() const { |
+ return stapled_responses_; |
+ } |
+ |
svaldez
2016/06/16 11:14:38
nit: You probably want the accessors in the same o
dadrian
2016/06/16 19:20:18
Done.
|
+ const base::Time& verify_time() const { return verify_time_; } |
+ |
+ private: |
+ base::Time verify_time_; |
+ StapleError staple_error_; |
+ std::vector<SingleResult> stapled_responses_; |
+ |
+ DISALLOW_COPY_AND_ASSIGN(ExpectStapleReport); |
+}; |
+ |
+} // namespace net |
+ |
+#endif /* NET_CERT_EXPECT_STAPLE_REPORT_H */ |