Implement Expect-Staple

net/cert/ocsp_verify_result.h

Index: net/cert/ocsp_verify_result.h
diff --git a/net/cert/ocsp_verify_result.h b/net/cert/ocsp_verify_result.h
new file mode 100644
index 0000000000000000000000000000000000000000..6a27d6ff15fa1b45ff238d16615aaa1c3155d3ff
--- /dev/null
+++ b/net/cert/ocsp_verify_result.h
@@ -0,0 +1,65 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_OCSP_VERIFY_RESULT_H
+#define NET_CERT_OCSP_VERIFY_RESULT_H
+
+#include <vector>
+
+#include "base/optional.h"
+#include "net/base/net_export.h"
+#include "net/cert/internal/parse_ocsp.h"
+
+namespace net {
+
+class NET_EXPORT OCSPVerifyResult {
+ public:
+  OCSPVerifyResult();
+  OCSPVerifyResult(const OCSPVerifyResult&);
+  ~OCSPVerifyResult();
+
+  void Reset();
+
+  enum ResponseStatus {
+    // No OCSPResponse was stapled.
+    MISSING,
+
+    // An OCSP response was stapled and matched the certificate.
+    PROVIDED,
+
+    // The stapled OCSP response did not have a SUCCESFUL status.
+    BAD_RESPONSE,
+
+    // At least one OCSPSingleResponse was stapled, but none matched the
+    // certificate.
+    NO_MATCHING_RESPONSE,
+
+    // The OCSPResponse structure could not be parsed.
+    PARSE_RESPONSE,
+
+    // The OCSPResponseData structure could not be parsed.
+    PARSE_RESPONSE_DATA,
+  };
+
+  // Stores the validity of a stapled OCSPSingleResponse.
+  struct SingleResult {
+    bool did_parse = false;
+    bool is_date_valid = false;
+    bool is_correct_certificate = false;
+    OCSPCertStatus::Status status = OCSPCertStatus::Status::UNKNOWN;
+  };
+
+  ResponseStatus response_status;
+
+  // The strictest CertStatus matching the certificate. Only present if
+  // |response_status| = OK.
+  base::Optional<OCSPCertStatus::Status> cert_status;

[Ryan Sleevi, 2016/06/23 22:11:52]

Reviewer Feels time: I'd really love to avoid introducing base::Optional into
net/. I think it's a mistake (in boost and C++17) and one of those things that I
think is really gross that we did in //base anyways but that doesn't mean it's
all that nice.

+
+  // Any stapled responses.

[Ryan Sleevi, 2016/06/23 22:11:52]

From the doc and discussion with Emily, I think this bears clarifying a bit more
what you're talking about (e.g. is this the BasicResponse data, etc).

When in doubt, cite RFC :)

+  std::vector<SingleResult> stapled_responses;
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_OCSP_VERIFY_RESULT_H