Cast device revocation checking.

components/cast_certificate/cast_crl.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_CAST_CERTIFICATE_CAST_CRL_H_
+#define COMPONENTS_CAST_CERTIFICATE_CAST_CRL_H_
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "base/compiler_specific.h"
+#include "base/memory/ref_counted.h"
+#include "base/time/time.h"
+
+namespace net {
+class ParsedCertificate;
+using ParsedCertificateList = std::vector<scoped_refptr<ParsedCertificate>>;
+}  // namespace net
+
+namespace cast_certificate {
+
+// This class represents the CRL information parsed from the binary proto.
+class CastCRL {
+ public:
+  virtual ~CastCRL(){};

[eroman, 2016/07/15 22:52:48]

space?
Suggest running "git cl format"

[ryanchung, 2016/07/18 23:39:08]

git cl format is removing the space. I don't know why.
Manually added space.

[eroman, 2016/07/19 01:54:59]

If that is what git cl does, then fine. No need to change
...I don't want to have to think about style formatting issues, am cool with
whatever tool does :)

+
+  // Verifies the revocation status of a cast device certificate given a chain
+  // of DER-encoded certificates.

[eroman, 2016/07/15 22:52:49]

nit on wording: Not sure "DER-encoded" needs to be part of that description.
ParsedCertificate to a large extend aims to abstract away the encoding of the
certificate.
Probably fine to just say "given a chain of X.509 certificates" or something.

[ryanchung, 2016/07/18 23:39:08]

Done.

+  //
+  // Inputs:
+  // * |certs| is the verified chain of DER-encoded certificates:

[eroman, 2016/07/15 22:52:49]

same here -- can leave off the "DER-encoded" 

[ryanchung, 2016/07/18 23:39:08]

Done.

+  //   * |certs[0]| is the target certificate (i.e. the device certificate)
+  //   * |certs[i]| is the certificate that issued certs[i-1]
+  //   * |certs.back()| must be trusted anchor.

[eroman, 2016/07/15 22:52:49]

nit: instead of "must be trusted anchor" how about "assumed to be a trusted
root"

[ryanchung, 2016/07/18 23:39:08]

Done.

+  //
+  // * |time| is the UTC time to use for determining if the certificate
+  //   is revoked.

[eroman, 2016/07/15 22:52:49]

Can you mention the return value?

"Returns true if no certificate in the chain was revoked"

[ryanchung, 2016/07/18 23:39:08]

Done.

+  virtual bool CheckRevocation(const net::ParsedCertificateList& certs,
+                               const base::Time::Exploded& time) const = 0;
+};
+
+// Parses and verifies the CRL used to verify the revocation status of
+// Cast device certificates.
+//
+// Inputs:
+// * |crl_proto| is a serialized cast_certificate.CrlBundle proto.
+// * |time| is the UTC time to use for determining if the CRL is valid.
+// Output:
+// Returns the CRL object if success, nullptr otherwise.
+std::unique_ptr<CastCRL> ParseAndVerifyCRL(const std::string& crl_proto,
+                                           const base::Time::Exploded& time);
+
+// Exposed only for testing, not for use in production code.
+//
+// Replaces trusted root certificates into the CastCRLTrustStore.
+bool SetCRLTrustAnchorForTest(const std::string& cert) WARN_UNUSED_RESULT;
+
+}  // namespace cast_certificate
+
+#endif  // COMPONENTS_CAST_CERTIFICATE_CAST_CRL_H_