Add OCSPVerifyResult for tracking stapled OCSP responses cross-platform.

net/test/spawned_test_server/base_test_server.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_TEST_SPAWNED_TEST_SERVER_BASE_TEST_SERVER_H_
 #define NET_TEST_SPAWNED_TEST_SERVER_BASE_TEST_SERVER_H_
 
 #include <stdint.h>
 
 #include <memory>
@@ skipping 63 matching lines @@
       // A certificate with invalid notBefore and notAfter times. Windows'
       // certificate library will not parse this certificate.
       CERT_BAD_VALIDITY,
     };
 
     // OCSPStatus enumerates the types of OCSP response that the testserver
     // can produce.
     enum OCSPStatus {
       OCSP_OK,
       OCSP_REVOKED,
-      OCSP_INVALID,
+      OCSP_INVALID_RESPONSE,
       OCSP_UNAUTHORIZED,
       OCSP_UNKNOWN,
+      OCSP_INVALID_RESPONSE_DATA,
+      OCSP_TRY_LATER,
+      OCSP_MISMATCHED_SERIAL,
+    };
+
+    // OCSPDate enumerates the date ranges for OCSP responses that the
+    // testserver can produce.
+    enum OCSPDate {
+      OCSP_DATE_VALID,
+      OCSP_DATE_OLD,
+      OCSP_DATE_EARLY,
+      OCSP_DATE_LONG,
+    };
+
+    // SingleResponse is used when specifying multiple stapled responses, each
+    // with their own CertStatus and date validity.
+    struct SingleResponse {

[Ryan Sleevi, 2016/07/18 20:08:08]

Naming: OCSPSingleResponse - since this is very much an OCSP concept.

[dadrian, 2016/07/18 22:23:32]

Done.

Although now the full type is SpawnedTestServer::SSLOptions::OCSPSingleResponse,
which is a bit of mouthful.

+      OCSPStatus status;
+      OCSPDate date;
+    };
+
+    // OCSPProduced enumerates the validity of the producedAt field in OCSP
+    // responses produced by the testserver.
+    enum OCSPProduced {
+      OCSP_PRODUCED_VALID,
+      OCSP_PRODUCED_BEFORE_CERT,
+      OCSP_PRODUCED_AFTER_CERT,
     };
 
     // Bitmask of key exchange algorithms that the test server supports and that
     // can be selectively enabled or disabled.
     enum KeyExchange {
       // Special value used to indicate that any algorithm the server supports
       // is acceptable. Preferred over explicitly OR-ing all key exchange
       // algorithms.
       KEY_EXCHANGE_ANY = 0,
 
@@ skipping 47 matching lines @@
     ~SSLOptions();
 
     // Returns the relative filename of the file that contains the
     // |server_certificate|.
     base::FilePath GetCertificateFile() const;
 
     // GetOCSPArgument returns the value of any OCSP argument to testserver or
     // the empty string if there is none.
     std::string GetOCSPArgument() const;
 
+    // GetOCSPDateArgument returns the value of the OCSP date argument to
+    // testserver or the empty string if there is none.
+    std::string GetOCSPDateArgument() const;
+
+    // GetOCSPProducedArgument returns the value of the OCSP produced argument
+    // to testserver or the empty string if there is none.
+    std::string GetOCSPProducedArgument() const;
+
     // The certificate to use when serving requests.
     ServerCertificate server_certificate;
 
     // If |server_certificate==CERT_AUTO| then this determines the type of OCSP
-    // response returned.
+    // response returned. Ignored if |ocsp_responses| is non-empty.
     OCSPStatus ocsp_status;
 
+    // If |server_certificate==CERT_AUTO| then this determines the date range
+    // set on the OCSP response returned. Ignore if |ocsp_responses| is
+    // non-empty.
+    OCSPDate ocsp_date;
+
+    // If |server_certificate==CERT_AUTO|, contains the status and validity for
+    // multiple stapled responeses. Overrides |ocsp_status| and |ocsp_date| when
+    // non-empty.
+    std::vector<SingleResponse> ocsp_responses;
+
+    // If |server_certificate==CERT_AUTO| then this determines the validity of
+    // the producedAt field on the returned OCSP response.
+    OCSPProduced ocsp_produced;
+
     // If not zero, |cert_serial| will be the serial number of the
     // auto-generated leaf certificate when |server_certificate==CERT_AUTO|.
     uint64_t cert_serial;
 
     // True if a CertificateRequest should be sent to the client during
     // handshaking.
     bool request_client_certificate;
 
     // If |request_client_certificate| is true, an optional list of files,
     // each containing a single, PEM-encoded X.509 certificates. The subject
@@ skipping 193 matching lines @@
   bool no_anonymous_ftp_user_;
 
   std::unique_ptr<ScopedPortException> allowed_port_;
 
   DISALLOW_COPY_AND_ASSIGN(BaseTestServer);
 };
 
 }  // namespace net
 
 #endif  // NET_TEST_SPAWNED_TEST_SERVER_BASE_TEST_SERVER_H_