Add OCSPVerifyResult for tracking stapled OCSP responses cross-platform.

net/cert/internal/parse_ocsp.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "base/sha1.h"
 #include "crypto/sha2.h"
 #include "net/cert/internal/parse_ocsp.h"
 #include "net/der/encode_values.h"
@@ skipping 110 matching lines @@
 // UnknownInfo ::= NULL
 bool ParseCertStatus(const der::Input& raw_tlv, OCSPCertStatus* out) {
   der::Parser parser(raw_tlv);
   der::Tag status_tag;
   der::Input status;
   if (!parser.ReadTagAndValue(&status_tag, &status))
     return false;
 
   out->has_reason = false;
   if (status_tag == der::ContextSpecificPrimitive(0)) {
-    out->status = OCSPCertStatus::Status::GOOD;
+    out->status = OCSPRevocationStatus::GOOD;
   } else if (status_tag == der::ContextSpecificConstructed(1)) {
-    out->status = OCSPCertStatus::Status::REVOKED;
+    out->status = OCSPRevocationStatus::REVOKED;
     if (!ParseRevokedInfo(status, out))
       return false;
   } else if (status_tag == der::ContextSpecificPrimitive(2)) {
-    out->status = OCSPCertStatus::Status::UNKNOWN;
+    out->status = OCSPRevocationStatus::UNKNOWN;
   } else {
     return false;
   }
 
   return !parser.HasMore();
 }
 
 }  // namespace
 
 // SingleResponse ::= SEQUENCE {
@@ skipping 342 matching lines @@
 
   return id.serial_number == serial_number;
 }
 
 }  // namespace
 
 bool GetOCSPCertStatus(const OCSPResponseData& response_data,
                        const der::Input& issuer_tbs_certificate_tlv,
                        const der::Input& cert_tbs_certificate_tlv,
                        OCSPCertStatus* out) {
-  out->status = OCSPCertStatus::Status::GOOD;
+  out->status = OCSPRevocationStatus::GOOD;
 
   ParsedTbsCertificate tbs_cert;
   if (!ParseTbsCertificate(cert_tbs_certificate_tlv, {}, &tbs_cert))
     return false;
   ParsedTbsCertificate issuer_tbs_cert;
   if (!ParseTbsCertificate(issuer_tbs_certificate_tlv, {}, &issuer_tbs_cert))
     return false;
 
   bool found = false;
   for (const auto& response : response_data.responses) {
     OCSPSingleResponse single_response;
     if (!ParseOCSPSingleResponse(response, &single_response))
       return false;
     if (CheckCertID(single_response.cert_id_tlv, tbs_cert, issuer_tbs_cert,
                     tbs_cert.serial_number)) {
       OCSPCertStatus new_status = single_response.cert_status;
       found = true;
       // In the case that we receive multiple responses, we keep only the
       // strictest status (REVOKED > UNKNOWN > GOOD).
-      if (out->status == OCSPCertStatus::Status::GOOD ||
-          new_status.status == OCSPCertStatus::Status::REVOKED) {
+      if (out->status == OCSPRevocationStatus::GOOD ||
+          new_status.status == OCSPRevocationStatus::REVOKED) {
         *out = new_status;
       }
     }
   }
 
   if (!found)
-    out->status = OCSPCertStatus::Status::UNKNOWN;
+    out->status = OCSPRevocationStatus::UNKNOWN;
 
   return found;
 }
 
 bool CheckOCSPDateValid(const OCSPSingleResponse& response,
                         const base::Time& verify_time,
                         const base::TimeDelta& max_age) {
   der::GeneralizedTime verify_time_der;
   if (!der::EncodeTimeAsGeneralizedTime(verify_time, &verify_time_der))
     return false;
 
   if (response.this_update > verify_time_der)
     return false;  // Response is not yet valid.
 
   if (response.has_next_update && (response.next_update <= verify_time_der))
     return false;  // Response is no longer valid.
 
   der::GeneralizedTime earliest_this_update;
   if (!der::EncodeTimeAsGeneralizedTime(verify_time - max_age,
                                         &earliest_this_update)) {
     return false;
   }
   if (response.this_update < earliest_this_update)
     return false;  // Response is too old.
 
   return true;
 }
 
 }  // namespace net