Add OCSPVerifyResult for tracking stapled OCSP responses cross-platform.

net/cert/cert_verify_proc.cc

Index: net/cert/cert_verify_proc.cc
diff --git a/net/cert/cert_verify_proc.cc b/net/cert/cert_verify_proc.cc
index 49a170d3cb55b929e0659e6757b6f7089c3086ad..f9b1f9428caa1d0353778534a0cf57009f0b15ce 100644
--- a/net/cert/cert_verify_proc.cc
+++ b/net/cert/cert_verify_proc.cc
@@ -182,6 +182,69 @@ bool IsPastSHA1DeprecationDate(const X509Certificate& cert) {
   return start >= kSHA1DeprecationDate;
 }
 
+bool CompareCertIDToCertificate(const OCSPCertID& cert_id,

[svaldez, 2016/06/29 14:41:22]

Might need a different name, since this only returns equality, rather than other
comparisons.

[dadrian, 2016/06/30 21:52:42]

Done.

+                                const X509Certificate& certificate) {
+  // TODO(dadrian): Verify name and key hashes. https://crbug.com/620005
+  der::Input serial(&certificate.serial_number());
+  return serial == cert_id.serial_number;

[svaldez, 2016/06/29 14:41:22]

nit: Swap to match method name.

[dadrian, 2016/06/30 21:52:42]

Done.

+}
+
+void CheckOCSP(const std::string& raw_response,
+               CertVerifyResult* verify_result) {
+  verify_result->ocsp.Reset();
+
+  if (raw_response.empty()) {
+    verify_result->ocsp.response_status = OCSPVerifyResult::MISSING;
+    return;
+  }
+  der::Input response_der(&raw_response);
+
+  OCSPResponse response;
+  if (!ParseOCSPResponse(response_der, &response)) {
+    verify_result->ocsp.response_status = OCSPVerifyResult::PARSE_RESPONSE;
+    return;
+  }
+
+  // If the OCSP response isn't status SUCCESSFUL, don't parse the rest of the
+  // data.
+  if (response.status != OCSPResponse::ResponseStatus::SUCCESSFUL) {
+    verify_result->ocsp.response_status = OCSPVerifyResult::BAD_RESPONSE;
+    return;
+  }
+
+  OCSPResponseData response_data;
+  if (!ParseOCSPResponseData(response.data, &response_data)) {
+    verify_result->ocsp.response_status = OCSPVerifyResult::PARSE_RESPONSE_DATA;
+    return;
+  }
+
+  // TODO(svaldez): Unify with GetOCSPCertStatus.
+  base::Time verify_time = base::Time::Now();
+  base::TimeDelta max_age = base::TimeDelta::FromDays(7);
+  verify_result->ocsp.response_status = OCSPVerifyResult::NO_MATCHING_RESPONSE;
+  for (const auto& single_response_der : response_data.responses) {
+    OCSPSingleResponse single_response;
+    if (!ParseOCSPSingleResponse(single_response_der, &single_response))

[svaldez, 2016/06/29 14:41:22]

Should either of these be setting response_status? Seems like we also want to
keep metrics on "invalid" OCSP responses, even if they don't match the
certificate.

+      continue;
+    OCSPCertID cert_id;
+    if (!ParseOCSPCertID(single_response.cert_id_tlv, &cert_id))
+      continue;
+    if (!CompareCertIDToCertificate(cert_id, *verify_result->verified_cert))
+      continue;
+    if (!CheckOCSPDateValid(single_response, verify_time, max_age)) {
+      if (verify_result->ocsp.response_status != OCSPVerifyResult::PROVIDED)
+        verify_result->ocsp.response_status = OCSPVerifyResult::INVALID_DATE;
+      continue;
+    }
+    verify_result->ocsp.response_status = OCSPVerifyResult::PROVIDED;
+    if (single_response.cert_status.status >=
+        verify_result->ocsp.cert_status.value_or(
+            OCSPCertStatus::Status::GOOD)) {

[svaldez, 2016/06/29 14:41:22]

This really should use the same ordering from parse_ocsp.cc:519. Otherwise
UNKNOWN status will occlude a REVOKED status.

[dadrian, 2016/06/30 21:52:42]

Done.

+      verify_result->ocsp.cert_status = single_response.cert_status.status;
+    }
+  }
+}
+
 // Comparison functor used for binary searching whether a given HashValue,
 // which MUST be a SHA-256 hash, is contained with an array of SHA-256
 // hashes.
@@ -258,6 +321,9 @@ int CertVerifyProc::Verify(X509Certificate* cert,
                           verify_result->common_name_fallback_used);
   }
 
+  // Check OCSP information
+  CheckOCSP(ocsp_response, verify_result);
+
   // This check is done after VerifyInternal so that VerifyInternal can fill
   // in the list of public key hashes.
   if (IsPublicKeyBlacklisted(verify_result->public_key_hashes)) {