| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef NET_CERT_INTERNAL_PATH_BUILDER_H_ | 5 #ifndef NET_CERT_INTERNAL_PATH_BUILDER_H_ |
| 6 #define NET_CERT_INTERNAL_PATH_BUILDER_H_ | 6 #define NET_CERT_INTERNAL_PATH_BUILDER_H_ |
| 7 | 7 |
| 8 #include <memory> | 8 #include <memory> |
| 9 #include <string> | 9 #include <string> |
| 10 #include <vector> | 10 #include <vector> |
| 11 | 11 |
| 12 #include "base/callback.h" | |
| 13 #include "net/base/completion_callback.h" | |
| 14 #include "net/base/net_export.h" | 12 #include "net/base/net_export.h" |
| 15 #include "net/cert/internal/cert_errors.h" | 13 #include "net/cert/internal/cert_errors.h" |
| 16 #include "net/cert/internal/completion_status.h" | |
| 17 #include "net/cert/internal/parsed_certificate.h" | 14 #include "net/cert/internal/parsed_certificate.h" |
| 18 #include "net/cert/internal/trust_store.h" | 15 #include "net/cert/internal/trust_store.h" |
| 19 #include "net/der/input.h" | 16 #include "net/der/input.h" |
| 20 #include "net/der/parse_values.h" | 17 #include "net/der/parse_values.h" |
| 21 | 18 |
| 22 namespace net { | 19 namespace net { |
| 23 | 20 |
| 24 namespace der { | 21 namespace der { |
| 25 struct GeneralizedTime; | 22 struct GeneralizedTime; |
| 26 } | 23 } |
| (...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 100 // better than invalid, but otherwise nothing is guaranteed. | 97 // better than invalid, but otherwise nothing is guaranteed. |
| 101 size_t best_result_index = 0; | 98 size_t best_result_index = 0; |
| 102 | 99 |
| 103 private: | 100 private: |
| 104 DISALLOW_COPY_AND_ASSIGN(Result); | 101 DISALLOW_COPY_AND_ASSIGN(Result); |
| 105 }; | 102 }; |
| 106 | 103 |
| 107 // TODO(mattm): allow caller specified hook/callback to extend path | 104 // TODO(mattm): allow caller specified hook/callback to extend path |
| 108 // verification. | 105 // verification. |
| 109 // | 106 // |
| 107 // TODO(eroman): The assumption is that |result| is default initialized. Can |
| 108 // probably just internalize |result| into CertPathBuilder. |
| 109 // |
| 110 // Creates a CertPathBuilder that attempts to find a path from |cert| to a | 110 // Creates a CertPathBuilder that attempts to find a path from |cert| to a |
| 111 // trust anchor in |trust_store|, which satisfies |signature_policy| and is | 111 // trust anchor in |trust_store|, which satisfies |signature_policy| and is |
| 112 // valid at |time|. Details of attempted path(s) are stored in |*result|. | 112 // valid at |time|. Details of attempted path(s) are stored in |*result|. |
| 113 // | 113 // |
| 114 // The caller must keep |trust_store|, |signature_policy|, and |*result| valid | 114 // The caller must keep |trust_store|, |signature_policy|, and |*result| valid |
| 115 // for the lifetime of the CertPathBuilder. | 115 // for the lifetime of the CertPathBuilder. |
| 116 CertPathBuilder(scoped_refptr<ParsedCertificate> cert, | 116 CertPathBuilder(scoped_refptr<ParsedCertificate> cert, |
| 117 const TrustStore* trust_store, | 117 const TrustStore* trust_store, |
| 118 const SignaturePolicy* signature_policy, | 118 const SignaturePolicy* signature_policy, |
| 119 const der::GeneralizedTime& time, | 119 const der::GeneralizedTime& time, |
| 120 Result* result); | 120 Result* result); |
| 121 ~CertPathBuilder(); | 121 ~CertPathBuilder(); |
| 122 | 122 |
| 123 // Adds a CertIssuerSource to provide intermediates for use in path building. | 123 // Adds a CertIssuerSource to provide intermediates for use in path building. |
| 124 // Multiple sources may be added. Must not be called after Run is called. | 124 // Multiple sources may be added. Must not be called after Run is called. |
| 125 // The |*cert_issuer_source| must remain valid for the lifetime of the | 125 // The |*cert_issuer_source| must remain valid for the lifetime of the |
| 126 // CertPathBuilder. | 126 // CertPathBuilder. |
| 127 // | 127 // |
| 128 // (If no issuer sources are added, the target certificate will only verify if | 128 // (If no issuer sources are added, the target certificate will only verify if |
| 129 // it is a trust anchor or is directly signed by a trust anchor.) | 129 // it is a trust anchor or is directly signed by a trust anchor.) |
| 130 void AddCertIssuerSource(CertIssuerSource* cert_issuer_source); | 130 void AddCertIssuerSource(CertIssuerSource* cert_issuer_source); |
| 131 | 131 |
| 132 // Begins verification of the target certificate. | 132 // Executes verification of the target certificate. |
| 133 // | 133 // |
| 134 // If the return value is SYNC then the verification is complete and the | 134 // Upon return results are written to the |result| object passed into the |
| 135 // |result| value can be inspected for the status, and |callback| will not be | 135 // constructor. Run must not be called more than once on each CertPathBuilder |
| 136 // called. | 136 // instance. |
| 137 // If the return value is ASYNC, the |callback| will be called asynchronously | 137 void Run(); |
| 138 // once the verification is complete. |result| should not be examined or | |
| 139 // modified until the |callback| is run. | |
| 140 // | |
| 141 // If |callback| is null, verification always completes synchronously, even if | |
| 142 // it fails to find a valid path and one could have been found asynchronously. | |
| 143 // | |
| 144 // The CertPathBuilder may be deleted while an ASYNC verification is pending, | |
| 145 // in which case the verification is cancelled, |callback| will not be called, | |
| 146 // and the output Result will be in an undefined state. | |
| 147 // It is safe to delete the CertPathBuilder during the |callback|. | |
| 148 // Run must not be called more than once on each CertPathBuilder instance. | |
| 149 CompletionStatus Run(const base::Closure& callback); | |
| 150 | 138 |
| 151 private: | 139 private: |
| 152 enum State { | 140 enum State { |
| 153 STATE_NONE, | 141 STATE_NONE, |
| 154 STATE_GET_NEXT_PATH, | 142 STATE_GET_NEXT_PATH, |
| 155 STATE_GET_NEXT_PATH_COMPLETE, | 143 STATE_GET_NEXT_PATH_COMPLETE, |
| 156 }; | 144 }; |
| 157 | 145 |
| 158 CompletionStatus DoLoop(bool allow_async); | 146 void DoGetNextPath(); |
| 159 | 147 void DoGetNextPathComplete(); |
| 160 CompletionStatus DoGetNextPath(bool allow_async); | |
| 161 void HandleGotNextPath(); | |
| 162 CompletionStatus DoGetNextPathComplete(); | |
| 163 | 148 |
| 164 void AddResultPath(std::unique_ptr<ResultPath> result_path); | 149 void AddResultPath(std::unique_ptr<ResultPath> result_path); |
| 165 | 150 |
| 166 base::Closure callback_; | |
| 167 | |
| 168 std::unique_ptr<CertPathIter> cert_path_iter_; | 151 std::unique_ptr<CertPathIter> cert_path_iter_; |
| 169 const SignaturePolicy* signature_policy_; | 152 const SignaturePolicy* signature_policy_; |
| 170 const der::GeneralizedTime time_; | 153 const der::GeneralizedTime time_; |
| 171 | 154 |
| 172 // Stores the next complete path to attempt verification on. This is filled in | 155 // Stores the next complete path to attempt verification on. This is filled in |
| 173 // by |cert_path_iter_| during the STATE_GET_NEXT_PATH step, and thus should | 156 // by |cert_path_iter_| during the STATE_GET_NEXT_PATH step, and thus should |
| 174 // only be accessed during the STATE_GET_NEXT_PATH_COMPLETE step. | 157 // only be accessed during the STATE_GET_NEXT_PATH_COMPLETE step. |
| 175 // (Will be empty if all paths have been tried, otherwise will be a candidate | 158 // (Will be empty if all paths have been tried, otherwise will be a candidate |
| 176 // path starting with the target cert and ending with a | 159 // path starting with the target cert and ending with a |
| 177 // certificate issued by trust anchor.) | 160 // certificate issued by trust anchor.) |
| 178 CertPath next_path_; | 161 CertPath next_path_; |
| 179 State next_state_; | 162 State next_state_; |
| 180 | 163 |
| 181 Result* out_result_; | 164 Result* out_result_; |
| 182 | 165 |
| 183 DISALLOW_COPY_AND_ASSIGN(CertPathBuilder); | 166 DISALLOW_COPY_AND_ASSIGN(CertPathBuilder); |
| 184 }; | 167 }; |
| 185 | 168 |
| 186 } // namespace net | 169 } // namespace net |
| 187 | 170 |
| 188 #endif // NET_CERT_INTERNAL_PATH_BUILDER_H_ | 171 #endif // NET_CERT_INTERNAL_PATH_BUILDER_H_ |
| OLD | NEW |