OLD | NEW |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_CERT_INTERNAL_PATH_BUILDER_H_ | 5 #ifndef NET_CERT_INTERNAL_PATH_BUILDER_H_ |
6 #define NET_CERT_INTERNAL_PATH_BUILDER_H_ | 6 #define NET_CERT_INTERNAL_PATH_BUILDER_H_ |
7 | 7 |
8 #include <memory> | 8 #include <memory> |
9 #include <string> | 9 #include <string> |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/callback.h" | |
13 #include "net/base/completion_callback.h" | |
14 #include "net/base/net_export.h" | 12 #include "net/base/net_export.h" |
15 #include "net/cert/internal/cert_errors.h" | 13 #include "net/cert/internal/cert_errors.h" |
16 #include "net/cert/internal/completion_status.h" | |
17 #include "net/cert/internal/parsed_certificate.h" | 14 #include "net/cert/internal/parsed_certificate.h" |
18 #include "net/cert/internal/trust_store.h" | 15 #include "net/cert/internal/trust_store.h" |
19 #include "net/der/input.h" | 16 #include "net/der/input.h" |
20 #include "net/der/parse_values.h" | 17 #include "net/der/parse_values.h" |
21 | 18 |
22 namespace net { | 19 namespace net { |
23 | 20 |
24 namespace der { | 21 namespace der { |
25 struct GeneralizedTime; | 22 struct GeneralizedTime; |
26 } | 23 } |
(...skipping 73 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
100 // better than invalid, but otherwise nothing is guaranteed. | 97 // better than invalid, but otherwise nothing is guaranteed. |
101 size_t best_result_index = 0; | 98 size_t best_result_index = 0; |
102 | 99 |
103 private: | 100 private: |
104 DISALLOW_COPY_AND_ASSIGN(Result); | 101 DISALLOW_COPY_AND_ASSIGN(Result); |
105 }; | 102 }; |
106 | 103 |
107 // TODO(mattm): allow caller specified hook/callback to extend path | 104 // TODO(mattm): allow caller specified hook/callback to extend path |
108 // verification. | 105 // verification. |
109 // | 106 // |
| 107 // TODO(eroman): The assumption is that |result| is default initialized. Can |
| 108 // probably just internalize |result| into CertPathBuilder. |
| 109 // |
110 // Creates a CertPathBuilder that attempts to find a path from |cert| to a | 110 // Creates a CertPathBuilder that attempts to find a path from |cert| to a |
111 // trust anchor in |trust_store|, which satisfies |signature_policy| and is | 111 // trust anchor in |trust_store|, which satisfies |signature_policy| and is |
112 // valid at |time|. Details of attempted path(s) are stored in |*result|. | 112 // valid at |time|. Details of attempted path(s) are stored in |*result|. |
113 // | 113 // |
114 // The caller must keep |trust_store|, |signature_policy|, and |*result| valid | 114 // The caller must keep |trust_store|, |signature_policy|, and |*result| valid |
115 // for the lifetime of the CertPathBuilder. | 115 // for the lifetime of the CertPathBuilder. |
116 CertPathBuilder(scoped_refptr<ParsedCertificate> cert, | 116 CertPathBuilder(scoped_refptr<ParsedCertificate> cert, |
117 const TrustStore* trust_store, | 117 const TrustStore* trust_store, |
118 const SignaturePolicy* signature_policy, | 118 const SignaturePolicy* signature_policy, |
119 const der::GeneralizedTime& time, | 119 const der::GeneralizedTime& time, |
120 Result* result); | 120 Result* result); |
121 ~CertPathBuilder(); | 121 ~CertPathBuilder(); |
122 | 122 |
123 // Adds a CertIssuerSource to provide intermediates for use in path building. | 123 // Adds a CertIssuerSource to provide intermediates for use in path building. |
124 // Multiple sources may be added. Must not be called after Run is called. | 124 // Multiple sources may be added. Must not be called after Run is called. |
125 // The |*cert_issuer_source| must remain valid for the lifetime of the | 125 // The |*cert_issuer_source| must remain valid for the lifetime of the |
126 // CertPathBuilder. | 126 // CertPathBuilder. |
127 // | 127 // |
128 // (If no issuer sources are added, the target certificate will only verify if | 128 // (If no issuer sources are added, the target certificate will only verify if |
129 // it is a trust anchor or is directly signed by a trust anchor.) | 129 // it is a trust anchor or is directly signed by a trust anchor.) |
130 void AddCertIssuerSource(CertIssuerSource* cert_issuer_source); | 130 void AddCertIssuerSource(CertIssuerSource* cert_issuer_source); |
131 | 131 |
132 // Begins verification of the target certificate. | 132 // Executes verification of the target certificate. |
133 // | 133 // |
134 // If the return value is SYNC then the verification is complete and the | 134 // Upon return results are written to the |result| object passed into the |
135 // |result| value can be inspected for the status, and |callback| will not be | 135 // constructor. Run must not be called more than once on each CertPathBuilder |
136 // called. | 136 // instance. |
137 // If the return value is ASYNC, the |callback| will be called asynchronously | 137 void Run(); |
138 // once the verification is complete. |result| should not be examined or | |
139 // modified until the |callback| is run. | |
140 // | |
141 // If |callback| is null, verification always completes synchronously, even if | |
142 // it fails to find a valid path and one could have been found asynchronously. | |
143 // | |
144 // The CertPathBuilder may be deleted while an ASYNC verification is pending, | |
145 // in which case the verification is cancelled, |callback| will not be called, | |
146 // and the output Result will be in an undefined state. | |
147 // It is safe to delete the CertPathBuilder during the |callback|. | |
148 // Run must not be called more than once on each CertPathBuilder instance. | |
149 CompletionStatus Run(const base::Closure& callback); | |
150 | 138 |
151 private: | 139 private: |
152 enum State { | 140 enum State { |
153 STATE_NONE, | 141 STATE_NONE, |
154 STATE_GET_NEXT_PATH, | 142 STATE_GET_NEXT_PATH, |
155 STATE_GET_NEXT_PATH_COMPLETE, | 143 STATE_GET_NEXT_PATH_COMPLETE, |
156 }; | 144 }; |
157 | 145 |
158 CompletionStatus DoLoop(bool allow_async); | 146 void DoGetNextPath(); |
159 | 147 void DoGetNextPathComplete(); |
160 CompletionStatus DoGetNextPath(bool allow_async); | |
161 void HandleGotNextPath(); | |
162 CompletionStatus DoGetNextPathComplete(); | |
163 | 148 |
164 void AddResultPath(std::unique_ptr<ResultPath> result_path); | 149 void AddResultPath(std::unique_ptr<ResultPath> result_path); |
165 | 150 |
166 base::Closure callback_; | |
167 | |
168 std::unique_ptr<CertPathIter> cert_path_iter_; | 151 std::unique_ptr<CertPathIter> cert_path_iter_; |
169 const SignaturePolicy* signature_policy_; | 152 const SignaturePolicy* signature_policy_; |
170 const der::GeneralizedTime time_; | 153 const der::GeneralizedTime time_; |
171 | 154 |
172 // Stores the next complete path to attempt verification on. This is filled in | 155 // Stores the next complete path to attempt verification on. This is filled in |
173 // by |cert_path_iter_| during the STATE_GET_NEXT_PATH step, and thus should | 156 // by |cert_path_iter_| during the STATE_GET_NEXT_PATH step, and thus should |
174 // only be accessed during the STATE_GET_NEXT_PATH_COMPLETE step. | 157 // only be accessed during the STATE_GET_NEXT_PATH_COMPLETE step. |
175 // (Will be empty if all paths have been tried, otherwise will be a candidate | 158 // (Will be empty if all paths have been tried, otherwise will be a candidate |
176 // path starting with the target cert and ending with a | 159 // path starting with the target cert and ending with a |
177 // certificate issued by trust anchor.) | 160 // certificate issued by trust anchor.) |
178 CertPath next_path_; | 161 CertPath next_path_; |
179 State next_state_; | 162 State next_state_; |
180 | 163 |
181 Result* out_result_; | 164 Result* out_result_; |
182 | 165 |
183 DISALLOW_COPY_AND_ASSIGN(CertPathBuilder); | 166 DISALLOW_COPY_AND_ASSIGN(CertPathBuilder); |
184 }; | 167 }; |
185 | 168 |
186 } // namespace net | 169 } // namespace net |
187 | 170 |
188 #endif // NET_CERT_INTERNAL_PATH_BUILDER_H_ | 171 #endif // NET_CERT_INTERNAL_PATH_BUILDER_H_ |
OLD | NEW |