OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_CERT_CRL_SET_H_ | 5 #ifndef NET_CERT_CRL_SET_H_ |
6 #define NET_CERT_CRL_SET_H_ | 6 #define NET_CERT_CRL_SET_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <string> | 9 #include <string> |
10 #include <utility> | 10 #include <utility> |
(...skipping 16 matching lines...) Expand all Loading... |
27 class NET_EXPORT CRLSet : public base::RefCountedThreadSafe<CRLSet> { | 27 class NET_EXPORT CRLSet : public base::RefCountedThreadSafe<CRLSet> { |
28 public: | 28 public: |
29 enum Result { | 29 enum Result { |
30 REVOKED, // the certificate should be rejected. | 30 REVOKED, // the certificate should be rejected. |
31 UNKNOWN, // the CRL for the certificate is not included in the set. | 31 UNKNOWN, // the CRL for the certificate is not included in the set. |
32 GOOD, // the certificate is not listed. | 32 GOOD, // the certificate is not listed. |
33 }; | 33 }; |
34 | 34 |
35 // Parse parses the bytes in |data| and, on success, puts a new CRLSet in | 35 // Parse parses the bytes in |data| and, on success, puts a new CRLSet in |
36 // |out_crl_set| and returns true. | 36 // |out_crl_set| and returns true. |
37 static bool Parse(base::StringPiece data, | 37 static bool Parse(base::StringPiece data, scoped_refptr<CRLSet>* out_crl_set); |
38 scoped_refptr<CRLSet>* out_crl_set); | |
39 | 38 |
40 // CheckSPKI checks whether the given SPKI has been listed as blocked. | 39 // CheckSPKI checks whether the given SPKI has been listed as blocked. |
41 // spki_hash: the SHA256 of the SubjectPublicKeyInfo of the certificate. | 40 // spki_hash: the SHA256 of the SubjectPublicKeyInfo of the certificate. |
42 Result CheckSPKI(const base::StringPiece& spki_hash) const; | 41 Result CheckSPKI(const base::StringPiece& spki_hash) const; |
43 | 42 |
44 // CheckSerial returns the information contained in the set for a given | 43 // CheckSerial returns the information contained in the set for a given |
45 // certificate: | 44 // certificate: |
46 // serial_number: the serial number of the certificate | 45 // serial_number: the serial number of the certificate |
47 // issuer_spki_hash: the SHA256 of the SubjectPublicKeyInfo of the CRL | 46 // issuer_spki_hash: the SHA256 of the SubjectPublicKeyInfo of the CRL |
48 // signer | 47 // signer |
49 Result CheckSerial( | 48 Result CheckSerial(const base::StringPiece& serial_number, |
50 const base::StringPiece& serial_number, | 49 const base::StringPiece& issuer_spki_hash) const; |
51 const base::StringPiece& issuer_spki_hash) const; | |
52 | 50 |
53 // IsExpired returns true iff the current time is past the NotAfter time | 51 // IsExpired returns true iff the current time is past the NotAfter time |
54 // specified in the CRLSet. | 52 // specified in the CRLSet. |
55 bool IsExpired() const; | 53 bool IsExpired() const; |
56 | 54 |
57 // ApplyDelta returns a new CRLSet in |out_crl_set| that is the result of | 55 // ApplyDelta returns a new CRLSet in |out_crl_set| that is the result of |
58 // updating the current CRL set with the delta information in |delta_bytes|. | 56 // updating the current CRL set with the delta information in |delta_bytes|. |
59 bool ApplyDelta(const base::StringPiece& delta_bytes, | 57 bool ApplyDelta(const base::StringPiece& delta_bytes, |
60 scoped_refptr<CRLSet>* out_crl_set); | 58 scoped_refptr<CRLSet>* out_crl_set); |
61 | 59 |
62 // GetIsDeltaUpdate extracts the header from |bytes|, sets *is_delta to | 60 // GetIsDeltaUpdate extracts the header from |bytes|, sets *is_delta to |
63 // whether |bytes| is a delta CRL set or not and returns true. In the event | 61 // whether |bytes| is a delta CRL set or not and returns true. In the event |
64 // of a parse error, it returns false. | 62 // of a parse error, it returns false. |
65 static bool GetIsDeltaUpdate(const base::StringPiece& bytes, bool *is_delta); | 63 static bool GetIsDeltaUpdate(const base::StringPiece& bytes, bool* is_delta); |
66 | 64 |
67 // Serialize returns a string of bytes suitable for passing to Parse. Parsing | 65 // Serialize returns a string of bytes suitable for passing to Parse. Parsing |
68 // and serializing a CRLSet is a lossless operation - the resulting bytes | 66 // and serializing a CRLSet is a lossless operation - the resulting bytes |
69 // will be equal. | 67 // will be equal. |
70 std::string Serialize() const; | 68 std::string Serialize() const; |
71 | 69 |
72 // sequence returns the sequence number of this CRL set. CRL sets generated | 70 // sequence returns the sequence number of this CRL set. CRL sets generated |
73 // by the same source are given strictly monotonically increasing sequence | 71 // by the same source are given strictly monotonically increasing sequence |
74 // numbers. | 72 // numbers. |
75 uint32 sequence() const; | 73 uint32 sequence() const; |
76 | 74 |
77 // CRLList contains a list of (issuer SPKI hash, revoked serial numbers) | 75 // CRLList contains a list of (issuer SPKI hash, revoked serial numbers) |
78 // pairs. | 76 // pairs. |
79 typedef std::vector< std::pair<std::string, std::vector<std::string> > > | 77 typedef std::vector<std::pair<std::string, std::vector<std::string> > > |
80 CRLList; | 78 CRLList; |
81 | 79 |
82 // crls returns the internal state of this CRLSet. It should only be used in | 80 // crls returns the internal state of this CRLSet. It should only be used in |
83 // testing. | 81 // testing. |
84 const CRLList& crls() const; | 82 const CRLList& crls() const; |
85 | 83 |
86 // EmptyCRLSetForTesting returns a valid, but empty, CRLSet for unit tests. | 84 // EmptyCRLSetForTesting returns a valid, but empty, CRLSet for unit tests. |
87 static CRLSet* EmptyCRLSetForTesting(); | 85 static CRLSet* EmptyCRLSetForTesting(); |
88 | 86 |
89 // ExpiredCRLSetForTesting returns a expired, empty CRLSet for unit tests. | 87 // ExpiredCRLSetForTesting returns a expired, empty CRLSet for unit tests. |
(...skipping 29 matching lines...) Expand all Loading... |
119 // to identify a CRL by index. | 117 // to identify a CRL by index. |
120 std::map<std::string, size_t> crls_index_by_issuer_; | 118 std::map<std::string, size_t> crls_index_by_issuer_; |
121 // blocked_spkis_ contains the SHA256 hashes of SPKIs which are to be blocked | 119 // blocked_spkis_ contains the SHA256 hashes of SPKIs which are to be blocked |
122 // no matter where in a certificate chain they might appear. | 120 // no matter where in a certificate chain they might appear. |
123 std::vector<std::string> blocked_spkis_; | 121 std::vector<std::string> blocked_spkis_; |
124 }; | 122 }; |
125 | 123 |
126 } // namespace net | 124 } // namespace net |
127 | 125 |
128 #endif // NET_CERT_CRL_SET_H_ | 126 #endif // NET_CERT_CRL_SET_H_ |
OLD | NEW |