OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 #ifndef NET_CERT_CERT_POLICY_ENFORCER_H | |
5 #define NET_CERT_CERT_POLICY_ENFORCER_H | |
6 | |
7 #include <stddef.h> | |
8 | |
9 #include "net/base/net_export.h" | |
10 | |
11 namespace net { | |
12 | |
13 namespace ct { | |
14 struct CTVerifyResult; | |
15 class EVCertsWhitelist; | |
16 } // namespace ct | |
Ryan Sleevi
2014/11/06 00:16:43
newline before 14 & after 15
Eran Messeri
2014/11/20 11:49:56
Done.
| |
17 | |
18 class X509Certificate; | |
19 | |
20 // Class for checking that a given certificate conforms to security-related | |
21 // policies. | |
22 class NET_EXPORT CertPolicyEnforcer { | |
23 public: | |
24 // Set the parameters for this policy enforcer: | |
25 // |num_ct_logs| is the number of Certificate Transparency log currently | |
26 // known to Chrome. | |
27 // |require_ct_for_ev| indicates whether Certificate Transparency presence | |
28 // is required for EV certificates. | |
29 CertPolicyEnforcer(size_t num_ct_logs, bool require_ct_for_ev); | |
Ryan Sleevi
2014/11/06 00:16:43
You can drop the bool now, explicit CertPolicyEnfo
Eran Messeri
2014/11/20 11:49:56
Will do when we use Finch.
Eran Messeri
2014/11/20 11:49:56
Will do, when I introduce Finch.
| |
30 virtual ~CertPolicyEnforcer(); | |
31 | |
32 // Returns true if the collection of SCTs for the given certificate | |
33 // conforms with the CT/EV policy and CT presence is required for EV | |
34 // certificates (as indicated in the c'tor). | |
35 // |cert| is the certificate for which the SCTs apply (this is needed | |
36 // to determine the certificate's lifetime). | |
37 // |ct_result| is the CTVerifyResult filled in by the Verify call. | |
38 bool DoesConformToCTEVPolicy(X509Certificate* cert, | |
39 const ct::EVCertsWhitelist* ev_whitelist, | |
40 // TODO(eranm): Add netlog | |
Ryan Sleevi
2014/11/06 00:16:43
Move the TODO to line 37, add a bug #
Eran Messeri
2014/11/20 11:49:56
Removed; turns out I don't need the NetLog here.
| |
41 const ct::CTVerifyResult& ct_result); | |
42 | |
43 private: | |
44 size_t num_ct_logs_; | |
45 bool enforce_ct_requirement_; | |
46 }; | |
47 | |
48 } // namespace net | |
49 | |
50 #endif // NET_CERT_CERT_POLICY_ENFORCER_H | |
OLD | NEW |