| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef NET_CERT_CERT_VERIFY_PROC_H_ | |
| 6 #define NET_CERT_CERT_VERIFY_PROC_H_ | |
| 7 | |
| 8 #include <string> | |
| 9 #include <vector> | |
| 10 | |
| 11 #include "base/gtest_prod_util.h" | |
| 12 #include "base/memory/ref_counted.h" | |
| 13 #include "net/base/net_export.h" | |
| 14 #include "net/cert/x509_cert_types.h" | |
| 15 | |
| 16 namespace net { | |
| 17 | |
| 18 class CertVerifyResult; | |
| 19 class CRLSet; | |
| 20 class X509Certificate; | |
| 21 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList; | |
| 22 | |
| 23 // Class to perform certificate path building and verification for various | |
| 24 // certificate uses. All methods of this class must be thread-safe, as they | |
| 25 // may be called from various non-joinable worker threads. | |
| 26 class NET_EXPORT CertVerifyProc | |
| 27 : public base::RefCountedThreadSafe<CertVerifyProc> { | |
| 28 public: | |
| 29 // Creates and returns the default CertVerifyProc. | |
| 30 static CertVerifyProc* CreateDefault(); | |
| 31 | |
| 32 // Verifies the certificate against the given hostname as an SSL server | |
| 33 // certificate. Returns OK if successful or an error code upon failure. | |
| 34 // | |
| 35 // The |*verify_result| structure, including the |verify_result->cert_status| | |
| 36 // bitmask, is always filled out regardless of the return value. If the | |
| 37 // certificate has multiple errors, the corresponding status flags are set in | |
| 38 // |verify_result->cert_status|, and the error code for the most serious | |
| 39 // error is returned. | |
| 40 // | |
| 41 // |flags| is bitwise OR'd of VerifyFlags: | |
| 42 // | |
| 43 // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate | |
| 44 // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet | |
| 45 // based revocation checking is always enabled, regardless of this flag, if | |
| 46 // |crl_set| is given. | |
| 47 // | |
| 48 // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is | |
| 49 // performed. | |
| 50 // | |
| 51 // |crl_set| points to an optional CRLSet structure which can be used to | |
| 52 // avoid revocation checks over the network. | |
| 53 // | |
| 54 // |additional_trust_anchors| lists certificates that can be trusted when | |
| 55 // building a certificate chain, in addition to the anchors known to the | |
| 56 // implementation. | |
| 57 int Verify(X509Certificate* cert, | |
| 58 const std::string& hostname, | |
| 59 int flags, | |
| 60 CRLSet* crl_set, | |
| 61 const CertificateList& additional_trust_anchors, | |
| 62 CertVerifyResult* verify_result); | |
| 63 | |
| 64 // Returns true if the implementation supports passing additional trust | |
| 65 // anchors to the Verify() call. The |additional_trust_anchors| parameter | |
| 66 // passed to Verify() is ignored when this returns false. | |
| 67 virtual bool SupportsAdditionalTrustAnchors() const = 0; | |
| 68 | |
| 69 protected: | |
| 70 CertVerifyProc(); | |
| 71 virtual ~CertVerifyProc(); | |
| 72 | |
| 73 private: | |
| 74 friend class base::RefCountedThreadSafe<CertVerifyProc>; | |
| 75 FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts); | |
| 76 FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, TestHasTooLongValidity); | |
| 77 | |
| 78 // Performs the actual verification using the desired underlying | |
| 79 // cryptographic library. | |
| 80 virtual int VerifyInternal(X509Certificate* cert, | |
| 81 const std::string& hostname, | |
| 82 int flags, | |
| 83 CRLSet* crl_set, | |
| 84 const CertificateList& additional_trust_anchors, | |
| 85 CertVerifyResult* verify_result) = 0; | |
| 86 | |
| 87 // Returns true if |cert| is explicitly blacklisted. | |
| 88 static bool IsBlacklisted(X509Certificate* cert); | |
| 89 | |
| 90 // IsPublicKeyBlacklisted returns true iff one of |public_key_hashes| (which | |
| 91 // are hashes of SubjectPublicKeyInfo structures) is explicitly blocked. | |
| 92 static bool IsPublicKeyBlacklisted(const HashValueVector& public_key_hashes); | |
| 93 | |
| 94 // HasNameConstraintsViolation returns true iff one of |public_key_hashes| | |
| 95 // (which are hashes of SubjectPublicKeyInfo structures) has name constraints | |
| 96 // imposed on it and the names in |dns_names| are not permitted. | |
| 97 static bool HasNameConstraintsViolation( | |
| 98 const HashValueVector& public_key_hashes, | |
| 99 const std::string& common_name, | |
| 100 const std::vector<std::string>& dns_names, | |
| 101 const std::vector<std::string>& ip_addrs); | |
| 102 | |
| 103 // The CA/Browser Forum's Baseline Requirements specify maximum validity | |
| 104 // periods (https://cabforum.org/Baseline_Requirements_V1.pdf): | |
| 105 // | |
| 106 // For certificates issued after 1 July 2012: 60 months. | |
| 107 // For certificates issued after 1 April 2015: 39 months. | |
| 108 // | |
| 109 // For certificates issued before the BRs took effect, there were no | |
| 110 // guidelines, but clamp them at a maximum of 10 year validity, with the | |
| 111 // requirement they expire within 7 years after the effective date of the BRs | |
| 112 // (i.e. by 1 July 2019). | |
| 113 static bool HasTooLongValidity(const X509Certificate& cert); | |
| 114 | |
| 115 DISALLOW_COPY_AND_ASSIGN(CertVerifyProc); | |
| 116 }; | |
| 117 | |
| 118 } // namespace net | |
| 119 | |
| 120 #endif // NET_CERT_CERT_VERIFY_PROC_H_ | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master