OLD | NEW |
| (Empty) |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_CERT_CT_LOG_VERIFIER_H_ | |
6 #define NET_CERT_CT_LOG_VERIFIER_H_ | |
7 | |
8 #include <string> | |
9 | |
10 #include "base/gtest_prod_util.h" | |
11 #include "base/memory/scoped_ptr.h" | |
12 #include "base/strings/string_piece.h" | |
13 #include "net/base/net_export.h" | |
14 #include "net/cert/signed_certificate_timestamp.h" | |
15 | |
16 // Forward declare the crypto types to avoid having to include the full | |
17 // headers. | |
18 #if defined(USE_OPENSSL) | |
19 typedef struct evp_pkey_st EVP_PKEY; | |
20 #else | |
21 typedef struct SECKEYPublicKeyStr SECKEYPublicKey; | |
22 #endif | |
23 | |
24 namespace net { | |
25 | |
26 namespace ct { | |
27 struct SignedTreeHead; | |
28 } // namespace ct | |
29 | |
30 // Class for verifying Signed Certificate Timestamps (SCTs) provided by a | |
31 // specific log (whose identity is provided during construction). | |
32 class NET_EXPORT CTLogVerifier { | |
33 public: | |
34 // Creates a new CTLogVerifier that will verify SignedCertificateTimestamps | |
35 // using |public_key|, which is a DER-encoded SubjectPublicKeyInfo. | |
36 // If |public_key| refers to an unsupported public key, returns NULL. | |
37 // |description| is a textual description of the log. | |
38 static scoped_ptr<CTLogVerifier> Create( | |
39 const base::StringPiece& public_key, | |
40 const base::StringPiece& description); | |
41 | |
42 ~CTLogVerifier(); | |
43 | |
44 // Returns the log's key ID (RFC6962, Section 3.2) | |
45 const std::string& key_id() const { return key_id_; } | |
46 // Returns the log's human-readable description. | |
47 const std::string& description() const { return description_; } | |
48 | |
49 // Verifies that |sct| contains a valid signature for |entry|. | |
50 bool Verify(const ct::LogEntry& entry, | |
51 const ct::SignedCertificateTimestamp& sct); | |
52 | |
53 // Verifies and sets |signed_tree_head|. If |signed_tree_head|'s signature is | |
54 // valid, stores it and returns true. Otherwise, discards the sth and | |
55 // returns false. | |
56 bool SetSignedTreeHead(scoped_ptr<ct::SignedTreeHead> signed_tree_head); | |
57 | |
58 private: | |
59 FRIEND_TEST_ALL_PREFIXES(CTLogVerifierTest, VerifySignature); | |
60 | |
61 CTLogVerifier(); | |
62 | |
63 // Performs crypto-library specific initialization. | |
64 bool Init(const base::StringPiece& public_key, | |
65 const base::StringPiece& description); | |
66 | |
67 // Performs the underlying verification using the selected public key. Note | |
68 // that |signature| contains the raw signature data (eg: without any | |
69 // DigitallySigned struct encoding). | |
70 bool VerifySignature(const base::StringPiece& data_to_sign, | |
71 const base::StringPiece& signature); | |
72 | |
73 // Returns true if the signature and hash algorithms in |signature| | |
74 // match those of the log | |
75 bool SignatureParametersMatch(const ct::DigitallySigned& signature); | |
76 | |
77 std::string key_id_; | |
78 std::string description_; | |
79 ct::DigitallySigned::HashAlgorithm hash_algorithm_; | |
80 ct::DigitallySigned::SignatureAlgorithm signature_algorithm_; | |
81 scoped_ptr<ct::SignedTreeHead> signed_tree_head_; | |
82 | |
83 #if defined(USE_OPENSSL) | |
84 EVP_PKEY* public_key_; | |
85 #else | |
86 SECKEYPublicKey* public_key_; | |
87 #endif | |
88 }; | |
89 | |
90 } // namespace net | |
91 | |
92 #endif // NET_CERT_CT_LOG_VERIFIER_H_ | |
OLD | NEW |