| Index: net/cert/cert_verifier.h
|
| diff --git a/net/cert/cert_verifier.h b/net/cert/cert_verifier.h
|
| deleted file mode 100644
|
| index 743c8350b271e414babcef1171557833b3d0f1b6..0000000000000000000000000000000000000000
|
| --- a/net/cert/cert_verifier.h
|
| +++ /dev/null
|
| @@ -1,124 +0,0 @@
|
| -// Copyright (c) 2012 The Chromium Authors. All rights reserved.
|
| -// Use of this source code is governed by a BSD-style license that can be
|
| -// found in the LICENSE file.
|
| -
|
| -#ifndef NET_CERT_CERT_VERIFIER_H_
|
| -#define NET_CERT_CERT_VERIFIER_H_
|
| -
|
| -#include <string>
|
| -
|
| -#include "base/basictypes.h"
|
| -#include "net/base/completion_callback.h"
|
| -#include "net/base/net_export.h"
|
| -
|
| -namespace net {
|
| -
|
| -class BoundNetLog;
|
| -class CertVerifyResult;
|
| -class CRLSet;
|
| -class X509Certificate;
|
| -
|
| -// CertVerifier represents a service for verifying certificates.
|
| -//
|
| -// CertVerifiers can handle multiple requests at a time. A simpler alternative
|
| -// for consumers that only have 1 outstanding request at a time is to create a
|
| -// SingleRequestCertVerifier wrapper around CertVerifier (which will
|
| -// automatically cancel the single request when it goes out of scope).
|
| -class NET_EXPORT CertVerifier {
|
| - public:
|
| - // Opaque pointer type used to cancel outstanding requests.
|
| - typedef void* RequestHandle;
|
| -
|
| - enum VerifyFlags {
|
| - // If set, enables online revocation checking via CRLs and OCSP for the
|
| - // certificate chain.
|
| - VERIFY_REV_CHECKING_ENABLED = 1 << 0,
|
| -
|
| - // If set, and the certificate being verified may be an EV certificate,
|
| - // attempt to verify the certificate according to the EV processing
|
| - // guidelines. In order to successfully verify a certificate as EV,
|
| - // either an online or offline revocation check must be successfully
|
| - // completed. To ensure it's possible to complete a revocation check,
|
| - // callers should also specify either VERIFY_REV_CHECKING_ENABLED or
|
| - // VERIFY_REV_CHECKING_ENABLED_EV_ONLY (to enable online checks), and
|
| - // VERIFY_CERT_IO_ENABLED (to enable network fetches for online checks).
|
| - VERIFY_EV_CERT = 1 << 1,
|
| -
|
| - // If set, permits NSS to use the network when verifying certificates,
|
| - // such as to fetch missing intermediates or to check OCSP or CRLs.
|
| - // TODO(rsleevi): http://crbug.com/143300 - Define this flag for all
|
| - // verification engines with well-defined semantics, rather than being
|
| - // NSS only.
|
| - VERIFY_CERT_IO_ENABLED = 1 << 2,
|
| -
|
| - // If set, enables online revocation checking via CRLs or OCSP when the
|
| - // chain is not covered by a fresh CRLSet, but only for certificates which
|
| - // may be EV, and only when VERIFY_EV_CERT is also set.
|
| - VERIFY_REV_CHECKING_ENABLED_EV_ONLY = 1 << 3,
|
| -
|
| - // If set, this is equivalent to VERIFY_REV_CHECKING_ENABLED, in that it
|
| - // enables online revocation checking via CRLs or OCSP, but only
|
| - // for certificates issued by non-public trust anchors. Failure to check
|
| - // revocation is treated as a hard failure.
|
| - // Note: If VERIFY_CERT_IO_ENABLE is not also supplied, certificates
|
| - // that chain to local trust anchors will likely fail - for example, due to
|
| - // lacking fresh cached revocation issue (Windows) or because OCSP stapling
|
| - // can only provide information for the leaf, and not for any
|
| - // intermediates.
|
| - VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS = 1 << 4,
|
| - };
|
| -
|
| - // When the verifier is destroyed, all certificate verification requests are
|
| - // canceled, and their completion callbacks will not be called.
|
| - virtual ~CertVerifier() {}
|
| -
|
| - // Verifies the given certificate against the given hostname as an SSL server.
|
| - // Returns OK if successful or an error code upon failure.
|
| - //
|
| - // The |*verify_result| structure, including the |verify_result->cert_status|
|
| - // bitmask, is always filled out regardless of the return value. If the
|
| - // certificate has multiple errors, the corresponding status flags are set in
|
| - // |verify_result->cert_status|, and the error code for the most serious
|
| - // error is returned.
|
| - //
|
| - // |flags| is bitwise OR'd of VerifyFlags.
|
| - // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, certificate revocation
|
| - // checking is performed.
|
| - //
|
| - // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is
|
| - // performed. If |flags| is VERIFY_EV_CERT (that is,
|
| - // VERIFY_REV_CHECKING_ENABLED is not set), EV certificate verification will
|
| - // not be performed.
|
| - //
|
| - // |crl_set| points to an optional CRLSet structure which can be used to
|
| - // avoid revocation checks over the network.
|
| - //
|
| - // |callback| must not be null. ERR_IO_PENDING is returned if the operation
|
| - // could not be completed synchronously, in which case the result code will
|
| - // be passed to the callback when available.
|
| - //
|
| - // |*out_req| will be filled with a handle to the async request.
|
| - // This handle is not valid after the request has completed.
|
| - //
|
| - // TODO(rsleevi): Move CRLSet* out of the CertVerifier signature.
|
| - virtual int Verify(X509Certificate* cert,
|
| - const std::string& hostname,
|
| - int flags,
|
| - CRLSet* crl_set,
|
| - CertVerifyResult* verify_result,
|
| - const CompletionCallback& callback,
|
| - RequestHandle* out_req,
|
| - const BoundNetLog& net_log) = 0;
|
| -
|
| - // Cancels the specified request. |req| is the handle returned by Verify().
|
| - // After a request is canceled, its completion callback will not be called.
|
| - virtual void CancelRequest(RequestHandle req) = 0;
|
| -
|
| - // Creates a CertVerifier implementation that verifies certificates using
|
| - // the preferred underlying cryptographic libraries.
|
| - static CertVerifier* CreateDefault();
|
| -};
|
| -
|
| -} // namespace net
|
| -
|
| -#endif // NET_CERT_CERT_VERIFIER_H_
|
|
|