Home | History | Annotate | Download | only in cert 
      1 // Copyright 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef NET_CERT_SIGNED_CERTIFICATE_TIMESTAMP_H_
      6 #define NET_CERT_SIGNED_CERTIFICATE_TIMESTAMP_H_
      7 
      8 #include <string>
      9 #include <vector>
     10 
     11 #include "base/memory/ref_counted.h"
     12 #include "base/time/time.h"
     13 #include "net/base/hash_value.h"
     14 #include "net/base/net_export.h"
     15 
     16 class Pickle;
     17 class PickleIterator;
     18 
     19 namespace net {
     20 
     21 // Structures related to Certificate Transparency (RFC6962).
     22 namespace ct {
     23 
     24 // LogEntry struct in RFC 6962, Section 3.1
     25 struct NET_EXPORT LogEntry {
     26   // LogEntryType enum in RFC 6962, Section 3.1
     27   enum Type {
     28     LOG_ENTRY_TYPE_X509 = 0,
     29     LOG_ENTRY_TYPE_PRECERT = 1
     30   };
     31 
     32   LogEntry();
     33   ~LogEntry();
     34   void Reset();
     35 
     36   Type type;
     37 
     38   // Set if type == LOG_ENTRY_TYPE_X509
     39   std::string leaf_certificate;
     40 
     41   // Set if type == LOG_ENTRY_TYPE_PRECERT
     42   SHA256HashValue issuer_key_hash;
     43   std::string tbs_certificate;
     44 };
     45 
     46 // Helper structure to represent Digitally Signed data, as described in
     47 // Sections 4.7 and 7.4.1.4.1 of RFC 5246.
     48 struct NET_EXPORT_PRIVATE DigitallySigned {
     49   enum HashAlgorithm {
     50     HASH_ALGO_NONE = 0,
     51     HASH_ALGO_MD5 = 1,
     52     HASH_ALGO_SHA1 = 2,
     53     HASH_ALGO_SHA224 = 3,
     54     HASH_ALGO_SHA256 = 4,
     55     HASH_ALGO_SHA384 = 5,
     56     HASH_ALGO_SHA512 = 6,
     57   };
     58 
     59   enum SignatureAlgorithm {
     60     SIG_ALGO_ANONYMOUS = 0,
     61     SIG_ALGO_RSA = 1,
     62     SIG_ALGO_DSA = 2,
     63     SIG_ALGO_ECDSA = 3
     64   };
     65 
     66   DigitallySigned();
     67   ~DigitallySigned();
     68 
     69   // Returns true if |other_hash_algorithm| and |other_signature_algorithm|
     70   // match this DigitallySigned hash and signature algorithms.
     71   bool SignatureParametersMatch(
     72       HashAlgorithm other_hash_algorithm,
     73       SignatureAlgorithm other_signature_algorithm) const;
     74 
     75   HashAlgorithm hash_algorithm;
     76   SignatureAlgorithm signature_algorithm;
     77   // 'signature' field.
     78   std::string signature_data;
     79 };
     80 
     81 // SignedCertificateTimestamp struct in RFC 6962, Section 3.2.
     82 struct NET_EXPORT SignedCertificateTimestamp
     83     : public base::RefCountedThreadSafe<SignedCertificateTimestamp> {
     84   // Predicate functor used in maps when SignedCertificateTimestamp is used as
     85   // the key.
     86   struct NET_EXPORT LessThan {
     87     bool operator()(const scoped_refptr<SignedCertificateTimestamp>& lhs,
     88                     const scoped_refptr<SignedCertificateTimestamp>& rhs) const;
     89   };
     90 
     91   // Version enum in RFC 6962, Section 3.2.
     92   enum Version {
     93     SCT_VERSION_1 = 0,
     94   };
     95 
     96   // Source of the SCT - supplementary, not defined in CT RFC.
     97   // Note: The numeric values are used within histograms and should not change
     98   // or be re-assigned.
     99   enum Origin {
    100     SCT_EMBEDDED = 0,
    101     SCT_FROM_TLS_EXTENSION = 1,
    102     SCT_FROM_OCSP_RESPONSE = 2,
    103     SCT_ORIGIN_MAX,
    104   };
    105 
    106   SignedCertificateTimestamp();
    107 
    108   void Persist(Pickle* pickle);
    109   static scoped_refptr<SignedCertificateTimestamp> CreateFromPickle(
    110       PickleIterator* iter);
    111 
    112   Version version;
    113   std::string log_id;
    114   base::Time timestamp;
    115   std::string extensions;
    116   DigitallySigned signature;
    117   // The origin should not participate in equality checks
    118   // as the same SCT can be provided from multiple sources.
    119   Origin origin;
    120   // The log description is not one of the SCT fields, but a user-readable
    121   // name defined alongside the log key. It should not participate
    122   // in equality checks as the log's description could change while
    123   // the SCT would be the same.
    124   std::string log_description;
    125 
    126  private:
    127   friend class base::RefCountedThreadSafe<SignedCertificateTimestamp>;
    128 
    129   ~SignedCertificateTimestamp();
    130 
    131   DISALLOW_COPY_AND_ASSIGN(SignedCertificateTimestamp);
    132 };
    133 
    134 }  // namespace ct
    135 
    136 }  // namespace net
    137 
    138 #endif  // NET_CERT_SIGNED_CERTIFICATE_TIMESTAMP_H_
    139