Home | History | Annotate | Download | only in cert 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef NET_CERT_CERT_VERIFY_PROC_H_
      6 #define NET_CERT_CERT_VERIFY_PROC_H_
      7 
      8 #include <string>
      9 #include <vector>
     10 
     11 #include "base/gtest_prod_util.h"
     12 #include "base/memory/ref_counted.h"
     13 #include "net/base/net_export.h"
     14 #include "net/cert/x509_cert_types.h"
     15 
     16 namespace net {
     17 
     18 class CertVerifyResult;
     19 class CRLSet;
     20 class X509Certificate;
     21 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
     22 
     23 // Class to perform certificate path building and verification for various
     24 // certificate uses. All methods of this class must be thread-safe, as they
     25 // may be called from various non-joinable worker threads.
     26 class NET_EXPORT CertVerifyProc
     27     : public base::RefCountedThreadSafe<CertVerifyProc> {
     28  public:
     29   // Creates and returns the default CertVerifyProc.
     30   static CertVerifyProc* CreateDefault();
     31 
     32   // Verifies the certificate against the given hostname as an SSL server
     33   // certificate. Returns OK if successful or an error code upon failure.
     34   //
     35   // The |*verify_result| structure, including the |verify_result->cert_status|
     36   // bitmask, is always filled out regardless of the return value. If the
     37   // certificate has multiple errors, the corresponding status flags are set in
     38   // |verify_result->cert_status|, and the error code for the most serious
     39   // error is returned.
     40   //
     41   // |flags| is bitwise OR'd of VerifyFlags:
     42   //
     43   // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate
     44   // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet
     45   // based revocation checking is always enabled, regardless of this flag, if
     46   // |crl_set| is given.
     47   //
     48   // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is
     49   // performed.
     50   //
     51   // |crl_set| points to an optional CRLSet structure which can be used to
     52   // avoid revocation checks over the network.
     53   //
     54   // |additional_trust_anchors| lists certificates that can be trusted when
     55   // building a certificate chain, in addition to the anchors known to the
     56   // implementation.
     57   int Verify(X509Certificate* cert,
     58              const std::string& hostname,
     59              int flags,
     60              CRLSet* crl_set,
     61              const CertificateList& additional_trust_anchors,
     62              CertVerifyResult* verify_result);
     63 
     64   // Returns true if the implementation supports passing additional trust
     65   // anchors to the Verify() call. The |additional_trust_anchors| parameter
     66   // passed to Verify() is ignored when this returns false.
     67   virtual bool SupportsAdditionalTrustAnchors() const = 0;
     68 
     69  protected:
     70   CertVerifyProc();
     71   virtual ~CertVerifyProc();
     72 
     73  private:
     74   friend class base::RefCountedThreadSafe<CertVerifyProc>;
     75   FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts);
     76 
     77   // Performs the actual verification using the desired underlying
     78   // cryptographic library.
     79   virtual int VerifyInternal(X509Certificate* cert,
     80                              const std::string& hostname,
     81                              int flags,
     82                              CRLSet* crl_set,
     83                              const CertificateList& additional_trust_anchors,
     84                              CertVerifyResult* verify_result) = 0;
     85 
     86   // Returns true if |cert| is explicitly blacklisted.
     87   static bool IsBlacklisted(X509Certificate* cert);
     88 
     89   // IsPublicKeyBlacklisted returns true iff one of |public_key_hashes| (which
     90   // are hashes of SubjectPublicKeyInfo structures) is explicitly blocked.
     91   static bool IsPublicKeyBlacklisted(const HashValueVector& public_key_hashes);
     92 
     93   // HasNameConstraintsViolation returns true iff one of |public_key_hashes|
     94   // (which are hashes of SubjectPublicKeyInfo structures) has name constraints
     95   // imposed on it and the names in |dns_names| are not permitted.
     96   static bool HasNameConstraintsViolation(
     97       const HashValueVector& public_key_hashes,
     98       const std::string& common_name,
     99       const std::vector<std::string>& dns_names,
    100       const std::vector<std::string>& ip_addrs);
    101 
    102   DISALLOW_COPY_AND_ASSIGN(CertVerifyProc);
    103 };
    104 
    105 }  // namespace net
    106 
    107 #endif  // NET_CERT_CERT_VERIFY_PROC_H_
    108