Home | History | Annotate | Download | only in cert 
      1 // Copyright 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef NET_CERT_MULTI_LOG_CT_VERIFIER_H_
      6 #define NET_CERT_MULTI_LOG_CT_VERIFIER_H_
      7 
      8 #include <map>
      9 #include <string>
     10 
     11 #include "base/memory/linked_ptr.h"
     12 #include "base/memory/scoped_ptr.h"
     13 #include "base/memory/scoped_vector.h"
     14 #include "net/base/net_export.h"
     15 #include "net/cert/ct_verifier.h"
     16 #include "net/cert/signed_certificate_timestamp.h"
     17 
     18 namespace net {
     19 
     20 namespace ct {
     21 struct LogEntry;
     22 }  // namespace ct
     23 
     24 class CTLogVerifier;
     25 
     26 // A Certificate Transparency verifier that can verify Signed Certificate
     27 // Timestamps from multiple logs.
     28 // There should be a global instance of this class and for all known logs,
     29 // AddLog should be called with a CTLogVerifier (which is created from the
     30 // log's public key).
     31 class NET_EXPORT MultiLogCTVerifier : public CTVerifier {
     32  public:
     33   MultiLogCTVerifier();
     34   virtual ~MultiLogCTVerifier();
     35 
     36   void AddLog(scoped_ptr<CTLogVerifier> log_verifier);
     37   void AddLogs(ScopedVector<CTLogVerifier> log_verifiers);
     38 
     39   // CTVerifier implementation:
     40   virtual int Verify(X509Certificate* cert,
     41                      const std::string& stapled_ocsp_response,
     42                      const std::string& sct_list_from_tls_extension,
     43                      ct::CTVerifyResult* result,
     44                      const BoundNetLog& net_log) OVERRIDE;
     45 
     46  private:
     47   // Mapping from a log's ID to the verifier for this log.
     48   // A log's ID is the SHA-256 of the log's key, as defined in section 3.2.
     49   // of RFC6962.
     50   typedef std::map<std::string, linked_ptr<CTLogVerifier> > IDToLogMap;
     51 
     52   // Verify a list of SCTs from |encoded_sct_list| over |expected_entry|,
     53   // placing the verification results in |result|. The SCTs in the list
     54   // come from |origin| (as will be indicated in the origin field of each SCT).
     55   bool VerifySCTs(const std::string& encoded_sct_list,
     56                   const ct::LogEntry& expected_entry,
     57                   ct::SignedCertificateTimestamp::Origin origin,
     58                   ct::CTVerifyResult* result);
     59 
     60   // Verifies a single, parsed SCT against all logs.
     61   bool VerifySingleSCT(
     62       scoped_refptr<ct::SignedCertificateTimestamp> sct,
     63       const ct::LogEntry& expected_entry,
     64       ct::CTVerifyResult* result);
     65 
     66   IDToLogMap logs_;
     67 
     68   DISALLOW_COPY_AND_ASSIGN(MultiLogCTVerifier);
     69 };
     70 
     71 }  // namespace net
     72 
     73 #endif  // NET_CERT_MULTI_LOG_CT_VERIFIER_H_
     74