net/cert/cert_verify_proc.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_CERT_VERIFY_PROC_H_
   6 #define NET_CERT_CERT_VERIFY_PROC_H_
   7
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/gtest_prod_util.h"
  12 #include "base/memory/ref_counted.h"
  13 #include "net/base/net_export.h"
  14 #include "net/cert/x509_cert_types.h"
  15
  16 namespace net {
  17
  18 class CertVerifyResult;
  19 class CRLSet;
  20 class X509Certificate;
  21 typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
  22
  23 // Class to perform certificate path building and verification for various
  24 // certificate uses. All methods of this class must be thread-safe, as they
  25 // may be called from various non-joinable worker threads.
  26 class NET_EXPORT CertVerifyProc
  27     : public base::RefCountedThreadSafe<CertVerifyProc> {
  28  public:
  29   // Creates and returns the default CertVerifyProc.
  30   static CertVerifyProc* CreateDefault();
  31
  32   // Verifies the certificate against the given hostname as an SSL server
  33   // certificate. Returns OK if successful or an error code upon failure.
  34   //
  35   // The |*verify_result| structure, including the |verify_result->cert_status|
  36   // bitmask, is always filled out regardless of the return value. If the
  37   // certificate has multiple errors, the corresponding status flags are set in
  38   // |verify_result->cert_status|, and the error code for the most serious
  39   // error is returned.
  40   //
  41   // |ocsp_response|, if non-empty, is a stapled OCSP response to use.
  42   //
  43   // |flags| is bitwise OR'd of VerifyFlags:
  44   //
  45   // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate
  46   // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet
  47   // based revocation checking is always enabled, regardless of this flag, if
  48   // |crl_set| is given.
  49   //
  50   // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is
  51   // performed.
  52   //
  53   // |crl_set| points to an optional CRLSet structure which can be used to
  54   // avoid revocation checks over the network.
  55   //
  56   // |additional_trust_anchors| lists certificates that can be trusted when
  57   // building a certificate chain, in addition to the anchors known to the
  58   // implementation.
  59   int Verify(X509Certificate* cert,
  60              const std::string& hostname,
  61              const std::string& ocsp_response,
  62              int flags,
  63              CRLSet* crl_set,
  64              const CertificateList& additional_trust_anchors,
  65              CertVerifyResult* verify_result);
  66
  67   // Returns true if the implementation supports passing additional trust
  68   // anchors to the Verify() call. The |additional_trust_anchors| parameter
  69   // passed to Verify() is ignored when this returns false.
  70   virtual bool SupportsAdditionalTrustAnchors() const = 0;
  71
  72   // Returns true if the implementation supports passing a stapled OCSP response
  73   // to the Verify() call. The |ocsp_response| parameter passed to Verify() is
  74   // ignored when this returns false.
  75   virtual bool SupportsOCSPStapling() const = 0;
  76
  77  protected:
  78   CertVerifyProc();
  79   virtual ~CertVerifyProc();
  80
  81  private:
  82   friend class base::RefCountedThreadSafe<CertVerifyProc>;
  83   FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts);
  84   FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, TestHasTooLongValidity);
  85
  86   // Performs the actual verification using the desired underlying
  87   // cryptographic library. On entry, |verify_result->verified_cert|
  88   // is set to |cert|, the unverified chain. If no chain is built, the
  89   // value must be left untouched.
  90   virtual int VerifyInternal(X509Certificate* cert,
  91                              const std::string& hostname,
  92                              const std::string& ocsp_response,
  93                              int flags,
  94                              CRLSet* crl_set,
  95                              const CertificateList& additional_trust_anchors,
  96                              CertVerifyResult* verify_result) = 0;
  97
  98   // Returns true if |cert| is explicitly blacklisted.
  99   static bool IsBlacklisted(X509Certificate* cert);
 100
 101   // IsPublicKeyBlacklisted returns true iff one of |public_key_hashes| (which
 102   // are hashes of SubjectPublicKeyInfo structures) is explicitly blocked.
 103   static bool IsPublicKeyBlacklisted(const HashValueVector& public_key_hashes);
 104
 105   // HasNameConstraintsViolation returns true iff one of |public_key_hashes|
 106   // (which are hashes of SubjectPublicKeyInfo structures) has name constraints
 107   // imposed on it and the names in |dns_names| are not permitted.
 108   static bool HasNameConstraintsViolation(
 109       const HashValueVector& public_key_hashes,
 110       const std::string& common_name,
 111       const std::vector<std::string>& dns_names,
 112       const std::vector<std::string>& ip_addrs);
 113
 114   // The CA/Browser Forum's Baseline Requirements specify maximum validity
 115   // periods (https://cabforum.org/Baseline_Requirements_V1.pdf):
 116   //
 117   // For certificates issued after 1 July 2012: 60 months.
 118   // For certificates issued after 1 April 2015: 39 months.
 119   //
 120   // For certificates issued before the BRs took effect, there were no
 121   // guidelines, but clamp them at a maximum of 10 year validity, with the
 122   // requirement they expire within 7 years after the effective date of the BRs
 123   // (i.e. by 1 July 2019).
 124   static bool HasTooLongValidity(const X509Certificate& cert);
 125
 126   DISALLOW_COPY_AND_ASSIGN(CertVerifyProc);
 127 };
 128
 129 }  // namespace net
 130
 131 #endif  // NET_CERT_CERT_VERIFY_PROC_H_