net/cert/multi_log_ct_verifier.h

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_MULTI_LOG_CT_VERIFIER_H_
   6 #define NET_CERT_MULTI_LOG_CT_VERIFIER_H_
   7
   8 #include <map>
   9 #include <string>
  10
  11 #include "base/memory/linked_ptr.h"
  12 #include "base/memory/scoped_ptr.h"
  13 #include "base/memory/scoped_vector.h"
  14 #include "net/base/net_export.h"
  15 #include "net/cert/ct_verifier.h"
  16 #include "net/cert/signed_certificate_timestamp.h"
  17
  18 namespace net {
  19
  20 namespace ct {
  21 struct LogEntry;
  22 }  // namespace ct
  23
  24 class CTLogVerifier;
  25
  26 // A Certificate Transparency verifier that can verify Signed Certificate
  27 // Timestamps from multiple logs.
  28 // There should be a global instance of this class and for all known logs,
  29 // AddLog should be called with a CTLogVerifier (which is created from the
  30 // log's public key).
  31 class NET_EXPORT MultiLogCTVerifier : public CTVerifier {
  32  public:
  33   MultiLogCTVerifier();
  34   virtual ~MultiLogCTVerifier();
  35
  36   void AddLog(scoped_ptr<CTLogVerifier> log_verifier);
  37   void AddLogs(ScopedVector<CTLogVerifier> log_verifiers);
  38
  39   // CTVerifier implementation:
  40   virtual int Verify(X509Certificate* cert,
  41                      const std::string& stapled_ocsp_response,
  42                      const std::string& sct_list_from_tls_extension,
  43                      ct::CTVerifyResult* result,
  44                      const BoundNetLog& net_log) OVERRIDE;
  45
  46  private:
  47   // Mapping from a log's ID to the verifier for this log.
  48   // A log's ID is the SHA-256 of the log's key, as defined in section 3.2.
  49   // of RFC6962.
  50   typedef std::map<std::string, linked_ptr<CTLogVerifier> > IDToLogMap;
  51
  52   // Verify a list of SCTs from |encoded_sct_list| over |expected_entry|,
  53   // placing the verification results in |result|. The SCTs in the list
  54   // come from |origin| (as will be indicated in the origin field of each SCT).
  55   bool VerifySCTs(const std::string& encoded_sct_list,
  56                   const ct::LogEntry& expected_entry,
  57                   ct::SignedCertificateTimestamp::Origin origin,
  58                   ct::CTVerifyResult* result);
  59
  60   // Verifies a single, parsed SCT against all logs.
  61   bool VerifySingleSCT(
  62       scoped_refptr<ct::SignedCertificateTimestamp> sct,
  63       const ct::LogEntry& expected_entry,
  64       ct::CTVerifyResult* result);
  65
  66   IDToLogMap logs_;
  67
  68   DISALLOW_COPY_AND_ASSIGN(MultiLogCTVerifier);
  69 };
  70
  71 }  // namespace net
  72
  73 #endif  // NET_CERT_MULTI_LOG_CT_VERIFIER_H_