security/ct/CTVerifyResult.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef CTVerifyResult_h
   8 #define CTVerifyResult_h
   9
  10 #include <vector>
  11
  12 #include "CTLog.h"
  13 #include "SignedCertificateTimestamp.h"
  14
  15 namespace mozilla {
  16 namespace ct {
  17
  18 // Holds a verified Signed Certificate Timestamp along with the verification
  19 // status (e.g. valid/invalid) and additional information related to the
  20 // verification.
  21 struct VerifiedSCT {
  22   VerifiedSCT();
  23
  24   // The original SCT.
  25   SignedCertificateTimestamp sct;
  26
  27   enum class Status {
  28     None,
  29     // The SCT is from a known log, and the signature is valid.
  30     Valid,
  31     // The SCT is from a known disqualified log, and the signature is valid.
  32     // For the disqualification time of the log see |logDisqualificationTime|.
  33     ValidFromDisqualifiedLog,
  34     // The SCT is from an unknown log and can not be verified.
  35     UnknownLog,
  36     // The SCT is from a known log, but the signature is invalid.
  37     InvalidSignature,
  38     // The SCT signature is valid, but the timestamp is in the future.
  39     // Such SCTs are considered invalid (see RFC 6962, Section 5.2).
  40     InvalidTimestamp,
  41   };
  42
  43   enum class Origin {
  44     Unknown,
  45     Embedded,
  46     TLSExtension,
  47     OCSPResponse,
  48   };
  49
  50   Status status;
  51   Origin origin;
  52   CTLogOperatorId logOperatorId;
  53   uint64_t logDisqualificationTime;
  54 };
  55
  56 typedef std::vector<VerifiedSCT> VerifiedSCTList;
  57
  58 // Holds Signed Certificate Timestamps verification results.
  59 class CTVerifyResult {
  60  public:
  61   CTVerifyResult() { Reset(); }
  62
  63   // SCTs that were processed during the verification along with their
  64   // verification results.
  65   VerifiedSCTList verifiedScts;
  66
  67   // The verifier makes the best effort to extract the available SCTs
  68   // from the binary sources provided to it.
  69   // If some SCT cannot be extracted due to encoding errors, the verifier
  70   // proceeds to the next available one. In other words, decoding errors are
  71   // effectively ignored.
  72   // Note that a serialized SCT may fail to decode for a "legitimate" reason,
  73   // e.g. if the SCT is from a future version of the Certificate Transparency
  74   // standard.
  75   // |decodingErrors| field counts the errors of the above kind.
  76   size_t decodingErrors;
  77
  78   void Reset();
  79 };
  80
  81 }  // namespace ct
  82 }  // namespace mozilla
  83
  84 #endif  // CTVerifyResult_h