1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef NET_CERT_CERT_VERIFY_PROC_H_
6#define NET_CERT_CERT_VERIFY_PROC_H_
7
8#include <string>
9#include <vector>
10
11#include "base/gtest_prod_util.h"
12#include "base/memory/ref_counted.h"
13#include "net/base/net_export.h"
14#include "net/cert/x509_cert_types.h"
15
16namespace net {
17
18class CertVerifyResult;
19class CRLSet;
20class X509Certificate;
21typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
22
23// Class to perform certificate path building and verification for various
24// certificate uses. All methods of this class must be thread-safe, as they
25// may be called from various non-joinable worker threads.
26class NET_EXPORT CertVerifyProc
27    : public base::RefCountedThreadSafe<CertVerifyProc> {
28 public:
29  // Creates and returns the default CertVerifyProc.
30  static CertVerifyProc* CreateDefault();
31
32  // Verifies the certificate against the given hostname as an SSL server
33  // certificate. Returns OK if successful or an error code upon failure.
34  //
35  // The |*verify_result| structure, including the |verify_result->cert_status|
36  // bitmask, is always filled out regardless of the return value. If the
37  // certificate has multiple errors, the corresponding status flags are set in
38  // |verify_result->cert_status|, and the error code for the most serious
39  // error is returned.
40  //
41  // |flags| is bitwise OR'd of VerifyFlags:
42  //
43  // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate
44  // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet
45  // based revocation checking is always enabled, regardless of this flag, if
46  // |crl_set| is given.
47  //
48  // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is
49  // performed.
50  //
51  // |crl_set| points to an optional CRLSet structure which can be used to
52  // avoid revocation checks over the network.
53  //
54  // |additional_trust_anchors| lists certificates that can be trusted when
55  // building a certificate chain, in addition to the anchors known to the
56  // implementation.
57  int Verify(X509Certificate* cert,
58             const std::string& hostname,
59             int flags,
60             CRLSet* crl_set,
61             const CertificateList& additional_trust_anchors,
62             CertVerifyResult* verify_result);
63
64  // Returns true if the implementation supports passing additional trust
65  // anchors to the Verify() call. The |additional_trust_anchors| parameter
66  // passed to Verify() is ignored when this returns false.
67  virtual bool SupportsAdditionalTrustAnchors() const = 0;
68
69 protected:
70  CertVerifyProc();
71  virtual ~CertVerifyProc();
72
73 private:
74  friend class base::RefCountedThreadSafe<CertVerifyProc>;
75  FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts);
76
77  // Performs the actual verification using the desired underlying
78  // cryptographic library.
79  virtual int VerifyInternal(X509Certificate* cert,
80                             const std::string& hostname,
81                             int flags,
82                             CRLSet* crl_set,
83                             const CertificateList& additional_trust_anchors,
84                             CertVerifyResult* verify_result) = 0;
85
86  // Returns true if |cert| is explicitly blacklisted.
87  static bool IsBlacklisted(X509Certificate* cert);
88
89  // IsPublicKeyBlacklisted returns true iff one of |public_key_hashes| (which
90  // are hashes of SubjectPublicKeyInfo structures) is explicitly blocked.
91  static bool IsPublicKeyBlacklisted(const HashValueVector& public_key_hashes);
92
93  // HasNameConstraintsViolation returns true iff one of |public_key_hashes|
94  // (which are hashes of SubjectPublicKeyInfo structures) has name constraints
95  // imposed on it and the names in |dns_names| are not permitted.
96  static bool HasNameConstraintsViolation(
97      const HashValueVector& public_key_hashes,
98      const std::string& common_name,
99      const std::vector<std::string>& dns_names,
100      const std::vector<std::string>& ip_addrs);
101
102  DISALLOW_COPY_AND_ASSIGN(CertVerifyProc);
103};
104
105}  // namespace net
106
107#endif  // NET_CERT_CERT_VERIFY_PROC_H_
108