1// Copyright (c) 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef NET_QUIC_CRYPTO_PROOF_SOURCE_H_
6#define NET_QUIC_CRYPTO_PROOF_SOURCE_H_
7
8#include <string>
9#include <vector>
10
11#include "net/base/net_export.h"
12
13namespace net {
14
15// ProofSource is an interface by which a QUIC server can obtain certificate
16// chains and signatures that prove its identity.
17class NET_EXPORT_PRIVATE ProofSource {
18 public:
19  virtual ~ProofSource() {}
20
21  // GetProof finds a certificate chain for |hostname|, sets |out_certs| to
22  // point to it (in leaf-first order), calculates a signature of
23  // |server_config| using that chain and puts the result in |out_signature|.
24  //
25  // The signature uses SHA-256 as the hash function and PSS padding when the
26  // key is RSA.
27  //
28  // The signature uses SHA-256 as the hash function when the key is ECDSA.
29  //
30  // If |ecdsa_ok| is true, the signature may use an ECDSA key. Otherwise, the
31  // signature must use an RSA key.
32  //
33  // |out_certs| is a pointer to a pointer, not a pointer to an array.
34  //
35  // The number of certificate chains is expected to be small and fixed thus
36  // the ProofSource retains ownership of the contents of |out_certs|. The
37  // expectation is that they will be cached forever.
38  //
39  // The signature values should be cached because |server_config| will be
40  // somewhat static. However, since they aren't bounded, the ProofSource may
41  // wish to evicit entries from that cache, thus the caller takes ownership of
42  // |*out_signature|.
43  //
44  // |hostname| may be empty to signify that a default certificate should be
45  // used.
46  //
47  // This function may be called concurrently.
48  virtual bool GetProof(const std::string& hostname,
49                        const std::string& server_config,
50                        bool ecdsa_ok,
51                        const std::vector<std::string>** out_certs,
52                        std::string* out_signature) = 0;
53};
54
55}  // namespace net
56
57#endif  // NET_QUIC_CRYPTO_PROOF_SOURCE_H_
58