1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
// Copyright 2013 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef NET_QUIC_CRYPTO_PROOF_VERIFIER_CHROMIUM_H_
#define NET_QUIC_CRYPTO_PROOF_VERIFIER_CHROMIUM_H_
#include <map>
#include <memory>
#include <string>
#include <vector>
#include "base/compiler_specific.h"
#include "base/macros.h"
#include "net/base/net_export.h"
#include "net/cert/cert_verify_result.h"
#include "net/cert/ct_verify_result.h"
#include "net/cert/x509_certificate.h"
#include "net/log/net_log_with_source.h"
#include "net/third_party/quiche/src/quic/core/crypto/proof_verifier.h"
namespace net {
class CTPolicyEnforcer;
class CertVerifier;
class CTVerifier;
class TransportSecurityState;
// ProofVerifyDetailsChromium is the implementation-specific information that a
// ProofVerifierChromium returns about a certificate verification.
class NET_EXPORT_PRIVATE ProofVerifyDetailsChromium
: public quic::ProofVerifyDetails {
public:
ProofVerifyDetailsChromium();
ProofVerifyDetailsChromium(const ProofVerifyDetailsChromium&);
~ProofVerifyDetailsChromium() override;
// quic::ProofVerifyDetails implementation
quic::ProofVerifyDetails* Clone() const override;
CertVerifyResult cert_verify_result;
ct::CTVerifyResult ct_verify_result;
// pinning_failure_log contains a message produced by
// TransportSecurityState::PKPState::CheckPublicKeyPins in the event of a
// pinning failure. It is a (somewhat) human-readable string.
std::string pinning_failure_log;
// True if PKP was bypassed due to a local trust anchor.
bool pkp_bypassed;
// True if there was a certificate error which should be treated as fatal,
// and false otherwise.
bool is_fatal_cert_error;
};
// ProofVerifyContextChromium is the implementation-specific information that a
// ProofVerifierChromium needs in order to log correctly.
struct ProofVerifyContextChromium : public quic::ProofVerifyContext {
public:
ProofVerifyContextChromium(int cert_verify_flags,
const NetLogWithSource& net_log)
: cert_verify_flags(cert_verify_flags), net_log(net_log) {}
int cert_verify_flags;
NetLogWithSource net_log;
};
// ProofVerifierChromium implements the QUIC quic::ProofVerifier interface. It
// is capable of handling multiple simultaneous requests.
class NET_EXPORT_PRIVATE ProofVerifierChromium : public quic::ProofVerifier {
public:
ProofVerifierChromium(CertVerifier* cert_verifier,
CTPolicyEnforcer* ct_policy_enforcer,
TransportSecurityState* transport_security_state,
CTVerifier* cert_transparency_verifier,
std::set<std::string> hostnames_to_allow_unknown_roots);
~ProofVerifierChromium() override;
// quic::ProofVerifier interface
quic::QuicAsyncStatus VerifyProof(
const std::string& hostname,
const uint16_t port,
const std::string& server_config,
quic::QuicTransportVersion quic_version,
quiche::QuicheStringPiece chlo_hash,
const std::vector<std::string>& certs,
const std::string& cert_sct,
const std::string& signature,
const quic::ProofVerifyContext* verify_context,
std::string* error_details,
std::unique_ptr<quic::ProofVerifyDetails>* verify_details,
std::unique_ptr<quic::ProofVerifierCallback> callback) override;
quic::QuicAsyncStatus VerifyCertChain(
const std::string& hostname,
const uint16_t port,
const std::vector<std::string>& certs,
const std::string& ocsp_response,
const std::string& cert_sct,
const quic::ProofVerifyContext* verify_context,
std::string* error_details,
std::unique_ptr<quic::ProofVerifyDetails>* verify_details,
std::unique_ptr<quic::ProofVerifierCallback> callback) override;
std::unique_ptr<quic::ProofVerifyContext> CreateDefaultContext() override;
private:
class Job;
void OnJobComplete(Job* job);
// Set owning pointers to active jobs.
std::map<Job*, std::unique_ptr<Job>> active_jobs_;
// Underlying verifier used to verify certificates.
CertVerifier* const cert_verifier_;
CTPolicyEnforcer* const ct_policy_enforcer_;
TransportSecurityState* const transport_security_state_;
CTVerifier* const cert_transparency_verifier_;
std::set<std::string> hostnames_to_allow_unknown_roots_;
DISALLOW_COPY_AND_ASSIGN(ProofVerifierChromium);
};
} // namespace net
#endif // NET_QUIC_CRYPTO_PROOF_VERIFIER_CHROMIUM_H_
|
