net/cert/crl_set.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_CRL_SET_H_
   6 #define NET_CERT_CRL_SET_H_
   7
   8 #include <string>
   9 #include <utility>
  10 #include <vector>
  11
  12 #include "base/containers/hash_tables.h"
  13 #include "base/memory/ref_counted.h"
  14 #include "base/strings/string_piece.h"
  15 #include "net/base/net_export.h"
  16 #include "net/cert/x509_cert_types.h"
  17
  18 namespace net {
  19
  20 // A CRLSet is a structure that lists the serial numbers of revoked
  21 // certificates from a number of issuers where issuers are identified by the
  22 // SHA256 of their SubjectPublicKeyInfo.
  23 // CRLSetStorage is responsible for creating CRLSet instances.
  24 class NET_EXPORT CRLSet : public base::RefCountedThreadSafe<CRLSet> {
  25  public:
  26   enum Result {
  27     REVOKED,  // the certificate should be rejected.
  28     UNKNOWN,  // the CRL for the certificate is not included in the set.
  29     GOOD,     // the certificate is not listed.
  30   };
  31
  32   // CheckSPKI checks whether the given SPKI has been listed as blocked.
  33   //   spki_hash: the SHA256 of the SubjectPublicKeyInfo of the certificate.
  34   Result CheckSPKI(const base::StringPiece& spki_hash) const;
  35
  36   // CheckSerial returns the information contained in the set for a given
  37   // certificate:
  38   //   serial_number: the serial number of the certificate
  39   //   issuer_spki_hash: the SHA256 of the SubjectPublicKeyInfo of the CRL
  40   //       signer
  41   Result CheckSerial(
  42       const base::StringPiece& serial_number,
  43       const base::StringPiece& issuer_spki_hash) const;
  44
  45   // IsExpired returns true iff the current time is past the NotAfter time
  46   // specified in the CRLSet.
  47   bool IsExpired() const;
  48
  49   // sequence returns the sequence number of this CRL set. CRL sets generated
  50   // by the same source are given strictly monotonically increasing sequence
  51   // numbers.
  52   uint32_t sequence() const;
  53
  54   // CRLList contains a list of (issuer SPKI hash, revoked serial numbers)
  55   // pairs.
  56   typedef std::vector< std::pair<std::string, std::vector<std::string> > >
  57       CRLList;
  58
  59   // crls returns the internal state of this CRLSet. It should only be used in
  60   // testing.
  61   const CRLList& crls() const;
  62
  63   // EmptyCRLSetForTesting returns a valid, but empty, CRLSet for unit tests.
  64   static CRLSet* EmptyCRLSetForTesting();
  65
  66   // ExpiredCRLSetForTesting returns a expired, empty CRLSet for unit tests.
  67   static CRLSet* ExpiredCRLSetForTesting();
  68
  69   // ForTesting returns a CRLSet for testing. If |is_expired| is true, calling
  70   // IsExpired on the result will return true. If |issuer_spki| is not NULL,
  71   // the CRLSet will cover certificates issued by that SPKI. If |serial_number|
  72   // is not emtpy, then that big-endian serial number will be considered to
  73   // have been revoked by |issuer_spki|.
  74   static CRLSet* ForTesting(bool is_expired,
  75                             const SHA256HashValue* issuer_spki,
  76                             const std::string& serial_number);
  77
  78  private:
  79   CRLSet();
  80   ~CRLSet();
  81
  82   friend class base::RefCountedThreadSafe<CRLSet>;
  83   friend class CRLSetStorage;
  84
  85   uint32_t sequence_;
  86   CRLList crls_;
  87   // not_after_ contains the time, in UNIX epoch seconds, after which the
  88   // CRLSet should be considered stale, or 0 if no such time was given.
  89   uint64_t not_after_;
  90   // crls_index_by_issuer_ maps from issuer SPKI hashes to the index in |crls_|
  91   // where the information for that issuer can be found. We have both |crls_|
  92   // and |crls_index_by_issuer_| because, when applying a delta update, we need
  93   // to identify a CRL by index.
  94   base::hash_map<std::string, size_t> crls_index_by_issuer_;
  95   // blocked_spkis_ contains the SHA256 hashes of SPKIs which are to be blocked
  96   // no matter where in a certificate chain they might appear.
  97   std::vector<std::string> blocked_spkis_;
  98 };
  99
 100 }  // namespace net
 101
 102 #endif  // NET_CERT_CRL_SET_H_