extensions/common/cast/cast_cert_validator.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef EXTENSIONS_COMMON_CAST_CAST_CERT_VALIDATOR_H_
   6 #define EXTENSIONS_COMMON_CAST_CAST_CERT_VALIDATOR_H_
   7
   8 #include <string>
   9 #include <vector>
  10
  11 #include "base/memory/scoped_ptr.h"
  12 #include "base/strings/string_piece.h"
  13
  14 namespace extensions {
  15 namespace api {
  16 namespace cast_crypto {
  17
  18 // Status of a certificate or certificate verification operation.
  19 struct VerificationResult {
  20   // Mapped to extensions::api::cast_channel::AuthResult::ErrorType in
  21   // cast_auto_util.cc. Update the mapping code when modifying this enum.
  22   enum ErrorType {
  23     // Verification has succeeded.
  24     ERROR_NONE = 0,
  25     // There was a problem with the certificate, such as invalid or corrupt
  26     // certificate data or invalid issuing certificate signature.
  27     ERROR_CERT_INVALID,
  28     // Certificate may be valid, but not trusted in this context.
  29     ERROR_CERT_UNTRUSTED,
  30     // Signature verification failed
  31     ERROR_SIGNATURE_INVALID,
  32     // Catch-all for internal errors that are not covered by the other error
  33     // types.
  34     ERROR_INTERNAL
  35   };
  36
  37   // Constructs a VerificationResult that corresponds to success.
  38   VerificationResult();
  39
  40   // Construct error-related objects
  41   VerificationResult(const std::string& error_message, ErrorType error_type);
  42   VerificationResult(const std::string& error_message,
  43                      ErrorType error_type,
  44                      int error_code);
  45
  46   bool Success() const { return error_type == ERROR_NONE; }
  47   bool Failure() const { return error_type != ERROR_NONE; }
  48
  49   // Generates a string representation of this object for logging.
  50   std::string GetLogString() const;
  51
  52   ErrorType error_type;
  53   // Human-readable description of the problem if error_type != ERROR_NONE
  54   std::string error_message;
  55   // May contain the underlying crypto library error code.
  56   int library_error_code;
  57 };
  58
  59 // An object of this type is returned by the VerifyCert function, and can be
  60 // used for additional certificate-related operations, using the verified
  61 // certificate.
  62 class CertVerificationContext {
  63  public:
  64   CertVerificationContext() {}
  65   virtual ~CertVerificationContext() {}
  66
  67   // Use the public key from the verified certificate to verify a
  68   // sha1WithRSAEncryption |signature| over arbitrary |data|. Both |signature|
  69   // and |data| hold raw binary data.
  70   virtual VerificationResult VerifySignatureOverData(
  71       const base::StringPiece& signature,
  72       const base::StringPiece& data) const = 0;
  73
  74   // Retrieve the Common Name attribute of the subject's distinguished name from
  75   // the verified certificate, if present.  Returns an empty string if no Common
  76   // Name is found.
  77   virtual std::string GetCommonName() const = 0;
  78
  79  private:
  80   DISALLOW_COPY_AND_ASSIGN(CertVerificationContext);
  81 };
  82
  83 // Verify a cast device certificate, using optional intermediate certificate
  84 // authority certificates. |context| will be populated with an instance of
  85 // CertVerificationContext, which allows to perform additional verification
  86 // steps as required.
  87 VerificationResult VerifyDeviceCert(
  88     const base::StringPiece& device_cert,
  89     const std::vector<std::string>& ica_certs,
  90     scoped_ptr<CertVerificationContext>* context);
  91
  92 // Sets trusted certificate authorities. Only exposed for tests.
  93 bool SetTrustedCertificateAuthoritiesForTest(const std::string& keys,
  94                                              const std::string& signature);
  95
  96 }  // namespace cast_crypto
  97 }  // namespace api
  98 }  // namespace extensions
  99
 100 #endif  // EXTENSIONS_COMMON_CAST_CAST_CERT_VALIDATOR_H_