cert_verifier.h 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_CERT_VERIFIER_H_
  5. #define NET_CERT_CERT_VERIFIER_H_
  6. #include <memory>
  7. #include <string>
  8. #include <vector>
  9. #include "base/memory/ref_counted.h"
  10. #include "base/strings/string_piece.h"
  11. #include "net/base/completion_once_callback.h"
  12. #include "net/base/hash_value.h"
  13. #include "net/base/net_export.h"
  14. #include "net/cert/cert_net_fetcher.h"
  15. #include "net/cert/x509_certificate.h"
  16. namespace net {
  17. class CertVerifyResult;
  18. class CRLSet;
  19. class NetLogWithSource;
  20. class ChromeRootStoreData;
  21. // CertVerifier represents a service for verifying certificates.
  22. //
  23. // CertVerifiers can handle multiple requests at a time.
  24. class NET_EXPORT CertVerifier {
  25. public:
  26. struct NET_EXPORT Config {
  27. Config();
  28. Config(const Config&);
  29. Config(Config&&);
  30. ~Config();
  31. Config& operator=(const Config&);
  32. Config& operator=(Config&&);
  33. // Enable online revocation checking via CRLs and OCSP for the certificate
  34. // chain. Note that revocation checking is soft-fail.
  35. bool enable_rev_checking = false;
  36. // Enable online revocation checking via CRLs and OCSP for the certificate
  37. // chain if the constructed chain terminates in a locally-installed,
  38. // non-public trust anchor. A revocation error, such as a failure to
  39. // obtain fresh revocation information, is treated as a hard failure.
  40. bool require_rev_checking_local_anchors = false;
  41. // Enable support for SHA-1 signatures if the constructed chain terminates
  42. // in a locally-installed, non-public trust anchor.
  43. bool enable_sha1_local_anchors = false;
  44. // Disable enforcement of the policies described at
  45. // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
  46. bool disable_symantec_enforcement = false;
  47. // Provides an optional CRLSet structure that can be used to avoid
  48. // revocation checks over the network. CRLSets can be used to add
  49. // additional certificates to be blocked beyond the internal block list,
  50. // whether leaves or intermediates.
  51. scoped_refptr<CRLSet> crl_set;
  52. // Additional trust anchors to consider during path validation. Ordinarily,
  53. // implementations of CertVerifier use trust anchors from the configured
  54. // system store. This is implementation-specific plumbing for passing
  55. // additional anchors through.
  56. CertificateList additional_trust_anchors;
  57. // Additional temporary certs to consider as intermediates during path
  58. // validation. Ordinarily, implementations of CertVerifier use intermediate
  59. // certs from the configured system store. This is implementation-specific
  60. // plumbing for passing additional intermediates through.
  61. CertificateList additional_untrusted_authorities;
  62. };
  63. class Request {
  64. public:
  65. Request() = default;
  66. Request(const Request&) = delete;
  67. Request& operator=(const Request&) = delete;
  68. // Destruction of the Request cancels it.
  69. virtual ~Request() = default;
  70. };
  71. enum VerifyFlags {
  72. // If set, actively overrides the current CertVerifier::Config to disable
  73. // dependent network fetches. This can be used to avoid triggering
  74. // re-entrancy in the network stack. For example, fetching a PAC script
  75. // over HTTPS may cause AIA, OCSP, or CRL fetches to block on retrieving
  76. // the PAC script, while the PAC script fetch is waiting for those
  77. // dependent fetches, creating a deadlock. When set, this flag prevents
  78. // those fetches from being started (best effort).
  79. // Note that cached information may still be used, if it can be accessed
  80. // without accessing the network.
  81. VERIFY_DISABLE_NETWORK_FETCHES = 1 << 0,
  82. VERIFY_FLAGS_LAST = VERIFY_DISABLE_NETWORK_FETCHES
  83. };
  84. // Parameters to verify |certificate| against the supplied
  85. // |hostname| as an SSL server.
  86. //
  87. // |hostname| should be a canonicalized hostname (in A-Label form) or IP
  88. // address in string form, following the rules of a URL host portion. In
  89. // the case of |hostname| being a domain name, it may contain a trailing
  90. // dot (e.g. "example.com."), as used to signal to DNS not to perform
  91. // suffix search, and it will safely be ignored. If |hostname| is an IPv6
  92. // address, it MUST be in URL form - that is, surrounded in square
  93. // brackets, such as "[::1]".
  94. //
  95. // |flags| is a bitwise OR of VerifyFlags.
  96. //
  97. // |ocsp_response| is optional, but if non-empty, should contain an OCSP
  98. // response obtained via OCSP stapling. It may be ignored by the
  99. // CertVerifier.
  100. //
  101. // |sct_list| is optional, but if non-empty, should contain a
  102. // SignedCertificateTimestampList from the TLS extension as described in
  103. // RFC6962 section 3.3.1. It may be ignored by the CertVerifier.
  104. class NET_EXPORT RequestParams {
  105. public:
  106. RequestParams();
  107. RequestParams(scoped_refptr<X509Certificate> certificate,
  108. base::StringPiece hostname,
  109. int flags,
  110. base::StringPiece ocsp_response,
  111. base::StringPiece sct_list);
  112. RequestParams(const RequestParams& other);
  113. ~RequestParams();
  114. const scoped_refptr<X509Certificate>& certificate() const {
  115. return certificate_;
  116. }
  117. const std::string& hostname() const { return hostname_; }
  118. int flags() const { return flags_; }
  119. const std::string& ocsp_response() const { return ocsp_response_; }
  120. const std::string& sct_list() const { return sct_list_; }
  121. bool operator==(const RequestParams& other) const;
  122. bool operator<(const RequestParams& other) const;
  123. private:
  124. scoped_refptr<X509Certificate> certificate_;
  125. std::string hostname_;
  126. int flags_;
  127. std::string ocsp_response_;
  128. std::string sct_list_;
  129. // Used to optimize sorting/indexing comparisons.
  130. std::string key_;
  131. };
  132. // When the verifier is destroyed, all certificate verification requests are
  133. // canceled, and their completion callbacks will not be called.
  134. virtual ~CertVerifier() = default;
  135. // Verifies the given certificate against the given hostname as an SSL server.
  136. // Returns OK if successful or an error code upon failure.
  137. //
  138. // The |*verify_result| structure, including the |verify_result->cert_status|
  139. // bitmask and |verify_result->verified_cert|, is always filled out regardless
  140. // of the return value. If the certificate has multiple errors, the
  141. // corresponding status flags are set in |verify_result->cert_status|, and the
  142. // error code for the most serious error is returned.
  143. //
  144. // |callback| must not be null. ERR_IO_PENDING is returned if the operation
  145. // could not be completed synchronously, in which case the result code will
  146. // be passed to the callback when available.
  147. //
  148. // |*out_req| is used to store a request handle in the event of asynchronous
  149. // completion (when Verify returns ERR_IO_PENDING). Provided that neither
  150. // the CertVerifier nor the Request have been deleted, |callback| will be
  151. // invoked once the underlying verification finishes. If either the
  152. // CertVerifier or the Request are deleted, then |callback| will be Reset()
  153. // and will not be invoked. It is fine for |out_req| to outlive the
  154. // CertVerifier, and it is fine to reset |out_req| or delete the
  155. // CertVerifier during the processing of |callback|.
  156. //
  157. // If Verify() completes synchronously then |out_req| *may* be reset to
  158. // nullptr. However it is not guaranteed that all implementations will reset
  159. // it in this case.
  160. virtual int Verify(const RequestParams& params,
  161. CertVerifyResult* verify_result,
  162. CompletionOnceCallback callback,
  163. std::unique_ptr<Request>* out_req,
  164. const NetLogWithSource& net_log) = 0;
  165. // Sets the configuration for new certificate verifications to be |config|.
  166. // Any in-progress verifications (i.e. those with outstanding Request
  167. // handles) will continue using the old configuration. This may be called
  168. // throughout the CertVerifier's lifetime in response to configuration
  169. // changes from embedders.
  170. // Note: As configuration changes will replace any existing configuration,
  171. // this should only be called by the logical 'owner' of this CertVerifier.
  172. // Callers should NOT attempt to change configuration for single calls, and
  173. // should NOT attempt to change configuration for CertVerifiers they do not
  174. // explicitly manage.
  175. virtual void SetConfig(const Config& config) = 0;
  176. // Creates a CertVerifier implementation that verifies certificates using
  177. // the preferred underlying cryptographic libraries. |cert_net_fetcher| may
  178. // not be used, depending on the platform.
  179. static std::unique_ptr<CertVerifier> CreateDefaultWithoutCaching(
  180. scoped_refptr<CertNetFetcher> cert_net_fetcher);
  181. // Wraps the result of |CreateDefaultWithoutCaching| in a CachingCertVerifier
  182. // and a CoalescingCertVerifier.
  183. static std::unique_ptr<CertVerifier> CreateDefault(
  184. scoped_refptr<CertNetFetcher> cert_net_fetcher);
  185. };
  186. // Overloads for comparing two configurations. Note, comparison is shallow -
  187. // that is, two scoped_refptr<CRLSet>s are equal iff they point to the same
  188. // object.
  189. NET_EXPORT bool operator==(const CertVerifier::Config& lhs,
  190. const CertVerifier::Config& rhs);
  191. NET_EXPORT bool operator!=(const CertVerifier::Config& lhs,
  192. const CertVerifier::Config& rhs);
  193. // A CertVerifier that can update its CertVerifyProc while it is running.
  194. class NET_EXPORT CertVerifierWithUpdatableProc : public CertVerifier {
  195. public:
  196. // Update the CertVerifyProc with new ChromeRootStoreData.
  197. virtual void UpdateChromeRootStoreData(
  198. scoped_refptr<CertNetFetcher> cert_net_fetcher,
  199. const ChromeRootStoreData* root_store_data) = 0;
  200. };
  201. } // namespace net
  202. #endif // NET_CERT_CERT_VERIFIER_H_