crl_set.h 5.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_CRL_SET_H_
  5. #define NET_CERT_CRL_SET_H_
  6. #include <stddef.h>
  7. #include <stdint.h>
  8. #include <string>
  9. #include <unordered_map>
  10. #include <utility>
  11. #include <vector>
  12. #include "base/memory/ref_counted.h"
  13. #include "base/strings/string_piece.h"
  14. #include "net/base/hash_value.h"
  15. #include "net/base/net_export.h"
  16. namespace net {
  17. // A CRLSet is a structure that lists the serial numbers of revoked
  18. // certificates from a number of issuers where issuers are identified by the
  19. // SHA256 of their SubjectPublicKeyInfo.
  20. // CRLSetStorage is responsible for creating CRLSet instances.
  21. class NET_EXPORT CRLSet : public base::RefCountedThreadSafe<CRLSet> {
  22. public:
  23. enum Result {
  24. REVOKED, // the certificate should be rejected.
  25. UNKNOWN, // the CRL for the certificate is not included in the set.
  26. GOOD, // the certificate is not listed.
  27. };
  28. // Parses the bytes in |data| and, on success, puts a new CRLSet in
  29. // |out_crl_set| and returns true.
  30. static bool Parse(base::StringPiece data, scoped_refptr<CRLSet>* out_crl_set);
  31. // Same as the above, but stores the string |data| in the resulting CRLSet.
  32. static bool ParseAndStoreUnparsedData(std::string data,
  33. scoped_refptr<CRLSet>* out_crl_set);
  34. // CheckSPKI checks whether the given SPKI has been listed as blocked.
  35. // spki_hash: the SHA256 of the SubjectPublicKeyInfo of the certificate.
  36. Result CheckSPKI(const base::StringPiece& spki_hash) const;
  37. // CheckSerial returns the information contained in the set for a given
  38. // certificate:
  39. // serial_number: the serial number of the certificate, as the DER-encoded
  40. // value
  41. // issuer_spki_hash: the SHA256 of the SubjectPublicKeyInfo of the CRL
  42. // signer
  43. Result CheckSerial(const base::StringPiece& serial_number,
  44. const base::StringPiece& issuer_spki_hash) const;
  45. // CheckSubject returns the information contained in the set for a given,
  46. // encoded subject name and SPKI hash. The subject name is encoded as a DER
  47. // X.501 Name (see https://tools.ietf.org/html/rfc5280#section-4.1.2.4).
  48. Result CheckSubject(const base::StringPiece& asn1_subject,
  49. const base::StringPiece& spki_hash) const;
  50. // Returns true if |spki_hash|, the SHA256 of the SubjectPublicKeyInfo,
  51. // is known to be used for interception by a party other than the device
  52. // or machine owner.
  53. bool IsKnownInterceptionKey(base::StringPiece spki_hash) const;
  54. // IsExpired returns true iff the current time is past the NotAfter time
  55. // specified in the CRLSet.
  56. bool IsExpired() const;
  57. // sequence returns the sequence number of this CRL set. CRL sets generated
  58. // by the same source are given strictly monotonically increasing sequence
  59. // numbers.
  60. uint32_t sequence() const;
  61. const std::string& unparsed_crl_set() const;
  62. // CRLList contains a map of (issuer SPKI hash, revoked serial numbers)
  63. // pairs.
  64. typedef std::unordered_map<std::string, std::vector<std::string>> CRLList;
  65. // crls returns the internal state of this CRLSet. It should only be used in
  66. // testing.
  67. const CRLList& CrlsForTesting() const;
  68. // BuiltinCRLSet() returns the default CRLSet, to be used when no CRLSet is
  69. // available from the network. The default CRLSet includes a statically-
  70. // configured block list.
  71. static scoped_refptr<CRLSet> BuiltinCRLSet();
  72. // EmptyCRLSetForTesting returns a valid, but empty, CRLSet for unit tests.
  73. static scoped_refptr<CRLSet> EmptyCRLSetForTesting();
  74. // ExpiredCRLSetForTesting returns a expired, empty CRLSet for unit tests.
  75. static scoped_refptr<CRLSet> ExpiredCRLSetForTesting();
  76. // ForTesting returns a CRLSet for testing. If |is_expired| is true, calling
  77. // IsExpired on the result will return true. If |issuer_spki| is not NULL,
  78. // the CRLSet will cover certificates issued by that SPKI. If |serial_number|
  79. // is not empty, then that DER-encoded serial number will be considered to
  80. // have been revoked by |issuer_spki|. If |utf8_common_name| is not empty
  81. // then the CRLSet will consider certificates with a subject consisting only
  82. // of that common name as a UTF8String to be revoked unless they match an
  83. // SPKI hash from |acceptable_spki_hashes_for_cn|.
  84. static scoped_refptr<CRLSet> ForTesting(
  85. bool is_expired,
  86. const SHA256HashValue* issuer_spki,
  87. const std::string& serial_number,
  88. const std::string utf8_common_name,
  89. const std::vector<std::string> acceptable_spki_hashes_for_cn);
  90. private:
  91. CRLSet();
  92. ~CRLSet();
  93. friend class base::RefCountedThreadSafe<CRLSet>;
  94. uint32_t sequence_ = 0;
  95. // not_after_ contains the time, in UNIX epoch seconds, after which the
  96. // CRLSet should be considered stale, or 0 if no such time was given.
  97. uint64_t not_after_ = 0;
  98. // crls_ is a map from the SHA-256 hash of an X.501 subject name to a list
  99. // of revoked serial numbers.
  100. CRLList crls_;
  101. // blocked_spkis_ contains the SHA256 hashes of SPKIs which are to be blocked
  102. // no matter where in a certificate chain they might appear.
  103. std::vector<std::string> blocked_spkis_;
  104. // known_interception_spkis_ contains the SHA256 hashes of SPKIs which are
  105. // known to be used for interception by a party other than the device or
  106. // machine owner.
  107. std::vector<std::string> known_interception_spkis_;
  108. // limited_subjects_ is a map from the SHA256 hash of an X.501 subject name
  109. // to a list of allowed SPKI hashes for certificates with that subject name.
  110. std::unordered_map<std::string, std::vector<std::string>> limited_subjects_;
  111. // A string that holds the unparsed version of the CRLSet. Only populated in
  112. // the case that the OOP CertVerifier is enabled.
  113. // TODO(crbug.com/1046728): temporary until the network service doesn't need
  114. // to know about CRLSets.
  115. std::string unparsed_crl_set_;
  116. };
  117. } // namespace net
  118. #endif // NET_CERT_CRL_SET_H_