ct_serialization.h 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_CT_SERIALIZATION_H_
  5. #define NET_CERT_CT_SERIALIZATION_H_
  6. #include <string>
  7. #include <vector>
  8. #include "base/memory/ref_counted.h"
  9. #include "base/strings/string_piece.h"
  10. #include "base/time/time.h"
  11. #include "net/base/net_export.h"
  12. // Utility functions for encoding/decoding structures used by Certificate
  13. // Transparency to/from the TLS wire format encoding.
  14. namespace net::ct {
  15. struct DigitallySigned;
  16. struct MerkleTreeLeaf;
  17. struct SignedCertificateTimestamp;
  18. struct SignedEntryData;
  19. struct SignedTreeHead;
  20. // If |input.signature_data| is less than kMaxSignatureLength, encodes the
  21. // |input| to |output| and returns true. Otherwise, returns false.
  22. NET_EXPORT_PRIVATE bool EncodeDigitallySigned(const DigitallySigned& input,
  23. std::string* output);
  24. // Reads and decodes a DigitallySigned object from |input|.
  25. // The bytes read from |input| are discarded (i.e. |input|'s prefix removed)
  26. // Returns true and fills |output| if all fields can be read, false otherwise.
  27. NET_EXPORT_PRIVATE bool DecodeDigitallySigned(base::StringPiece* input,
  28. DigitallySigned* output);
  29. // Encodes the |input| SignedEntryData to |output|. Returns true if the entry
  30. // size does not exceed allowed size in RFC6962, false otherwise.
  31. NET_EXPORT_PRIVATE bool EncodeSignedEntry(const SignedEntryData& input,
  32. std::string* output);
  33. // Serialises the Merkle tree |leaf|, appending it to |output|.
  34. // These bytes can be hashed for use with audit proof fetching.
  35. // Note that |leaf.log_id| is not part of the TLS encoding, and so will not be
  36. // serialized.
  37. NET_EXPORT bool EncodeTreeLeaf(const MerkleTreeLeaf& leaf, std::string* output);
  38. // Encodes the data signed by a Signed Certificate Timestamp (SCT) into
  39. // |output|. The signature included in the SCT is then verified over these
  40. // bytes.
  41. // |timestamp| timestamp from the SCT.
  42. // |serialized_log_entry| the log entry signed by the SCT.
  43. // |extensions| CT extensions.
  44. // Returns true if the extensions' length does not exceed
  45. // kMaxExtensionsLength, false otherwise.
  46. NET_EXPORT_PRIVATE bool EncodeV1SCTSignedData(
  47. const base::Time& timestamp,
  48. const std::string& serialized_log_entry,
  49. const std::string& extensions,
  50. std::string* output);
  51. // Encodes the data signed by a Signed Tree Head (STH) |signed_tree_head| into
  52. // |output|. The signature included in the |signed_tree_head| can then be
  53. // verified over these bytes.
  54. // Returns true if the data could be encoded successfully, false
  55. // otherwise.
  56. NET_EXPORT_PRIVATE bool EncodeTreeHeadSignature(
  57. const SignedTreeHead& signed_tree_head,
  58. std::string* output);
  59. // Decode a list of Signed Certificate Timestamps
  60. // (SignedCertificateTimestampList as defined in RFC6962): from a single
  61. // string in |input| to a vector of individually-encoded SCTs |output|.
  62. // This list is typically obtained from the CT extension in a certificate.
  63. // Returns true if the list could be read and decoded successfully, false
  64. // otherwise (note that the validity of each individual SCT should be checked
  65. // separately).
  66. NET_EXPORT_PRIVATE bool DecodeSCTList(base::StringPiece input,
  67. std::vector<base::StringPiece>* output);
  68. // Decodes a single SCT from |input| to |output|.
  69. // Returns true if all fields in the SCT could be read and decoded, false
  70. // otherwise.
  71. NET_EXPORT_PRIVATE bool DecodeSignedCertificateTimestamp(
  72. base::StringPiece* input,
  73. scoped_refptr<ct::SignedCertificateTimestamp>* output);
  74. // Serializes a Signed Certificate Timestamp (SCT) into |output|.
  75. // Returns true if the SCT could be encoded successfully, false
  76. // otherwise.
  77. NET_EXPORT bool EncodeSignedCertificateTimestamp(
  78. const scoped_refptr<ct::SignedCertificateTimestamp>& input,
  79. std::string* output);
  80. // Writes an SCTList into |output|, containing a single |sct|.
  81. NET_EXPORT_PRIVATE bool EncodeSCTListForTesting(const base::StringPiece& sct,
  82. std::string* output);
  83. } // namespace net::ct
  84. #endif // NET_CERT_CT_SERIALIZATION_H_