ev_root_ca_metadata.h 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_EV_ROOT_CA_METADATA_H_
  5. #define NET_CERT_EV_ROOT_CA_METADATA_H_
  6. #include "build/build_config.h"
  7. #include <map>
  8. #include <set>
  9. #include <string>
  10. #include <vector>
  11. #include "crypto/crypto_buildflags.h"
  12. #include "net/base/net_export.h"
  13. #include "net/cert/x509_certificate.h"
  14. #if BUILDFLAG(USE_NSS_CERTS) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_APPLE) || \
  15. BUILDFLAG(IS_FUCHSIA)
  16. // When not defined, the EVRootCAMetadata singleton is a dumb placeholder
  17. // implementation that will fail all EV lookup operations.
  18. #define PLATFORM_USES_CHROMIUM_EV_METADATA
  19. #endif
  20. namespace base {
  21. template <typename T>
  22. struct LazyInstanceTraitsBase;
  23. } // namespace base
  24. namespace net {
  25. namespace der {
  26. class Input;
  27. } // namespace der
  28. // A singleton. This class stores the meta data of the root CAs that issue
  29. // extended-validation (EV) certificates.
  30. class NET_EXPORT_PRIVATE EVRootCAMetadata {
  31. public:
  32. #if BUILDFLAG(IS_WIN)
  33. typedef const char* PolicyOID;
  34. #else
  35. // DER-encoded OID value (no tag or length).
  36. typedef der::Input PolicyOID;
  37. #endif
  38. static EVRootCAMetadata* GetInstance();
  39. EVRootCAMetadata(const EVRootCAMetadata&) = delete;
  40. EVRootCAMetadata& operator=(const EVRootCAMetadata&) = delete;
  41. // Returns true if policy_oid is an EV policy OID of some root CA.
  42. bool IsEVPolicyOID(PolicyOID policy_oid) const;
  43. // Same as above but using the the DER-encoded OID (no tag or length).
  44. bool IsEVPolicyOIDGivenBytes(const der::Input& policy_oid) const;
  45. // Returns true if the root CA with the given certificate fingerprint has
  46. // the EV policy OID policy_oid.
  47. bool HasEVPolicyOID(const SHA256HashValue& fingerprint,
  48. PolicyOID policy_oid) const;
  49. // Same as above but using the the DER-encoded OID (no tag or length).
  50. bool HasEVPolicyOIDGivenBytes(const SHA256HashValue& fingerprint,
  51. const der::Input& policy_oid) const;
  52. #if defined(PLATFORM_USES_CHROMIUM_EV_METADATA)
  53. // Returns true if |policy_oid| is for 2.23.140.1.1 (CA/Browser Forum's
  54. // Extended Validation Policy). This is used as a hack by the
  55. // platform-specific CertVerifyProcs when doing EV verification.
  56. static bool IsCaBrowserForumEvOid(PolicyOID policy_oid);
  57. #endif
  58. // AddEVCA adds an EV CA to the list of known EV CAs with the given policy.
  59. // |policy| is expressed as a string of dotted numbers. It returns true on
  60. // success.
  61. bool AddEVCA(const SHA256HashValue& fingerprint, const char* policy);
  62. // RemoveEVCA removes an EV CA that was previously added by AddEVCA. It
  63. // returns true on success.
  64. bool RemoveEVCA(const SHA256HashValue& fingerprint);
  65. private:
  66. friend struct base::LazyInstanceTraitsBase<EVRootCAMetadata>;
  67. EVRootCAMetadata();
  68. ~EVRootCAMetadata();
  69. #if BUILDFLAG(IS_WIN)
  70. using ExtraEVCAMap = std::map<SHA256HashValue, std::string>;
  71. // extra_cas_ contains any EV CA metadata that was added at runtime.
  72. ExtraEVCAMap extra_cas_;
  73. #elif defined(PLATFORM_USES_CHROMIUM_EV_METADATA)
  74. using PolicyOIDMap = std::map<SHA256HashValue, std::vector<std::string>>;
  75. PolicyOIDMap ev_policy_;
  76. std::set<std::string> policy_oids_;
  77. #endif
  78. };
  79. } // namespace net
  80. #endif // NET_CERT_EV_ROOT_CA_METADATA_H_