signed_certificate_timestamp.h 4.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_SIGNED_CERTIFICATE_TIMESTAMP_H_
  5. #define NET_CERT_SIGNED_CERTIFICATE_TIMESTAMP_H_
  6. #include <string>
  7. #include <vector>
  8. #include "base/memory/ref_counted.h"
  9. #include "base/time/time.h"
  10. #include "net/base/hash_value.h"
  11. #include "net/base/net_export.h"
  12. namespace base {
  13. class Pickle;
  14. class PickleIterator;
  15. }
  16. // Structures related to Certificate Transparency (RFC6962).
  17. namespace net::ct {
  18. // Contains the data necessary to reconstruct the signed_entry of a
  19. // SignedCertificateTimestamp, from RFC 6962, Section 3.2.
  20. //
  21. // All the data necessary to validate a SignedCertificateTimestamp is present
  22. // within the SignedCertificateTimestamp, except for the signature_type,
  23. // entry_type, and the actual entry. The only supported signature_type at
  24. // present is certificate_timestamp. The entry_type is implicit from the
  25. // context in which it is received (those in the X.509 extension are
  26. // precert_entry, all others are x509_entry). The signed_entry itself is
  27. // reconstructed from the certificate being verified, or from the corresponding
  28. // precertificate.
  29. //
  30. // The SignedEntryData contains this reconstructed data, and can be used to
  31. // either generate or verify the signature in SCTs.
  32. struct NET_EXPORT SignedEntryData {
  33. // LogEntryType enum in RFC 6962, Section 3.1
  34. enum Type {
  35. LOG_ENTRY_TYPE_X509 = 0,
  36. LOG_ENTRY_TYPE_PRECERT = 1
  37. };
  38. SignedEntryData();
  39. ~SignedEntryData();
  40. void Reset();
  41. Type type = LOG_ENTRY_TYPE_X509;
  42. // Set if type == LOG_ENTRY_TYPE_X509
  43. std::string leaf_certificate;
  44. // Set if type == LOG_ENTRY_TYPE_PRECERT
  45. SHA256HashValue issuer_key_hash;
  46. std::string tbs_certificate;
  47. };
  48. // Helper structure to represent Digitally Signed data, as described in
  49. // Sections 4.7 and 7.4.1.4.1 of RFC 5246.
  50. struct NET_EXPORT DigitallySigned {
  51. enum HashAlgorithm {
  52. HASH_ALGO_NONE = 0,
  53. HASH_ALGO_MD5 = 1,
  54. HASH_ALGO_SHA1 = 2,
  55. HASH_ALGO_SHA224 = 3,
  56. HASH_ALGO_SHA256 = 4,
  57. HASH_ALGO_SHA384 = 5,
  58. HASH_ALGO_SHA512 = 6,
  59. };
  60. enum SignatureAlgorithm {
  61. SIG_ALGO_ANONYMOUS = 0,
  62. SIG_ALGO_RSA = 1,
  63. SIG_ALGO_DSA = 2,
  64. SIG_ALGO_ECDSA = 3
  65. };
  66. DigitallySigned();
  67. ~DigitallySigned();
  68. // Returns true if |other_hash_algorithm| and |other_signature_algorithm|
  69. // match this DigitallySigned hash and signature algorithms.
  70. bool SignatureParametersMatch(
  71. HashAlgorithm other_hash_algorithm,
  72. SignatureAlgorithm other_signature_algorithm) const;
  73. HashAlgorithm hash_algorithm = HASH_ALGO_NONE;
  74. SignatureAlgorithm signature_algorithm = SIG_ALGO_ANONYMOUS;
  75. // 'signature' field.
  76. std::string signature_data;
  77. };
  78. // SignedCertificateTimestamp struct in RFC 6962, Section 3.2.
  79. struct NET_EXPORT SignedCertificateTimestamp
  80. : public base::RefCountedThreadSafe<SignedCertificateTimestamp> {
  81. // Predicate functor used in maps when SignedCertificateTimestamp is used as
  82. // the key.
  83. struct NET_EXPORT LessThan {
  84. bool operator()(const scoped_refptr<SignedCertificateTimestamp>& lhs,
  85. const scoped_refptr<SignedCertificateTimestamp>& rhs) const;
  86. };
  87. // Version enum in RFC 6962, Section 3.2.
  88. enum Version {
  89. V1 = 0,
  90. };
  91. // Source of the SCT - supplementary, not defined in CT RFC.
  92. // Note: The numeric values are used within histograms and should not change
  93. // or be re-assigned.
  94. enum Origin {
  95. SCT_EMBEDDED = 0,
  96. SCT_FROM_TLS_EXTENSION = 1,
  97. SCT_FROM_OCSP_RESPONSE = 2,
  98. SCT_ORIGIN_MAX,
  99. };
  100. SignedCertificateTimestamp();
  101. SignedCertificateTimestamp(const SignedCertificateTimestamp&) = delete;
  102. SignedCertificateTimestamp& operator=(const SignedCertificateTimestamp&) =
  103. delete;
  104. void Persist(base::Pickle* pickle);
  105. static scoped_refptr<SignedCertificateTimestamp> CreateFromPickle(
  106. base::PickleIterator* iter);
  107. Version version = V1;
  108. std::string log_id;
  109. base::Time timestamp;
  110. std::string extensions;
  111. DigitallySigned signature;
  112. Origin origin = SCT_EMBEDDED;
  113. // The log description is not one of the SCT fields, but a user-readable
  114. // name defined alongside the log key. It should not participate
  115. // in equality checks as the log's description could change while
  116. // the SCT would be the same.
  117. std::string log_description;
  118. private:
  119. friend class base::RefCountedThreadSafe<SignedCertificateTimestamp>;
  120. ~SignedCertificateTimestamp();
  121. };
  122. using SCTList = std::vector<scoped_refptr<ct::SignedCertificateTimestamp>>;
  123. } // namespace net::ct
  124. #endif // NET_CERT_SIGNED_CERTIFICATE_TIMESTAMP_H_