1 // Copyright 2013 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_CT_VERIFIER_H_ 6 #define NET_CERT_CT_VERIFIER_H_ 7 8 #include "base/strings/string_piece.h" 9 #include "net/base/net_export.h" 10 #include "net/cert/signed_certificate_timestamp_and_status.h" 11 12 namespace net { 13 14 class NetLogWithSource; 15 class X509Certificate; 16 17 // Interface for verifying Signed Certificate Timestamps over a certificate. 18 class NET_EXPORT CTVerifier { 19 public: 20 virtual ~CTVerifier() = default; 21 22 // Verifies SCTs embedded in the certificate itself, SCTs embedded in a 23 // stapled OCSP response, and SCTs obtained via the 24 // signed_certificate_timestamp TLS extension on the given |cert|. 25 // A certificate is permitted but not required to use multiple sources for 26 // SCTs. It is expected that most certificates will use only one source 27 // (embedding, TLS extension or OCSP stapling). If no stapled OCSP response 28 // is available, |stapled_ocsp_response| should be an empty string. If no SCT 29 // TLS extension was negotiated, |sct_list_from_tls_extension| should be an 30 // empty string. |output_scts| will be cleared and filled with the SCTs 31 // present, if any, along with their verification results. 32 // The |hostname| (or IP address literal) of the server that presented |cert| 33 // must be provided so that inclusion checks for |cert| are able to avoid 34 // leaking information about which servers have been visited. 35 virtual void Verify(base::StringPiece hostname, 36 X509Certificate* cert, 37 base::StringPiece stapled_ocsp_response, 38 base::StringPiece sct_list_from_tls_extension, 39 SignedCertificateTimestampAndStatusList* output_scts, 40 const NetLogWithSource& net_log) = 0; 41 }; 42 43 } // namespace net 44 45 #endif // NET_CERT_CT_VERIFIER_H_ 46