blob: 51b8fa5169cfb782632ff8448cf20a21a75b8caf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
// Copyright 2019 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CAST_COMMON_CERTIFICATE_CAST_CRL_H_
#define CAST_COMMON_CERTIFICATE_CAST_CRL_H_
#include <openssl/x509.h>
#include <memory>
#include <string>
#include <unordered_map>
#include <unordered_set>
#include <vector>
#include "cast/common/certificate/cast_cert_validator.h"
#include "cast/common/certificate/proto/revocation.pb.h"
#include "platform/base/macros.h"
namespace cast {
namespace certificate {
// This class represents the certificate revocation list information parsed from
// the binary in a protobuf message.
class CastCRL {
public:
CastCRL(const TbsCrl& tbs_crl, const DateTime& overall_not_after);
~CastCRL();
// Verifies the revocation status of a cast device certificate given a chain
// of X.509 certificates.
//
// Inputs:
// * |trusted_chain| is the chain of verified certificates, starting with
// trust anchor.
//
// * |time| is the timestamp to use for determining if the certificate is
// revoked.
//
// Output:
// Returns true if no certificate in the chain was revoked.
bool CheckRevocation(const std::vector<X509*>& trusted_chain,
const DateTime& time) const;
private:
struct SerialNumberRange {
uint64_t first_serial;
uint64_t last_serial;
};
DateTime not_before_;
DateTime not_after_;
// Revoked public key hashes.
// The values consist of the SHA256 hash of the SubjectPublicKeyInfo.
std::unordered_set<std::string> revoked_hashes_;
// Revoked serial number ranges indexed by issuer public key hash.
// The key is the SHA256 hash of issuer's SubjectPublicKeyInfo.
// The value is a list of revoked serial number ranges.
std::unordered_map<std::string, std::vector<SerialNumberRange>>
revoked_serial_numbers_;
OSP_DISALLOW_COPY_AND_ASSIGN(CastCRL);
};
struct TrustStore;
// Parses and verifies the CRL used to verify the revocation status of
// Cast device certificates, using the built-in Cast CRL trust anchors.
//
// Inputs:
// * |crl_proto| is a serialized cast_certificate.CrlBundle proto.
// * |time| is the timestamp to use for determining if the CRL is valid.
// * |trust_store| is the set of trust anchors to use. This should be nullptr
// in production, but can be overridden in tests.
//
// Output:
// Returns the CRL object if success, nullptr otherwise.
std::unique_ptr<CastCRL> ParseAndVerifyCRL(const std::string& crl_proto,
const DateTime& time,
TrustStore* trust_store = nullptr);
} // namespace certificate
} // namespace cast
#endif // CAST_COMMON_CERTIFICATE_CAST_CRL_H_
|
