security/pkix/test/lib/pkixtestutil.h@97036ab72558 (annotated)
security/pkix/test/lib/pkixtestutil.h
Tue, 06 Jan 2015 21:39:09 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Tue, 06 Jan 2015 21:39:09 +0100
- branch
- TOR_BUG_9701
- changeset 8
- 97036ab72558
- permissions
- -rw-r--r--
Conditionally force memory storage according to privacy.thirdparty.isolate;
This solves Tor bug #9701, complying with disk avoidance documented in
https://www.torproject.org/projects/torbrowser/design/#disk-avoidance.
| michael@0 | 1 | /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ |
| michael@0 | 2 | /* vim: set ts=8 sts=2 et sw=2 tw=80: */ |
| michael@0 | 3 | /* Copyright 2013 Mozilla Foundation |
| michael@0 | 4 | * |
| michael@0 | 5 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| michael@0 | 6 | * you may not use this file except in compliance with the License. |
| michael@0 | 7 | * You may obtain a copy of the License at |
| michael@0 | 8 | * |
| michael@0 | 9 | * http://www.apache.org/licenses/LICENSE-2.0 |
| michael@0 | 10 | * |
| michael@0 | 11 | * Unless required by applicable law or agreed to in writing, software |
| michael@0 | 12 | * distributed under the License is distributed on an "AS IS" BASIS, |
| michael@0 | 13 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| michael@0 | 14 | * See the License for the specific language governing permissions and |
| michael@0 | 15 | * limitations under the License. |
| michael@0 | 16 | */ |
| michael@0 | 17 | |
| michael@0 | 18 | #ifndef mozilla_pkix_test__pkixtestutils_h |
| michael@0 | 19 | #define mozilla_pkix_test__pkixtestutils_h |
| michael@0 | 20 | |
| michael@0 | 21 | #include "pkix/ScopedPtr.h" |
| michael@0 | 22 | #include "pkix/pkixtypes.h" |
| michael@0 | 23 | #include "seccomon.h" |
| michael@0 | 24 | |
| michael@0 | 25 | namespace mozilla { namespace pkix { namespace test { |
| michael@0 | 26 | |
| michael@0 | 27 | class OCSPResponseExtension |
| michael@0 | 28 | { |
| michael@0 | 29 | public: |
| michael@0 | 30 | SECItem id; |
| michael@0 | 31 | bool critical; |
| michael@0 | 32 | SECItem value; |
| michael@0 | 33 | OCSPResponseExtension* next; |
| michael@0 | 34 | }; |
| michael@0 | 35 | |
| michael@0 | 36 | class OCSPResponseContext |
| michael@0 | 37 | { |
| michael@0 | 38 | public: |
| michael@0 | 39 | OCSPResponseContext(PLArenaPool* arena, CERTCertificate* cert, PRTime time); |
| michael@0 | 40 | |
| michael@0 | 41 | PLArenaPool* arena; |
| michael@0 | 42 | // TODO(bug 980538): add a way to specify what certificates are included. |
| michael@0 | 43 | pkix::ScopedCERTCertificate cert; // The subject of the OCSP response |
| michael@0 | 44 | pkix::ScopedCERTCertificate issuerCert; // The issuer of the subject |
| michael@0 | 45 | pkix::ScopedCERTCertificate signerCert; // This cert signs the response |
| michael@0 | 46 | uint8_t responseStatus; // See the OCSPResponseStatus enum in rfc 6960 |
| michael@0 | 47 | bool skipResponseBytes; // If true, don't include responseBytes |
| michael@0 | 48 | |
| michael@0 | 49 | static const uint32_t MaxIncludedCertificates = 4; |
| michael@0 | 50 | pkix::ScopedCERTCertificate includedCertificates[MaxIncludedCertificates]; |
| michael@0 | 51 | |
| michael@0 | 52 | // The following fields are on a per-SingleResponse basis. In the future we |
| michael@0 | 53 | // may support including multiple SingleResponses per response. |
| michael@0 | 54 | PRTime producedAt; |
| michael@0 | 55 | PRTime thisUpdate; |
| michael@0 | 56 | PRTime nextUpdate; |
| michael@0 | 57 | bool includeNextUpdate; |
| michael@0 | 58 | SECOidTag certIDHashAlg; |
| michael@0 | 59 | uint8_t certStatus; // See the CertStatus choice in rfc 6960 |
| michael@0 | 60 | PRTime revocationTime; // For certStatus == revoked |
| michael@0 | 61 | bool badSignature; // If true, alter the signature to fail verification |
| michael@0 | 62 | |
| michael@0 | 63 | enum ResponderIDType { |
| michael@0 | 64 | ByName = 1, |
| michael@0 | 65 | ByKeyHash = 2 |
| michael@0 | 66 | }; |
| michael@0 | 67 | ResponderIDType responderIDType; |
| michael@0 | 68 | |
| michael@0 | 69 | OCSPResponseExtension* extensions; |
| michael@0 | 70 | bool includeEmptyExtensions; // If true, include the extension wrapper |
| michael@0 | 71 | // regardless of if there are any actual |
| michael@0 | 72 | // extensions. |
| michael@0 | 73 | }; |
| michael@0 | 74 | |
| michael@0 | 75 | // The return value, if non-null, is owned by the arena in the context |
| michael@0 | 76 | // and MUST NOT be freed. |
| michael@0 | 77 | // This function does its best to respect the NSPR error code convention |
| michael@0 | 78 | // (that is, if it returns null, calling PR_GetError() will return the |
| michael@0 | 79 | // error of the failed operation). However, this is not guaranteed. |
| michael@0 | 80 | SECItem* CreateEncodedOCSPResponse(OCSPResponseContext& context); |
| michael@0 | 81 | |
| michael@0 | 82 | } } } // namespace mozilla::pkix::test |
| michael@0 | 83 | |
| michael@0 | 84 | #endif // mozilla_pkix_test__pkixtestutils_h |
