security/manager/boot/src/PublicKeyPinningService.h@b8a032363ba2 (annotated)
security/manager/boot/src/PublicKeyPinningService.h
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | /* This Source Code Form is subject to the terms of the Mozilla Public |
| michael@0 | 2 | * License, v. 2.0. If a copy of the MPL was not distributed with this |
| michael@0 | 3 | * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| michael@0 | 4 | |
| michael@0 | 5 | #ifndef PublicKeyPinningService_h |
| michael@0 | 6 | #define PublicKeyPinningService_h |
| michael@0 | 7 | |
| michael@0 | 8 | #include "cert.h" |
| michael@0 | 9 | |
| michael@0 | 10 | namespace mozilla { |
| michael@0 | 11 | namespace psm { |
| michael@0 | 12 | |
| michael@0 | 13 | class PublicKeyPinningService |
| michael@0 | 14 | { |
| michael@0 | 15 | public: |
| michael@0 | 16 | /** |
| michael@0 | 17 | * Returns true if the given (host, certList) passes pinning checks, |
| michael@0 | 18 | * false otherwise. If the host is pinned, return true if one of the keys in |
| michael@0 | 19 | * the given certificate chain matches the pin set specified by the |
| michael@0 | 20 | * hostname. If the hostname is null or empty evaluate against all the |
| michael@0 | 21 | * possible names for the EE cert (Common Name (CN) plus all DNS Name: |
| michael@0 | 22 | * subject Alt Name entries). The certList's head is the EE cert and the |
| michael@0 | 23 | * tail is the trust anchor. |
| michael@0 | 24 | * Note: if an alt name is a wildcard, it won't necessarily find a pinset |
| michael@0 | 25 | * that would otherwise be valid for it |
| michael@0 | 26 | */ |
| michael@0 | 27 | static bool ChainHasValidPins(const CERTCertList* certList, |
| michael@0 | 28 | const char* hostname, |
| michael@0 | 29 | const PRTime, |
| michael@0 | 30 | bool enforceTestMode); |
| michael@0 | 31 | }; |
| michael@0 | 32 | |
| michael@0 | 33 | }} // namespace mozilla::psm |
| michael@0 | 34 | |
| michael@0 | 35 | #endif // PublicKeyPinningServiceService_h |
