OpenSSL/NSS implementation of ProofVerfifier.

net/quic/crypto/proof_verifier_openssl.h

+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_CRYPTO_PROOF_VERIFIER_OPENSSL_H_
+#define NET_QUIC_CRYPTO_PROOF_VERIFIER_OPENSSL_H_
+
+#include <string>
+#include <vector>
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "net/base/net_export.h"
+#include "net/quic/crypto/proof_verifier.h"
+
+struct x509_store_st;
+typedef struct x509_store_st X509_STORE;
+struct x509_st;
+typedef struct x509_st X509;
+
+namespace net {
+
+// ProofVerifierOpenSSL implements the QUIC ProofVerifier interface using
+// OpenSSL.
+class NET_EXPORT_PRIVATE ProofVerifierOpenSSL : public ProofVerifier {
+ public:
+  explicit ProofVerifierOpenSSL(const std::string& root_ca_filename);
+  virtual ~ProofVerifierOpenSSL();
+
+  // ProofVerifier interface
+  virtual bool VerifyProof(const std::string& hostname,
+                           const std::string& server_config,
+                           const std::vector<std::string>& certs,
+                           const std::string& signature,
+                           std::string* error_details) const OVERRIDE;
+
+ private:
+  X509* VerifyChain(const std::vector<std::string>& certs) const;
+  static bool VerifySignature(const std::string& signed_data,
+                              const std::string& signature,
+                              X509* cert);
+  static bool VerifyLeafForHost(X509* cert, const std::string& hostname);
+
+  X509_STORE* store_;
+
+  DISALLOW_COPY_AND_ASSIGN(ProofVerifierOpenSSL);
+};
+
+}  // namespace net
+
+#endif  // NET_QUIC_CRYPTO_PROOF_VERIFIER_OPENSSL_H_