blob: 86d6c32b19f938523dfbc77f385d1235045adac8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef NET_CERT_INTERNAL_SIGNATURE_POLICY_H_
#define NET_CERT_INTERNAL_SIGNATURE_POLICY_H_
#include <stddef.h>
#include "base/compiler_specific.h"
#include "net/base/net_export.h"
#include "net/cert/internal/signature_algorithm.h"
namespace net {
class CertErrors;
class SignatureAlgorithm;
// SignaturePolicy is an interface (and base implementation) for applying
// policies when verifying signed data. It lets callers override which
// algorithms, named curves, and key sizes to allow.
class NET_EXPORT SignaturePolicy {
public:
virtual ~SignaturePolicy() {}
// Implementations should return true if |algorithm| is acceptable. For
// instance, implementations could reject any signature algorithms that used
// SHA-1.
//
// The default implementation accepts all signature algorithms.
virtual bool IsAcceptableSignatureAlgorithm(
const SignatureAlgorithm& algorithm,
CertErrors* errors) const;
// Implementations should return true if |curve_nid| is an allowed
// elliptical curve. |curve_nid| is an object ID from BoringSSL (for example
// NID_secp384r1).
//
// The default implementation accepts secp256r1, secp384r1, secp521r1 only.
virtual bool IsAcceptableCurveForEcdsa(int curve_nid,
CertErrors* errors) const;
// Implementations should return true if |modulus_length_bits| is an allowed
// RSA key size in bits.
//
// The default implementation accepts any modulus length >= 2048 bits.
virtual bool IsAcceptableModulusLengthForRsa(size_t modulus_length_bits,
CertErrors* errors) const;
};
// SimpleSignaturePolicy modifies the base SignaturePolicy by allowing the
// minimum RSA key length to be specified (rather than hard coded to 2048).
class NET_EXPORT SimpleSignaturePolicy : public SignaturePolicy {
public:
explicit SimpleSignaturePolicy(size_t min_rsa_modulus_length_bits);
bool IsAcceptableModulusLengthForRsa(size_t modulus_length_bits,
CertErrors* errors) const override;
private:
const size_t min_rsa_modulus_length_bits_;
};
} // namespace net
#endif // NET_CERT_INTERNAL_SIGNATURE_POLICY_H_
|
