1// Copyright 2016 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef NET_CERT_OCSP_VERIFY_RESULT_H_
6#define NET_CERT_OCSP_VERIFY_RESULT_H_
7
8#include <string>
9
10#include "net/base/net_export.h"
11#include "net/cert/ocsp_revocation_status.h"
12
13namespace net {
14
15// The result of OCSP verification. This always contains a ResponseStatus, which
16// describes whether or not an OCSP response was provided, and response level
17// errors. It optionally contains an OCSPRevocationStatus when |response_status
18// = PROVIDED|. For example, a stapled OCSP response matching the certificate,
19// and indicating a non-revoked status, will have |response_status = PROVIDED|
20// and |revocation_status = GOOD|. This is populated as part of the certificate
21// verification process, and should not be modified at other layers.
22struct NET_EXPORT OCSPVerifyResult {
23 OCSPVerifyResult();
24 OCSPVerifyResult(const OCSPVerifyResult&);
25 ~OCSPVerifyResult();
26
27 bool operator==(const OCSPVerifyResult& other) const;
28
29 // This value is histogrammed, so do not re-order or change values, and add
30 // new values at the end.
31 enum ResponseStatus {
32 // OCSP verification was not checked on this connection.
33 NOT_CHECKED = 0,
34
35 // No OCSPResponse was stapled.
36 MISSING = 1,
37
38 // An up-to-date OCSP response was stapled and matched the certificate.
39 PROVIDED = 2,
40
41 // The stapled OCSP response did not have a SUCCESSFUL status.
42 ERROR_RESPONSE = 3,
43
44 // The OCSPResponseData field producedAt was outside the certificate
45 // validity period.
46 BAD_PRODUCED_AT = 4,
47
48 // At least one OCSPSingleResponse was stapled, but none matched the
49 // certificate.
50 NO_MATCHING_RESPONSE = 5,
51
52 // A matching OCSPSingleResponse was stapled, but was either expired or not
53 // yet valid.
54 INVALID_DATE = 6,
55
56 // The OCSPResponse structure could not be parsed.
57 PARSE_RESPONSE_ERROR = 7,
58
59 // The OCSPResponseData structure could not be parsed.
60 PARSE_RESPONSE_DATA_ERROR = 8,
61 RESPONSE_STATUS_MAX = PARSE_RESPONSE_DATA_ERROR
62 };
63
64 ResponseStatus response_status = NOT_CHECKED;
65
66 // The strictest CertStatus matching the certificate (REVOKED > UNKNOWN >
67 // GOOD). Only valid if |response_status| = PROVIDED.
68 OCSPRevocationStatus revocation_status = OCSPRevocationStatus::UNKNOWN;
69};
70
71} // namespace net
72
73#endif // NET_CERT_OCSP_VERIFY_RESULT_H_
74