1 // Copyright 2017 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_INTERNAL_SYSTEM_TRUST_STORE_H_ 6 #define NET_CERT_INTERNAL_SYSTEM_TRUST_STORE_H_ 7 8 #include "base/containers/span.h" 9 #include "build/build_config.h" 10 #include "net/base/net_export.h" 11 #include "net/net_buildflags.h" 12 #include "third_party/boringssl/src/pki/parsed_certificate.h" 13 #include "third_party/boringssl/src/pki/trust_store.h" 14 15 namespace net { 16 17 struct ChromeRootCertConstraints; 18 19 // The SystemTrustStore interface is used to encapsulate a bssl::TrustStore for 20 // the current platform, with some extra bells and whistles. Implementations 21 // must be thread-safe. 22 // 23 // This is primarily used to abstract out the platform-specific bits that 24 // relate to configuring the bssl::TrustStore needed for path building. 25 class SystemTrustStore { 26 public: 27 virtual ~SystemTrustStore() = default; 28 29 // Returns an aggregate bssl::TrustStore that can be used by the path builder. 30 // The store composes the system trust store (if implemented) with manually 31 // added trust anchors added via AddTrustAnchor(). This pointer is non-owned, 32 // and valid only for the lifetime of |this|. Any bssl::TrustStore objects 33 // returned from this method must be thread-safe. 34 virtual bssl::TrustStore* GetTrustStore() = 0; 35 36 // IsKnownRoot() returns true if the given certificate originated from the 37 // system trust store and is a "standard" one. The meaning of "standard" is 38 // that it is one of default trust anchors for the system, as opposed to a 39 // user-installed one. 40 virtual bool IsKnownRoot(const bssl::ParsedCertificate* cert) const = 0; 41 42 #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) 43 // Returns the current version of the Chrome Root Store being used. If 44 // Chrome Root Store is not in use, returns 0. 45 virtual int64_t chrome_root_store_version() const = 0; 46 47 // Returns the Chrome Root Store constraints for `cert`, or nullptr if the 48 // certificate is not constrained. 49 virtual base::span<const ChromeRootCertConstraints> GetChromeRootConstraints( 50 const bssl::ParsedCertificate* cert) const = 0; 51 #endif 52 }; 53 54 #if BUILDFLAG(IS_FUCHSIA) 55 // Creates an instance of SystemTrustStore that wraps the current platform's SSL 56 // trust store. This cannot return nullptr. 57 NET_EXPORT std::unique_ptr<SystemTrustStore> CreateSslSystemTrustStore(); 58 #endif 59 60 #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) 61 class TrustStoreChrome; 62 63 // Creates an instance of SystemTrustStore that wraps the current platform's SSL 64 // trust store for user added roots, but uses the Chrome Root Store trust 65 // anchors. This cannot return nullptr. 66 NET_EXPORT std::unique_ptr<SystemTrustStore> 67 CreateSslSystemTrustStoreChromeRoot( 68 std::unique_ptr<TrustStoreChrome> chrome_root); 69 70 // Creates an instance of SystemTrustStore that only uses the Chrome Root Store 71 // trust anchors. 72 // This cannot return nullptr. 73 NET_EXPORT std::unique_ptr<SystemTrustStore> CreateChromeOnlySystemTrustStore( 74 std::unique_ptr<TrustStoreChrome> chrome_root); 75 76 NET_EXPORT_PRIVATE std::unique_ptr<SystemTrustStore> 77 CreateSystemTrustStoreChromeForTesting( 78 std::unique_ptr<TrustStoreChrome> trust_store_chrome, 79 std::unique_ptr<bssl::TrustStore> trust_store_system); 80 #endif // BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) 81 82 #if BUILDFLAG(IS_MAC) 83 // Initializes trust cache on a worker thread, if the builtin verifier is 84 // enabled. 85 NET_EXPORT void InitializeTrustStoreMacCache(); 86 #endif 87 88 #if BUILDFLAG(IS_WIN) 89 // Initializes windows system trust store on a worker thread, if the builtin 90 // verifier is enabled. 91 NET_EXPORT void InitializeTrustStoreWinSystem(); 92 #endif 93 94 #if BUILDFLAG(IS_ANDROID) 95 // Initializes Android system trust store on a worker thread, if the builtin 96 // verifier is enabled. 97 NET_EXPORT void InitializeTrustStoreAndroid(); 98 #endif 99 100 } // namespace net 101 102 #endif // NET_CERT_INTERNAL_SYSTEM_TRUST_STORE_H_ 103