DXR is a code search and navigation tool aimed at making sense of large projects. It supports full-text and regex searches as well as structural queries.

Implementation

Mercurial (409f3966645a)

VCS Links

Line Code
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */


#ifndef ContentSignatureVerifier_h
#define ContentSignatureVerifier_h

#include "cert.h"
#include "CSTrustDomain.h"
#include "nsIContentSignatureVerifier.h"
#include "nsIStreamListener.h"
#include "nsString.h"
#include "ScopedNSSTypes.h"

// 45a5fe2f-c350-4b86-962d-02d5aaaa955a
#define NS_CONTENTSIGNATUREVERIFIER_CID \
  { 0x45a5fe2f, 0xc350, 0x4b86, \
    { 0x96, 0x2d, 0x02, 0xd5, 0xaa, 0xaa, 0x95, 0x5a } }
#define NS_CONTENTSIGNATUREVERIFIER_CONTRACTID \
    "@mozilla.org/security/contentsignatureverifier;1"

class ContentSignatureVerifier final : public nsIContentSignatureVerifier
                                     , public nsIStreamListener
                                     , public nsIInterfaceRequestor
{
public:
  NS_DECL_ISUPPORTS
  NS_DECL_NSICONTENTSIGNATUREVERIFIER
  NS_DECL_NSIINTERFACEREQUESTOR
  NS_DECL_NSISTREAMLISTENER
  NS_DECL_NSIREQUESTOBSERVER

  ContentSignatureVerifier()
    : mCx(nullptr)
    , mInitialised(false)
    , mHasCertChain(false)
  {
  }

private:
  ~ContentSignatureVerifier() {}

  nsresult UpdateInternal(const nsACString& aData);
  nsresult DownloadCertChain();
  nsresult CreateContextInternal(const nsACString& aData,
                                 const nsACString& aCertChain,
                                 const nsACString& aName);

  nsresult ParseContentSignatureHeader(const nsACString& aContentSignatureHeader);

  // verifier context for incremental verifications
  mozilla::UniqueVFYContext mCx;
  bool mInitialised;
  // Indicates whether we hold a cert chain to verify the signature or not.
  // It's set by default in CreateContext or when the channel created in
  // DownloadCertChain finished. Update and End must only be called after
  // mHashCertChain is set.
  bool mHasCertChain;
  // signature to verify
  nsCString mSignature;
  // x5u (X.509 URL) value pointing to pem cert chain
  nsCString mCertChainURL;
  // the downloaded cert chain to verify against
  FallibleTArray<nsCString> mCertChain;
  // verification key
  mozilla::UniqueSECKEYPublicKey mKey;
  // name of the verifying context
  nsCString mName;
  // callback to notify when finished
  nsCOMPtr<nsIContentSignatureReceiverCallback> mCallback;
  // channel to download the cert chain
  nsCOMPtr<nsIChannel> mChannel;
  // EE certificate fingerprint
  nsCString mFingerprint;
};

#endif // ContentSignatureVerifier_h