1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
// Copyright 2025 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/cert/require_ct_delegate.h"
namespace net {
// static
ct::CTRequirementsStatus RequireCTDelegate::CheckCTRequirements(
const RequireCTDelegate* delegate,
std::string_view host,
bool is_issued_by_known_root,
const HashValueVector& public_key_hashes,
const X509Certificate* validated_certificate_chain,
ct::CTPolicyCompliance policy_compliance) {
// CT is not required if the certificate does not chain to a publicly
// trusted root certificate.
if (!is_issued_by_known_root) {
return ct::CTRequirementsStatus::CT_NOT_REQUIRED;
}
// A connection is considered compliant if it has sufficient SCTs or if the
// build is outdated. Other statuses are not considered compliant; this
// includes COMPLIANCE_DETAILS_NOT_AVAILABLE because compliance must have been
// evaluated in order to determine that the connection is compliant.
bool complies =
(policy_compliance ==
ct::CTPolicyCompliance::CT_POLICY_COMPLIES_VIA_SCTS ||
policy_compliance == ct::CTPolicyCompliance::CT_POLICY_BUILD_NOT_TIMELY);
CTRequirementLevel ct_required = CTRequirementLevel::NOT_REQUIRED;
if (delegate) {
// Allow the delegate to override the CT requirement state.
ct_required = delegate->IsCTRequiredForHost(
host, validated_certificate_chain, public_key_hashes);
}
switch (ct_required) {
case CTRequirementLevel::REQUIRED:
return complies ? ct::CTRequirementsStatus::CT_REQUIREMENTS_MET
: ct::CTRequirementsStatus::CT_REQUIREMENTS_NOT_MET;
case CTRequirementLevel::NOT_REQUIRED:
return ct::CTRequirementsStatus::CT_NOT_REQUIRED;
}
}
} // namespace net
|
