/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

/* vim: set ts=2 et sw=2 tw=80: */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef ContentSignatureVerifier_h

#define ContentSignatureVerifier_h

#include "cert.h"

#include "CSTrustDomain.h"

#include "nsIContentSignatureVerifier.h"

#include "nsIStreamListener.h"

#include "nsString.h"

#include "ScopedNSSTypes.h"

// 45a5fe2f-c350-4b86-962d-02d5aaaa955a

#define NS_CONTENTSIGNATUREVERIFIER_CID \

  { 0x45a5fe2f, 0xc350, 0x4b86, \

    { 0x96, 0x2d, 0x02, 0xd5, 0xaa, 0xaa, 0x95, 0x5a } }

#define NS_CONTENTSIGNATUREVERIFIER_CONTRACTID \

    "@mozilla.org/security/contentsignatureverifier;1"

class ContentSignatureVerifier final : public nsIContentSignatureVerifier

                                     , public nsIStreamListener

                                     , public nsIInterfaceRequestor

{

public:

  NS_DECL_ISUPPORTS

  NS_DECL_NSICONTENTSIGNATUREVERIFIER

  NS_DECL_NSIINTERFACEREQUESTOR

  NS_DECL_NSISTREAMLISTENER

  NS_DECL_NSIREQUESTOBSERVER

  ContentSignatureVerifier()

    : mCx(nullptr)

    , mInitialised(false)

    , mHasCertChain(false)

  {

  }

private:

  ~ContentSignatureVerifier() {}

  nsresult UpdateInternal(const nsACString& aData);

  nsresult DownloadCertChain();

  nsresult CreateContextInternal(const nsACString& aData,

                                 const nsACString& aCertChain,

                                 const nsACString& aName);

  nsresult ParseContentSignatureHeader(const nsACString& aContentSignatureHeader);

  // verifier context for incremental verifications

  mozilla::UniqueVFYContext mCx;

  bool mInitialised;

  // Indicates whether we hold a cert chain to verify the signature or not.

  // It's set by default in CreateContext or when the channel created in

  // DownloadCertChain finished. Update and End must only be called after

  // mHashCertChain is set.

  bool mHasCertChain;

  // signature to verify

  nsCString mSignature;

  // x5u (X.509 URL) value pointing to pem cert chain

  nsCString mCertChainURL;

  // the downloaded cert chain to verify against

  FallibleTArray<nsCString> mCertChain;

  // verification key

  mozilla::UniqueSECKEYPublicKey mKey;

  // name of the verifying context

  nsCString mName;

  // callback to notify when finished

  nsCOMPtr<nsIContentSignatureReceiverCallback> mCallback;

  // channel to download the cert chain

  nsCOMPtr<nsIChannel> mChannel;

  // EE certificate fingerprint

  nsCString mFingerprint;

};

#endif // ContentSignatureVerifier_h