Add distrust by SPKI to TrustStoreInMemory
Change-Id: I9dcb1ef1218ece2678688abe7459fb2d1dcb8854
Bug: chromium:1477317
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64308
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: Bob Beck <bbe@google.com>
diff --git a/pki/trust_store_in_memory.h b/pki/trust_store_in_memory.h
index 4fea8d1..59ae3a4 100644
--- a/pki/trust_store_in_memory.h
+++ b/pki/trust_store_in_memory.h
@@ -6,6 +6,7 @@
#define BSSL_PKI_TRUST_STORE_IN_MEMORY_H_
#include <unordered_map>
+#include <set>
#include <openssl/base.h>
@@ -55,6 +56,12 @@
void AddDistrustedCertificateForTest(
std::shared_ptr<const ParsedCertificate> cert);
+ // Distrusts the provided SPKI. This will override any other trust (e.g. if a
+ // certificate is passed into AddTrustAnchor() and the certificate's SPKI is
+ // passed into AddDistrustedCertificateBySPKI(), GetTrust() will return
+ // CertificateTrust::ForDistrusted()).
+ void AddDistrustedCertificateBySPKI(std::string spki);
+
// Adds a certificate to the store, that is neither trusted nor untrusted.
void AddCertificateWithUnspecifiedTrust(
std::shared_ptr<const ParsedCertificate> cert);
@@ -81,6 +88,9 @@
// Multimap from normalized subject -> Entry.
std::unordered_multimap<std::string_view, Entry> entries_;
+ // Set of distrusted SPKIs.
+ std::set<std::string> distrusted_spkis_;
+
// Returns the `Entry` matching `cert`, or `nullptr` if not in the trust
// store.
const Entry *GetEntry(const ParsedCertificate *cert) const;
