You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
67 lines
2.1 KiB
67 lines
2.1 KiB
// Copyright 2019 The Chromium Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
syntax = "proto2";
|
|
|
|
package cast.certificate;
|
|
|
|
option optimize_for = LITE_RUNTIME;
|
|
|
|
// A suite of test data to exercise Cast device certificate verification and
|
|
// revocation logic.
|
|
message DeviceCertTestSuite {
|
|
repeated DeviceCertTest tests = 1;
|
|
}
|
|
|
|
enum VerificationResult {
|
|
// This should never be encountered in a valid test.
|
|
UNSPECIFIED = 0;
|
|
|
|
// The device certificate is valid.
|
|
SUCCESS = 1;
|
|
|
|
// Problem with device certificate or its path.
|
|
PATH_VERIFICATION_FAILED = 2;
|
|
|
|
// Problem with the CRL.
|
|
CRL_VERIFICATION_FAILED = 3;
|
|
|
|
// Device certificate or one of the certificates in its path did not pass the
|
|
// revocation check.
|
|
REVOCATION_CHECK_FAILED = 4;
|
|
|
|
// No CRL was provided, but revocation check is required, and therefore fails.
|
|
REVOCATION_CHECK_FAILED_WITHOUT_CRL = 5;
|
|
|
|
// CRL is valid at the time of initial verification, but when device cert
|
|
// revocation is checked, the CRL signer cert has expired and the CRL is no
|
|
// longer valid.
|
|
CRL_EXPIRED_AFTER_INITIAL_VERIFICATION = 6;
|
|
}
|
|
|
|
message DeviceCertTest {
|
|
// Human-readable description of the test.
|
|
optional string description = 1;
|
|
|
|
// Expected result of the certificate verification.
|
|
optional VerificationResult expected_result = 4;
|
|
|
|
// Device certiticate path up to a trusted root. Root is not included.
|
|
repeated bytes der_cert_path = 2;
|
|
|
|
// Serialized cast.CrlBundle proto if revocation check is required.
|
|
optional bytes crl_bundle = 3;
|
|
|
|
// Time at which to verify the device certificate.
|
|
optional uint64 cert_verification_time_seconds = 5;
|
|
|
|
// Time at which to verify the CRL. It this field is omitted, the CRL is
|
|
// verified at cert_verification_time_seconds.
|
|
optional uint64 crl_verification_time_seconds = 6;
|
|
|
|
// Chooses between test and production trust anchors for device certificates
|
|
// and CRLs. Defaults to using the test trust anchors.
|
|
optional bool use_test_trust_anchors = 7 [default = true];
|
|
}
|