OLD | NEW |
1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_BASE_SSL_CONFIG_SERVICE_H_ | 5 #ifndef NET_BASE_SSL_CONFIG_SERVICE_H_ |
6 #define NET_BASE_SSL_CONFIG_SERVICE_H_ | 6 #define NET_BASE_SSL_CONFIG_SERVICE_H_ |
7 #pragma once | 7 #pragma once |
8 | 8 |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
12 #include "base/observer_list.h" | 12 #include "base/observer_list.h" |
13 #include "base/ref_counted.h" | 13 #include "base/ref_counted.h" |
14 #include "net/base/x509_certificate.h" | 14 #include "net/base/x509_certificate.h" |
15 | 15 |
16 namespace net { | 16 namespace net { |
17 | 17 |
18 // A collection of SSL-related configuration settings. | 18 // A collection of SSL-related configuration settings. |
19 struct SSLConfig { | 19 struct SSLConfig { |
20 // Default to revocation checking. | 20 // Default to revocation checking. |
21 // Default to SSL 3.0 on and TLS 1.0 on. | 21 // Default to SSL 3.0 on and TLS 1.0 on. |
22 SSLConfig(); | 22 SSLConfig(); |
23 ~SSLConfig(); | 23 ~SSLConfig(); |
24 | 24 |
| 25 // Returns true if |cert| is one of the certs in |allowed_bad_certs|. |
| 26 bool IsAllowedBadCert(X509Certificate* cert) const; |
| 27 |
25 bool rev_checking_enabled; // True if server certificate revocation | 28 bool rev_checking_enabled; // True if server certificate revocation |
26 // checking is enabled. | 29 // checking is enabled. |
27 // SSL 2.0 is not supported. | 30 // SSL 2.0 is not supported. |
28 bool ssl3_enabled; // True if SSL 3.0 is enabled. | 31 bool ssl3_enabled; // True if SSL 3.0 is enabled. |
29 bool tls1_enabled; // True if TLS 1.0 is enabled. | 32 bool tls1_enabled; // True if TLS 1.0 is enabled. |
30 bool dnssec_enabled; // True if we'll accept DNSSEC chains in certificates. | 33 bool dnssec_enabled; // True if we'll accept DNSSEC chains in certificates. |
31 bool snap_start_enabled; // True if we'll try Snap Start handshakes. | 34 bool snap_start_enabled; // True if we'll try Snap Start handshakes. |
32 // True if we'll do async checks for certificate provenance using DNS. | 35 // True if we'll do async checks for certificate provenance using DNS. |
33 bool dns_cert_provenance_checking_enabled; | 36 bool dns_cert_provenance_checking_enabled; |
34 | 37 |
(...skipping 37 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
72 // are not SSL configuration settings. | 75 // are not SSL configuration settings. |
73 | 76 |
74 struct CertAndStatus { | 77 struct CertAndStatus { |
75 CertAndStatus(); | 78 CertAndStatus(); |
76 ~CertAndStatus(); | 79 ~CertAndStatus(); |
77 | 80 |
78 scoped_refptr<X509Certificate> cert; | 81 scoped_refptr<X509Certificate> cert; |
79 int cert_status; | 82 int cert_status; |
80 }; | 83 }; |
81 | 84 |
82 // Returns true if |cert| is one of the certs in |allowed_bad_certs|. | |
83 bool IsAllowedBadCert(X509Certificate* cert) const; | |
84 | |
85 // Add any known-bad SSL certificate (with its cert status) to | 85 // Add any known-bad SSL certificate (with its cert status) to |
86 // |allowed_bad_certs| that should not trigger an ERR_CERT_* error when | 86 // |allowed_bad_certs| that should not trigger an ERR_CERT_* error when |
87 // calling SSLClientSocket::Connect. This would normally be done in | 87 // calling SSLClientSocket::Connect. This would normally be done in |
88 // response to the user explicitly accepting the bad certificate. | 88 // response to the user explicitly accepting the bad certificate. |
89 std::vector<CertAndStatus> allowed_bad_certs; | 89 std::vector<CertAndStatus> allowed_bad_certs; |
90 | 90 |
91 // True if we should send client_cert to the server. | 91 // True if we should send client_cert to the server. |
92 bool send_client_cert; | 92 bool send_client_cert; |
93 | 93 |
94 bool verify_ev_cert; // True if we should verify the certificate for EV. | 94 bool verify_ev_cert; // True if we should verify the certificate for EV. |
(...skipping 99 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
194 void ProcessConfigUpdate(const SSLConfig& orig_config, | 194 void ProcessConfigUpdate(const SSLConfig& orig_config, |
195 const SSLConfig& new_config); | 195 const SSLConfig& new_config); |
196 | 196 |
197 private: | 197 private: |
198 ObserverList<Observer> observer_list_; | 198 ObserverList<Observer> observer_list_; |
199 }; | 199 }; |
200 | 200 |
201 } // namespace net | 201 } // namespace net |
202 | 202 |
203 #endif // NET_BASE_SSL_CONFIG_SERVICE_H_ | 203 #endif // NET_BASE_SSL_CONFIG_SERVICE_H_ |
OLD | NEW |