OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/base/transport_security_state.h" | 5 #include "net/base/transport_security_state.h" |
6 | 6 |
7 #if defined(USE_OPENSSL) | 7 #if defined(USE_OPENSSL) |
8 #include <openssl/ecdsa.h> | 8 #include <openssl/ecdsa.h> |
9 #include <openssl/ssl.h> | 9 #include <openssl/ssl.h> |
10 #else // !defined(USE_OPENSSL) | 10 #else // !defined(USE_OPENSSL) |
(...skipping 905 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
916 }; | 916 }; |
917 static const char* const kGoogleRejectedCerts[] = { | 917 static const char* const kGoogleRejectedCerts[] = { |
918 kSPKIHash_Aetna, | 918 kSPKIHash_Aetna, |
919 kSPKIHash_GeoTrustGlobal, | 919 kSPKIHash_GeoTrustGlobal, |
920 kSPKIHash_GeoTrustPrimary, | 920 kSPKIHash_GeoTrustPrimary, |
921 kSPKIHash_Intel, | 921 kSPKIHash_Intel, |
922 kSPKIHash_TCTrustCenter, | 922 kSPKIHash_TCTrustCenter, |
923 kSPKIHash_Vodafone, | 923 kSPKIHash_Vodafone, |
924 NULL, | 924 NULL, |
925 }; | 925 }; |
926 static const PublicKeyPins kGooglePins = { | 926 #define kGooglePins { \ |
927 kGoogleAcceptableCerts, | 927 kGoogleAcceptableCerts, \ |
928 kGoogleRejectedCerts, | 928 kGoogleRejectedCerts, \ |
929 }; | 929 } |
930 | 930 |
931 static const char* const kTorAcceptableCerts[] = { | 931 static const char* const kTorAcceptableCerts[] = { |
932 kSPKIHash_RapidSSL, | 932 kSPKIHash_RapidSSL, |
933 kSPKIHash_DigiCertEVRoot, | 933 kSPKIHash_DigiCertEVRoot, |
934 kSPKIHash_Tor1, | 934 kSPKIHash_Tor1, |
935 kSPKIHash_Tor2, | 935 kSPKIHash_Tor2, |
936 kSPKIHash_Tor3, | 936 kSPKIHash_Tor3, |
937 NULL, | 937 NULL, |
938 }; | 938 }; |
939 static const PublicKeyPins kTorPins = { | 939 #define kTorPins { \ |
940 kTorAcceptableCerts, | 940 kTorAcceptableCerts, \ |
941 kNoRejectedPublicKeys, | 941 kNoRejectedPublicKeys, \ |
942 }; | 942 } |
943 | 943 |
944 static const char* const kTwitterComAcceptableCerts[] = { | 944 static const char* const kTwitterComAcceptableCerts[] = { |
945 kSPKIHash_VeriSignClass1, | 945 kSPKIHash_VeriSignClass1, |
946 kSPKIHash_VeriSignClass3, | 946 kSPKIHash_VeriSignClass3, |
947 kSPKIHash_VeriSignClass3_G4, | 947 kSPKIHash_VeriSignClass3_G4, |
948 kSPKIHash_VeriSignClass4_G3, | 948 kSPKIHash_VeriSignClass4_G3, |
949 kSPKIHash_VeriSignClass3_G3, | 949 kSPKIHash_VeriSignClass3_G3, |
950 kSPKIHash_VeriSignClass1_G3, | 950 kSPKIHash_VeriSignClass1_G3, |
951 kSPKIHash_VeriSignClass2_G3, | 951 kSPKIHash_VeriSignClass2_G3, |
952 kSPKIHash_VeriSignClass3_G2, | 952 kSPKIHash_VeriSignClass3_G2, |
953 kSPKIHash_VeriSignClass2_G2, | 953 kSPKIHash_VeriSignClass2_G2, |
954 kSPKIHash_VeriSignClass3_G5, | 954 kSPKIHash_VeriSignClass3_G5, |
955 kSPKIHash_VeriSignUniversal, | 955 kSPKIHash_VeriSignUniversal, |
956 kSPKIHash_GeoTrustGlobal, | 956 kSPKIHash_GeoTrustGlobal, |
957 kSPKIHash_GeoTrustGlobal2, | 957 kSPKIHash_GeoTrustGlobal2, |
958 kSPKIHash_GeoTrustUniversal, | 958 kSPKIHash_GeoTrustUniversal, |
959 kSPKIHash_GeoTrustUniversal2, | 959 kSPKIHash_GeoTrustUniversal2, |
960 kSPKIHash_GeoTrustPrimary, | 960 kSPKIHash_GeoTrustPrimary, |
961 kSPKIHash_GeoTrustPrimary_G2, | 961 kSPKIHash_GeoTrustPrimary_G2, |
962 kSPKIHash_GeoTrustPrimary_G3, | 962 kSPKIHash_GeoTrustPrimary_G3, |
963 kSPKIHash_Twitter1, | 963 kSPKIHash_Twitter1, |
964 NULL, | 964 NULL, |
965 }; | 965 }; |
966 static const PublicKeyPins kTwitterComPins = { | 966 #define kTwitterComPins { \ |
967 kTwitterComAcceptableCerts, | 967 kTwitterComAcceptableCerts, \ |
968 kNoRejectedPublicKeys, | 968 kNoRejectedPublicKeys, \ |
969 }; | 969 } |
970 | 970 |
971 // kTestAcceptableCerts doesn't actually match any public keys and is used | 971 // kTestAcceptableCerts doesn't actually match any public keys and is used |
972 // with "pinningtest.appspot.com", below, to test if pinning is active. | 972 // with "pinningtest.appspot.com", below, to test if pinning is active. |
973 static const char* const kTestAcceptableCerts[] = { | 973 static const char* const kTestAcceptableCerts[] = { |
974 "sha1/AAAAAAAAAAAAAAAAAAAAAAAAAAA=", | 974 "sha1/AAAAAAAAAAAAAAAAAAAAAAAAAAA=", |
975 NULL, | 975 NULL, |
976 }; | 976 }; |
977 static const PublicKeyPins kTestPins = { | 977 #define kTestPins { \ |
978 kTestAcceptableCerts, | 978 kTestAcceptableCerts, \ |
979 kNoRejectedPublicKeys, | 979 kNoRejectedPublicKeys, \ |
980 }; | 980 } |
981 | 981 |
982 static const PublicKeyPins kNoPins = { | 982 #define kNoPins { \ |
983 NULL, NULL, | 983 NULL, NULL, \ |
984 }; | 984 } |
985 | 985 |
986 #if defined(OS_CHROMEOS) | 986 #if defined(OS_CHROMEOS) |
987 static const bool kTwitterHSTS = true; | 987 static const bool kTwitterHSTS = true; |
988 #else | 988 #else |
989 static const bool kTwitterHSTS = false; | 989 static const bool kTwitterHSTS = false; |
990 #endif | 990 #endif |
991 | 991 |
992 // In the medium term this list is likely to just be hardcoded here. This | 992 // In the medium term this list is likely to just be hardcoded here. This |
993 // slightly odd form removes the need for additional relocations records. | 993 // slightly odd form removes the need for additional relocations records. |
994 static const struct HSTSPreload kPreloadedSTS[] = { | 994 static const struct HSTSPreload kPreloadedSTS[] = { |
(...skipping 358 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1353 const { | 1353 const { |
1354 return mode == MODE_STRICT; | 1354 return mode == MODE_STRICT; |
1355 } | 1355 } |
1356 | 1356 |
1357 bool TransportSecurityState::DomainState::ShouldMixedScriptingBeBlocked() | 1357 bool TransportSecurityState::DomainState::ShouldMixedScriptingBeBlocked() |
1358 const { | 1358 const { |
1359 return true; | 1359 return true; |
1360 } | 1360 } |
1361 | 1361 |
1362 } // namespace | 1362 } // namespace |
OLD | NEW |