Implement Token Binding negotiation TLS extension

net/ssl/ssl_config.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_CONFIG_H_
 #define NET_SSL_SSL_CONFIG_H_
 
 #include <stdint.h>
 
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
 #include "net/cert/x509_certificate.h"
 #include "net/socket/next_proto.h"
 
 namespace net {
 
 // Various TLS/SSL ProtocolVersion values encoded as uint16
 //      struct {
 //          uint8 major;
 //          uint8 minor;
 //      } ProtocolVersion;
 // The most significant byte is |major|, and the least significant byte
 // is |minor|.
 enum {
   SSL_PROTOCOL_VERSION_TLS1 = 0x0301,
   SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302,
   SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303,
 };
 
+enum TokenBindingParam {
+  TB_PARAM_RSA2048_PKCS15_SHA256 = 0,
+  TB_PARAM_RSA2048_PSS_SHA256 = 1,
+  TB_PARAM_ECDSAP256_SHA256 = 2,
+};
+
 // Default minimum protocol version.
 NET_EXPORT extern const uint16_t kDefaultSSLVersionMin;
 
 // Default maximum protocol version.
 NET_EXPORT extern const uint16_t kDefaultSSLVersionMax;
 
 // Default minimum protocol version that it's acceptable to fallback to.
 NET_EXPORT extern const uint16_t kDefaultSSLVersionFallbackMin;
 
 // A collection of SSL-related configuration settings.
@@ skipping 66 matching lines @@
   // big-endian form, they should be declared in host byte order, with the
   // first uint8 occupying the most significant byte.
   // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
   // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
   std::vector<uint16> disabled_cipher_suites;
 
   // Enables deprecated cipher suites. Currently, RC4 is deprecated.
   bool enable_deprecated_cipher_suites;
 
   bool channel_id_enabled;   // True if TLS channel ID extension is enabled.
+
+  // List of Token Binding key parameters supported by the client. If empty,
+  // Token Binding will be disabled.
+  std::vector<TokenBindingParam> token_binding_params;
+
   bool false_start_enabled;  // True if we'll use TLS False Start.
   // True if the Certificate Transparency signed_certificate_timestamp
   // TLS extension is enabled.
   bool signed_cert_timestamps_enabled;
 
   // If true, causes only ECDHE cipher suites to be enabled.
   bool require_ecdhe;
 
   // TODO(wtc): move the following members to a new SSLParams structure.  They
   // are not SSL configuration settings.
@@ skipping 42 matching lines @@
 
   // The list of application-level protocols to enable renegotiation for.
   NextProtoVector renego_allowed_for_protos;
 
   scoped_refptr<X509Certificate> client_cert;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_CONFIG_H_