| OLD | NEW | 
|---|
|  | (Empty) | 
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. |  | 
| 2 // Use of this source code is governed by a BSD-style license that can be |  | 
| 3 // found in the LICENSE file. |  | 
| 4 |  | 
| 5 #ifndef NET_SSL_SSL_SERVER_CONFIG_H_ |  | 
| 6 #define NET_SSL_SSL_SERVER_CONFIG_H_ |  | 
| 7 |  | 
| 8 #include <stdint.h> |  | 
| 9 #include <vector> |  | 
| 10 |  | 
| 11 #include "base/basictypes.h" |  | 
| 12 #include "net/base/net_export.h" |  | 
| 13 #include "net/ssl/ssl_config.h" |  | 
| 14 |  | 
| 15 namespace net { |  | 
| 16 |  | 
| 17 // A collection of server-side SSL-related configuration settings. |  | 
| 18 struct NET_EXPORT SSLServerConfig { |  | 
| 19   // Defaults |  | 
| 20   SSLServerConfig(); |  | 
| 21   ~SSLServerConfig(); |  | 
| 22 |  | 
| 23   // The minimum and maximum protocol versions that are enabled. |  | 
| 24   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined in ssl_config.h) |  | 
| 25   // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it |  | 
| 26   // means no protocol versions are enabled. |  | 
| 27   uint16_t version_min; |  | 
| 28   uint16_t version_max; |  | 
| 29 |  | 
| 30   // Presorted list of cipher suites which should be explicitly prevented from |  | 
| 31   // being used in addition to those disabled by the net built-in policy. |  | 
| 32   // |  | 
| 33   // By default, all cipher suites supported by the underlying SSL |  | 
| 34   // implementation will be enabled except for: |  | 
| 35   // - Null encryption cipher suites. |  | 
| 36   // - Weak cipher suites: < 80 bits of security strength. |  | 
| 37   // - FORTEZZA cipher suites (obsolete). |  | 
| 38   // - IDEA cipher suites (RFC 5469 explains why). |  | 
| 39   // - Anonymous cipher suites. |  | 
| 40   // - ECDSA cipher suites on platforms that do not support ECDSA signed |  | 
| 41   //   certificates, as servers may use the presence of such ciphersuites as a |  | 
| 42   //   hint to send an ECDSA certificate. |  | 
| 43   // The ciphers listed in |disabled_cipher_suites| will be removed in addition |  | 
| 44   // to the above list. |  | 
| 45   // |  | 
| 46   // Though cipher suites are sent in TLS as "uint8 CipherSuite[2]", in |  | 
| 47   // big-endian form, they should be declared in host byte order, with the |  | 
| 48   // first uint8 occupying the most significant byte. |  | 
| 49   // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to |  | 
| 50   // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002. |  | 
| 51   std::vector<uint16_t> disabled_cipher_suites; |  | 
| 52 |  | 
| 53   // If true, causes only ECDHE cipher suites to be enabled. |  | 
| 54   bool require_ecdhe; |  | 
| 55 |  | 
| 56   // Requires a client certificate for client authentication from the client. |  | 
| 57   // This doesn't currently enforce certificate validity. |  | 
| 58   bool require_client_cert; |  | 
| 59 }; |  | 
| 60 |  | 
| 61 }  // namespace net |  | 
| 62 |  | 
| 63 #endif  // NET_SSL_SSL_SERVER_CONFIG_H_ |  | 
| OLD | NEW | 
|---|