Distrust publicly trusted SHA-1 certs

net/cert/cert_verify_proc.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CERT_VERIFY_PROC_H_
 #define NET_CERT_CERT_VERIFY_PROC_H_
 
 #include <string>
 #include <vector>
 
+#include "base/feature_list.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
 #include "net/cert/x509_cert_types.h"
 
 namespace net {
 
 class CertVerifyResult;
 class CRLSet;
@@ skipping 55 matching lines @@
   virtual bool SupportsOCSPStapling() const = 0;
 
  protected:
   CertVerifyProc();
   virtual ~CertVerifyProc();
 
  private:
   friend class base::RefCountedThreadSafe<CertVerifyProc>;
   FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts);
   FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, TestHasTooLongValidity);
+  FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest,
+                           VerifyRejectsSHA1AfterDeprecationLegacyMode);
 
   // Performs the actual verification using the desired underlying
   // cryptographic library. On entry, |verify_result->verified_cert|
   // is set to |cert|, the unverified chain. If no chain is built, the
   // value must be left untouched.
   virtual int VerifyInternal(X509Certificate* cert,
                              const std::string& hostname,
                              const std::string& ocsp_response,
                              int flags,
                              CRLSet* crl_set,
@@ skipping 21 matching lines @@
   //
   // For certificates issued after 1 July 2012: 60 months.
   // For certificates issued after 1 April 2015: 39 months.
   //
   // For certificates issued before the BRs took effect, there were no
   // guidelines, but clamp them at a maximum of 10 year validity, with the
   // requirement they expire within 7 years after the effective date of the BRs
   // (i.e. by 1 July 2019).
   static bool HasTooLongValidity(const X509Certificate& cert);
 
+  // Emergency kill-switch for SHA-1 deprecation. Disabled by default.
+  static const base::Feature kSHA1LegacyMode;
+
   DISALLOW_COPY_AND_ASSIGN(CertVerifyProc);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CERT_VERIFY_PROC_H_