| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/ssl/ssl_config.h" | 5 #include "net/ssl/ssl_config.h" |
| 6 | 6 |
| 7 #if defined(USE_OPENSSL) | 7 #if defined(USE_OPENSSL) |
| 8 #include <openssl/ssl.h> | 8 #include <openssl/ssl.h> |
| 9 #endif | 9 #endif |
| 10 | 10 |
| 11 namespace net { | 11 namespace net { |
| 12 | 12 |
| 13 const uint16 kDefaultSSLVersionMin = SSL_PROTOCOL_VERSION_SSL3; | 13 const uint16 kDefaultSSLVersionMin = SSL_PROTOCOL_VERSION_SSL3; |
| 14 | 14 |
| 15 const uint16 kDefaultSSLVersionMax = | 15 const uint16 kDefaultSSLVersionMax = |
| 16 #if defined(USE_OPENSSL) | 16 #if defined(USE_OPENSSL) |
| 17 #if defined(SSL_OP_NO_TLSv1_2) | 17 #if defined(SSL_OP_NO_TLSv1_2) |
| 18 SSL_PROTOCOL_VERSION_TLS1_2; | 18 SSL_PROTOCOL_VERSION_TLS1_2; |
| 19 #elif defined(SSL_OP_NO_TLSv1_1) | 19 #elif defined(SSL_OP_NO_TLSv1_1) |
| 20 SSL_PROTOCOL_VERSION_TLS1_1; | 20 SSL_PROTOCOL_VERSION_TLS1_1; |
| 21 #else | 21 #else |
| 22 SSL_PROTOCOL_VERSION_TLS1; | 22 SSL_PROTOCOL_VERSION_TLS1; |
| 23 #endif | 23 #endif |
| 24 #else | 24 #else |
| 25 SSL_PROTOCOL_VERSION_TLS1_2; | 25 SSL_PROTOCOL_VERSION_TLS1_2; |
| 26 #endif | 26 #endif |
| 27 | 27 |
| 28 SSLConfig::CertAndStatus::CertAndStatus() : cert_status(0) {} | 28 SSLConfig::CertAndStatus::CertAndStatus() : cert_status(0) { |
| 29 } |
| 29 | 30 |
| 30 SSLConfig::CertAndStatus::~CertAndStatus() {} | 31 SSLConfig::CertAndStatus::~CertAndStatus() { |
| 32 } |
| 31 | 33 |
| 32 SSLConfig::SSLConfig() | 34 SSLConfig::SSLConfig() |
| 33 : rev_checking_enabled(false), | 35 : rev_checking_enabled(false), |
| 34 rev_checking_required_local_anchors(false), | 36 rev_checking_required_local_anchors(false), |
| 35 version_min(kDefaultSSLVersionMin), | 37 version_min(kDefaultSSLVersionMin), |
| 36 version_max(kDefaultSSLVersionMax), | 38 version_max(kDefaultSSLVersionMax), |
| 37 channel_id_enabled(true), | 39 channel_id_enabled(true), |
| 38 false_start_enabled(true), | 40 false_start_enabled(true), |
| 39 signed_cert_timestamps_enabled(true), | 41 signed_cert_timestamps_enabled(true), |
| 40 require_forward_secrecy(false), | 42 require_forward_secrecy(false), |
| 41 send_client_cert(false), | 43 send_client_cert(false), |
| 42 verify_ev_cert(false), | 44 verify_ev_cert(false), |
| 43 version_fallback(false), | 45 version_fallback(false), |
| 44 cert_io_enabled(true) { | 46 cert_io_enabled(true) { |
| 45 } | 47 } |
| 46 | 48 |
| 47 SSLConfig::~SSLConfig() {} | 49 SSLConfig::~SSLConfig() { |
| 50 } |
| 48 | 51 |
| 49 bool SSLConfig::IsAllowedBadCert(X509Certificate* cert, | 52 bool SSLConfig::IsAllowedBadCert(X509Certificate* cert, |
| 50 CertStatus* cert_status) const { | 53 CertStatus* cert_status) const { |
| 51 std::string der_cert; | 54 std::string der_cert; |
| 52 if (!X509Certificate::GetDEREncoded(cert->os_cert_handle(), &der_cert)) | 55 if (!X509Certificate::GetDEREncoded(cert->os_cert_handle(), &der_cert)) |
| 53 return false; | 56 return false; |
| 54 return IsAllowedBadCert(der_cert, cert_status); | 57 return IsAllowedBadCert(der_cert, cert_status); |
| 55 } | 58 } |
| 56 | 59 |
| 57 bool SSLConfig::IsAllowedBadCert(const base::StringPiece& der_cert, | 60 bool SSLConfig::IsAllowedBadCert(const base::StringPiece& der_cert, |
| 58 CertStatus* cert_status) const { | 61 CertStatus* cert_status) const { |
| 59 for (size_t i = 0; i < allowed_bad_certs.size(); ++i) { | 62 for (size_t i = 0; i < allowed_bad_certs.size(); ++i) { |
| 60 if (der_cert == allowed_bad_certs[i].der_cert) { | 63 if (der_cert == allowed_bad_certs[i].der_cert) { |
| 61 if (cert_status) | 64 if (cert_status) |
| 62 *cert_status = allowed_bad_certs[i].cert_status; | 65 *cert_status = allowed_bad_certs[i].cert_status; |
| 63 return true; | 66 return true; |
| 64 } | 67 } |
| 65 } | 68 } |
| 66 return false; | 69 return false; |
| 67 } | 70 } |
| 68 | 71 |
| 69 } // namespace net | 72 } // namespace net |
| OLD | NEW |