OLD | NEW |
---|---|
(Empty) | |
1 // Copyright (c) 2017 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CHROME_BROWSER_SSL_IGNORE_ERRORS_CERT_VERIFIER_H_ | |
6 #define CHROME_BROWSER_SSL_IGNORE_ERRORS_CERT_VERIFIER_H_ | |
7 | |
8 #include <memory> | |
9 #include <string> | |
10 #include <vector> | |
11 | |
12 #include "base/containers/flat_set.h" | |
13 #include "net/cert/cert_verifier.h" | |
14 | |
15 namespace net { | |
16 struct SHA256HashValue; | |
17 class SHA256HashValueLessThan; | |
18 } // namespace net | |
19 | |
20 // IgnoreErrorsCertVerifier wraps another CertVerifier in order to ignore | |
21 // verification errors from certificate chains that match a whitelist of SPKI | |
22 // fingerprints. | |
23 class NET_EXPORT IgnoreErrorsCertVerifier : public net::CertVerifier { | |
24 public: | |
25 // SPKIHashSet is a set of SHA-256 SPKI fingerprints (RFC 7469, Section 2.4). | |
26 using SPKIHashSet = | |
27 base::flat_set<net::SHA256HashValue, net::SHA256HashValueLessThan>; | |
28 | |
29 // MakeWhitelist converts a vector of Base64-encoded SHA-256 SPKI fingerprints | |
30 // into an SPKIHashSet. Invalid fingerprints are logged and skipped. | |
31 static SPKIHashSet MakeWhitelist( | |
32 const std::vector<std::string>& fingerprints); | |
33 | |
34 IgnoreErrorsCertVerifier(std::unique_ptr<net::CertVerifier> verifier, | |
35 SPKIHashSet whitelist); | |
36 | |
37 ~IgnoreErrorsCertVerifier() override; | |
38 | |
39 // Verify invokes Verify() on the wrapped CertVerifier. If any of the | |
40 // certificates from the chain in |params| match one of the SPKI fingerprints | |
41 // from the whitelist, it returns OK regardless of the actual verification | |
42 // result (or ERR_IO_PENDING on asynchronous completion). Otherwise the actual | |
43 // result is returned. | |
Ryan Sleevi
2017/04/25 18:07:09
I think this needs updating with the new behaviour
martinkr
2017/04/25 19:48:37
Done.
| |
44 int Verify(const RequestParams& params, | |
45 net::CRLSet* crl_set, | |
46 net::CertVerifyResult* verify_result, | |
47 const net::CompletionCallback& callback, | |
48 std::unique_ptr<Request>* out_req, | |
49 const net::NetLogWithSource& net_log) override; | |
50 | |
51 private: | |
52 std::unique_ptr<net::CertVerifier> verifier_; | |
53 SPKIHashSet whitelist_; | |
54 }; | |
55 | |
56 #endif // CHROME_BROWSER_SSL_IGNORE_ERRORS_CERT_VERIFIER_H_ | |
OLD | NEW |