OLD | NEW |
---|---|
(Empty) | |
1 // Copyright (c) 2017 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_ | |
6 #define NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_ | |
Ryan Sleevi
2017/04/07 16:08:05
Seems like this could be moved to chrome/browser/s
martinkr
2017/04/07 21:40:57
Ah yes, I wasn't super familiar with the code orga
| |
7 | |
8 #include <memory> | |
9 | |
10 #include "base/containers/flat_set.h" | |
11 #include "net/cert/cert_verifier.h" | |
12 | |
13 namespace net { | |
14 | |
15 // IgnoreErrorsCertVerifier wraps another CertVerifier in order to ignore | |
16 // verification errors from certificate chains that match a whitelist of SPKI | |
17 // fingerprints. | |
18 class NET_EXPORT IgnoreErrorsCertVerifier : public CertVerifier { | |
19 public: | |
20 // SPKIHashSet is a set of SHA-256 SPKI fingerprints (RFC 7469, Section 2.4). | |
21 using SPKIHashSet = base::flat_set<SHA256HashValue, SHA256HashValueLessThan>; | |
22 | |
23 // MakeWhitelist converts a vector of Base64-encoded SHA-256 SPKI fingerprints | |
24 // into an SPKIHashSet. Invalid fingerprints are logged and skipped. | |
25 static SPKIHashSet MakeWhitelist( | |
26 const std::vector<std::string>& fingerprints); | |
27 | |
28 IgnoreErrorsCertVerifier(std::unique_ptr<CertVerifier> verifier, | |
29 SPKIHashSet whitelist); | |
30 | |
31 ~IgnoreErrorsCertVerifier() override; | |
32 | |
33 // Verify invokes Verify() on the wrapped CertVerifier. If any of the | |
34 // certificates from the chain in |params| match one of the SPKI fingerprints | |
35 // from the whitelist, it returns OK regardless of the actual verification | |
36 // result (or ERR_IO_PENDING on asynchronous completion). Otherwise the actual | |
37 // result is returned. | |
38 int Verify(const RequestParams& params, | |
39 CRLSet* crl_set, | |
40 CertVerifyResult* verify_result, | |
41 const CompletionCallback& callback, | |
42 std::unique_ptr<Request>* out_req, | |
43 const NetLogWithSource& net_log) override; | |
44 | |
45 private: | |
46 std::unique_ptr<CertVerifier> verifier_; | |
47 SPKIHashSet whitelist_; | |
48 }; | |
49 | |
50 } // namespace net | |
51 | |
52 #endif // NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_ | |
OLD | NEW |