Index: net/cert/ignore_errors_cert_verifier.h |
diff --git a/net/cert/ignore_errors_cert_verifier.h b/net/cert/ignore_errors_cert_verifier.h |
new file mode 100644 |
index 0000000000000000000000000000000000000000..83bbc019b18b93e58307c7065ab60838c555e0a1 |
--- /dev/null |
+++ b/net/cert/ignore_errors_cert_verifier.h |
@@ -0,0 +1,52 @@ |
+// Copyright (c) 2017 The Chromium Authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+#ifndef NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_ |
+#define NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_ |
Ryan Sleevi
2017/04/07 16:08:05
Seems like this could be moved to chrome/browser/s
martinkr
2017/04/07 21:40:57
Ah yes, I wasn't super familiar with the code orga
|
+ |
+#include <memory> |
+ |
+#include "base/containers/flat_set.h" |
+#include "net/cert/cert_verifier.h" |
+ |
+namespace net { |
+ |
+// IgnoreErrorsCertVerifier wraps another CertVerifier in order to ignore |
+// verification errors from certificate chains that match a whitelist of SPKI |
+// fingerprints. |
+class NET_EXPORT IgnoreErrorsCertVerifier : public CertVerifier { |
+ public: |
+ // SPKIHashSet is a set of SHA-256 SPKI fingerprints (RFC 7469, Section 2.4). |
+ using SPKIHashSet = base::flat_set<SHA256HashValue, SHA256HashValueLessThan>; |
+ |
+ // MakeWhitelist converts a vector of Base64-encoded SHA-256 SPKI fingerprints |
+ // into an SPKIHashSet. Invalid fingerprints are logged and skipped. |
+ static SPKIHashSet MakeWhitelist( |
+ const std::vector<std::string>& fingerprints); |
+ |
+ IgnoreErrorsCertVerifier(std::unique_ptr<CertVerifier> verifier, |
+ SPKIHashSet whitelist); |
+ |
+ ~IgnoreErrorsCertVerifier() override; |
+ |
+ // Verify invokes Verify() on the wrapped CertVerifier. If any of the |
+ // certificates from the chain in |params| match one of the SPKI fingerprints |
+ // from the whitelist, it returns OK regardless of the actual verification |
+ // result (or ERR_IO_PENDING on asynchronous completion). Otherwise the actual |
+ // result is returned. |
+ int Verify(const RequestParams& params, |
+ CRLSet* crl_set, |
+ CertVerifyResult* verify_result, |
+ const CompletionCallback& callback, |
+ std::unique_ptr<Request>* out_req, |
+ const NetLogWithSource& net_log) override; |
+ |
+ private: |
+ std::unique_ptr<CertVerifier> verifier_; |
+ SPKIHashSet whitelist_; |
+}; |
+ |
+} // namespace net |
+ |
+#endif // NET_CERT_IGNORE_ERRORS_CERT_VERIFIER_H_ |