Merge Chromium + Blink git repositories
[chromium-blink-merge.git] / net / ssl / ssl_config.cc
bloba539440d44e188eb47cba3a1bc1d2a284a7eac7e
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "net/ssl/ssl_config.h"
7 #include "net/cert/cert_verifier.h"
8 #include "net/socket/ssl_client_socket.h"
10 namespace net {
12 const uint16 kDefaultSSLVersionMin = SSL_PROTOCOL_VERSION_TLS1;
14 const uint16 kDefaultSSLVersionFallbackMin = SSL_PROTOCOL_VERSION_TLS1_1;
16 SSLConfig::CertAndStatus::CertAndStatus() : cert_status(0) {}
18 SSLConfig::CertAndStatus::~CertAndStatus() {}
20 SSLConfig::SSLConfig()
21 : rev_checking_enabled(false),
22 rev_checking_required_local_anchors(false),
23 version_min(kDefaultSSLVersionMin),
24 version_max(SSLClientSocket::GetMaxSupportedSSLVersion()),
25 version_fallback_min(kDefaultSSLVersionFallbackMin),
26 enable_deprecated_cipher_suites(false),
27 channel_id_enabled(true),
28 false_start_enabled(true),
29 signed_cert_timestamps_enabled(true),
30 require_ecdhe(false),
31 send_client_cert(false),
32 verify_ev_cert(false),
33 version_fallback(false),
34 cert_io_enabled(true),
35 renego_allowed_default(false) {}
37 SSLConfig::~SSLConfig() {}
39 bool SSLConfig::IsAllowedBadCert(X509Certificate* cert,
40 CertStatus* cert_status) const {
41 std::string der_cert;
42 if (!X509Certificate::GetDEREncoded(cert->os_cert_handle(), &der_cert))
43 return false;
44 return IsAllowedBadCert(der_cert, cert_status);
47 bool SSLConfig::IsAllowedBadCert(const base::StringPiece& der_cert,
48 CertStatus* cert_status) const {
49 for (size_t i = 0; i < allowed_bad_certs.size(); ++i) {
50 if (der_cert == allowed_bad_certs[i].der_cert) {
51 if (cert_status)
52 *cert_status = allowed_bad_certs[i].cert_status;
53 return true;
56 return false;
59 int SSLConfig::GetCertVerifyFlags() const {
60 int flags = 0;
61 if (rev_checking_enabled)
62 flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED;
63 if (verify_ev_cert)
64 flags |= CertVerifier::VERIFY_EV_CERT;
65 if (cert_io_enabled)
66 flags |= CertVerifier::VERIFY_CERT_IO_ENABLED;
67 if (rev_checking_required_local_anchors)
68 flags |= CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS;
69 return flags;
72 } // namespace net