net/ssl/ssl_config.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SSL_SSL_CONFIG_H_
   6 #define NET_SSL_SSL_CONFIG_H_
   7
   8 #include "base/basictypes.h"
   9 #include "base/memory/ref_counted.h"
  10 #include "net/base/net_export.h"
  11 #include "net/cert/x509_certificate.h"
  12 #include "net/socket/next_proto.h"
  13
  14 namespace net {
  15
  16 // Various TLS/SSL ProtocolVersion values encoded as uint16
  17 //      struct {
  18 //          uint8 major;
  19 //          uint8 minor;
  20 //      } ProtocolVersion;
  21 // The most significant byte is |major|, and the least significant byte
  22 // is |minor|.
  23 enum {
  24   SSL_PROTOCOL_VERSION_TLS1 = 0x0301,
  25   SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302,
  26   SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303,
  27 };
  28
  29 // Default minimum protocol version.
  30 NET_EXPORT extern const uint16 kDefaultSSLVersionMin;
  31
  32 // For maximum supported protocol version, use
  33 // SSLClientSocket::GetMaxSupportedSSLVersion().
  34
  35 // Default minimum protocol version that it's acceptable to fallback to.
  36 NET_EXPORT extern const uint16 kDefaultSSLVersionFallbackMin;
  37
  38 // A collection of SSL-related configuration settings.
  39 struct NET_EXPORT SSLConfig {
  40   // Default to revocation checking.
  41   SSLConfig();
  42   ~SSLConfig();
  43
  44   // Returns true if |cert| is one of the certs in |allowed_bad_certs|.
  45   // The expected cert status is written to |cert_status|. |*cert_status| can
  46   // be NULL if user doesn't care about the cert status.
  47   bool IsAllowedBadCert(X509Certificate* cert, CertStatus* cert_status) const;
  48
  49   // Same as above except works with DER encoded certificates instead
  50   // of X509Certificate.
  51   bool IsAllowedBadCert(const base::StringPiece& der_cert,
  52                         CertStatus* cert_status) const;
  53
  54   // Returns the set of flags to use for certificate verification, which is a
  55   // bitwise OR of CertVerifier::VerifyFlags that represent this SSLConfig's
  56   // configuration.
  57   int GetCertVerifyFlags() const;
  58
  59   // rev_checking_enabled is true if online certificate revocation checking is
  60   // enabled (i.e. OCSP and CRL fetching).
  61   //
  62   // Regardless of this flag, CRLSet checking is always enabled and locally
  63   // cached revocation information will be considered.
  64   bool rev_checking_enabled;
  65
  66   // rev_checking_required_local_anchors is true if revocation checking is
  67   // required to succeed when certificates chain to local trust anchors (that
  68   // is, non-public CAs). If revocation information cannot be obtained, such
  69   // certificates will be treated as revoked ("hard-fail").
  70   // Note: This is distinct from rev_checking_enabled. If true, it is
  71   // equivalent to also setting rev_checking_enabled, but only when the
  72   // certificate chain chains to a local (non-public) trust anchor.
  73   bool rev_checking_required_local_anchors;
  74
  75   // The minimum and maximum protocol versions that are enabled.
  76   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.)
  77   // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
  78   // means no protocol versions are enabled.
  79   uint16 version_min;
  80   uint16 version_max;
  81
  82   // version_fallback_min contains the minimum version that is acceptable to
  83   // fallback to. Versions before this may be tried to see whether they would
  84   // have succeeded and thus to give a better message to the user, but the
  85   // resulting connection won't be used in these cases.
  86   uint16 version_fallback_min;
  87
  88   // Presorted list of cipher suites which should be explicitly prevented from
  89   // being used in addition to those disabled by the net built-in policy.
  90   //
  91   // By default, all cipher suites supported by the underlying SSL
  92   // implementation will be enabled except for:
  93   // - Null encryption cipher suites.
  94   // - Weak cipher suites: < 80 bits of security strength.
  95   // - FORTEZZA cipher suites (obsolete).
  96   // - IDEA cipher suites (RFC 5469 explains why).
  97   // - Anonymous cipher suites.
  98   // - ECDSA cipher suites on platforms that do not support ECDSA signed
  99   //   certificates, as servers may use the presence of such ciphersuites as a
 100   //   hint to send an ECDSA certificate.
 101   // The ciphers listed in |disabled_cipher_suites| will be removed in addition
 102   // to the above list.
 103   //
 104   // Though cipher suites are sent in TLS as "uint8 CipherSuite[2]", in
 105   // big-endian form, they should be declared in host byte order, with the
 106   // first uint8 occupying the most significant byte.
 107   // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
 108   // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
 109   std::vector<uint16> disabled_cipher_suites;
 110
 111   // Enables deprecated cipher suites. Currently, RC4 is deprecated.
 112   bool enable_deprecated_cipher_suites;
 113
 114   bool channel_id_enabled;   // True if TLS channel ID extension is enabled.
 115   bool false_start_enabled;  // True if we'll use TLS False Start.
 116   // True if the Certificate Transparency signed_certificate_timestamp
 117   // TLS extension is enabled.
 118   bool signed_cert_timestamps_enabled;
 119
 120   // If true, causes only ECDHE cipher suites to be enabled.
 121   bool require_ecdhe;
 122
 123   // TODO(wtc): move the following members to a new SSLParams structure.  They
 124   // are not SSL configuration settings.
 125
 126   struct NET_EXPORT CertAndStatus {
 127     CertAndStatus();
 128     ~CertAndStatus();
 129
 130     std::string der_cert;
 131     CertStatus cert_status;
 132   };
 133
 134   // Add any known-bad SSL certificate (with its cert status) to
 135   // |allowed_bad_certs| that should not trigger an ERR_CERT_* error when
 136   // calling SSLClientSocket::Connect.  This would normally be done in
 137   // response to the user explicitly accepting the bad certificate.
 138   std::vector<CertAndStatus> allowed_bad_certs;
 139
 140   // True if we should send client_cert to the server.
 141   bool send_client_cert;
 142
 143   bool verify_ev_cert;  // True if we should verify the certificate for EV.
 144
 145   bool version_fallback;  // True if we are falling back to an older protocol
 146                           // version (one still needs to decrement
 147                           // version_max).
 148
 149   // If cert_io_enabled is false, then certificate verification will not
 150   // result in additional HTTP requests. (For example: to fetch missing
 151   // intermediates or to perform OCSP/CRL fetches.) It also implies that online
 152   // revocation checking is disabled.
 153   // NOTE: Only used by NSS.
 154   bool cert_io_enabled;
 155
 156   // The list of application level protocols supported. If set, this will
 157   // enable Next Protocol Negotiation (if supported). The order of the
 158   // protocols doesn't matter expect for one case: if the server supports Next
 159   // Protocol Negotiation, but there is no overlap between the server's and
 160   // client's protocol sets, then the first protocol in this list will be
 161   // requested by the client.
 162   NextProtoVector next_protos;
 163
 164   // True if renegotiation should be allowed for the default application-level
 165   // protocol when the peer negotiates neither ALPN nor NPN.
 166   bool renego_allowed_default;
 167
 168   // The list of application-level protocols to enable renegotiation for.
 169   NextProtoVector renego_allowed_for_protos;
 170
 171   scoped_refptr<X509Certificate> client_cert;
 172 };
 173
 174 }  // namespace net
 175
 176 #endif  // NET_SSL_SSL_CONFIG_H_