net/ssl/ssl_config.h

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_SSL_SSL_CONFIG_H_
   6 #define NET_SSL_SSL_CONFIG_H_
   7
   8 #include "base/basictypes.h"
   9 #include "base/memory/ref_counted.h"
  10 #include "net/base/net_export.h"
  11 #include "net/cert/x509_certificate.h"
  12 #include "net/socket/next_proto.h"
  13
  14 namespace net {
  15
  16 // Various TLS/SSL ProtocolVersion values encoded as uint16
  17 //      struct {
  18 //          uint8 major;
  19 //          uint8 minor;
  20 //      } ProtocolVersion;
  21 // The most significant byte is |major|, and the least significant byte
  22 // is |minor|.
  23 enum {
  24   SSL_PROTOCOL_VERSION_TLS1 = 0x0301,
  25   SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302,
  26   SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303,
  27 };
  28
  29 // Default minimum protocol version.
  30 NET_EXPORT extern const uint16 kDefaultSSLVersionMin;
  31
  32 // For maximum supported protocol version, use
  33 // SSLClientSocket::GetMaxSupportedSSLVersion().
  34
  35 // Default minimum protocol version that it's acceptable to fallback to.
  36 NET_EXPORT extern const uint16 kDefaultSSLVersionFallbackMin;
  37
  38 // A collection of SSL-related configuration settings.
  39 struct NET_EXPORT SSLConfig {
  40   // Default to revocation checking.
  41   SSLConfig();
  42   ~SSLConfig();
  43
  44   // Returns true if |cert| is one of the certs in |allowed_bad_certs|.
  45   // The expected cert status is written to |cert_status|. |*cert_status| can
  46   // be NULL if user doesn't care about the cert status.
  47   bool IsAllowedBadCert(X509Certificate* cert, CertStatus* cert_status) const;
  48
  49   // Same as above except works with DER encoded certificates instead
  50   // of X509Certificate.
  51   bool IsAllowedBadCert(const base::StringPiece& der_cert,
  52                         CertStatus* cert_status) const;
  53
  54   // rev_checking_enabled is true if online certificate revocation checking is
  55   // enabled (i.e. OCSP and CRL fetching).
  56   //
  57   // Regardless of this flag, CRLSet checking is always enabled and locally
  58   // cached revocation information will be considered.
  59   bool rev_checking_enabled;
  60
  61   // rev_checking_required_local_anchors is true if revocation checking is
  62   // required to succeed when certificates chain to local trust anchors (that
  63   // is, non-public CAs). If revocation information cannot be obtained, such
  64   // certificates will be treated as revoked ("hard-fail").
  65   // Note: This is distinct from rev_checking_enabled. If true, it is
  66   // equivalent to also setting rev_checking_enabled, but only when the
  67   // certificate chain chains to a local (non-public) trust anchor.
  68   bool rev_checking_required_local_anchors;
  69
  70   // The minimum and maximum protocol versions that are enabled.
  71   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.)
  72   // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
  73   // means no protocol versions are enabled.
  74   uint16 version_min;
  75   uint16 version_max;
  76
  77   // version_fallback_min contains the minimum version that is acceptable to
  78   // fallback to. Versions before this may be tried to see whether they would
  79   // have succeeded and thus to give a better message to the user, but the
  80   // resulting connection won't be used in these cases.
  81   uint16 version_fallback_min;
  82
  83   // Presorted list of cipher suites which should be explicitly prevented from
  84   // being used in addition to those disabled by the net built-in policy.
  85   //
  86   // By default, all cipher suites supported by the underlying SSL
  87   // implementation will be enabled except for:
  88   // - Null encryption cipher suites.
  89   // - Weak cipher suites: < 80 bits of security strength.
  90   // - FORTEZZA cipher suites (obsolete).
  91   // - IDEA cipher suites (RFC 5469 explains why).
  92   // - Anonymous cipher suites.
  93   // - ECDSA cipher suites on platforms that do not support ECDSA signed
  94   //   certificates, as servers may use the presence of such ciphersuites as a
  95   //   hint to send an ECDSA certificate.
  96   // The ciphers listed in |disabled_cipher_suites| will be removed in addition
  97   // to the above list.
  98   //
  99   // Though cipher suites are sent in TLS as "uint8 CipherSuite[2]", in
 100   // big-endian form, they should be declared in host byte order, with the
 101   // first uint8 occupying the most significant byte.
 102   // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
 103   // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
 104   std::vector<uint16> disabled_cipher_suites;
 105
 106   // Enables deprecated cipher suites. Currently, RC4 is deprecated.
 107   bool enable_deprecated_cipher_suites;
 108
 109   bool channel_id_enabled;   // True if TLS channel ID extension is enabled.
 110   bool false_start_enabled;  // True if we'll use TLS False Start.
 111   // True if the Certificate Transparency signed_certificate_timestamp
 112   // TLS extension is enabled.
 113   bool signed_cert_timestamps_enabled;
 114
 115   // If true, causes only ECDHE cipher suites to be enabled.
 116   bool require_ecdhe;
 117
 118   // TODO(wtc): move the following members to a new SSLParams structure.  They
 119   // are not SSL configuration settings.
 120
 121   struct NET_EXPORT CertAndStatus {
 122     CertAndStatus();
 123     ~CertAndStatus();
 124
 125     std::string der_cert;
 126     CertStatus cert_status;
 127   };
 128
 129   // Add any known-bad SSL certificate (with its cert status) to
 130   // |allowed_bad_certs| that should not trigger an ERR_CERT_* error when
 131   // calling SSLClientSocket::Connect.  This would normally be done in
 132   // response to the user explicitly accepting the bad certificate.
 133   std::vector<CertAndStatus> allowed_bad_certs;
 134
 135   // True if we should send client_cert to the server.
 136   bool send_client_cert;
 137
 138   bool verify_ev_cert;  // True if we should verify the certificate for EV.
 139
 140   bool version_fallback;  // True if we are falling back to an older protocol
 141                           // version (one still needs to decrement
 142                           // version_max).
 143
 144   // If cert_io_enabled is false, then certificate verification will not
 145   // result in additional HTTP requests. (For example: to fetch missing
 146   // intermediates or to perform OCSP/CRL fetches.) It also implies that online
 147   // revocation checking is disabled.
 148   // NOTE: Only used by NSS.
 149   bool cert_io_enabled;
 150
 151   // The list of application level protocols supported. If set, this will
 152   // enable Next Protocol Negotiation (if supported). The order of the
 153   // protocols doesn't matter expect for one case: if the server supports Next
 154   // Protocol Negotiation, but there is no overlap between the server's and
 155   // client's protocol sets, then the first protocol in this list will be
 156   // requested by the client.
 157   NextProtoVector next_protos;
 158
 159   // True if renegotiation should be allowed for the default application-level
 160   // protocol when the peer negotiates neither ALPN nor NPN.
 161   bool renego_allowed_default;
 162
 163   // The list of application-level protocols to enable renegotiation for.
 164   NextProtoVector renego_allowed_for_protos;
 165
 166   scoped_refptr<X509Certificate> client_cert;
 167
 168   // Information about how to proceed with fastradio padding.
 169   // |fastradio_padding_enabled| determines if the feature is enabled globally.
 170   // |fastradio_padding_eligible| determines if the endpoint associated with
 171   // this config should use it.
 172   // |fastradio_padding_eligible| can be true when |fastradio_padding_enabled|
 173   // is false: in this case, fastradio padding would not be enabled, but
 174   // metrics can be collected for experiments.
 175   bool fastradio_padding_enabled;
 176   bool fastradio_padding_eligible;
 177 };
 178
 179 }  // namespace net
 180
 181 #endif  // NET_SSL_SSL_CONFIG_H_