ssl_config.h 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162
  1. // Copyright 2014 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SSL_SSL_CONFIG_H_
  5. #define NET_SSL_SSL_CONFIG_H_
  6. #include <stdint.h>
  7. #include "base/containers/flat_map.h"
  8. #include "base/memory/ref_counted.h"
  9. #include "net/base/net_export.h"
  10. #include "net/base/network_isolation_key.h"
  11. #include "net/base/privacy_mode.h"
  12. #include "net/cert/cert_status_flags.h"
  13. #include "net/cert/x509_certificate.h"
  14. #include "net/socket/next_proto.h"
  15. #include "net/ssl/ssl_private_key.h"
  16. #include "third_party/abseil-cpp/absl/types/optional.h"
  17. namespace net {
  18. // Various TLS/SSL ProtocolVersion values encoded as uint16_t
  19. // struct {
  20. // uint8_t major;
  21. // uint8_t minor;
  22. // } ProtocolVersion;
  23. // The most significant byte is |major|, and the least significant byte
  24. // is |minor|.
  25. enum {
  26. SSL_PROTOCOL_VERSION_TLS1 = 0x0301,
  27. SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302,
  28. SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303,
  29. SSL_PROTOCOL_VERSION_TLS1_3 = 0x0304,
  30. };
  31. // Default minimum protocol version.
  32. NET_EXPORT extern const uint16_t kDefaultSSLVersionMin;
  33. // Default maximum protocol version.
  34. NET_EXPORT extern const uint16_t kDefaultSSLVersionMax;
  35. // A collection of SSL-related configuration settings.
  36. struct NET_EXPORT SSLConfig {
  37. using ApplicationSettings = base::flat_map<NextProto, std::vector<uint8_t>>;
  38. // Default to revocation checking.
  39. SSLConfig();
  40. SSLConfig(const SSLConfig& other);
  41. ~SSLConfig();
  42. // Returns true if |cert| is one of the certs in |allowed_bad_certs|.
  43. // The expected cert status is written to |cert_status|. |*cert_status| can
  44. // be NULL if user doesn't care about the cert status.
  45. bool IsAllowedBadCert(X509Certificate* cert, CertStatus* cert_status) const;
  46. // Returns the set of flags to use for certificate verification, which is a
  47. // bitwise OR of CertVerifier::VerifyFlags that represent this SSLConfig's
  48. // configuration.
  49. int GetCertVerifyFlags() const;
  50. // If specified, the minimum and maximum protocol versions that are enabled.
  51. // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.) If
  52. // unspecified, values from the SSLConfigService are used.
  53. absl::optional<uint16_t> version_min_override;
  54. absl::optional<uint16_t> version_max_override;
  55. // Whether early data is enabled on this connection. Note that early data has
  56. // weaker security properties than normal data and changes the
  57. // SSLClientSocket's behavior. The caller must only send replayable data prior
  58. // to handshake confirmation. See StreamSocket::ConfirmHandshake for details.
  59. //
  60. // Additionally, early data may be rejected by the server, resulting in some
  61. // socket operation failing with ERR_EARLY_DATA_REJECTED or
  62. // ERR_WRONG_VERSION_ON_EARLY_DATA before any data is returned from the
  63. // server. The caller must handle these cases, typically by retrying the
  64. // high-level operation.
  65. //
  66. // If unsure, do not enable this option.
  67. bool early_data_enabled = false;
  68. // If true, causes only ECDHE cipher suites to be enabled.
  69. bool require_ecdhe = false;
  70. // If true, causes SHA-1 signature algorithms in TLS 1.2 to be disabled.
  71. bool disable_legacy_crypto = false;
  72. // TODO(wtc): move the following members to a new SSLParams structure. They
  73. // are not SSL configuration settings.
  74. struct NET_EXPORT CertAndStatus {
  75. CertAndStatus();
  76. CertAndStatus(scoped_refptr<X509Certificate> cert, CertStatus status);
  77. CertAndStatus(const CertAndStatus&);
  78. ~CertAndStatus();
  79. scoped_refptr<X509Certificate> cert;
  80. CertStatus cert_status = 0;
  81. };
  82. // Add any known-bad SSL certificate (with its cert status) to
  83. // |allowed_bad_certs| that should not trigger an ERR_CERT_* error when
  84. // calling SSLClientSocket::Connect. This would normally be done in
  85. // response to the user explicitly accepting the bad certificate.
  86. std::vector<CertAndStatus> allowed_bad_certs;
  87. // True if all certificate errors should be ignored.
  88. bool ignore_certificate_errors = false;
  89. // True if, for a single connection, any dependent network fetches should
  90. // be disabled. This can be used to avoid triggering re-entrancy in the
  91. // network layer. For example, fetching a PAC script over HTTPS may cause
  92. // AIA, OCSP, or CRL fetches to block on retrieving the PAC script, while
  93. // the PAC script fetch is waiting for those dependent fetches, creating a
  94. // deadlock.
  95. bool disable_cert_verification_network_fetches = false;
  96. // The list of application level protocols supported with ALPN (Application
  97. // Layer Protocol Negotiation), in decreasing order of preference. Protocols
  98. // will be advertised in this order during TLS handshake.
  99. NextProtoVector alpn_protos;
  100. // True if renegotiation should be allowed for the default application-level
  101. // protocol when the peer does not negotiate ALPN.
  102. bool renego_allowed_default = false;
  103. // The list of application-level protocols to enable renegotiation for.
  104. NextProtoVector renego_allowed_for_protos;
  105. // ALPS TLS extension is enabled and corresponding data is sent to server
  106. // for each NextProto in |application_settings|. Data might be empty.
  107. ApplicationSettings application_settings;
  108. // If the PartitionSSLSessionsByNetworkIsolationKey feature is enabled, the
  109. // session cache is partitioned by this value.
  110. NetworkIsolationKey network_isolation_key;
  111. // If non-empty, a serialized ECHConfigList to use to encrypt the ClientHello.
  112. // If this field is non-empty, callers should handle |ERR_ECH_NOT_NEGOTIATED|
  113. // errors from Connect() by calling GetECHRetryConfigs() to determine how to
  114. // retry the connection.
  115. std::vector<uint8_t> ech_config_list;
  116. // An additional boolean to partition the session cache by.
  117. //
  118. // TODO(https://crbug.com/775438, https://crbug.com/951205): This should
  119. // additionally disable client certificates, once client certificate handling
  120. // is moved into SSLClientContext. With client certificates are disabled, the
  121. // current session cache partitioning behavior will be needed to correctly
  122. // implement it. For now, it acts as an incomplete version of
  123. // PartitionSSLSessionsByNetworkIsolationKey.
  124. PrivacyMode privacy_mode = PRIVACY_MODE_DISABLED;
  125. // True if the post-handshake peeking of the transport should be skipped. This
  126. // logic ensures tickets are resolved early, but can interfere with some unit
  127. // tests.
  128. bool disable_post_handshake_peek_for_testing = false;
  129. };
  130. } // namespace net
  131. #endif // NET_SSL_SSL_CONFIG_H_