ssl_config_service.h 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SSL_SSL_CONFIG_SERVICE_H_
  5. #define NET_SSL_SSL_CONFIG_SERVICE_H_
  6. #include <vector>
  7. #include "base/memory/ref_counted.h"
  8. #include "base/observer_list.h"
  9. #include "net/base/net_export.h"
  10. #include "net/ssl/ssl_config.h"
  11. namespace net {
  12. struct NET_EXPORT SSLContextConfig {
  13. SSLContextConfig();
  14. SSLContextConfig(const SSLContextConfig&);
  15. SSLContextConfig(SSLContextConfig&&);
  16. ~SSLContextConfig();
  17. SSLContextConfig& operator=(const SSLContextConfig&);
  18. SSLContextConfig& operator=(SSLContextConfig&&);
  19. // The minimum and maximum protocol versions that are enabled.
  20. // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined in ssl_config.h.)
  21. // SSL 2.0/3.0 and TLS 1.0/1.1 are not supported. If version_max <
  22. // version_min, it means no protocol versions are enabled.
  23. uint16_t version_min = kDefaultSSLVersionMin;
  24. uint16_t version_max = kDefaultSSLVersionMax;
  25. // Presorted list of cipher suites which should be explicitly prevented from
  26. // being used in addition to those disabled by the net built-in policy.
  27. //
  28. // Though cipher suites are sent in TLS as "uint8_t CipherSuite[2]", in
  29. // big-endian form, they should be declared in host byte order, with the
  30. // first uint8_t occupying the most significant byte.
  31. // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
  32. // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
  33. std::vector<uint16_t> disabled_cipher_suites;
  34. // If false, disables post-quantum key agreement in TLS connections.
  35. bool cecpq2_enabled = true;
  36. // If false, disables TLS Encrypted ClientHello (ECH). If true, the feature
  37. // may be enabled or disabled, depending on feature flags.
  38. bool ech_enabled = true;
  39. // ADDING MORE HERE? Don't forget to update |SSLContextConfigsAreEqual|.
  40. };
  41. // The interface for retrieving global SSL configuration. This interface
  42. // does not cover setting the SSL configuration, as on some systems, the
  43. // SSLConfigService objects may not have direct access to the configuration, or
  44. // live longer than the configuration preferences.
  45. class NET_EXPORT SSLConfigService {
  46. public:
  47. // Observer is notified when SSL config settings have changed.
  48. class NET_EXPORT Observer {
  49. public:
  50. // Notify observers if SSL settings have changed.
  51. virtual void OnSSLContextConfigChanged() = 0;
  52. protected:
  53. virtual ~Observer() = default;
  54. };
  55. SSLConfigService();
  56. virtual ~SSLConfigService();
  57. // May not be thread-safe, should only be called on the IO thread.
  58. virtual SSLContextConfig GetSSLContextConfig() = 0;
  59. // Returns true if connections to |hostname| can reuse, or are permitted to
  60. // reuse, connections on which a client cert has been negotiated. Note that
  61. // this must return true for both hostnames being pooled - that is to say this
  62. // function must return true for both the hostname of the existing connection
  63. // and the potential hostname to pool before allowing the connection to be
  64. // reused.
  65. //
  66. // NOTE: Pooling connections with ambient authority can create security issues
  67. // with that ambient authority and privacy issues in that embedders (and
  68. // users) may not have been consulted to send a client cert to |hostname|.
  69. // Implementations of this method should only return true if they have
  70. // received affirmative consent (e.g. through preferences or Enterprise
  71. // policy).
  72. //
  73. // NOTE: For Web Platform clients, this violates the Fetch Standard's policies
  74. // around connection pools: https://fetch.spec.whatwg.org/#connections.
  75. // Implementations that return true should take steps to limit the Web
  76. // Platform visibility of this, such as only allowing it to be used for
  77. // Enterprise or internal configurations.
  78. //
  79. // DEPRECATED: For the reasons above, this method is temporary and will be
  80. // removed in a future release. Please leave a comment on
  81. // https://crbug.com/855690 if you believe this is needed.
  82. virtual bool CanShareConnectionWithClientCerts(
  83. const std::string& hostname) const = 0;
  84. // Add an observer of this service.
  85. void AddObserver(Observer* observer);
  86. // Remove an observer of this service.
  87. void RemoveObserver(Observer* observer);
  88. // Calls the OnSSLContextConfigChanged method of registered observers. Should
  89. // only be called on the IO thread.
  90. void NotifySSLContextConfigChange();
  91. // Checks if the config-service managed fields in two SSLContextConfigs are
  92. // the same.
  93. static bool SSLContextConfigsAreEqualForTesting(
  94. const SSLContextConfig& config1,
  95. const SSLContextConfig& config2);
  96. protected:
  97. // Process before/after config update. If |force_notification| is true,
  98. // NotifySSLContextConfigChange will be called regardless of whether
  99. // |orig_config| and |new_config| are equal.
  100. void ProcessConfigUpdate(const SSLContextConfig& orig_config,
  101. const SSLContextConfig& new_config,
  102. bool force_notification);
  103. private:
  104. base::ObserverList<Observer>::Unchecked observer_list_;
  105. };
  106. } // namespace net
  107. #endif // NET_SSL_SSL_CONFIG_SERVICE_H_