123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123 |
- // Copyright (c) 2012 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #ifndef NET_SSL_SSL_INFO_H_
- #define NET_SSL_SSL_INFO_H_
- #include <stdint.h>
- #include <vector>
- #include "base/memory/ref_counted.h"
- #include "net/base/hash_value.h"
- #include "net/base/net_export.h"
- #include "net/cert/cert_status_flags.h"
- #include "net/cert/ct_policy_status.h"
- #include "net/cert/ocsp_verify_result.h"
- #include "net/cert/sct_status_flags.h"
- #include "net/cert/signed_certificate_timestamp_and_status.h"
- namespace net {
- class X509Certificate;
- // SSL connection info.
- // This is really a struct. All members are public.
- class NET_EXPORT SSLInfo {
- public:
- // HandshakeType enumerates the possible resumption cases after an SSL
- // handshake.
- enum HandshakeType {
- HANDSHAKE_UNKNOWN = 0,
- HANDSHAKE_RESUME, // we resumed a previous session.
- HANDSHAKE_FULL, // we negotiated a new session.
- };
- SSLInfo();
- SSLInfo(const SSLInfo& info);
- ~SSLInfo();
- SSLInfo& operator=(const SSLInfo& info);
- void Reset();
- bool is_valid() const { return cert.get() != nullptr; }
- // The SSL certificate.
- scoped_refptr<X509Certificate> cert;
- // The SSL certificate as received by the client. Can be different
- // from |cert|, which is the chain as built by the client during
- // validation.
- scoped_refptr<X509Certificate> unverified_cert;
- // Bitmask of status info of |cert|, representing, for example, known errors
- // and extended validation (EV) status.
- // See cert_status_flags.h for values.
- CertStatus cert_status = 0;
- // The ID of the (EC)DH group used by the key exchange or zero if unknown
- // (older cache entries may not store the value) or not applicable.
- uint16_t key_exchange_group = 0;
- // The signature algorithm used by the peer in the TLS handshake, as defined
- // by the TLS SignatureScheme registry
- // (https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme).
- // These correspond to |SSL_SIGN_*| constants in BoringSSL. The value is zero
- // if unknown (older cache entries may not store the value) or not applicable.
- uint16_t peer_signature_algorithm = 0;
- // Information about the SSL connection itself. See
- // ssl_connection_status_flags.h for values. The protocol version,
- // ciphersuite, and compression in use are encoded within.
- int connection_status = 0;
- // If the certificate is valid, then this is true iff it was rooted at a
- // standard CA root. (As opposed to a user-installed root.)
- bool is_issued_by_known_root = false;
- // True if pinning was bypassed on this connection.
- bool pkp_bypassed = false;
- // True if a client certificate was sent to the server. Note that sending
- // a Certificate message with no client certificate in it does not count.
- bool client_cert_sent = false;
- // True if data was received over early data on the server. This field is only
- // set for server sockets.
- bool early_data_received = false;
- // True if the connection negotiated the Encrypted ClientHello extension.
- bool encrypted_client_hello = false;
- HandshakeType handshake_type = HANDSHAKE_UNKNOWN;
- // The hashes, in several algorithms, of the SubjectPublicKeyInfos from
- // each certificate in the chain.
- HashValueVector public_key_hashes;
- // pinning_failure_log contains a message produced by
- // TransportSecurityState::PKPState::CheckPublicKeyPins in the event of a
- // pinning failure. It is a (somewhat) human-readable string.
- std::string pinning_failure_log;
- // List of SignedCertificateTimestamps and their corresponding validation
- // status.
- SignedCertificateTimestampAndStatusList signed_certificate_timestamps;
- // Whether the connection complied with the CT cert policy, and if
- // not, why not.
- ct::CTPolicyCompliance ct_policy_compliance =
- ct::CTPolicyCompliance::CT_POLICY_COMPLIANCE_DETAILS_NOT_AVAILABLE;
- // OCSP stapling details.
- OCSPVerifyResult ocsp_result;
- // True if there was a certificate error which should be treated as fatal,
- // and false otherwise.
- bool is_fatal_cert_error = false;
- };
- } // namespace net
- #endif // NET_SSL_SSL_INFO_H_
|