ssl_info.h 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_SSL_SSL_INFO_H_
  5. #define NET_SSL_SSL_INFO_H_
  6. #include <stdint.h>
  7. #include <vector>
  8. #include "base/memory/ref_counted.h"
  9. #include "net/base/hash_value.h"
  10. #include "net/base/net_export.h"
  11. #include "net/cert/cert_status_flags.h"
  12. #include "net/cert/ct_policy_status.h"
  13. #include "net/cert/ocsp_verify_result.h"
  14. #include "net/cert/sct_status_flags.h"
  15. #include "net/cert/signed_certificate_timestamp_and_status.h"
  16. namespace net {
  17. class X509Certificate;
  18. // SSL connection info.
  19. // This is really a struct. All members are public.
  20. class NET_EXPORT SSLInfo {
  21. public:
  22. // HandshakeType enumerates the possible resumption cases after an SSL
  23. // handshake.
  24. enum HandshakeType {
  25. HANDSHAKE_UNKNOWN = 0,
  26. HANDSHAKE_RESUME, // we resumed a previous session.
  27. HANDSHAKE_FULL, // we negotiated a new session.
  28. };
  29. SSLInfo();
  30. SSLInfo(const SSLInfo& info);
  31. ~SSLInfo();
  32. SSLInfo& operator=(const SSLInfo& info);
  33. void Reset();
  34. bool is_valid() const { return cert.get() != nullptr; }
  35. // The SSL certificate.
  36. scoped_refptr<X509Certificate> cert;
  37. // The SSL certificate as received by the client. Can be different
  38. // from |cert|, which is the chain as built by the client during
  39. // validation.
  40. scoped_refptr<X509Certificate> unverified_cert;
  41. // Bitmask of status info of |cert|, representing, for example, known errors
  42. // and extended validation (EV) status.
  43. // See cert_status_flags.h for values.
  44. CertStatus cert_status = 0;
  45. // The ID of the (EC)DH group used by the key exchange or zero if unknown
  46. // (older cache entries may not store the value) or not applicable.
  47. uint16_t key_exchange_group = 0;
  48. // The signature algorithm used by the peer in the TLS handshake, as defined
  49. // by the TLS SignatureScheme registry
  50. // (https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme).
  51. // These correspond to |SSL_SIGN_*| constants in BoringSSL. The value is zero
  52. // if unknown (older cache entries may not store the value) or not applicable.
  53. uint16_t peer_signature_algorithm = 0;
  54. // Information about the SSL connection itself. See
  55. // ssl_connection_status_flags.h for values. The protocol version,
  56. // ciphersuite, and compression in use are encoded within.
  57. int connection_status = 0;
  58. // If the certificate is valid, then this is true iff it was rooted at a
  59. // standard CA root. (As opposed to a user-installed root.)
  60. bool is_issued_by_known_root = false;
  61. // True if pinning was bypassed on this connection.
  62. bool pkp_bypassed = false;
  63. // True if a client certificate was sent to the server. Note that sending
  64. // a Certificate message with no client certificate in it does not count.
  65. bool client_cert_sent = false;
  66. // True if data was received over early data on the server. This field is only
  67. // set for server sockets.
  68. bool early_data_received = false;
  69. // True if the connection negotiated the Encrypted ClientHello extension.
  70. bool encrypted_client_hello = false;
  71. HandshakeType handshake_type = HANDSHAKE_UNKNOWN;
  72. // The hashes, in several algorithms, of the SubjectPublicKeyInfos from
  73. // each certificate in the chain.
  74. HashValueVector public_key_hashes;
  75. // pinning_failure_log contains a message produced by
  76. // TransportSecurityState::PKPState::CheckPublicKeyPins in the event of a
  77. // pinning failure. It is a (somewhat) human-readable string.
  78. std::string pinning_failure_log;
  79. // List of SignedCertificateTimestamps and their corresponding validation
  80. // status.
  81. SignedCertificateTimestampAndStatusList signed_certificate_timestamps;
  82. // Whether the connection complied with the CT cert policy, and if
  83. // not, why not.
  84. ct::CTPolicyCompliance ct_policy_compliance =
  85. ct::CTPolicyCompliance::CT_POLICY_COMPLIANCE_DETAILS_NOT_AVAILABLE;
  86. // OCSP stapling details.
  87. OCSPVerifyResult ocsp_result;
  88. // True if there was a certificate error which should be treated as fatal,
  89. // and false otherwise.
  90. bool is_fatal_cert_error = false;
  91. };
  92. } // namespace net
  93. #endif // NET_SSL_SSL_INFO_H_