ignore_errors_cert_verifier.h 2.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef SERVICES_NETWORK_IGNORE_ERRORS_CERT_VERIFIER_H_
  5. #define SERVICES_NETWORK_IGNORE_ERRORS_CERT_VERIFIER_H_
  6. #include <memory>
  7. #include <vector>
  8. #include "base/command_line.h"
  9. #include "base/component_export.h"
  10. #include "net/base/completion_once_callback.h"
  11. #include "net/cert/cert_verifier.h"
  12. #include "services/network/public/cpp/spki_hash_set.h"
  13. namespace network {
  14. // IgnoreErrorsCertVerifier wraps another CertVerifier in order to ignore
  15. // verification errors from certificate chains that match a allowlist of SPKI
  16. // fingerprints.
  17. class COMPONENT_EXPORT(NETWORK_SERVICE) IgnoreErrorsCertVerifier
  18. : public net::CertVerifier {
  19. public:
  20. // If the |user_data_dir_switch| is passed in as a valid pointer but
  21. // --user-data-dir flag is missing, or --ignore-certificate-errors-spki-list
  22. // flag is missing then MaybeWrapCertVerifier returns the supplied verifier.
  23. // Otherwise it returns an IgnoreErrorsCertVerifier wrapping the supplied
  24. // verifier using the allowlist from the
  25. // --ignore-certificate-errors-spki-list flag.
  26. //
  27. // As the --user-data-dir flag is embedder defined, the flag to check for
  28. // needs to be passed in from |user_data_dir_switch|.
  29. static std::unique_ptr<net::CertVerifier> MaybeWrapCertVerifier(
  30. const base::CommandLine& command_line,
  31. const char* user_data_dir_switch,
  32. std::unique_ptr<net::CertVerifier> verifier);
  33. IgnoreErrorsCertVerifier(std::unique_ptr<net::CertVerifier> verifier,
  34. SPKIHashSet allowlist);
  35. IgnoreErrorsCertVerifier(const IgnoreErrorsCertVerifier&) = delete;
  36. IgnoreErrorsCertVerifier& operator=(const IgnoreErrorsCertVerifier&) = delete;
  37. ~IgnoreErrorsCertVerifier() override;
  38. // Verify skips certificate verification and returns OK if any of the
  39. // certificates from the chain in |params| match one of the SPKI fingerprints
  40. // from the allowlist. Otherwise, it invokes Verify on the wrapped verifier
  41. // and returns the result.
  42. int Verify(const RequestParams& params,
  43. net::CertVerifyResult* verify_result,
  44. net::CompletionOnceCallback callback,
  45. std::unique_ptr<Request>* out_req,
  46. const net::NetLogWithSource& net_log) override;
  47. void SetConfig(const Config& config) override;
  48. private:
  49. friend class IgnoreErrorsCertVerifierTest;
  50. void SetAllowlistForTesting(const SPKIHashSet& allowlist);
  51. std::unique_ptr<net::CertVerifier> verifier_;
  52. SPKIHashSet allowlist_;
  53. };
  54. } // namespace network
  55. #endif // SERVICES_NETWORK_IGNORE_ERRORS_CERT_VERIFIER_H_