OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef NET_SSL_SSL_CONFIG_H_ | 5 #ifndef NET_SSL_SSL_CONFIG_H_ |
6 #define NET_SSL_SSL_CONFIG_H_ | 6 #define NET_SSL_SSL_CONFIG_H_ |
7 | 7 |
8 #include <stdint.h> | 8 #include <stdint.h> |
9 | 9 |
10 #include "base/memory/ref_counted.h" | 10 #include "base/memory/ref_counted.h" |
11 #include "net/base/net_export.h" | 11 #include "net/base/net_export.h" |
12 #include "net/cert/x509_certificate.h" | 12 #include "net/cert/x509_certificate.h" |
13 #include "net/socket/next_proto.h" | 13 #include "net/socket/next_proto.h" |
14 | 14 |
15 namespace net { | 15 namespace net { |
16 | 16 |
17 // Various TLS/SSL ProtocolVersion values encoded as uint16 | 17 // Various TLS/SSL ProtocolVersion values encoded as uint16 |
18 // struct { | 18 // struct { |
19 // uint8 major; | 19 // uint8 major; |
20 // uint8 minor; | 20 // uint8 minor; |
21 // } ProtocolVersion; | 21 // } ProtocolVersion; |
22 // The most significant byte is |major|, and the least significant byte | 22 // The most significant byte is |major|, and the least significant byte |
23 // is |minor|. | 23 // is |minor|. |
24 enum { | 24 enum { |
25 SSL_PROTOCOL_VERSION_TLS1 = 0x0301, | 25 SSL_PROTOCOL_VERSION_TLS1 = 0x0301, |
26 SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302, | 26 SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302, |
27 SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303, | 27 SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303, |
28 }; | 28 }; |
29 | 29 |
| 30 enum TokenBindingParam { |
| 31 TB_PARAM_RSA2048_PKCS15 = 0, |
| 32 TB_PARAM_RSA2048_PSS = 1, |
| 33 TB_PARAM_ECDSAP256 = 2, |
| 34 }; |
| 35 |
30 // Default minimum protocol version. | 36 // Default minimum protocol version. |
31 NET_EXPORT extern const uint16_t kDefaultSSLVersionMin; | 37 NET_EXPORT extern const uint16_t kDefaultSSLVersionMin; |
32 | 38 |
33 // Default maximum protocol version. | 39 // Default maximum protocol version. |
34 NET_EXPORT extern const uint16_t kDefaultSSLVersionMax; | 40 NET_EXPORT extern const uint16_t kDefaultSSLVersionMax; |
35 | 41 |
36 // Default minimum protocol version that it's acceptable to fallback to. | 42 // Default minimum protocol version that it's acceptable to fallback to. |
37 NET_EXPORT extern const uint16_t kDefaultSSLVersionFallbackMin; | 43 NET_EXPORT extern const uint16_t kDefaultSSLVersionFallbackMin; |
38 | 44 |
39 // A collection of SSL-related configuration settings. | 45 // A collection of SSL-related configuration settings. |
(...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
116 // NOTE: because they are under a fallback, connections are still vulnerable | 122 // NOTE: because they are under a fallback, connections are still vulnerable |
117 // to them as far as downgrades are concerned, so this should only be used for | 123 // to them as far as downgrades are concerned, so this should only be used for |
118 // measurement of ciphers not to be carried long-term. It is no fix for | 124 // measurement of ciphers not to be carried long-term. It is no fix for |
119 // servers with bad configurations without full removal. | 125 // servers with bad configurations without full removal. |
120 bool deprecated_cipher_suites_enabled; | 126 bool deprecated_cipher_suites_enabled; |
121 | 127 |
122 // Enables RC4 cipher suites. | 128 // Enables RC4 cipher suites. |
123 bool rc4_enabled; | 129 bool rc4_enabled; |
124 | 130 |
125 bool channel_id_enabled; // True if TLS channel ID extension is enabled. | 131 bool channel_id_enabled; // True if TLS channel ID extension is enabled. |
| 132 |
| 133 // List of Token Binding key parameters supported by the client. If empty, |
| 134 // Token Binding will be disabled, even if token_binding_enabled is true. |
| 135 std::vector<TokenBindingParam> token_binding_params; |
| 136 |
126 bool false_start_enabled; // True if we'll use TLS False Start. | 137 bool false_start_enabled; // True if we'll use TLS False Start. |
127 // True if the Certificate Transparency signed_certificate_timestamp | 138 // True if the Certificate Transparency signed_certificate_timestamp |
128 // TLS extension is enabled. | 139 // TLS extension is enabled. |
129 bool signed_cert_timestamps_enabled; | 140 bool signed_cert_timestamps_enabled; |
130 | 141 |
131 // If true, causes only ECDHE cipher suites to be enabled. | 142 // If true, causes only ECDHE cipher suites to be enabled. |
132 bool require_ecdhe; | 143 bool require_ecdhe; |
133 | 144 |
134 // TODO(wtc): move the following members to a new SSLParams structure. They | 145 // TODO(wtc): move the following members to a new SSLParams structure. They |
135 // are not SSL configuration settings. | 146 // are not SSL configuration settings. |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
185 | 196 |
186 // The list of application-level protocols to enable renegotiation for. | 197 // The list of application-level protocols to enable renegotiation for. |
187 NextProtoVector renego_allowed_for_protos; | 198 NextProtoVector renego_allowed_for_protos; |
188 | 199 |
189 scoped_refptr<X509Certificate> client_cert; | 200 scoped_refptr<X509Certificate> client_cert; |
190 }; | 201 }; |
191 | 202 |
192 } // namespace net | 203 } // namespace net |
193 | 204 |
194 #endif // NET_SSL_SSL_CONFIG_H_ | 205 #endif // NET_SSL_SSL_CONFIG_H_ |
OLD | NEW |