mirror of
https://github.com/klzgrad/naiveproxy.git
synced 2024-12-01 01:36:09 +03:00
89 lines
3.2 KiB
C++
89 lines
3.2 KiB
C++
// Copyright 2015 The Chromium Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#ifndef NET_SSL_SSL_SERVER_CONFIG_H_
|
|
#define NET_SSL_SSL_SERVER_CONFIG_H_
|
|
|
|
#include <stdint.h>
|
|
|
|
#include <vector>
|
|
|
|
#include "net/base/net_export.h"
|
|
#include "net/ssl/ssl_config.h"
|
|
|
|
namespace net {
|
|
|
|
class ClientCertVerifier;
|
|
|
|
// A collection of server-side SSL-related configuration settings.
|
|
struct NET_EXPORT SSLServerConfig {
|
|
enum ClientCertType {
|
|
NO_CLIENT_CERT,
|
|
OPTIONAL_CLIENT_CERT,
|
|
REQUIRE_CLIENT_CERT,
|
|
};
|
|
|
|
// Defaults
|
|
SSLServerConfig();
|
|
SSLServerConfig(const SSLServerConfig& other);
|
|
~SSLServerConfig();
|
|
|
|
// The minimum and maximum protocol versions that are enabled.
|
|
// (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined in ssl_config.h)
|
|
// SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
|
|
// means no protocol versions are enabled.
|
|
uint16_t version_min;
|
|
uint16_t version_max;
|
|
|
|
// Whether early data is enabled on this connection. The caller is obligated
|
|
// to reject early data that is non-safe to be replayed.
|
|
bool early_data_enabled;
|
|
|
|
// Presorted list of cipher suites which should be explicitly prevented from
|
|
// being used in addition to those disabled by the net built-in policy.
|
|
//
|
|
// By default, all cipher suites supported by the underlying SSL
|
|
// implementation will be enabled except for:
|
|
// - Null encryption cipher suites.
|
|
// - Weak cipher suites: < 80 bits of security strength.
|
|
// - FORTEZZA cipher suites (obsolete).
|
|
// - IDEA cipher suites (RFC 5469 explains why).
|
|
// - Anonymous cipher suites.
|
|
// - ECDSA cipher suites on platforms that do not support ECDSA signed
|
|
// certificates, as servers may use the presence of such ciphersuites as a
|
|
// hint to send an ECDSA certificate.
|
|
// The ciphers listed in |disabled_cipher_suites| will be removed in addition
|
|
// to the above list.
|
|
//
|
|
// Though cipher suites are sent in TLS as "uint8_t CipherSuite[2]", in
|
|
// big-endian form, they should be declared in host byte order, with the
|
|
// first uint8_t occupying the most significant byte.
|
|
// Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
|
|
// disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
|
|
std::vector<uint16_t> disabled_cipher_suites;
|
|
|
|
// If true, causes only ECDHE cipher suites to be enabled.
|
|
bool require_ecdhe;
|
|
|
|
// Sets the requirement for client certificates during handshake.
|
|
ClientCertType client_cert_type;
|
|
|
|
// List of DER-encoded X.509 DistinguishedName of certificate authorities
|
|
// to be included in the CertificateRequest handshake message,
|
|
// if client certificates are required.
|
|
std::vector<std::string> cert_authorities_;
|
|
|
|
// Provides the ClientCertVerifier that is to be used to verify
|
|
// client certificates during the handshake.
|
|
// The |client_cert_verifier| continues to be owned by the caller,
|
|
// and must outlive any sockets spawned from this SSLServerContext.
|
|
// This field is meaningful only if client certificates are requested.
|
|
// If a verifier is not provided then all certificates are accepted.
|
|
ClientCertVerifier* client_cert_verifier;
|
|
};
|
|
|
|
} // namespace net
|
|
|
|
#endif // NET_SSL_SSL_SERVER_CONFIG_H_
|