src/net/ssl/ssl_config_service.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/ssl/ssl_config_service.h"
   6
   7 #include "base/lazy_instance.h"
   8 #include "base/memory/ref_counted.h"
   9 #include "base/synchronization/lock.h"
  10 #include "net/cert/crl_set.h"
  11 #include "net/ssl/ssl_config_service_defaults.h"
  12
  13 #if defined(USE_OPENSSL)
  14 #include <openssl/ssl.h>
  15 #endif
  16
  17 namespace net {
  18
  19 static uint16 g_default_version_min = SSL_PROTOCOL_VERSION_SSL3;
  20
  21 static uint16 g_default_version_max =
  22 #if defined(USE_OPENSSL)
  23 #if defined(SSL_OP_NO_TLSv1_2)
  24     SSL_PROTOCOL_VERSION_TLS1_2;
  25 #elif defined(SSL_OP_NO_TLSv1_1)
  26     SSL_PROTOCOL_VERSION_TLS1_1;
  27 #else
  28     SSL_PROTOCOL_VERSION_TLS1;
  29 #endif
  30 #else
  31     SSL_PROTOCOL_VERSION_TLS1_2;
  32 #endif
  33
  34 SSLConfig::CertAndStatus::CertAndStatus() : cert_status(0) {}
  35
  36 SSLConfig::CertAndStatus::~CertAndStatus() {}
  37
  38 SSLConfig::SSLConfig()
  39     : rev_checking_enabled(false),
  40       rev_checking_required_local_anchors(false),
  41       version_min(g_default_version_min),
  42       version_max(g_default_version_max),
  43       cached_info_enabled(false),
  44       channel_id_enabled(true),
  45       false_start_enabled(true),
  46       require_forward_secrecy(false),
  47       unrestricted_ssl3_fallback_enabled(false),
  48       send_client_cert(false),
  49       verify_ev_cert(false),
  50       version_fallback(false),
  51       cert_io_enabled(true) {
  52 }
  53
  54 SSLConfig::~SSLConfig() {
  55 }
  56
  57 bool SSLConfig::IsAllowedBadCert(X509Certificate* cert,
  58                                  CertStatus* cert_status) const {
  59   std::string der_cert;
  60   if (!X509Certificate::GetDEREncoded(cert->os_cert_handle(), &der_cert))
  61     return false;
  62   return IsAllowedBadCert(der_cert, cert_status);
  63 }
  64
  65 bool SSLConfig::IsAllowedBadCert(const base::StringPiece& der_cert,
  66                                  CertStatus* cert_status) const {
  67   for (size_t i = 0; i < allowed_bad_certs.size(); ++i) {
  68     if (der_cert == allowed_bad_certs[i].der_cert) {
  69       if (cert_status)
  70         *cert_status = allowed_bad_certs[i].cert_status;
  71       return true;
  72     }
  73   }
  74   return false;
  75 }
  76
  77 SSLConfigService::SSLConfigService()
  78     : observer_list_(ObserverList<Observer>::NOTIFY_EXISTING_ONLY) {
  79 }
  80
  81 static bool g_cached_info_enabled = false;
  82
  83 // GlobalCRLSet holds a reference to the global CRLSet. It simply wraps a lock
  84 // around a scoped_refptr so that getting a reference doesn't race with
  85 // updating the CRLSet.
  86 class GlobalCRLSet {
  87  public:
  88   void Set(const scoped_refptr<CRLSet>& new_crl_set) {
  89     base::AutoLock locked(lock_);
  90     crl_set_ = new_crl_set;
  91   }
  92
  93   scoped_refptr<CRLSet> Get() const {
  94     base::AutoLock locked(lock_);
  95     return crl_set_;
  96   }
  97
  98  private:
  99   scoped_refptr<CRLSet> crl_set_;
 100   mutable base::Lock lock_;
 101 };
 102
 103 base::LazyInstance<GlobalCRLSet>::Leaky g_crl_set = LAZY_INSTANCE_INITIALIZER;
 104
 105 // static
 106 void SSLConfigService::SetCRLSet(scoped_refptr<CRLSet> crl_set) {
 107   // Note: this can be called concurently with GetCRLSet().
 108   g_crl_set.Get().Set(crl_set);
 109 }
 110
 111 // static
 112 scoped_refptr<CRLSet> SSLConfigService::GetCRLSet() {
 113   return g_crl_set.Get().Get();
 114 }
 115
 116 void SSLConfigService::EnableCachedInfo() {
 117   g_cached_info_enabled = true;
 118 }
 119
 120 // static
 121 bool SSLConfigService::cached_info_enabled() {
 122   return g_cached_info_enabled;
 123 }
 124
 125 // static
 126 uint16 SSLConfigService::default_version_min() {
 127   return g_default_version_min;
 128 }
 129
 130 // static
 131 uint16 SSLConfigService::default_version_max() {
 132   return g_default_version_max;
 133 }
 134
 135 void SSLConfigService::AddObserver(Observer* observer) {
 136   observer_list_.AddObserver(observer);
 137 }
 138
 139 void SSLConfigService::RemoveObserver(Observer* observer) {
 140   observer_list_.RemoveObserver(observer);
 141 }
 142
 143 void SSLConfigService::NotifySSLConfigChange() {
 144   FOR_EACH_OBSERVER(Observer, observer_list_, OnSSLConfigChanged());
 145 }
 146
 147 SSLConfigService::~SSLConfigService() {
 148 }
 149
 150 // static
 151 void SSLConfigService::SetSSLConfigFlags(SSLConfig* ssl_config) {
 152   ssl_config->cached_info_enabled = g_cached_info_enabled;
 153 }
 154
 155 void SSLConfigService::ProcessConfigUpdate(const SSLConfig& orig_config,
 156                                            const SSLConfig& new_config) {
 157   bool config_changed =
 158       (orig_config.rev_checking_enabled != new_config.rev_checking_enabled) ||
 159       (orig_config.rev_checking_required_local_anchors !=
 160        new_config.rev_checking_required_local_anchors) ||
 161       (orig_config.version_min != new_config.version_min) ||
 162       (orig_config.version_max != new_config.version_max) ||
 163       (orig_config.disabled_cipher_suites !=
 164        new_config.disabled_cipher_suites) ||
 165       (orig_config.channel_id_enabled != new_config.channel_id_enabled) ||
 166       (orig_config.false_start_enabled != new_config.false_start_enabled) ||
 167       (orig_config.require_forward_secrecy !=
 168        new_config.require_forward_secrecy) ||
 169       (orig_config.unrestricted_ssl3_fallback_enabled !=
 170        new_config.unrestricted_ssl3_fallback_enabled);
 171
 172   if (config_changed)
 173     NotifySSLConfigChange();
 174 }
 175
 176 // static
 177 bool SSLConfigService::IsSNIAvailable(SSLConfigService* service) {
 178   if (!service)
 179     return false;
 180
 181   SSLConfig ssl_config;
 182   service->GetSSLConfig(&ssl_config);
 183   return ssl_config.version_max >= SSL_PROTOCOL_VERSION_TLS1;
 184 }
 185
 186 }  // namespace net