1 // Copyright 2012 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_SSL_SSL_INFO_H_ 6 #define NET_SSL_SSL_INFO_H_ 7 8 #include "base/memory/scoped_refptr.h" 9 #include "net/base/hash_value.h" 10 #include "net/base/net_export.h" 11 #include "net/cert/cert_status_flags.h" 12 #include "net/cert/ct_policy_status.h" 13 #include "net/cert/sct_status_flags.h" 14 #include "net/cert/signed_certificate_timestamp_and_status.h" 15 #include "third_party/boringssl/src/pki/ocsp_verify_result.h" 16 17 namespace net { 18 19 class X509Certificate; 20 21 // SSL connection info. 22 // This is really a struct. All members are public. 23 class NET_EXPORT SSLInfo { 24 public: 25 // HandshakeType enumerates the possible resumption cases after an SSL 26 // handshake. 27 enum HandshakeType { 28 HANDSHAKE_UNKNOWN = 0, 29 HANDSHAKE_RESUME, // we resumed a previous session. 30 HANDSHAKE_FULL, // we negotiated a new session. 31 }; 32 33 SSLInfo(); 34 SSLInfo(const SSLInfo& info); 35 ~SSLInfo(); 36 SSLInfo& operator=(const SSLInfo& info); 37 38 void Reset(); 39 is_valid()40 bool is_valid() const { return cert.get() != nullptr; } 41 42 // The SSL certificate. 43 scoped_refptr<X509Certificate> cert; 44 45 // The SSL certificate as received by the client. Can be different 46 // from |cert|, which is the chain as built by the client during 47 // validation. 48 scoped_refptr<X509Certificate> unverified_cert; 49 50 // Bitmask of status info of |cert|, representing, for example, known errors 51 // and extended validation (EV) status. 52 // See cert_status_flags.h for values. 53 CertStatus cert_status = 0; 54 55 // The ID of the (EC)DH group used by the key exchange or zero if unknown 56 // (older cache entries may not store the value) or not applicable. 57 uint16_t key_exchange_group = 0; 58 59 // The signature algorithm used by the peer in the TLS handshake, as defined 60 // by the TLS SignatureScheme registry 61 // (https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme). 62 // These correspond to |SSL_SIGN_*| constants in BoringSSL. The value is zero 63 // if unknown (older cache entries may not store the value) or not applicable. 64 uint16_t peer_signature_algorithm = 0; 65 66 // Information about the SSL connection itself. See 67 // ssl_connection_status_flags.h for values. The protocol version, 68 // ciphersuite, and compression in use are encoded within. 69 int connection_status = 0; 70 71 // If the certificate is valid, then this is true iff it was rooted at a 72 // standard CA root. (As opposed to a user-installed root.) 73 bool is_issued_by_known_root = false; 74 75 // True if pinning was bypassed on this connection. 76 bool pkp_bypassed = false; 77 78 // True if a client certificate was sent to the server. Note that sending 79 // a Certificate message with no client certificate in it does not count. 80 bool client_cert_sent = false; 81 82 // True if data was received over early data on the server. This field is only 83 // set for server sockets. 84 bool early_data_received = false; 85 86 // True if the connection negotiated the Encrypted ClientHello extension. 87 bool encrypted_client_hello = false; 88 89 HandshakeType handshake_type = HANDSHAKE_UNKNOWN; 90 91 // The hashes, in several algorithms, of the SubjectPublicKeyInfos from 92 // each certificate in the chain. 93 HashValueVector public_key_hashes; 94 95 // List of SignedCertificateTimestamps and their corresponding validation 96 // status. 97 SignedCertificateTimestampAndStatusList signed_certificate_timestamps; 98 99 // Whether the connection complied with the CT cert policy, and if 100 // not, why not. 101 ct::CTPolicyCompliance ct_policy_compliance = 102 ct::CTPolicyCompliance::CT_POLICY_COMPLIANCE_DETAILS_NOT_AVAILABLE; 103 104 // OCSP stapling details. 105 bssl::OCSPVerifyResult ocsp_result; 106 107 // True if there was a certificate error which should be treated as fatal, 108 // and false otherwise. 109 bool is_fatal_cert_error = false; 110 }; 111 112 } // namespace net 113 114 #endif // NET_SSL_SSL_INFO_H_ 115