15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2011 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 52a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#ifndef NET_SSL_SSL_CIPHER_SUITE_NAMES_H_ 62a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#define NET_SSL_SSL_CIPHER_SUITE_NAMES_H_ 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <string> 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "base/basictypes.h" 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include "net/base/net_export.h" 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)namespace net { 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// SSLCipherSuiteToStrings returns three strings for a given cipher suite 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// number, the name of the key exchange algorithm, the name of the cipher and 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// the name of the MAC. The cipher suite number is the number as sent on the 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// wire and recorded at 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// http://www.iana.org/assignments/tls-parameters/tls-parameters.xml 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// If the cipher suite is unknown, the strings are set to "???". 217d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles)// In the case of an AEAD cipher suite, *mac_str is NULL and *is_aead is true. 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)NET_EXPORT void SSLCipherSuiteToStrings(const char** key_exchange_str, 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char** cipher_str, 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const char** mac_str, 257d4cd473f85ac64c3747c96c277f9e506a0d2246Torne (Richard Coles) bool* is_aead, 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint16 cipher_suite); 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// SSLVersionToString returns the name of the SSL protocol version 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// specified by |ssl_version|, which is defined in 302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// net/ssl/ssl_connection_status_flags.h. 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// If the version is unknown, |name| is set to "???". 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)NET_EXPORT void SSLVersionToString(const char** name, int ssl_version); 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Parses a string literal that represents a SSL/TLS cipher suite. 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Supported literal forms: 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 0xAABB, where AA is cipher_suite[0] and BB is cipher_suite[1], as 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// defined in RFC 2246, Section 7.4.1.2. Unrecognized but parsable cipher 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// suites in this form will not return an error. 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Returns true if the cipher suite was successfully parsed, storing the 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// result in |cipher_suite|. 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// TODO(rsleevi): Support the full strings defined in the IANA TLS parameters 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// list. 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)NET_EXPORT bool ParseSSLCipherString(const std::string& cipher_string, 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) uint16* cipher_suite); 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 49cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// |cipher_suite| is the IANA id for the cipher suite. What a "secure" 50cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// cipher suite is arbitrarily determined here. The intent is to indicate what 51cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// cipher suites meet modern security standards when backwards compatibility can 52cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// be ignored. Notably, HTTP/2 requires/encourages this sort of validation of 53cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// cipher suites: https://http2.github.io/http2-spec/#TLSUsage. 54cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 55cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// Currently, this function follows these criteria: 56cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 1) Only uses forward secure key exchanges 57cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)// 2) Only uses AEADs 58cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles)NET_EXPORT_PRIVATE bool IsSecureTLSCipherSuite(uint16 cipher_suite); 59cedac228d2dd51db4b79ea1e72c7f249408ee061Torne (Richard Coles) 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} // namespace net 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#endif // NET_SSL_SSL_CIPHER_SUITE_NAMES_H_ 63