SSLPolicy Fix: Step 8....

chrome/browser/ssl/ssl_manager.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SSL_SSL_MANAGER_H_
 #define CHROME_BROWSER_SSL_SSL_MANAGER_H_
 
 #include <string>
 #include <map>
 #include <vector>
@@ skipping 27 matching lines @@
 class URLRequest;
 class WebContents;
 
 // The SSLManager SSLManager controls the SSL UI elements in a TabContents.  It
 // listens for various events that influence when these elements should or
 // should not be displayed and adjusts them accordingly.
 //
 // There is one SSLManager per tab.
 // The security state (secure/insecure) is stored in the navigation entry.
 // Along with it are stored any SSL error code and the associated cert.
-//
 
 class SSLManager : public NotificationObserver {
  public:
   class CertError;
 
   // An ErrorHandler carries information from the IO thread to the UI thread
   // and is dispatched to the appropriate SSLManager when it arrives on the
   // UI thread.  Subclasses should override the OnDispatched/OnDispatchFailed
   // methods to implement the actions that should be taken on the UI thread.
   // These methods can call the different convenience methods ContinueRequest/
@@ skipping 10 matching lines @@
 
     // Find the appropriate SSLManager for the URLRequest and begin handling
     // this error.
     //
     // Call on UI thread.
     void Dispatch();
 
     // Available on either thread.
     const GURL& request_url() const { return request_url_; }
 
+    // Available on either thread.
+    ResourceType::Type resource_type() const { return resource_type_; }
+
+    // Available on either thread.
+    const std::string& frame_origin() const { return frame_origin_; }
+
+    // Available on either thread.
+    const std::string& main_frame_origin() const { return main_frame_origin_; }
+
     // Call on the UI thread.
     SSLManager* manager() const { return manager_; }
 
     // Returns the WebContents this object is associated with.  Should be
     // called from the UI thread.
     WebContents* GetWebContents();
 
     // Cancels the associated URLRequest.
     // This method can be called from OnDispatchFailed and OnDispatched.
     void CancelRequest();
@@ skipping 22 matching lines @@
     // Does nothing on the URLRequest but ensures the current instance ref
     // count is decremented appropriately.  Subclasses that do not want to
     // take any specific actions in their OnDispatched/OnDispatchFailed should
     // call this.
     void TakeNoAction();
 
    protected:
     // Construct on the IO thread.
     ErrorHandler(ResourceDispatcherHost* resource_dispatcher_host,
                  URLRequest* request,
+                 ResourceType::Type resource_type,
+                 const std::string& frame_origin,
+                 const std::string& main_frame_origin,
                  MessageLoop* ui_loop);
 
     // The following 2 methods are the methods subclasses should implement.
     virtual void OnDispatchFailed() { TakeNoAction(); }
 
     // Can use the manager_ member.
     virtual void OnDispatched() { TakeNoAction(); }
 
     // We cache the message loops to be able to proxy events across the thread
     // boundaries.
@@ skipping 26 matching lines @@
 
     // Derefs this instance.
     // Call on the IO thread.
     void CompleteTakeNoAction();
 
     // We use these members to find the correct SSLManager when we arrive on
     // the UI thread.
     int render_process_host_id_;
     int tab_contents_id_;
 
+    // The URL that we requested.
     // This read-only member can be accessed on any thread.
-    const GURL request_url_;  // The URL that we requested.
+    const GURL request_url_;
 
+    // What kind of resource is associated with the requested that generated
+    // that error.
+    // This read-only member can be accessed on any thread.
+    const ResourceType::Type resource_type_;
+
+    // The origin of the frame associated with this request.
+    // This read-only member can be accessed on any thread.
+    const std::string frame_origin_;
+
+    // The origin of the main frame associated with this request.
+    // This read-only member can be accessed on any thread.
+    const std::string main_frame_origin_;
+
+    // A flag to make sure we notify the URLRequest exactly once.
     // Should only be accessed on the IO thread
-    bool request_has_been_notified_;  // A flag to make sure we notify the
-                                      // URLRequest exactly once.
+    bool request_has_been_notified_;
 
     DISALLOW_COPY_AND_ASSIGN(ErrorHandler);
   };
 
   // A CertError represents an error that occurred with the certificate in an
   // SSL session.  A CertError object exists both on the IO thread and on the UI
   // thread and allows us to cancel/continue a request it is associated with.
   class CertError : public ErrorHandler {
    public:
 
     virtual CertError* AsCertError() { return this; }
 
     // These accessors are available on either thread
     const net::SSLInfo& ssl_info() const { return ssl_info_; }
     int cert_error() const { return cert_error_; }
 
-    ResourceType::Type resource_type() const { return resource_type_; }
    private:
     // SSLManager is responsible for creating CertError objects.
     friend class SSLManager;
 
     // Construct on the IO thread.
     // We mark this method as private because it is tricky to correctly
     // construct a CertError object.
     CertError(ResourceDispatcherHost* resource_dispatcher_host,
               URLRequest* request,
               ResourceType::Type resource_type,
+              const std::string& frame_origin,
+              const std::string& main_frame_origin,
               int cert_error,
               net::X509Certificate* cert,
               MessageLoop* ui_loop);
 
     // ErrorHandler methods
     virtual void OnDispatchFailed() { CancelRequest(); }
     virtual void OnDispatched() { manager_->OnCertError(this); }
 
     // These read-only members can be accessed on any thread.
     net::SSLInfo ssl_info_;
     const int cert_error_;  // The error we represent.
 
-    // What kind of resource is associated with the requested that generated
-    // that error.
-    ResourceType::Type resource_type_;
-
     DISALLOW_COPY_AND_ASSIGN(CertError);
   };
 
   // The MixedContentHandler class is used to query what to do with
   // mixed content, from the IO thread to the UI thread.
   class MixedContentHandler : public ErrorHandler {
    public:
     // Created on the IO thread.
     MixedContentHandler(ResourceDispatcherHost* rdh,
                         URLRequest* request,
+                        ResourceType::Type resource_type,
+                        const std::string& frame_origin,
+                        const std::string& main_frame_origin,
                         MessageLoop* ui_loop)
-        : ErrorHandler(rdh, request, ui_loop) { }
+        : ErrorHandler(rdh, request, resource_type, frame_origin,
+                       main_frame_origin, ui_loop) { }
 
    protected:
     virtual void OnDispatchFailed() { TakeNoAction(); }
     virtual void OnDispatched() { manager()->OnMixedContent(this); }
 
    private:
     DISALLOW_COPY_AND_ASSIGN(MixedContentHandler);
   };
 
+  // RequestInfo wraps up the information SSLPolicy needs about a request in
+  // order to update our security IU.  RequestInfo is RefCounted in case we need
+  // to deal with the request asynchronously.
+  class RequestInfo : public base::RefCounted<RequestInfo> {
+   public:
+    RequestInfo(SSLManager* manager,
+                const GURL& url,
+                ResourceType::Type resource_type,
+                const std::string& frame_origin,
+                const std::string& main_frame_origin,
+                int ssl_cert_id,
+                int ssl_cert_status)
+        : manager_(manager),
+          url_(url),
+          resource_type_(resource_type),
+          frame_origin_(frame_origin),
+          main_frame_origin_(main_frame_origin),
+          ssl_cert_id_(ssl_cert_id),
+          ssl_cert_status_(ssl_cert_status) {
+    }
+
+    SSLManager* manager() const { return manager_; }
+    const GURL& url() const { return url_; }
+    ResourceType::Type resource_type() const { return resource_type_; }
+    const std::string& frame_origin() const { return frame_origin_; }
+    const std::string& main_frame_origin() const { return main_frame_origin_; }
+    int ssl_cert_id() const { return ssl_cert_id_; }
+    int ssl_cert_status() const { return ssl_cert_status_; }
+
+   private:
+    SSLManager* manager_;
+    GURL url_;
+    ResourceType::Type resource_type_;
+    std::string frame_origin_;
+    std::string main_frame_origin_;
+    int ssl_cert_id_;
+    int ssl_cert_status_;
+
+    DISALLOW_COPY_AND_ASSIGN(RequestInfo);
+  };
+
   // The SSLManager will ask its delegate to decide how to handle events
   // relevant to SSL.  Delegates are expected to be stateless and intended to be
   // easily implementable.
   //
   // Delegates should interact with the rest of the browser only through their
   // parameters and through the delegate API of the SSLManager.
   //
   // If a delegate needs to do something tricky, consider having the SSLManager
   // do it instead.
   class Delegate {
    public:
     // An error occurred with the certificate in an SSL connection.
-    virtual void OnCertError(const GURL& main_frame_url, CertError* error) = 0;
+    virtual void OnCertError(CertError* error) = 0;
 
     // A request for a mixed-content resource was made.  Note that the resource
     // request was not started yet and the delegate is responsible for starting
     // it.
-    virtual void OnMixedContent(
-        NavigationController* navigation_controller,
-        const GURL& main_frame_url,
-        MixedContentHandler* mixed_content_handler) = 0;
+    virtual void OnMixedContent(MixedContentHandler* handler) = 0;
 
-    // We have started a resource request for the given URL.
-    virtual void OnRequestStarted(SSLManager* manager,
-                                  const GURL& url,
-                                  ResourceType::Type resource_type,
-                                  int ssl_cert_id,
-                                  int ssl_cert_status) = 0;
+    // We have started a resource request with the given info.
+    virtual void OnRequestStarted(RequestInfo* info) = 0;
 
     // Returns the default security style for a given URL.
     virtual SecurityStyle GetDefaultStyle(const GURL& url) = 0;
   };
 
   static void RegisterUserPrefs(PrefService* prefs);
 
   // Construct an SSLManager for the specified tab.
   // If |delegate| is NULL, SSLPolicy::GetDefaultPolicy() is used.
   SSLManager(NavigationController* controller, Delegate* delegate);
 
   ~SSLManager();
 
   //////////////////////////////////////////////////////////////////////////////
   // Delegate API
   //
   // The SSL manager expects these methods to be called by its delegate.  They
   // exist to make Delegates easy to implement.
 
   // Ensure that the specified message is displayed to the user.  This will
   // display an InfoBar at the top of the associated tab.
   void ShowMessage(const std::wstring& msg);
 
   // Same as ShowMessage but also contains a link that when clicked run the
   // specified task.  The SSL Manager becomes the owner of the task.
   void ShowMessageWithLink(const std::wstring& msg,
                            const std::wstring& link_text,
                            Task* task);
 
+  // Records that a host is "broken," that is, the origin for that host has been
+  // contaminated with insecure content, either via HTTP or via HTTPS with a
+  // bad certificate.
+  void MarkHostAsBroken(const std::string& host);
+
+  // Returns whether the specified host was marked as broken.
+  bool DidMarkHostAsBroken(const std::string& host) const;
+
   // Sets the maximum security style for the page.  If the current security
   // style is lower than |style|, this will not have an effect on the security
   // indicators.
   //
   // It will return true if the navigation entry was updated or false if
   // nothing changed. The caller is responsible for broadcasting
   // NOTIFY_SSY_STATE_CHANGED if it returns true.
   bool SetMaxSecurityStyle(SecurityStyle style);
 
   // Logs a message to the console of the page.
   void AddMessageToConsole(const std::wstring& msg,
                            ConsoleMessageLevel level);
 
   // Records that |cert| is permitted to be used for |host| in the future.
   void DenyCertForHost(net::X509Certificate* cert, const std::string& host);
 
   // Records that |cert| is not permitted to be used for |host| in the future.
   void AllowCertForHost(net::X509Certificate* cert, const std::string& host);
 
   // Queries whether |cert| is allowed or denied for |host|.
   net::X509Certificate::Policy::Judgment QueryPolicy(
       net::X509Certificate* cert, const std::string& host);
 
-  // Allow mixed/unsafe content to be visible (non filtered) for the specified
-  // URL.
-  // Note that the current implementation allows on a host name basis.
-  void AllowShowInsecureContentForURL(const GURL& url);
+  // Allow mixed content to be visible (non filtered).
+  void AllowMixedContentForHost(const std::string& host);
 
-  // Returns whether the specified URL is allowed to show insecure (mixed or
-  // unsafe) content.
-  bool CanShowInsecureContent(const GURL& url);
+  // Returns whether the specified host is allowed to show mixed content.
+  bool DidAllowMixedContentForHost(const std::string& host) const;
 
   //
   //////////////////////////////////////////////////////////////////////////////
 
   // The delegate of the SSLManager.  This value may be changed at any time,
   // but it is not permissible for it to be NULL.
   Delegate* delegate() const { return delegate_; }
   void set_delegate(Delegate* delegate) { delegate_ = delegate; }
 
   // Entry point for SSLCertificateErrors.  This function begins the process
@@ skipping 24 matching lines @@
   // the SSL manager.  The error originated from the ResourceDispatcherHost.
   //
   // Called on the UI thread.
   void OnCertError(CertError* error);
 
   // Called by MixedContentHandler::Dispatch to kick off processing of the
   // mixed-content resource request.  The info originated from the
   // ResourceDispatcherHost.
   //
   // Called on the UI thread.
-  void OnMixedContent(MixedContentHandler* mixed_content);
+  void OnMixedContent(MixedContentHandler* handler);
 
   // Entry point for navigation.  This function begins the process of updating
   // the security UI when the main frame navigates to a new URL.
   //
   // Called on the UI thread.
   virtual void Observe(NotificationType type,
                        const NotificationSource& source,
                        const NotificationDetails& details);
 
   // Entry point for navigation.  This function begins the process of updating
@@ skipping 50 matching lines @@
 
   // Entry points for notifications to which we subscribe. Note that
   // DidCommitProvisionalLoad uses the abstract NotificationDetails type since
   // the type we need is in NavigationController which would create a circular
   // header file dependency.
   void DidLoadFromMemoryCache(LoadFromMemoryCacheDetails* details);
   void DidCommitProvisionalLoad(const NotificationDetails& details);
   void DidFailProvisionalLoadWithError(ProvisionalLoadDetails* details);
   void DidStartResourceResponse(ResourceRequestDetails* details);
   void DidReceiveResourceRedirect(ResourceRedirectDetails* details);
+  void DidChangeSSLInternalState();
+
+  // Dispatch NotificationType::SSL_INTERNAL_STATE_CHANGED notification.
+  void DispatchSSLInternalStateChanged();
+
+  // Dispatch NotificationType::SSL_VISIBLE_STATE_CHANGED notification.
+  void DispatchSSLVisibleStateChanged();
 
   // Convenience method for initializing navigation entries.
   void InitializeEntryIfNeeded(NavigationEntry* entry);
 
   // Shows the pending messages (in info-bars) if any.
   void ShowPendingMessages();
 
   // Clears any pending messages.
   void ClearPendingMessages();
 
@@ skipping 12 matching lines @@
   SSLHostState* ssl_host_state_;
 
   // The list of messages that should be displayed (in info bars) when the page
   // currently loading had loaded.
   std::vector<SSLMessageInfo> pending_messages_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLManager);
 };
 
 #endif  // CHROME_BROWSER_SSL_SSL_MANAGER_H_