Common Name Mismatch Handler For WWW Subdomain Mismatch case

chrome/browser/ssl/ssl_error_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_error_handler.h"
 
 #include "base/callback_helpers.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
 #include "base/time/time.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/ssl_blocking_page.h"
 #include "chrome/browser/ssl/ssl_cert_reporter.h"
+#include "chrome/browser/ssl/ssl_error_classification.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/web_contents.h"
 
 #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION)
 #include "chrome/browser/captive_portal/captive_portal_service.h"
 #include "chrome/browser/captive_portal/captive_portal_service_factory.h"
 #include "chrome/browser/captive_portal/captive_portal_tab_helper.h"
 #include "chrome/browser/ssl/captive_portal_blocking_page.h"
 #endif
@@ skipping 119 matching lines @@
       web_contents->GetBrowserContext());
   registrar_.Add(this,
                  chrome::NOTIFICATION_CAPTIVE_PORTAL_CHECK_RESULT,
                  content::Source<Profile>(profile));
 #endif
 }
 
 SSLErrorHandler::~SSLErrorHandler() {
 }
 
+bool IsCommonNameMismatchHandlerEnabled() {
+  // Add finch trail later.
+  return 1;

[meacer, 2015/07/09 17:58:56]

|return true| instead of 1. Actually, just remove this function and enable the
check by default. It'll only be enabled on canary and dev for a few days until
you land the finch CL.

[Bhanu Dev, 2015/07/11 04:00:43]

Done.

+}
+
 void SSLErrorHandler::StartHandlingError() {
   RecordUMA(HANDLE_ALL);
 
+  if (IsCommonNameMismatchHandlerEnabled()) {
+    std::vector<std::string> dns_names;
+    ssl_info_.cert->GetDNSNames(&dns_names);
+    DCHECK(!dns_names.empty());

[meacer, 2015/07/09 17:58:56]

I feel that dns_names can actually be empty, so not sure if this check is valid.

[Bhanu Dev, 2015/07/11 04:00:43]

|dns_names| contains the DNS names in SAN field or common name in the subject
field. Can there be a certificate with no common name (CN)? 

+    GURL suggested_url;
+    if (CommonNameMismatchHandler::GetSuggestedUrl(request_url_, dns_names,
+                                                   suggested_url)) {
+      Profile* profile =
+          Profile::FromBrowserContext(web_contents_->GetBrowserContext());
+      scoped_refptr<net::URLRequestContextGetter> request_context(
+          profile->GetRequestContext());
+      common_name_mismatch_handler_.reset(
+          new CommonNameMismatchHandler(request_context));
+      common_name_mismatch_handler_->CheckSuggestedUrl(
+          suggested_url,
+          base::Bind(&SSLErrorHandler::CommonNameMismatchHandlerCallback,
+                     base::Unretained(this)));
+      timer_.Start(FROM_HERE, base::TimeDelta::FromSeconds(
+                                  common_name_handler_delay_in_seconds),
+                   this, &SSLErrorHandler::OnTimerExpired);
+      if (g_timer_started_callback)
+        g_timer_started_callback->Run(web_contents_);
+      return;
+    }
+  }
+
 #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION)
   if (IsCaptivePortalInterstitialEnabled()) {
     CheckForCaptivePortal();
     timer_.Start(FROM_HERE,
                  GetInterstitialDisplayDelay(g_interstitial_delay_type),
                  this, &SSLErrorHandler::OnTimerExpired);
     if (g_timer_started_callback)
       g_timer_started_callback->Run(web_contents_);
     return;
   }
 #endif
   // Display an SSL interstitial.
-  ShowSSLInterstitial();
+  ShowSSLInterstitial(GURL());
 }
 
 void SSLErrorHandler::OnTimerExpired() {
-  ShowSSLInterstitial();
+  ShowSSLInterstitial(GURL());
 }
 
 void SSLErrorHandler::CheckForCaptivePortal() {
 #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION)
   Profile* profile = Profile::FromBrowserContext(
       web_contents_->GetBrowserContext());
   CaptivePortalService* captive_portal_service =
       CaptivePortalServiceFactory::GetForProfile(profile);
   captive_portal_service->DetectCaptivePortal();
 #else
@@ skipping 13 matching lines @@
                                  ssl_cert_reporter_.Pass(), ssl_info_,
                                  callback_))->Show();
   // Once an interstitial is displayed, no need to keep the handler around.
   // This is the equivalent of "delete this".
   web_contents_->RemoveUserData(UserDataKey());
 #else
   NOTREACHED();
 #endif
 }
 
-void SSLErrorHandler::ShowSSLInterstitial() {
+void SSLErrorHandler::ShowSSLInterstitial(const GURL& suggested_url) {
   // Show SSL blocking page. The interstitial owns the blocking page.
   const Profile* const profile =
       Profile::FromBrowserContext(web_contents_->GetBrowserContext());
   RecordUMA(SSLBlockingPage::IsOverridable(options_mask_, profile)
                 ? SHOW_SSL_INTERSTITIAL_OVERRIDABLE
                 : SHOW_SSL_INTERSTITIAL_NONOVERRIDABLE);
   (new SSLBlockingPage(web_contents_, cert_error_, ssl_info_, request_url_,
                        options_mask_, base::Time::NowFromSystemTime(),
-                       ssl_cert_reporter_.Pass(), callback_))->Show();
+                       ssl_cert_reporter_.Pass(), callback_, suggested_url))
+      ->Show();
   // Once an interstitial is displayed, no need to keep the handler around.
   // This is the equivalent of "delete this".
   web_contents_->RemoveUserData(UserDataKey());
 }
 
 void SSLErrorHandler::Observe(
     int type,
     const content::NotificationSource& source,
     const content::NotificationDetails& details) {
 #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION)
   if (type == chrome::NOTIFICATION_CAPTIVE_PORTAL_CHECK_RESULT) {
     timer_.Stop();
     CaptivePortalService::Results* results =
         content::Details<CaptivePortalService::Results>(details).ptr();
     if (results->result == captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL)
       ShowCaptivePortalInterstitial(results->landing_url);
     else
-      ShowSSLInterstitial();
+      ShowSSLInterstitial(GURL());
   }
 #endif
 }
 
 // Destroy the error handler on all new navigations. This ensures that the
 // handler is properly recreated when a hanging page is navigated to an SSL
 // error, even when the tab's WebContents doesn't change.
 void SSLErrorHandler::DidStartNavigationToPendingEntry(
     const GURL& url,
     content::NavigationController::ReloadType reload_type) {
   // Need to explicity deny the certificate via the callback, otherwise memory
   // is leaked.
   if (!callback_.is_null()) {
     base::ResetAndReturn(&callback_).Run(false);
   }
   web_contents_->RemoveUserData(UserDataKey());
 }
+
+void SSLErrorHandler::CommonNameMismatchHandlerCallback(
+    const CommonNameMismatchHandler::Results& results) {
+  timer_.Stop();
+  if (results.result == CommonNameMismatchHandler::SuggestedUrlCheckResult::
+                            RESULT_SUGGESTED_URL_VALID) {
+    ShowSSLInterstitial(results.new_url);

[meacer, 2015/07/09 17:58:56]

For this CL, let's just record the result in a histogram and call
ShowSSLInterstitial without a suggested URL. You can then add the UI logic once
the design is finalized. That means you don't have to keep around a
suggested_url for this CL (if the tests turn out to be difficult to write
because of this, let me know and we can reconsider)

This is going to slightly affect how many captive portal interstitials we
display since this CL is giving priority to common name mismatches, but I expect
the difference to be minimal so it's fine.

[Bhanu Dev, 2015/07/11 04:00:43]

Acknowledged.

+  } else {
+    ShowSSLInterstitial(GURL());
+  }
+}