New SSL metric added: Likely From Same Domain

chrome/browser/ssl/ssl_error_classification.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <vector>
 
 #include "chrome/browser/ssl/ssl_error_classification.h"
 
 #include "base/build_time.h"
 #include "base/metrics/field_trial.h"
@@ skipping 37 matching lines @@
   SUBDOMAIN_MATCH,
   SUBDOMAIN_INVERSE_MATCH,
   SUBDOMAIN_OUTSIDE_WILDCARD,
   HOST_NAME_NOT_KNOWN_TLD,
   LIKELY_MULTI_TENANT_HOSTING,
   LOCALHOST,
   PRIVATE_URL,
   AUTHORITY_ERROR_CAPTIVE_PORTAL,
   SELF_SIGNED,
   EXPIRED_RECENTLY,
+  LIKELY_SAME_DOMAIN,
   UNUSED_INTERSTITIAL_CAUSE_ENTRY,
 };
 
 // Events for UMA. Do not reorder or change!
 enum SSLInterstitialCauseCaptivePortal {
   CAPTIVE_PORTAL_ALL,
   CAPTIVE_PORTAL_DETECTION_ENABLED,
   CAPTIVE_PORTAL_DETECTION_ENABLED_OVERRIDABLE,
   CAPTIVE_PORTAL_PROBE_COMPLETED,
   CAPTIVE_PORTAL_PROBE_COMPLETED_OVERRIDABLE,
@@ skipping 133 matching lines @@
           RecordSSLInterstitialCause(overridable, SUBDOMAIN_OUTSIDE_WILDCARD);
         std::vector<std::string> dns_names;
         cert_.GetDNSNames(&dns_names);
         std::vector<Tokens> dns_name_tokens = GetTokenizedDNSNames(dns_names);
         if (NameUnderAnyNames(host_name_tokens, dns_name_tokens))
           RecordSSLInterstitialCause(overridable, SUBDOMAIN_MATCH);
         if (AnyNamesUnderName(dns_name_tokens, host_name_tokens))
           RecordSSLInterstitialCause(overridable, SUBDOMAIN_INVERSE_MATCH);
         if (IsCertLikelyFromMultiTenantHosting())
           RecordSSLInterstitialCause(overridable, LIKELY_MULTI_TENANT_HOSTING);
+        if (IsCertLikelyFromSameDomain())
+          RecordSSLInterstitialCause(overridable, LIKELY_SAME_DOMAIN);
       } else {
          RecordSSLInterstitialCause(overridable, HOST_NAME_NOT_KNOWN_TLD);
       }
       break;
     }
     case SSLErrorInfo::CERT_AUTHORITY_INVALID: {
       const std::string& hostname = request_url_.HostNoBrackets();
       if (net::IsLocalhost(hostname))
         RecordSSLInterstitialCause(overridable, LOCALHOST);
       if (IsHostnameNonUniqueOrDotless(hostname))
@@ skipping 235 matching lines @@
   for (size_t i = 0; i < dns_names_size; ++i) {
     for (size_t j = i + 1; j < dns_names_size; ++j) {
       int edit_distance = GetLevensteinDistance(dns_names[i], dns_names[j]);
       if (edit_distance < kMinimumEditDsitance)
         return false;
     }
   }
   return true;
 }
 
+bool SSLErrorClassification::IsCertLikelyFromSameDomain() const {
+  std::string host_name = request_url_.host();
+  std::vector<std::string> dns_names;
+  cert_.GetDNSNames(&dns_names);
+
+  dns_names.push_back(host_name);
+  size_t dns_names_size = dns_names.size();
+  std::vector<std::string> dns_names_domain;
+
+  for (size_t i = 0; i < dns_names_size; ++i) {

[meacer, 2015/07/11 00:26:07]

Use C++11 style loop:

for (const string& dns_name: dns_names)

[Bhanu Dev, 2015/07/13 19:22:43]

Done.

+    dns_names_domain.push_back(
+        net::registry_controlled_domains::
+        GetDomainAndRegistry(
+            dns_names[i],
+            net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES));
+  }
+
+  size_t dns_names_domain_size = dns_names_domain.size();

[meacer, 2015/07/11 00:26:07]

This is just used once, no need to create a separate variable.

[Bhanu Dev, 2015/07/13 19:22:43]

Done.

+  std::string host_name_domain = dns_names_domain[dns_names_domain_size - 1];

[meacer, 2015/07/11 00:26:07]

Need to check if dns_names_domain_size==0. In fact, just do an early exit after
cert_.GetDNSNames in that case.

[Bhanu Dev, 2015/07/13 19:22:43]

I think dns_names_domain_size cannot be 0, since host_name is appended to it. I
added a DCHECK.

+
+  return std::find(dns_names_domain.begin(), dns_names_domain.end() - 1,

[meacer, 2015/07/11 00:26:07]

You might want to add a small comment here saying why you are excluding the last
item (that it's the original domain pushed above).

[Bhanu Dev, 2015/07/13 19:22:43]

Done.

+                   host_name_domain) != dns_names_domain.end() - 1;
+}
+
 // static
 bool SSLErrorClassification::IsHostnameNonUniqueOrDotless(
     const std::string& hostname) {
   return net::IsHostnameNonUnique(hostname) ||
          hostname.find('.') == std::string::npos;
 }
 
 void SSLErrorClassification::Observe(
     int type,
     const content::NotificationSource& source,
@@ skipping 17 matching lines @@
     // sure we don't clear the captive protal flag, since the interstitial was
     // potentially caused by the captive portal.
     captive_portal_detected_ = captive_portal_detected_ ||
         (results->result == captive_portal::RESULT_BEHIND_CAPTIVE_PORTAL);
     // Also keep track of non-HTTP portals and error cases.
     captive_portal_no_response_ = captive_portal_no_response_ ||
         (results->result == captive_portal::RESULT_NO_RESPONSE);
   }
 #endif
 }