Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 5 #ifndef COMPONENTS_SSL_ERRORS_ERROR_CLASSIFICATION_H_ |
| 6 #define CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 6 #define COMPONENTS_SSL_ERRORS_ERROR_CLASSIFICATION_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/time/time.h" | 11 #include "base/time/time.h" |
| 12 #include "content/public/browser/notification_observer.h" | |
| 13 #include "content/public/browser/notification_registrar.h" | |
| 14 #include "net/cert/x509_certificate.h" | 12 #include "net/cert/x509_certificate.h" |
| 15 #include "url/gurl.h" | 13 #include "url/gurl.h" |
| 16 | 14 |
| 17 namespace content { | 15 namespace ssl_errors { |
| 18 class WebContents; | |
| 19 } | |
| 20 | 16 |
| 21 // This class classifies characteristics of SSL errors, including information | 17 // This class classifies characteristics of SSL errors. |
| 22 // about captive portal detection. | 18 class ErrorClassification { |
| 23 // | |
| 24 // This class should only be used on the UI thread because its | |
| 25 // implementation uses captive_portal::CaptivePortalService which can only be | |
| 26 // accessed on the UI thread. | |
| 27 class SSLErrorClassification : public content::NotificationObserver { | |
| 28 public: | 19 public: |
| 29 SSLErrorClassification(content::WebContents* web_contents, | 20 ErrorClassification(const base::Time& current_time, |
| 30 const base::Time& current_time, | 21 const GURL& url, |
| 31 const GURL& url, | 22 int cert_error, |
| 32 int cert_error, | 23 const net::X509Certificate& cert); |
| 33 const net::X509Certificate& cert); | 24 ~ErrorClassification(); |
| 34 ~SSLErrorClassification() override; | |
| 35 | 25 |
| 36 // Returns true if the system time is in the past. | 26 // Returns true if the system time is in the past. |
| 37 static bool IsUserClockInThePast(const base::Time& time_now); | 27 static bool IsUserClockInThePast(const base::Time& time_now); |
| 38 | 28 |
| 39 // Returns true if the system time is too far in the future or the user is | 29 // Returns true if the system time is too far in the future or the user is |
| 40 // using a version of Chrome which is more than 1 year old. | 30 // using a version of Chrome which is more than 1 year old. |
| 41 static bool IsUserClockInTheFuture(const base::Time& time_now); | 31 static bool IsUserClockInTheFuture(const base::Time& time_now); |
| 42 | 32 |
| 43 // Sets a clock for browser tests that check the build time. Used by | 33 // Sets a clock for browser tests that check the build time. Used by |
| 44 // IsUserClockInThePast and IsUserClockInTheFuture. | 34 // IsUserClockInThePast and IsUserClockInTheFuture. |
| (...skipping 19 matching lines...) Expand all Loading... | |
| 64 // www.food.example.com ~ example.com -> false | 54 // www.food.example.com ~ example.com -> false |
| 65 // mail.example.com ~ example.com -> false | 55 // mail.example.com ~ example.com -> false |
| 66 static bool GetWWWSubDomainMatch(const std::string& host_name, | 56 static bool GetWWWSubDomainMatch(const std::string& host_name, |
| 67 const std::vector<std::string>& dns_names, | 57 const std::vector<std::string>& dns_names, |
| 68 std::string* www_match_host_name); | 58 std::string* www_match_host_name); |
| 69 | 59 |
| 70 // A function which calculates the severity score when the ssl error is | 60 // A function which calculates the severity score when the ssl error is |
| 71 // |CERT_DATE_INVALID|. The calculated score is between 0.0 and 1.0, higher | 61 // |CERT_DATE_INVALID|. The calculated score is between 0.0 and 1.0, higher |
| 72 // being more severe, indicating how severe the certificate's | 62 // being more severe, indicating how severe the certificate's |
| 73 // date invalid error is. | 63 // date invalid error is. |
| 74 void InvalidDateSeverityScore(); | 64 void InvalidDateSeverityScore(); |
|
estark
2015/09/23 22:42:19
While you're here: it doesn't look like this metho
| |
| 75 | 65 |
| 76 // A function which calculates the severity score when the ssl error is | 66 // A function which calculates the severity score when the ssl error is |
| 77 // |CERT_COMMON_NAME_INVALID|. The calculated score is between 0.0 and 1.0, | 67 // |CERT_COMMON_NAME_INVALID|. The calculated score is between 0.0 and 1.0, |
| 78 // higher being more severe, indicating how severe the certificate's common | 68 // higher being more severe, indicating how severe the certificate's common |
| 79 // name invalid error is. | 69 // name invalid error is. |
| 80 void InvalidCommonNameSeverityScore(); | 70 void InvalidCommonNameSeverityScore(); |
| 81 | 71 |
| 82 // A function which calculates the severity score when the ssl error is | 72 // A function which calculates the severity score when the ssl error is |
| 83 // |CERT_AUTHORITY_INVALID|, returns a score between 0.0 and 1.0, higher | 73 // |CERT_AUTHORITY_INVALID|, returns a score between 0.0 and 1.0, higher |
| 84 // values being more severe, indicating how severe the certificate's | 74 // values being more severe, indicating how severe the certificate's |
| 85 // authority invalid error is. | 75 // authority invalid error is. |
| 86 void InvalidAuthoritySeverityScore(); | 76 void InvalidAuthoritySeverityScore(); |
| 87 | 77 |
| 88 void RecordUMAStatistics(bool overridable) const; | 78 void RecordUMAStatistics(bool overridable) const; |
| 89 void RecordCaptivePortalUMAStatistics(bool overridable) const; | |
| 90 base::TimeDelta TimePassedSinceExpiry() const; | 79 base::TimeDelta TimePassedSinceExpiry() const; |
| 91 | 80 |
| 92 private: | 81 private: |
| 93 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestDateInvalidScore); | 82 FRIEND_TEST_ALL_PREFIXES(ErrorClassificationTest, TestDateInvalidScore); |
| 94 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestNameMismatch); | 83 FRIEND_TEST_ALL_PREFIXES(ErrorClassificationTest, TestNameMismatch); |
| 95 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, | 84 FRIEND_TEST_ALL_PREFIXES(ErrorClassificationTest, TestHostNameHasKnownTLD); |
| 96 TestHostNameHasKnownTLD); | |
| 97 | 85 |
| 98 typedef std::vector<std::string> Tokens; | 86 typedef std::vector<std::string> Tokens; |
| 99 | 87 |
| 100 // Returns true if the hostname has a known Top Level Domain. | 88 // Returns true if the hostname has a known Top Level Domain. |
| 101 static bool IsHostNameKnownTLD(const std::string& host_name); | 89 static bool IsHostNameKnownTLD(const std::string& host_name); |
| 102 | 90 |
| 103 // Returns true if GetWWWSubDomainMatch finds a www mismatch. | 91 // Returns true if GetWWWSubDomainMatch finds a www mismatch. |
| 104 bool IsWWWSubDomainMatch() const; | 92 bool IsWWWSubDomainMatch() const; |
| 105 | 93 |
| 106 // Returns true if |child| is a subdomain of any of the |potential_parents|. | 94 // Returns true if |child| is a subdomain of any of the |potential_parents|. |
| 107 bool NameUnderAnyNames(const Tokens& child, | 95 bool NameUnderAnyNames(const Tokens& child, |
| 108 const std::vector<Tokens>& potential_parents) const; | 96 const std::vector<Tokens>& potential_parents) const; |
| 109 | 97 |
| 110 // Returns true if any of the |potential_children| is a subdomain of the | 98 // Returns true if any of the |potential_children| is a subdomain of the |
| 111 // |parent|. The inverse case should be treated carefully as this is most | 99 // |parent|. The inverse case should be treated carefully as this is most |
| 112 // likely a MITM attack. We don't want foo.appspot.com to be able to MITM for | 100 // likely a MITM attack. We don't want foo.appspot.com to be able to MITM for |
| 113 // appspot.com. | 101 // appspot.com. |
| 114 bool AnyNamesUnderName(const std::vector<Tokens>& potential_children, | 102 bool AnyNamesUnderName(const std::vector<Tokens>& potential_children, |
| 115 const Tokens& parent) const; | 103 const Tokens& parent) const; |
| 116 | 104 |
| 117 // Returns true if |hostname| is too broad for the scope of a wildcard | 105 // Returns true if |hostname| is too broad for the scope of a wildcard |
| 118 // certificate. E.g.: | 106 // certificate. E.g.: |
| 119 // | 107 // |
| 120 // a.b.example.com ~ *.example.com --> true | 108 // a.b.example.com ~ *.example.com --> true |
| 121 // b.example.com ~ *.example.com --> false | 109 // b.example.com ~ *.example.com --> false |
| 122 bool IsSubDomainOutsideWildcard(const Tokens& hostname) const; | 110 bool IsSubDomainOutsideWildcard(const Tokens& hostname) const; |
| 123 | 111 |
| 124 // Returns true if the certificate is a shared certificate. Note - This | 112 // Returns true if the certificate is a shared certificate. Note - This |
| 125 // function should be used with caution (only for UMA histogram) as an | 113 // function should be used with caution (only for UMA histogram) as an |
| (...skipping 19 matching lines...) Expand all Loading... | |
| 145 // Tokenize("example.com")) | 133 // Tokenize("example.com")) |
| 146 // --> 2. | 134 // --> 2. |
| 147 size_t FindSubDomainDifference(const Tokens& potential_subdomain, | 135 size_t FindSubDomainDifference(const Tokens& potential_subdomain, |
| 148 const Tokens& parent) const; | 136 const Tokens& parent) const; |
| 149 | 137 |
| 150 static Tokens Tokenize(const std::string& name); | 138 static Tokens Tokenize(const std::string& name); |
| 151 | 139 |
| 152 float CalculateScoreTimePassedSinceExpiry() const; | 140 float CalculateScoreTimePassedSinceExpiry() const; |
| 153 float CalculateScoreEnvironments() const; | 141 float CalculateScoreEnvironments() const; |
| 154 | 142 |
| 155 // content::NotificationObserver: | |
| 156 void Observe(int type, | |
| 157 const content::NotificationSource& source, | |
| 158 const content::NotificationDetails& details) override; | |
| 159 | |
| 160 content::WebContents* web_contents_; | |
| 161 // This stores the current time. | 143 // This stores the current time. |
|
estark
2015/09/23 22:42:19
nit on pre-existing code, which must surely be the
| |
| 162 base::Time current_time_; | 144 base::Time current_time_; |
| 163 const GURL request_url_; | 145 const GURL request_url_; |
| 164 int cert_error_; | 146 int cert_error_; |
| 165 // This stores the certificate. | 147 // This stores the certificate. |
| 166 const net::X509Certificate& cert_; | 148 const net::X509Certificate& cert_; |
| 167 // Is captive portal detection enabled? | |
| 168 bool captive_portal_detection_enabled_; | |
| 169 // Did the probe complete before the interstitial was closed? | |
| 170 bool captive_portal_probe_completed_; | |
| 171 // Did the captive portal probe receive an error or get a non-HTTP response? | |
| 172 bool captive_portal_no_response_; | |
| 173 // Was a captive portal detected? | |
| 174 bool captive_portal_detected_; | |
| 175 | |
| 176 content::NotificationRegistrar registrar_; | |
| 177 }; | 149 }; |
| 178 | 150 |
| 179 #endif // CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 151 } // namespace ssl_errors |
| 152 | |
| 153 #endif // COMPONENTS_SSL_ERRORS_ERROR_CLASSIFICATION_H_ | |
| OLD | NEW |