OLD | NEW |
---|---|
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/ssl_errors/error_classification.h" | 5 #include "components/ssl_errors/error_classification.h" |
6 | 6 |
7 #include <limits.h> | 7 #include <limits.h> |
8 #include <stddef.h> | 8 #include <stddef.h> |
9 | 9 |
10 #include <vector> | 10 #include <vector> |
11 | 11 |
12 #include "base/build_time.h" | 12 #include "base/build_time.h" |
13 #include "base/lazy_instance.h" | 13 #include "base/lazy_instance.h" |
14 #include "base/metrics/histogram_macros.h" | 14 #include "base/metrics/histogram_macros.h" |
15 #include "base/strings/string_split.h" | 15 #include "base/strings/string_split.h" |
16 #include "base/strings/utf_string_conversions.h" | 16 #include "base/strings/utf_string_conversions.h" |
17 #include "base/time/time.h" | 17 #include "base/time/time.h" |
18 #include "build/build_config.h" | 18 #include "build/build_config.h" |
19 #include "components/network_time/network_time_tracker.h" | |
19 #include "components/ssl_errors/error_info.h" | 20 #include "components/ssl_errors/error_info.h" |
20 #include "components/url_formatter/url_formatter.h" | 21 #include "components/url_formatter/url_formatter.h" |
21 #include "net/base/network_change_notifier.h" | 22 #include "net/base/network_change_notifier.h" |
22 #include "net/base/registry_controlled_domains/registry_controlled_domain.h" | 23 #include "net/base/registry_controlled_domains/registry_controlled_domain.h" |
23 #include "net/base/url_util.h" | 24 #include "net/base/url_util.h" |
24 #include "net/cert/x509_cert_types.h" | 25 #include "net/cert/x509_cert_types.h" |
25 #include "net/cert/x509_certificate.h" | 26 #include "net/cert/x509_certificate.h" |
26 #include "url/gurl.h" | 27 #include "url/gurl.h" |
27 | 28 |
28 #if defined(OS_WIN) | 29 #if defined(OS_WIN) |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
112 return GetWWWSubDomainMatch(request_url, dns_names, &www_host); | 113 return GetWWWSubDomainMatch(request_url, dns_names, &www_host); |
113 } | 114 } |
114 | 115 |
115 // The time to use when doing build time operations in browser tests. | 116 // The time to use when doing build time operations in browser tests. |
116 base::LazyInstance<base::Time> g_testing_build_time = LAZY_INSTANCE_INITIALIZER; | 117 base::LazyInstance<base::Time> g_testing_build_time = LAZY_INSTANCE_INITIALIZER; |
117 | 118 |
118 } // namespace | 119 } // namespace |
119 | 120 |
120 void RecordUMAStatistics(bool overridable, | 121 void RecordUMAStatistics(bool overridable, |
121 const base::Time& current_time, | 122 const base::Time& current_time, |
123 const network_time::NetworkTimeTracker* network_time, | |
122 const GURL& request_url, | 124 const GURL& request_url, |
123 int cert_error, | 125 int cert_error, |
124 const net::X509Certificate& cert) { | 126 const net::X509Certificate& cert) { |
125 ssl_errors::ErrorInfo::ErrorType type = | 127 ssl_errors::ErrorInfo::ErrorType type = |
126 ssl_errors::ErrorInfo::NetErrorToErrorType(cert_error); | 128 ssl_errors::ErrorInfo::NetErrorToErrorType(cert_error); |
127 UMA_HISTOGRAM_ENUMERATION("interstitial.ssl_error_type", type, | 129 UMA_HISTOGRAM_ENUMERATION("interstitial.ssl_error_type", type, |
128 ssl_errors::ErrorInfo::END_OF_ENUM); | 130 ssl_errors::ErrorInfo::END_OF_ENUM); |
129 switch (type) { | 131 switch (type) { |
130 case ssl_errors::ErrorInfo::CERT_DATE_INVALID: { | 132 case ssl_errors::ErrorInfo::CERT_DATE_INVALID: { |
131 if (IsUserClockInThePast(base::Time::NowFromSystemTime())) { | 133 switch (GetClockState( |
132 RecordSSLInterstitialCause(overridable, CLOCK_PAST); | 134 current_time, network_time, |
133 } else if (IsUserClockInTheFuture(base::Time::NowFromSystemTime())) { | 135 false /* don't record statistics; that's already done */)) { |
134 RecordSSLInterstitialCause(overridable, CLOCK_FUTURE); | 136 case CLOCK_STATE_PAST: |
135 } else if (cert.HasExpired() && | 137 RecordSSLInterstitialCause(overridable, CLOCK_PAST); |
136 (current_time - cert.valid_expiry()).InDays() < 28) { | 138 break; |
137 RecordSSLInterstitialCause(overridable, EXPIRED_RECENTLY); | 139 case CLOCK_STATE_FUTURE: |
140 RecordSSLInterstitialCause(overridable, CLOCK_FUTURE); | |
141 break; | |
142 case CLOCK_STATE_UNKNOWN: | |
143 // Fall through, but, would it be better to break here? Not | |
144 // sure it makes sense to record |EXPIRED_RECENTLY| in this | |
145 // case. UNKNOWN means that network time is unavailable and | |
146 // that the system clock is within a 367-day bound around | |
147 // the build time. That's a lot of slop. | |
148 case CLOCK_STATE_OK: | |
149 if (cert.HasExpired() && | |
150 (current_time - cert.valid_expiry()).InDays() < 28) { | |
151 RecordSSLInterstitialCause(overridable, EXPIRED_RECENTLY); | |
152 } | |
153 break; | |
138 } | 154 } |
139 break; | |
140 } | 155 } |
141 case ssl_errors::ErrorInfo::CERT_COMMON_NAME_INVALID: { | 156 case ssl_errors::ErrorInfo::CERT_COMMON_NAME_INVALID: { |
142 std::string host_name = request_url.host(); | 157 std::string host_name = request_url.host(); |
143 if (IsHostNameKnownTLD(host_name)) { | 158 if (IsHostNameKnownTLD(host_name)) { |
144 HostnameTokens host_name_tokens = Tokenize(host_name); | 159 HostnameTokens host_name_tokens = Tokenize(host_name); |
145 if (IsWWWSubDomainMatch(request_url, cert)) | 160 if (IsWWWSubDomainMatch(request_url, cert)) |
146 RecordSSLInterstitialCause(overridable, WWW_SUBDOMAIN_MATCH); | 161 RecordSSLInterstitialCause(overridable, WWW_SUBDOMAIN_MATCH); |
147 if (IsSubDomainOutsideWildcard(request_url, cert)) | 162 if (IsSubDomainOutsideWildcard(request_url, cert)) |
148 RecordSSLInterstitialCause(overridable, SUBDOMAIN_OUTSIDE_WILDCARD); | 163 RecordSSLInterstitialCause(overridable, SUBDOMAIN_OUTSIDE_WILDCARD); |
149 std::vector<std::string> dns_names; | 164 std::vector<std::string> dns_names; |
(...skipping 24 matching lines...) Expand all Loading... | |
174 break; | 189 break; |
175 } | 190 } |
176 default: | 191 default: |
177 break; | 192 break; |
178 } | 193 } |
179 UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.connection_type", | 194 UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.connection_type", |
180 net::NetworkChangeNotifier::GetConnectionType(), | 195 net::NetworkChangeNotifier::GetConnectionType(), |
181 net::NetworkChangeNotifier::CONNECTION_LAST); | 196 net::NetworkChangeNotifier::CONNECTION_LAST); |
182 } | 197 } |
183 | 198 |
184 bool IsUserClockInThePast(const base::Time& time_now) { | 199 ClockState GetClockState( |
185 base::Time build_time; | 200 const base::Time& now_system, |
186 if (!g_testing_build_time.Get().is_null()) { | 201 const network_time::NetworkTimeTracker* network_time_tracker, |
187 build_time = g_testing_build_time.Get(); | 202 bool record_results) { |
188 } else { | 203 base::Time now_network; |
189 build_time = base::GetBuildTime(); | 204 base::TimeDelta uncertainty; |
205 const base::TimeDelta kNetworkTimeFudge = base::TimeDelta::FromMinutes(5); | |
206 ClockState network_state = CLOCK_STATE_UNKNOWN; | |
207 if (network_time_tracker->GetNetworkTime(&now_network, &uncertainty)) { | |
208 if (now_system < now_network - uncertainty - kNetworkTimeFudge) { | |
209 network_state = CLOCK_STATE_PAST; | |
210 } else if (now_system > now_network + uncertainty + kNetworkTimeFudge) { | |
211 network_state = CLOCK_STATE_FUTURE; | |
212 } else { | |
213 network_state = CLOCK_STATE_OK; | |
214 } | |
190 } | 215 } |
191 | 216 |
192 if (time_now < build_time - base::TimeDelta::FromDays(2)) | 217 ClockState build_time_state = CLOCK_STATE_UNKNOWN; |
193 return true; | 218 base::Time build_time = g_testing_build_time.Get().is_null() |
194 return false; | 219 ? base::GetBuildTime() |
195 } | 220 : g_testing_build_time.Get(); |
196 | 221 if (now_system < build_time - base::TimeDelta::FromDays(2)) { |
197 bool IsUserClockInTheFuture(const base::Time& time_now) { | 222 build_time_state = CLOCK_STATE_PAST; |
198 base::Time build_time; | 223 } else if (now_system > build_time + base::TimeDelta::FromDays(365)) { |
199 if (!g_testing_build_time.Get().is_null()) { | 224 build_time_state = CLOCK_STATE_FUTURE; |
200 build_time = g_testing_build_time.Get(); | |
201 } else { | |
202 build_time = base::GetBuildTime(); | |
203 } | 225 } |
204 | 226 |
205 if (time_now > build_time + base::TimeDelta::FromDays(365)) | 227 UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.clockstate.network", |
206 return true; | 228 network_state, CLOCK_STATE_FUTURE + 1); |
estark
2016/03/12 07:54:53
Normal style is to add a CLOCK_STATE_MAX value at
mab
2016/03/14 21:25:25
Done.
| |
207 return false; | 229 UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.clockstate.build_time", |
230 build_time_state, CLOCK_STATE_FUTURE + 1); | |
231 | |
232 return network_state == CLOCK_STATE_UNKNOWN ? build_time_state | |
233 : network_state; | |
208 } | 234 } |
209 | 235 |
210 void SetBuildTimeForTesting(const base::Time& testing_time) { | 236 void SetBuildTimeForTesting(const base::Time& testing_time) { |
211 g_testing_build_time.Get() = testing_time; | 237 g_testing_build_time.Get() = testing_time; |
212 } | 238 } |
213 | 239 |
214 bool IsHostNameKnownTLD(const std::string& host_name) { | 240 bool IsHostNameKnownTLD(const std::string& host_name) { |
215 size_t tld_length = net::registry_controlled_domains::GetRegistryLength( | 241 size_t tld_length = net::registry_controlled_domains::GetRegistryLength( |
216 host_name, net::registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES, | 242 host_name, net::registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES, |
217 net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES); | 243 net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES); |
(...skipping 194 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
412 return std::find(dns_names_domain.begin(), dns_names_domain.end() - 1, | 438 return std::find(dns_names_domain.begin(), dns_names_domain.end() - 1, |
413 host_name_domain) != dns_names_domain.end() - 1; | 439 host_name_domain) != dns_names_domain.end() - 1; |
414 } | 440 } |
415 | 441 |
416 bool IsHostnameNonUniqueOrDotless(const std::string& hostname) { | 442 bool IsHostnameNonUniqueOrDotless(const std::string& hostname) { |
417 return net::IsHostnameNonUnique(hostname) || | 443 return net::IsHostnameNonUnique(hostname) || |
418 hostname.find('.') == std::string::npos; | 444 hostname.find('.') == std::string::npos; |
419 } | 445 } |
420 | 446 |
421 } // namespace ssl_errors | 447 } // namespace ssl_errors |
OLD | NEW |