Add a deprecation warning for DHE.

chrome/renderer/chrome_render_frame_observer.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_render_frame_observer.h"
 
 #include <stddef.h>
+#include <string.h>
 
 #include <limits>
 #include <string>
 #include <vector>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "chrome/common/chrome_isolated_world_ids.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/crash_keys.h"
 #include "chrome/common/prerender_messages.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/renderer/prerender/prerender_helper.h"
 #include "chrome/renderer/safe_browsing/phishing_classifier_delegate.h"
 #include "components/translate/content/renderer/translate_helper.h"
 #include "content/public/common/ssl_status.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_view.h"
 #include "extensions/common/constants.h"
 #include "net/base/url_util.h"
+#include "net/ssl/ssl_cipher_suite_names.h"
+#include "net/ssl/ssl_connection_status_flags.h"
 #include "skia/ext/image_operations.h"
 #include "third_party/WebKit/public/platform/WebImage.h"
 #include "third_party/WebKit/public/platform/modules/app_banner/WebAppBannerPromptReply.h"
 #include "third_party/WebKit/public/web/WebDataSource.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebElement.h"
 #include "third_party/WebKit/public/web/WebFrameContentDumper.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebNode.h"
 #include "third_party/WebKit/public/web/WebSecurityPolicy.h"
@@ skipping 199 matching lines @@
 
 void ChromeRenderFrameObserver::DidFinishDocumentLoad() {
   // If the navigation is to a localhost URL (and the flag is set to
   // allow localhost SSL misconfigurations), print a warning to the
   // console telling the developer to check their SSL configuration
   // before going to production.
   bool allow_localhost = base::CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kAllowInsecureLocalhost);
   WebDataSource* ds = render_frame()->GetWebFrame()->dataSource();
 
+  SSLStatus ssl_status = render_frame()->GetRenderView()->GetSSLStatusOfFrame(
+      render_frame()->GetWebFrame());
+
   if (allow_localhost) {
-    SSLStatus ssl_status = render_frame()->GetRenderView()->GetSSLStatusOfFrame(
-        render_frame()->GetWebFrame());
     bool is_cert_error = net::IsCertStatusError(ssl_status.cert_status) &&
                          !net::IsCertStatusMinorError(ssl_status.cert_status);
     bool is_localhost = net::IsLocalhost(GURL(ds->request().url()).host());
 
     if (is_cert_error && is_localhost) {
       render_frame()->GetWebFrame()->addMessageToConsole(
           blink::WebConsoleMessage(
               blink::WebConsoleMessage::LevelWarning,
               base::ASCIIToUTF16(
                   "This site does not have a valid SSL "
                   "certificate! Without SSL, your site's and "
                   "visitors' data is vulnerable to theft and "
                   "tampering. Get a valid SSL certificate before"
                   " releasing your website to the public.")));
     }
   }
+
+  // DHE is deprecated and will be removed in M52. See https://crbug.com/598109.
+  // TODO(davidben): Remove this logic when DHE is removed.
+  uint16_t cipher_suite =
+      net::SSLConnectionStatusToCipherSuite(ssl_status.connection_status);
+  const char* key_exchange;
+  const char* unused;
+  bool is_aead_unused;
+  net::SSLCipherSuiteToStrings(&key_exchange, &unused, &unused, &is_aead_unused,
+                               cipher_suite);
+  if (strcmp(key_exchange, "DHE_RSA") == 0) {
+    render_frame()->GetWebFrame()->addMessageToConsole(blink::WebConsoleMessage(
+        blink::WebConsoleMessage::LevelWarning,
+        base::ASCIIToUTF16("This site requires a DHE-based SSL cipher suite. "
+                           "These are deprecated and will be removed in M52, "
+                           "around July 2016. See "
+                           "https://www.chromestatus.com/feature/"
+                           "5752033759985664 for more details.")));
+  }
 }
 
 void ChromeRenderFrameObserver::OnAppBannerPromptRequest(
     int request_id,
     const std::string& platform) {
   // App banner prompt requests are handled in the general chrome render frame
   // observer, not the AppBannerClient, as the AppBannerClient is created lazily
   // by blink and may not exist when the request is sent.
   blink::WebAppBannerPromptReply reply = blink::WebAppBannerPromptReply::None;
   blink::WebString web_platform(base::UTF8ToUTF16(platform));
@@ skipping 109 matching lines @@
     case blink::WebMeaningfulLayout::FinishedParsing:
       CapturePageText(PRELIMINARY_CAPTURE);
       break;
     case blink::WebMeaningfulLayout::FinishedLoading:
       CapturePageText(FINAL_CAPTURE);
       break;
     default:
       break;
   }
 }