Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(142)

Side by Side Diff: net/cert/cert_verify_proc.cc

Issue 21572002: Add UMA entry for intranet SSL warnings (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Needed to move the unit tests as well Created 7 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/cert/cert_verify_proc.h" 5 #include "net/cert/cert_verify_proc.h"
6 6
7 #include "base/metrics/histogram.h" 7 #include "base/metrics/histogram.h"
8 #include "base/sha1.h" 8 #include "base/sha1.h"
9 #include "build/build_config.h" 9 #include "build/build_config.h"
10 #include "net/base/net_errors.h" 10 #include "net/base/net_errors.h"
11 #include "net/base/net_util.h" 11 #include "net/base/net_util.h"
12 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
13 #include "net/cert/cert_status_flags.h" 12 #include "net/cert/cert_status_flags.h"
14 #include "net/cert/cert_verifier.h" 13 #include "net/cert/cert_verifier.h"
15 #include "net/cert/cert_verify_result.h" 14 #include "net/cert/cert_verify_result.h"
16 #include "net/cert/crl_set.h" 15 #include "net/cert/crl_set.h"
17 #include "net/cert/x509_certificate.h" 16 #include "net/cert/x509_certificate.h"
18 #include "url/url_canon.h"
19 17
20 #if defined(USE_NSS) || defined(OS_IOS) 18 #if defined(USE_NSS) || defined(OS_IOS)
21 #include "net/cert/cert_verify_proc_nss.h" 19 #include "net/cert/cert_verify_proc_nss.h"
22 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID) 20 #elif defined(USE_OPENSSL) && !defined(OS_ANDROID)
23 #include "net/cert/cert_verify_proc_openssl.h" 21 #include "net/cert/cert_verify_proc_openssl.h"
24 #elif defined(OS_ANDROID) 22 #elif defined(OS_ANDROID)
25 #include "net/cert/cert_verify_proc_android.h" 23 #include "net/cert/cert_verify_proc_android.h"
26 #elif defined(OS_MACOSX) 24 #elif defined(OS_MACOSX)
27 #include "net/cert/cert_verify_proc_mac.h" 25 #include "net/cert/cert_verify_proc_mac.h"
28 #elif defined(OS_WIN) 26 #elif defined(OS_WIN)
(...skipping 261 matching lines...) Expand 10 before | Expand all | Expand 10 after
290 if (j->tag == HASH_VALUE_SHA1 && 288 if (j->tag == HASH_VALUE_SHA1 &&
291 memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) { 289 memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) {
292 return true; 290 return true;
293 } 291 }
294 } 292 }
295 } 293 }
296 294
297 return false; 295 return false;
298 } 296 }
299 297
300 // static
301 bool CertVerifyProc::IsHostnameNonUnique(const std::string& hostname) {
302 // CanonicalizeHost requires surrounding brackets to parse an IPv6 address.
303 const std::string host_or_ip = hostname.find(':') != std::string::npos ?
304 "[" + hostname + "]" : hostname;
305 url_canon::CanonHostInfo host_info;
306 std::string canonical_name = CanonicalizeHost(host_or_ip, &host_info);
307
308 // If canonicalization fails, then the input is truly malformed. However,
309 // to avoid mis-reporting bad inputs as "non-unique", treat them as unique.
310 if (canonical_name.empty())
311 return false;
312
313 // If |hostname| is an IP address, presume it's unique.
314 // TODO(rsleevi): In the future, this should also reject IP addresses in
315 // IANA-reserved ranges, since those are also non-unique among publicly
316 // trusted CAs.
317 if (host_info.IsIPAddress())
318 return false;
319
320 // Check for a registry controlled portion of |hostname|, ignoring private
321 // registries, as they already chain to ICANN-administered registries,
322 // and explicitly ignoring unknown registries.
323 //
324 // Note: This means that as new gTLDs are introduced on the Internet, they
325 // will be treated as non-unique until the registry controlled domain list
326 // is updated. However, because gTLDs are expected to provide significant
327 // advance notice to deprecate older versions of this code, this an
328 // acceptable tradeoff.
329 return 0 == registry_controlled_domains::GetRegistryLength(
330 canonical_name,
331 registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES,
332 registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES);
333 }
334
335 } // namespace net 298 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698