| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/security_state/security_state_model.h" | 5 #include "components/security_state/security_state_model.h" |
| 6 | 6 |
| 7 #include <stdint.h> | 7 #include <stdint.h> |
| 8 | 8 |
| 9 #include "base/command_line.h" | 9 #include "base/command_line.h" |
| 10 #include "base/metrics/field_trial.h" | 10 #include "base/metrics/field_trial.h" |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 65 static const int64_t kJanuary2017 = INT64_C(13127702400000000); | 65 static const int64_t kJanuary2017 = INT64_C(13127702400000000); |
| 66 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017)) | 66 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017)) |
| 67 return SecurityStateModel::DEPRECATED_SHA1_MAJOR; | 67 return SecurityStateModel::DEPRECATED_SHA1_MAJOR; |
| 68 static const int64_t kJanuary2016 = INT64_C(13096080000000000); | 68 static const int64_t kJanuary2016 = INT64_C(13096080000000000); |
| 69 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016)) | 69 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016)) |
| 70 return SecurityStateModel::DEPRECATED_SHA1_MINOR; | 70 return SecurityStateModel::DEPRECATED_SHA1_MINOR; |
| 71 | 71 |
| 72 return SecurityStateModel::NO_DEPRECATED_SHA1; | 72 return SecurityStateModel::NO_DEPRECATED_SHA1; |
| 73 } | 73 } |
| 74 | 74 |
| 75 SecurityStateModel::MixedContentStatus GetMixedContentStatus( | 75 SecurityStateModel::ContentStatus GetMixedContentStatus( |
| 76 const SecurityStateModel::VisibleSecurityState& visible_security_state) { | 76 const SecurityStateModel::VisibleSecurityState& visible_security_state) { |
| 77 bool ran_insecure_content = visible_security_state.ran_mixed_content; | 77 bool ran_insecure_content = visible_security_state.ran_mixed_content; |
| 78 bool displayed_insecure_content = | 78 bool displayed_insecure_content = |
| 79 visible_security_state.displayed_mixed_content; | 79 visible_security_state.displayed_mixed_content; |
| 80 if (ran_insecure_content && displayed_insecure_content) | 80 if (ran_insecure_content && displayed_insecure_content) |
| 81 return SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT; | 81 return SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN; |
| 82 if (ran_insecure_content) | 82 if (ran_insecure_content) |
| 83 return SecurityStateModel::RAN_MIXED_CONTENT; | 83 return SecurityStateModel::CONTENT_STATUS_RAN; |
| 84 if (displayed_insecure_content) | 84 if (displayed_insecure_content) |
| 85 return SecurityStateModel::DISPLAYED_MIXED_CONTENT; | 85 return SecurityStateModel::CONTENT_STATUS_DISPLAYED; |
| 86 | 86 |
| 87 return SecurityStateModel::NO_MIXED_CONTENT; | 87 return SecurityStateModel::CONTENT_STATUS_NONE; |
| 88 } | 88 } |
| 89 | 89 |
| 90 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest( | 90 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest( |
| 91 const SecurityStateModel::VisibleSecurityState& visible_security_state, | 91 const SecurityStateModel::VisibleSecurityState& visible_security_state, |
| 92 SecurityStateModelClient* client, | 92 SecurityStateModelClient* client, |
| 93 const scoped_refptr<net::X509Certificate>& cert, | 93 const scoped_refptr<net::X509Certificate>& cert, |
| 94 SecurityStateModel::SHA1DeprecationStatus sha1_status, | 94 SecurityStateModel::SHA1DeprecationStatus sha1_status, |
| 95 SecurityStateModel::MixedContentStatus mixed_content_status) { | 95 SecurityStateModel::ContentStatus mixed_content_status) { |
| 96 DCHECK(visible_security_state.initialized); | 96 DCHECK(visible_security_state.initialized); |
| 97 GURL url = visible_security_state.url; | 97 GURL url = visible_security_state.url; |
| 98 switch (visible_security_state.initial_security_level) { | 98 switch (visible_security_state.initial_security_level) { |
| 99 case SecurityStateModel::NONE: { | 99 case SecurityStateModel::NONE: { |
| 100 if (!client->IsOriginSecure(url) && url.IsStandard()) | 100 if (!client->IsOriginSecure(url) && url.IsStandard()) |
| 101 return GetSecurityLevelForNonSecureFieldTrial(); | 101 return GetSecurityLevelForNonSecureFieldTrial(); |
| 102 return SecurityStateModel::NONE; | 102 return SecurityStateModel::NONE; |
| 103 } | 103 } |
| 104 | 104 |
| 105 case SecurityStateModel::SECURITY_ERROR: | 105 case SecurityStateModel::SECURITY_ERROR: |
| 106 return SecurityStateModel::SECURITY_ERROR; | 106 return SecurityStateModel::SECURITY_ERROR; |
| 107 | 107 |
| 108 case SecurityStateModel::SECURITY_WARNING: | 108 case SecurityStateModel::SECURITY_WARNING: |
| 109 case SecurityStateModel::SECURITY_POLICY_WARNING: | 109 case SecurityStateModel::SECURITY_POLICY_WARNING: |
| 110 return visible_security_state.initial_security_level; | 110 return visible_security_state.initial_security_level; |
| 111 | 111 |
| 112 case SecurityStateModel::SECURE: | 112 case SecurityStateModel::SECURE: |
| 113 case SecurityStateModel::EV_SECURE: { | 113 case SecurityStateModel::EV_SECURE: { |
| 114 // Major cert errors and active mixed content will generally be | 114 // Major cert errors and active mixed content will generally be |
| 115 // downgraded by the embedder to SECURITY_ERROR and handled above, | 115 // downgraded by the embedder to SECURITY_ERROR and handled above, |
| 116 // but downgrade here just in case. | 116 // but downgrade here just in case. |
| 117 net::CertStatus cert_status = visible_security_state.cert_status; | 117 net::CertStatus cert_status = visible_security_state.cert_status; |
| 118 if (net::IsCertStatusError(cert_status) && | 118 if (net::IsCertStatusError(cert_status) && |
| 119 !net::IsCertStatusMinorError(cert_status)) { | 119 !net::IsCertStatusMinorError(cert_status)) { |
| 120 return SecurityStateModel::SECURITY_ERROR; | 120 return SecurityStateModel::SECURITY_ERROR; |
| 121 } | 121 } |
| 122 if (mixed_content_status == SecurityStateModel::RAN_MIXED_CONTENT || | 122 if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_RAN || |
| 123 mixed_content_status == | 123 mixed_content_status == |
| 124 SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT) { | 124 SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN) { |
| 125 return SecurityStateModel::kRanInsecureContentLevel; | 125 return SecurityStateModel::kRanInsecureContentLevel; |
| 126 } | 126 } |
| 127 | 127 |
| 128 // Report if there is a policy cert first, before reporting any other | 128 // Report if there is a policy cert first, before reporting any other |
| 129 // authenticated-but-with-errors cases. A policy cert is a strong | 129 // authenticated-but-with-errors cases. A policy cert is a strong |
| 130 // indicator of a MITM being present (the enterprise), while the | 130 // indicator of a MITM being present (the enterprise), while the |
| 131 // other authenticated-but-with-errors indicate something may | 131 // other authenticated-but-with-errors indicate something may |
| 132 // be wrong, or may be wrong in the future, but is unclear now. | 132 // be wrong, or may be wrong in the future, but is unclear now. |
| 133 if (client->UsedPolicyInstalledCertificate()) | 133 if (client->UsedPolicyInstalledCertificate()) |
| 134 return SecurityStateModel::SECURITY_POLICY_WARNING; | 134 return SecurityStateModel::SECURITY_POLICY_WARNING; |
| 135 | 135 |
| 136 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR) | 136 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR) |
| 137 return SecurityStateModel::SECURITY_ERROR; | 137 return SecurityStateModel::SECURITY_ERROR; |
| 138 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR) | 138 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR) |
| 139 return SecurityStateModel::NONE; | 139 return SecurityStateModel::NONE; |
| 140 | 140 |
| 141 // Active mixed content is handled above. | 141 // Active mixed content is handled above. |
| 142 DCHECK_NE(SecurityStateModel::RAN_MIXED_CONTENT, mixed_content_status); | 142 DCHECK_NE(SecurityStateModel::CONTENT_STATUS_RAN, mixed_content_status); |
| 143 DCHECK_NE(SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT, | 143 DCHECK_NE(SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN, |
| 144 mixed_content_status); | 144 mixed_content_status); |
| 145 if (mixed_content_status == SecurityStateModel::DISPLAYED_MIXED_CONTENT) | 145 if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_DISPLAYED) |
| 146 return SecurityStateModel::kDisplayedInsecureContentLevel; | 146 return SecurityStateModel::kDisplayedInsecureContentLevel; |
| 147 | 147 |
| 148 if (net::IsCertStatusError(cert_status)) { | 148 if (net::IsCertStatusError(cert_status)) { |
| 149 // Major cert errors are handled above. | 149 // Major cert errors are handled above. |
| 150 DCHECK(net::IsCertStatusMinorError(cert_status)); | 150 DCHECK(net::IsCertStatusMinorError(cert_status)); |
| 151 return SecurityStateModel::NONE; | 151 return SecurityStateModel::NONE; |
| 152 } | 152 } |
| 153 if (net::SSLConnectionStatusToVersion( | 153 if (net::SSLConnectionStatusToVersion( |
| 154 visible_security_state.connection_status) == | 154 visible_security_state.connection_status) == |
| 155 net::SSL_CONNECTION_VERSION_SSL3) { | 155 net::SSL_CONNECTION_VERSION_SSL3) { |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 205 const SecurityStateModel::SecurityLevel | 205 const SecurityStateModel::SecurityLevel |
| 206 SecurityStateModel::kDisplayedInsecureContentLevel = | 206 SecurityStateModel::kDisplayedInsecureContentLevel = |
| 207 SecurityStateModel::NONE; | 207 SecurityStateModel::NONE; |
| 208 const SecurityStateModel::SecurityLevel | 208 const SecurityStateModel::SecurityLevel |
| 209 SecurityStateModel::kRanInsecureContentLevel = | 209 SecurityStateModel::kRanInsecureContentLevel = |
| 210 SecurityStateModel::SECURITY_ERROR; | 210 SecurityStateModel::SECURITY_ERROR; |
| 211 | 211 |
| 212 SecurityStateModel::SecurityInfo::SecurityInfo() | 212 SecurityStateModel::SecurityInfo::SecurityInfo() |
| 213 : security_level(SecurityStateModel::NONE), | 213 : security_level(SecurityStateModel::NONE), |
| 214 sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1), | 214 sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1), |
| 215 mixed_content_status(SecurityStateModel::NO_MIXED_CONTENT), | 215 mixed_content_status(SecurityStateModel::CONTENT_STATUS_NONE), |
| 216 scheme_is_cryptographic(false), | 216 scheme_is_cryptographic(false), |
| 217 cert_status(0), | 217 cert_status(0), |
| 218 cert_id(0), | 218 cert_id(0), |
| 219 security_bits(-1), | 219 security_bits(-1), |
| 220 connection_status(0), | 220 connection_status(0), |
| 221 is_secure_protocol_and_ciphersuite(false), | 221 is_secure_protocol_and_ciphersuite(false), |
| 222 pkp_bypassed(false) {} | 222 pkp_bypassed(false) {} |
| 223 | 223 |
| 224 SecurityStateModel::SecurityInfo::~SecurityInfo() {} | 224 SecurityStateModel::SecurityInfo::~SecurityInfo() {} |
| 225 | 225 |
| (...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 277 cert_id == other.cert_id && cert_status == other.cert_status && | 277 cert_id == other.cert_id && cert_status == other.cert_status && |
| 278 connection_status == other.connection_status && | 278 connection_status == other.connection_status && |
| 279 security_bits == other.security_bits && | 279 security_bits == other.security_bits && |
| 280 sct_verify_statuses == other.sct_verify_statuses && | 280 sct_verify_statuses == other.sct_verify_statuses && |
| 281 displayed_mixed_content == other.displayed_mixed_content && | 281 displayed_mixed_content == other.displayed_mixed_content && |
| 282 ran_mixed_content == other.ran_mixed_content && | 282 ran_mixed_content == other.ran_mixed_content && |
| 283 pkp_bypassed == other.pkp_bypassed); | 283 pkp_bypassed == other.pkp_bypassed); |
| 284 } | 284 } |
| 285 | 285 |
| 286 } // namespace security_state | 286 } // namespace security_state |
| OLD | NEW |