OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/security_state/security_state_model.h" | 5 #include "components/security_state/security_state_model.h" |
6 | 6 |
7 #include <stdint.h> | 7 #include <stdint.h> |
8 | 8 |
9 #include "base/command_line.h" | 9 #include "base/command_line.h" |
10 #include "base/metrics/field_trial.h" | 10 #include "base/metrics/field_trial.h" |
(...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
65 static const int64_t kJanuary2017 = INT64_C(13127702400000000); | 65 static const int64_t kJanuary2017 = INT64_C(13127702400000000); |
66 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017)) | 66 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017)) |
67 return SecurityStateModel::DEPRECATED_SHA1_MAJOR; | 67 return SecurityStateModel::DEPRECATED_SHA1_MAJOR; |
68 static const int64_t kJanuary2016 = INT64_C(13096080000000000); | 68 static const int64_t kJanuary2016 = INT64_C(13096080000000000); |
69 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016)) | 69 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016)) |
70 return SecurityStateModel::DEPRECATED_SHA1_MINOR; | 70 return SecurityStateModel::DEPRECATED_SHA1_MINOR; |
71 | 71 |
72 return SecurityStateModel::NO_DEPRECATED_SHA1; | 72 return SecurityStateModel::NO_DEPRECATED_SHA1; |
73 } | 73 } |
74 | 74 |
75 SecurityStateModel::MixedContentStatus GetMixedContentStatus( | 75 SecurityStateModel::ContentStatus GetMixedContentStatus( |
76 const SecurityStateModel::VisibleSecurityState& visible_security_state) { | 76 const SecurityStateModel::VisibleSecurityState& visible_security_state) { |
77 bool ran_insecure_content = visible_security_state.ran_mixed_content; | 77 bool ran_insecure_content = visible_security_state.ran_mixed_content; |
78 bool displayed_insecure_content = | 78 bool displayed_insecure_content = |
79 visible_security_state.displayed_mixed_content; | 79 visible_security_state.displayed_mixed_content; |
80 if (ran_insecure_content && displayed_insecure_content) | 80 if (ran_insecure_content && displayed_insecure_content) |
81 return SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT; | 81 return SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN; |
82 if (ran_insecure_content) | 82 if (ran_insecure_content) |
83 return SecurityStateModel::RAN_MIXED_CONTENT; | 83 return SecurityStateModel::CONTENT_STATUS_RAN; |
84 if (displayed_insecure_content) | 84 if (displayed_insecure_content) |
85 return SecurityStateModel::DISPLAYED_MIXED_CONTENT; | 85 return SecurityStateModel::CONTENT_STATUS_DISPLAYED; |
86 | 86 |
87 return SecurityStateModel::NO_MIXED_CONTENT; | 87 return SecurityStateModel::CONTENT_STATUS_NONE; |
88 } | 88 } |
89 | 89 |
90 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest( | 90 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest( |
91 const SecurityStateModel::VisibleSecurityState& visible_security_state, | 91 const SecurityStateModel::VisibleSecurityState& visible_security_state, |
92 SecurityStateModelClient* client, | 92 SecurityStateModelClient* client, |
93 const scoped_refptr<net::X509Certificate>& cert, | 93 const scoped_refptr<net::X509Certificate>& cert, |
94 SecurityStateModel::SHA1DeprecationStatus sha1_status, | 94 SecurityStateModel::SHA1DeprecationStatus sha1_status, |
95 SecurityStateModel::MixedContentStatus mixed_content_status) { | 95 SecurityStateModel::ContentStatus mixed_content_status) { |
96 DCHECK(visible_security_state.initialized); | 96 DCHECK(visible_security_state.initialized); |
97 GURL url = visible_security_state.url; | 97 GURL url = visible_security_state.url; |
98 switch (visible_security_state.initial_security_level) { | 98 switch (visible_security_state.initial_security_level) { |
99 case SecurityStateModel::NONE: { | 99 case SecurityStateModel::NONE: { |
100 if (!client->IsOriginSecure(url) && url.IsStandard()) | 100 if (!client->IsOriginSecure(url) && url.IsStandard()) |
101 return GetSecurityLevelForNonSecureFieldTrial(); | 101 return GetSecurityLevelForNonSecureFieldTrial(); |
102 return SecurityStateModel::NONE; | 102 return SecurityStateModel::NONE; |
103 } | 103 } |
104 | 104 |
105 case SecurityStateModel::SECURITY_ERROR: | 105 case SecurityStateModel::SECURITY_ERROR: |
106 return SecurityStateModel::SECURITY_ERROR; | 106 return SecurityStateModel::SECURITY_ERROR; |
107 | 107 |
108 case SecurityStateModel::SECURITY_WARNING: | 108 case SecurityStateModel::SECURITY_WARNING: |
109 case SecurityStateModel::SECURITY_POLICY_WARNING: | 109 case SecurityStateModel::SECURITY_POLICY_WARNING: |
110 return visible_security_state.initial_security_level; | 110 return visible_security_state.initial_security_level; |
111 | 111 |
112 case SecurityStateModel::SECURE: | 112 case SecurityStateModel::SECURE: |
113 case SecurityStateModel::EV_SECURE: { | 113 case SecurityStateModel::EV_SECURE: { |
114 // Major cert errors and active mixed content will generally be | 114 // Major cert errors and active mixed content will generally be |
115 // downgraded by the embedder to SECURITY_ERROR and handled above, | 115 // downgraded by the embedder to SECURITY_ERROR and handled above, |
116 // but downgrade here just in case. | 116 // but downgrade here just in case. |
117 net::CertStatus cert_status = visible_security_state.cert_status; | 117 net::CertStatus cert_status = visible_security_state.cert_status; |
118 if (net::IsCertStatusError(cert_status) && | 118 if (net::IsCertStatusError(cert_status) && |
119 !net::IsCertStatusMinorError(cert_status)) { | 119 !net::IsCertStatusMinorError(cert_status)) { |
120 return SecurityStateModel::SECURITY_ERROR; | 120 return SecurityStateModel::SECURITY_ERROR; |
121 } | 121 } |
122 if (mixed_content_status == SecurityStateModel::RAN_MIXED_CONTENT || | 122 if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_RAN || |
123 mixed_content_status == | 123 mixed_content_status == |
124 SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT) { | 124 SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN) { |
125 return SecurityStateModel::kRanInsecureContentLevel; | 125 return SecurityStateModel::kRanInsecureContentLevel; |
126 } | 126 } |
127 | 127 |
128 // Report if there is a policy cert first, before reporting any other | 128 // Report if there is a policy cert first, before reporting any other |
129 // authenticated-but-with-errors cases. A policy cert is a strong | 129 // authenticated-but-with-errors cases. A policy cert is a strong |
130 // indicator of a MITM being present (the enterprise), while the | 130 // indicator of a MITM being present (the enterprise), while the |
131 // other authenticated-but-with-errors indicate something may | 131 // other authenticated-but-with-errors indicate something may |
132 // be wrong, or may be wrong in the future, but is unclear now. | 132 // be wrong, or may be wrong in the future, but is unclear now. |
133 if (client->UsedPolicyInstalledCertificate()) | 133 if (client->UsedPolicyInstalledCertificate()) |
134 return SecurityStateModel::SECURITY_POLICY_WARNING; | 134 return SecurityStateModel::SECURITY_POLICY_WARNING; |
135 | 135 |
136 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR) | 136 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR) |
137 return SecurityStateModel::SECURITY_ERROR; | 137 return SecurityStateModel::SECURITY_ERROR; |
138 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR) | 138 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR) |
139 return SecurityStateModel::NONE; | 139 return SecurityStateModel::NONE; |
140 | 140 |
141 // Active mixed content is handled above. | 141 // Active mixed content is handled above. |
142 DCHECK_NE(SecurityStateModel::RAN_MIXED_CONTENT, mixed_content_status); | 142 DCHECK_NE(SecurityStateModel::CONTENT_STATUS_RAN, mixed_content_status); |
143 DCHECK_NE(SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT, | 143 DCHECK_NE(SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN, |
144 mixed_content_status); | 144 mixed_content_status); |
145 if (mixed_content_status == SecurityStateModel::DISPLAYED_MIXED_CONTENT) | 145 if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_DISPLAYED) |
146 return SecurityStateModel::kDisplayedInsecureContentLevel; | 146 return SecurityStateModel::kDisplayedInsecureContentLevel; |
147 | 147 |
148 if (net::IsCertStatusError(cert_status)) { | 148 if (net::IsCertStatusError(cert_status)) { |
149 // Major cert errors are handled above. | 149 // Major cert errors are handled above. |
150 DCHECK(net::IsCertStatusMinorError(cert_status)); | 150 DCHECK(net::IsCertStatusMinorError(cert_status)); |
151 return SecurityStateModel::NONE; | 151 return SecurityStateModel::NONE; |
152 } | 152 } |
153 if (net::SSLConnectionStatusToVersion( | 153 if (net::SSLConnectionStatusToVersion( |
154 visible_security_state.connection_status) == | 154 visible_security_state.connection_status) == |
155 net::SSL_CONNECTION_VERSION_SSL3) { | 155 net::SSL_CONNECTION_VERSION_SSL3) { |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
205 const SecurityStateModel::SecurityLevel | 205 const SecurityStateModel::SecurityLevel |
206 SecurityStateModel::kDisplayedInsecureContentLevel = | 206 SecurityStateModel::kDisplayedInsecureContentLevel = |
207 SecurityStateModel::NONE; | 207 SecurityStateModel::NONE; |
208 const SecurityStateModel::SecurityLevel | 208 const SecurityStateModel::SecurityLevel |
209 SecurityStateModel::kRanInsecureContentLevel = | 209 SecurityStateModel::kRanInsecureContentLevel = |
210 SecurityStateModel::SECURITY_ERROR; | 210 SecurityStateModel::SECURITY_ERROR; |
211 | 211 |
212 SecurityStateModel::SecurityInfo::SecurityInfo() | 212 SecurityStateModel::SecurityInfo::SecurityInfo() |
213 : security_level(SecurityStateModel::NONE), | 213 : security_level(SecurityStateModel::NONE), |
214 sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1), | 214 sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1), |
215 mixed_content_status(SecurityStateModel::NO_MIXED_CONTENT), | 215 mixed_content_status(SecurityStateModel::CONTENT_STATUS_NONE), |
216 scheme_is_cryptographic(false), | 216 scheme_is_cryptographic(false), |
217 cert_status(0), | 217 cert_status(0), |
218 cert_id(0), | 218 cert_id(0), |
219 security_bits(-1), | 219 security_bits(-1), |
220 connection_status(0), | 220 connection_status(0), |
221 is_secure_protocol_and_ciphersuite(false), | 221 is_secure_protocol_and_ciphersuite(false), |
222 pkp_bypassed(false) {} | 222 pkp_bypassed(false) {} |
223 | 223 |
224 SecurityStateModel::SecurityInfo::~SecurityInfo() {} | 224 SecurityStateModel::SecurityInfo::~SecurityInfo() {} |
225 | 225 |
(...skipping 51 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
277 cert_id == other.cert_id && cert_status == other.cert_status && | 277 cert_id == other.cert_id && cert_status == other.cert_status && |
278 connection_status == other.connection_status && | 278 connection_status == other.connection_status && |
279 security_bits == other.security_bits && | 279 security_bits == other.security_bits && |
280 sct_verify_statuses == other.sct_verify_statuses && | 280 sct_verify_statuses == other.sct_verify_statuses && |
281 displayed_mixed_content == other.displayed_mixed_content && | 281 displayed_mixed_content == other.displayed_mixed_content && |
282 ran_mixed_content == other.ran_mixed_content && | 282 ran_mixed_content == other.ran_mixed_content && |
283 pkp_bypassed == other.pkp_bypassed); | 283 pkp_bypassed == other.pkp_bypassed); |
284 } | 284 } |
285 | 285 |
286 } // namespace security_state | 286 } // namespace security_state |
OLD | NEW |