OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "components/security_state/security_state_model.h" | 5 #include "components/security_state/security_state_model.h" |
6 | 6 |
7 #include <stdint.h> | 7 #include <stdint.h> |
8 | 8 |
9 #include "base/command_line.h" | 9 #include "base/command_line.h" |
10 #include "base/metrics/field_trial.h" | 10 #include "base/metrics/field_trial.h" |
(...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
65 static const int64_t kJanuary2017 = INT64_C(13127702400000000); | 65 static const int64_t kJanuary2017 = INT64_C(13127702400000000); |
66 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017)) | 66 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2017)) |
67 return SecurityStateModel::DEPRECATED_SHA1_MAJOR; | 67 return SecurityStateModel::DEPRECATED_SHA1_MAJOR; |
68 static const int64_t kJanuary2016 = INT64_C(13096080000000000); | 68 static const int64_t kJanuary2016 = INT64_C(13096080000000000); |
69 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016)) | 69 if (cert->valid_expiry() >= base::Time::FromInternalValue(kJanuary2016)) |
70 return SecurityStateModel::DEPRECATED_SHA1_MINOR; | 70 return SecurityStateModel::DEPRECATED_SHA1_MINOR; |
71 | 71 |
72 return SecurityStateModel::NO_DEPRECATED_SHA1; | 72 return SecurityStateModel::NO_DEPRECATED_SHA1; |
73 } | 73 } |
74 | 74 |
75 SecurityStateModel::MixedContentStatus GetMixedContentStatus( | 75 SecurityStateModel::ContentStatus GetMixedContentStatus( |
76 const SecurityStateModel::VisibleSecurityState& visible_security_state) { | 76 const SecurityStateModel::VisibleSecurityState& visible_security_state) { |
77 bool ran_insecure_content = visible_security_state.ran_mixed_content; | 77 bool ran_insecure_content = visible_security_state.ran_mixed_content; |
78 bool displayed_insecure_content = | 78 bool displayed_insecure_content = |
79 visible_security_state.displayed_mixed_content; | 79 visible_security_state.displayed_mixed_content; |
80 if (ran_insecure_content && displayed_insecure_content) | 80 if (ran_insecure_content && displayed_insecure_content) |
81 return SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT; | 81 return SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN; |
82 if (ran_insecure_content) | 82 if (ran_insecure_content) |
83 return SecurityStateModel::RAN_MIXED_CONTENT; | 83 return SecurityStateModel::CONTENT_STATUS_RAN; |
84 if (displayed_insecure_content) | 84 if (displayed_insecure_content) |
85 return SecurityStateModel::DISPLAYED_MIXED_CONTENT; | 85 return SecurityStateModel::CONTENT_STATUS_DISPLAYED; |
86 | 86 |
87 return SecurityStateModel::NO_MIXED_CONTENT; | 87 return SecurityStateModel::CONTENT_STATUS_NONE; |
88 } | 88 } |
89 | 89 |
90 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest( | 90 SecurityStateModel::SecurityLevel GetSecurityLevelForRequest( |
91 const SecurityStateModel::VisibleSecurityState& visible_security_state, | 91 const SecurityStateModel::VisibleSecurityState& visible_security_state, |
92 SecurityStateModelClient* client, | 92 SecurityStateModelClient* client, |
93 const scoped_refptr<net::X509Certificate>& cert, | 93 const scoped_refptr<net::X509Certificate>& cert, |
94 SecurityStateModel::SHA1DeprecationStatus sha1_status, | 94 SecurityStateModel::SHA1DeprecationStatus sha1_status, |
95 SecurityStateModel::MixedContentStatus mixed_content_status) { | 95 SecurityStateModel::ContentStatus mixed_content_status) { |
96 DCHECK(visible_security_state.connection_info_initialized || | 96 DCHECK(visible_security_state.connection_info_initialized || |
97 visible_security_state.fails_malware_check); | 97 visible_security_state.fails_malware_check); |
98 | 98 |
99 // Override the connection security information if the website failed the | 99 // Override the connection security information if the website failed the |
100 // browser's malware checks. | 100 // browser's malware checks. |
101 if (visible_security_state.fails_malware_check) | 101 if (visible_security_state.fails_malware_check) |
102 return SecurityStateModel::SECURITY_ERROR; | 102 return SecurityStateModel::SECURITY_ERROR; |
103 | 103 |
104 GURL url = visible_security_state.url; | 104 GURL url = visible_security_state.url; |
105 switch (visible_security_state.initial_security_level) { | 105 switch (visible_security_state.initial_security_level) { |
(...skipping 13 matching lines...) Expand all Loading... |
119 case SecurityStateModel::SECURE: | 119 case SecurityStateModel::SECURE: |
120 case SecurityStateModel::EV_SECURE: { | 120 case SecurityStateModel::EV_SECURE: { |
121 // Major cert errors and active mixed content will generally be | 121 // Major cert errors and active mixed content will generally be |
122 // downgraded by the embedder to SECURITY_ERROR and handled above, | 122 // downgraded by the embedder to SECURITY_ERROR and handled above, |
123 // but downgrade here just in case. | 123 // but downgrade here just in case. |
124 net::CertStatus cert_status = visible_security_state.cert_status; | 124 net::CertStatus cert_status = visible_security_state.cert_status; |
125 if (net::IsCertStatusError(cert_status) && | 125 if (net::IsCertStatusError(cert_status) && |
126 !net::IsCertStatusMinorError(cert_status)) { | 126 !net::IsCertStatusMinorError(cert_status)) { |
127 return SecurityStateModel::SECURITY_ERROR; | 127 return SecurityStateModel::SECURITY_ERROR; |
128 } | 128 } |
129 if (mixed_content_status == SecurityStateModel::RAN_MIXED_CONTENT || | 129 if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_RAN || |
130 mixed_content_status == | 130 mixed_content_status == |
131 SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT) { | 131 SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN) { |
132 return SecurityStateModel::kRanInsecureContentLevel; | 132 return SecurityStateModel::kRanInsecureContentLevel; |
133 } | 133 } |
134 | 134 |
135 // Report if there is a policy cert first, before reporting any other | 135 // Report if there is a policy cert first, before reporting any other |
136 // authenticated-but-with-errors cases. A policy cert is a strong | 136 // authenticated-but-with-errors cases. A policy cert is a strong |
137 // indicator of a MITM being present (the enterprise), while the | 137 // indicator of a MITM being present (the enterprise), while the |
138 // other authenticated-but-with-errors indicate something may | 138 // other authenticated-but-with-errors indicate something may |
139 // be wrong, or may be wrong in the future, but is unclear now. | 139 // be wrong, or may be wrong in the future, but is unclear now. |
140 if (client->UsedPolicyInstalledCertificate()) | 140 if (client->UsedPolicyInstalledCertificate()) |
141 return SecurityStateModel::SECURITY_POLICY_WARNING; | 141 return SecurityStateModel::SECURITY_POLICY_WARNING; |
142 | 142 |
143 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR) | 143 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MAJOR) |
144 return SecurityStateModel::SECURITY_ERROR; | 144 return SecurityStateModel::SECURITY_ERROR; |
145 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR) | 145 if (sha1_status == SecurityStateModel::DEPRECATED_SHA1_MINOR) |
146 return SecurityStateModel::NONE; | 146 return SecurityStateModel::NONE; |
147 | 147 |
148 // Active mixed content is handled above. | 148 // Active mixed content is handled above. |
149 DCHECK_NE(SecurityStateModel::RAN_MIXED_CONTENT, mixed_content_status); | 149 DCHECK_NE(SecurityStateModel::CONTENT_STATUS_RAN, mixed_content_status); |
150 DCHECK_NE(SecurityStateModel::RAN_AND_DISPLAYED_MIXED_CONTENT, | 150 DCHECK_NE(SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN, |
151 mixed_content_status); | 151 mixed_content_status); |
152 if (mixed_content_status == SecurityStateModel::DISPLAYED_MIXED_CONTENT) | 152 if (mixed_content_status == SecurityStateModel::CONTENT_STATUS_DISPLAYED) |
153 return SecurityStateModel::kDisplayedInsecureContentLevel; | 153 return SecurityStateModel::kDisplayedInsecureContentLevel; |
154 | 154 |
155 if (net::IsCertStatusError(cert_status)) { | 155 if (net::IsCertStatusError(cert_status)) { |
156 // Major cert errors are handled above. | 156 // Major cert errors are handled above. |
157 DCHECK(net::IsCertStatusMinorError(cert_status)); | 157 DCHECK(net::IsCertStatusMinorError(cert_status)); |
158 return SecurityStateModel::NONE; | 158 return SecurityStateModel::NONE; |
159 } | 159 } |
160 if (net::SSLConnectionStatusToVersion( | 160 if (net::SSLConnectionStatusToVersion( |
161 visible_security_state.connection_status) == | 161 visible_security_state.connection_status) == |
162 net::SSL_CONNECTION_VERSION_SSL3) { | 162 net::SSL_CONNECTION_VERSION_SSL3) { |
(...skipping 12 matching lines...) Expand all Loading... |
175 void SecurityInfoForRequest( | 175 void SecurityInfoForRequest( |
176 SecurityStateModelClient* client, | 176 SecurityStateModelClient* client, |
177 const SecurityStateModel::VisibleSecurityState& visible_security_state, | 177 const SecurityStateModel::VisibleSecurityState& visible_security_state, |
178 const scoped_refptr<net::X509Certificate>& cert, | 178 const scoped_refptr<net::X509Certificate>& cert, |
179 SecurityStateModel::SecurityInfo* security_info) { | 179 SecurityStateModel::SecurityInfo* security_info) { |
180 if (!visible_security_state.connection_info_initialized) { | 180 if (!visible_security_state.connection_info_initialized) { |
181 *security_info = SecurityStateModel::SecurityInfo(); | 181 *security_info = SecurityStateModel::SecurityInfo(); |
182 security_info->fails_malware_check = | 182 security_info->fails_malware_check = |
183 visible_security_state.fails_malware_check; | 183 visible_security_state.fails_malware_check; |
184 if (security_info->fails_malware_check) { | 184 if (security_info->fails_malware_check) { |
185 security_info->security_level = | 185 security_info->security_level = GetSecurityLevelForRequest( |
186 GetSecurityLevelForRequest(visible_security_state, client, cert, | 186 visible_security_state, client, cert, |
187 SecurityStateModel::UNKNOWN_SHA1, | 187 SecurityStateModel::UNKNOWN_SHA1, |
188 SecurityStateModel::UNKNOWN_MIXED_CONTENT); | 188 SecurityStateModel::CONTENT_STATUS_UNKNOWN); |
189 } | 189 } |
190 return; | 190 return; |
191 } | 191 } |
192 security_info->cert_id = visible_security_state.cert_id; | 192 security_info->cert_id = visible_security_state.cert_id; |
193 security_info->sha1_deprecation_status = | 193 security_info->sha1_deprecation_status = |
194 GetSHA1DeprecationStatus(cert, visible_security_state); | 194 GetSHA1DeprecationStatus(cert, visible_security_state); |
195 security_info->mixed_content_status = | 195 security_info->mixed_content_status = |
196 GetMixedContentStatus(visible_security_state); | 196 GetMixedContentStatus(visible_security_state); |
197 security_info->security_bits = visible_security_state.security_bits; | 197 security_info->security_bits = visible_security_state.security_bits; |
198 security_info->connection_status = visible_security_state.connection_status; | 198 security_info->connection_status = visible_security_state.connection_status; |
(...skipping 25 matching lines...) Expand all Loading... |
224 SecurityStateModel::kDisplayedInsecureContentLevel = | 224 SecurityStateModel::kDisplayedInsecureContentLevel = |
225 SecurityStateModel::NONE; | 225 SecurityStateModel::NONE; |
226 const SecurityStateModel::SecurityLevel | 226 const SecurityStateModel::SecurityLevel |
227 SecurityStateModel::kRanInsecureContentLevel = | 227 SecurityStateModel::kRanInsecureContentLevel = |
228 SecurityStateModel::SECURITY_ERROR; | 228 SecurityStateModel::SECURITY_ERROR; |
229 | 229 |
230 SecurityStateModel::SecurityInfo::SecurityInfo() | 230 SecurityStateModel::SecurityInfo::SecurityInfo() |
231 : security_level(SecurityStateModel::NONE), | 231 : security_level(SecurityStateModel::NONE), |
232 fails_malware_check(false), | 232 fails_malware_check(false), |
233 sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1), | 233 sha1_deprecation_status(SecurityStateModel::NO_DEPRECATED_SHA1), |
234 mixed_content_status(SecurityStateModel::NO_MIXED_CONTENT), | 234 mixed_content_status(SecurityStateModel::CONTENT_STATUS_NONE), |
235 scheme_is_cryptographic(false), | 235 scheme_is_cryptographic(false), |
236 cert_status(0), | 236 cert_status(0), |
237 cert_id(0), | 237 cert_id(0), |
238 security_bits(-1), | 238 security_bits(-1), |
239 connection_status(0), | 239 connection_status(0), |
240 is_secure_protocol_and_ciphersuite(false), | 240 is_secure_protocol_and_ciphersuite(false), |
241 pkp_bypassed(false) {} | 241 pkp_bypassed(false) {} |
242 | 242 |
243 SecurityStateModel::SecurityInfo::~SecurityInfo() {} | 243 SecurityStateModel::SecurityInfo::~SecurityInfo() {} |
244 | 244 |
(...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
298 cert_id == other.cert_id && cert_status == other.cert_status && | 298 cert_id == other.cert_id && cert_status == other.cert_status && |
299 connection_status == other.connection_status && | 299 connection_status == other.connection_status && |
300 security_bits == other.security_bits && | 300 security_bits == other.security_bits && |
301 sct_verify_statuses == other.sct_verify_statuses && | 301 sct_verify_statuses == other.sct_verify_statuses && |
302 displayed_mixed_content == other.displayed_mixed_content && | 302 displayed_mixed_content == other.displayed_mixed_content && |
303 ran_mixed_content == other.ran_mixed_content && | 303 ran_mixed_content == other.ran_mixed_content && |
304 pkp_bypassed == other.pkp_bypassed); | 304 pkp_bypassed == other.pkp_bypassed); |
305 } | 305 } |
306 | 306 |
307 } // namespace security_state | 307 } // namespace security_state |
OLD | NEW |