| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/ssl/chrome_security_state_model_client.h" | 5 #include "chrome/browser/ssl/chrome_security_state_model_client.h" |
| 6 | 6 |
| 7 #include <openssl/ssl.h> | 7 #include <openssl/ssl.h> |
| 8 | 8 |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| (...skipping 22 matching lines...) Expand all Loading... |
| 33 #include "net/ssl/ssl_connection_status_flags.h" | 33 #include "net/ssl/ssl_connection_status_flags.h" |
| 34 #include "ui/base/l10n/l10n_util.h" | 34 #include "ui/base/l10n/l10n_util.h" |
| 35 | 35 |
| 36 DEFINE_WEB_CONTENTS_USER_DATA_KEY(ChromeSecurityStateModelClient); | 36 DEFINE_WEB_CONTENTS_USER_DATA_KEY(ChromeSecurityStateModelClient); |
| 37 | 37 |
| 38 using safe_browsing::SafeBrowsingUIManager; | 38 using safe_browsing::SafeBrowsingUIManager; |
| 39 using security_state::SecurityStateModel; | 39 using security_state::SecurityStateModel; |
| 40 | 40 |
| 41 namespace { | 41 namespace { |
| 42 | 42 |
| 43 // Converts a content::SecurityStyle (an indicator of a request's | |
| 44 // overall security level computed by //content) into a | |
| 45 // SecurityStateModel::SecurityLevel (a finer-grained SecurityStateModel | |
| 46 // concept that can express all of SecurityStateModel's policies that | |
| 47 // //content doesn't necessarily know about). | |
| 48 SecurityStateModel::SecurityLevel GetSecurityLevelForSecurityStyle( | |
| 49 content::SecurityStyle style) { | |
| 50 switch (style) { | |
| 51 case content::SECURITY_STYLE_UNKNOWN: | |
| 52 NOTREACHED(); | |
| 53 return SecurityStateModel::NONE; | |
| 54 case content::SECURITY_STYLE_UNAUTHENTICATED: | |
| 55 return SecurityStateModel::NONE; | |
| 56 case content::SECURITY_STYLE_AUTHENTICATION_BROKEN: | |
| 57 return SecurityStateModel::DANGEROUS; | |
| 58 case content::SECURITY_STYLE_WARNING: | |
| 59 // content currently doesn't use this style. | |
| 60 NOTREACHED(); | |
| 61 return SecurityStateModel::SECURITY_WARNING; | |
| 62 case content::SECURITY_STYLE_AUTHENTICATED: | |
| 63 return SecurityStateModel::SECURE; | |
| 64 } | |
| 65 return SecurityStateModel::NONE; | |
| 66 } | |
| 67 | |
| 68 // Note: This is a lossy operation. Not all of the policies that can be | 43 // Note: This is a lossy operation. Not all of the policies that can be |
| 69 // expressed by a SecurityLevel (a //chrome concept) can be expressed by | 44 // expressed by a SecurityLevel (a //chrome concept) can be expressed by |
| 70 // a content::SecurityStyle. | 45 // a blink::WebSecurityStyle. |
| 71 content::SecurityStyle SecurityLevelToSecurityStyle( | 46 blink::WebSecurityStyle SecurityLevelToSecurityStyle( |
| 72 SecurityStateModel::SecurityLevel security_level) { | 47 SecurityStateModel::SecurityLevel security_level) { |
| 73 switch (security_level) { | 48 switch (security_level) { |
| 74 case SecurityStateModel::NONE: | 49 case SecurityStateModel::NONE: |
| 75 case SecurityStateModel::HTTP_SHOW_WARNING: | 50 case SecurityStateModel::HTTP_SHOW_WARNING: |
| 76 return content::SECURITY_STYLE_UNAUTHENTICATED; | 51 return blink::WebSecurityStyleUnauthenticated; |
| 77 case SecurityStateModel::SECURITY_WARNING: | 52 case SecurityStateModel::SECURITY_WARNING: |
| 78 case SecurityStateModel::SECURE_WITH_POLICY_INSTALLED_CERT: | 53 case SecurityStateModel::SECURE_WITH_POLICY_INSTALLED_CERT: |
| 79 return content::SECURITY_STYLE_WARNING; | 54 return blink::WebSecurityStyleWarning; |
| 80 case SecurityStateModel::EV_SECURE: | 55 case SecurityStateModel::EV_SECURE: |
| 81 case SecurityStateModel::SECURE: | 56 case SecurityStateModel::SECURE: |
| 82 return content::SECURITY_STYLE_AUTHENTICATED; | 57 return blink::WebSecurityStyleAuthenticated; |
| 83 case SecurityStateModel::DANGEROUS: | 58 case SecurityStateModel::DANGEROUS: |
| 84 return content::SECURITY_STYLE_AUTHENTICATION_BROKEN; | 59 return blink::WebSecurityStyleAuthenticationBroken; |
| 85 } | 60 } |
| 86 | 61 |
| 87 NOTREACHED(); | 62 NOTREACHED(); |
| 88 return content::SECURITY_STYLE_UNKNOWN; | 63 return blink::WebSecurityStyleUnknown; |
| 89 } | 64 } |
| 90 | 65 |
| 91 void AddConnectionExplanation( | 66 void AddConnectionExplanation( |
| 92 const security_state::SecurityStateModel::SecurityInfo& security_info, | 67 const security_state::SecurityStateModel::SecurityInfo& security_info, |
| 93 content::SecurityStyleExplanations* security_style_explanations) { | 68 content::SecurityStyleExplanations* security_style_explanations) { |
| 94 | 69 |
| 95 // Avoid showing TLS details when we couldn't even establish a TLS connection | 70 // Avoid showing TLS details when we couldn't even establish a TLS connection |
| 96 // (e.g. for net errors) or if there was no real connection (some tests). We | 71 // (e.g. for net errors) or if there was no real connection (some tests). We |
| 97 // check the |connection_status| to see if there was a connection. | 72 // check the |connection_status| to see if there was a connection. |
| 98 if (security_info.connection_status == 0) { | 73 if (security_info.connection_status == 0) { |
| (...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 175 content::WebContents* web_contents, | 150 content::WebContents* web_contents, |
| 176 SecurityStateModel::VisibleSecurityState* state) { | 151 SecurityStateModel::VisibleSecurityState* state) { |
| 177 safe_browsing::SafeBrowsingService* sb_service = | 152 safe_browsing::SafeBrowsingService* sb_service = |
| 178 g_browser_process->safe_browsing_service(); | 153 g_browser_process->safe_browsing_service(); |
| 179 if (!sb_service) | 154 if (!sb_service) |
| 180 return; | 155 return; |
| 181 scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager(); | 156 scoped_refptr<SafeBrowsingUIManager> sb_ui_manager = sb_service->ui_manager(); |
| 182 if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents( | 157 if (sb_ui_manager->IsUrlWhitelistedOrPendingForWebContents( |
| 183 entry->GetURL(), false, entry, web_contents, false)) { | 158 entry->GetURL(), false, entry, web_contents, false)) { |
| 184 state->fails_malware_check = true; | 159 state->fails_malware_check = true; |
| 185 state->initial_security_level = SecurityStateModel::DANGEROUS; | |
| 186 } | 160 } |
| 187 } | 161 } |
| 188 | 162 |
| 189 } // namespace | 163 } // namespace |
| 190 | 164 |
| 191 ChromeSecurityStateModelClient::ChromeSecurityStateModelClient( | 165 ChromeSecurityStateModelClient::ChromeSecurityStateModelClient( |
| 192 content::WebContents* web_contents) | 166 content::WebContents* web_contents) |
| 193 : web_contents_(web_contents), | 167 : web_contents_(web_contents), |
| 194 security_state_model_(new SecurityStateModel()) { | 168 security_state_model_(new SecurityStateModel()) { |
| 195 security_state_model_->SetClient(this); | 169 security_state_model_->SetClient(this); |
| 196 } | 170 } |
| 197 | 171 |
| 198 ChromeSecurityStateModelClient::~ChromeSecurityStateModelClient() {} | 172 ChromeSecurityStateModelClient::~ChromeSecurityStateModelClient() {} |
| 199 | 173 |
| 200 // static | 174 // static |
| 201 content::SecurityStyle ChromeSecurityStateModelClient::GetSecurityStyle( | 175 blink::WebSecurityStyle ChromeSecurityStateModelClient::GetSecurityStyle( |
| 202 const security_state::SecurityStateModel::SecurityInfo& security_info, | 176 const security_state::SecurityStateModel::SecurityInfo& security_info, |
| 203 content::SecurityStyleExplanations* security_style_explanations) { | 177 content::SecurityStyleExplanations* security_style_explanations) { |
| 204 const content::SecurityStyle security_style = | 178 const blink::WebSecurityStyle security_style = |
| 205 SecurityLevelToSecurityStyle(security_info.security_level); | 179 SecurityLevelToSecurityStyle(security_info.security_level); |
| 206 | 180 |
| 207 security_style_explanations->ran_insecure_content_style = | 181 security_style_explanations->ran_insecure_content_style = |
| 208 SecurityLevelToSecurityStyle( | 182 SecurityLevelToSecurityStyle( |
| 209 SecurityStateModel::kRanInsecureContentLevel); | 183 SecurityStateModel::kRanInsecureContentLevel); |
| 210 security_style_explanations->displayed_insecure_content_style = | 184 security_style_explanations->displayed_insecure_content_style = |
| 211 SecurityLevelToSecurityStyle( | 185 SecurityLevelToSecurityStyle( |
| 212 SecurityStateModel::kDisplayedInsecureContentLevel); | 186 SecurityStateModel::kDisplayedInsecureContentLevel); |
| 213 | 187 |
| 214 // Check if the page is HTTP; if so, no explanations are needed. Note | 188 // Check if the page is HTTP; if so, no explanations are needed. Note |
| 215 // that SECURITY_STYLE_UNAUTHENTICATED does not necessarily mean that | 189 // that SecurityStyleUnauthenticated does not necessarily mean that |
| 216 // the page is loaded over HTTP, because the security style merely | 190 // the page is loaded over HTTP, because the security style merely |
| 217 // represents how the embedder wishes to display the security state of | 191 // represents how the embedder wishes to display the security state of |
| 218 // the page, and the embedder can choose to display HTTPS page as HTTP | 192 // the page, and the embedder can choose to display HTTPS page as HTTP |
| 219 // if it wants to (for example, displaying deprecated crypto | 193 // if it wants to (for example, displaying deprecated crypto |
| 220 // algorithms with the same UI treatment as HTTP pages). | 194 // algorithms with the same UI treatment as HTTP pages). |
| 221 security_style_explanations->scheme_is_cryptographic = | 195 security_style_explanations->scheme_is_cryptographic = |
| 222 security_info.scheme_is_cryptographic; | 196 security_info.scheme_is_cryptographic; |
| 223 if (!security_info.scheme_is_cryptographic) { | 197 if (!security_info.scheme_is_cryptographic) { |
| 224 return security_style; | 198 return security_style; |
| 225 } | 199 } |
| (...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 318 } | 292 } |
| 319 | 293 |
| 320 return security_style; | 294 return security_style; |
| 321 } | 295 } |
| 322 | 296 |
| 323 void ChromeSecurityStateModelClient::GetSecurityInfo( | 297 void ChromeSecurityStateModelClient::GetSecurityInfo( |
| 324 SecurityStateModel::SecurityInfo* result) const { | 298 SecurityStateModel::SecurityInfo* result) const { |
| 325 security_state_model_->GetSecurityInfo(result); | 299 security_state_model_->GetSecurityInfo(result); |
| 326 } | 300 } |
| 327 | 301 |
| 328 bool ChromeSecurityStateModelClient::RetrieveCert( | |
| 329 scoped_refptr<net::X509Certificate>* cert) { | |
| 330 content::NavigationEntry* entry = | |
| 331 web_contents_->GetController().GetVisibleEntry(); | |
| 332 if (!entry || !entry->GetSSL().certificate) | |
| 333 return false; | |
| 334 *cert = entry->GetSSL().certificate; | |
| 335 return true; | |
| 336 } | |
| 337 | |
| 338 bool ChromeSecurityStateModelClient::UsedPolicyInstalledCertificate() { | 302 bool ChromeSecurityStateModelClient::UsedPolicyInstalledCertificate() { |
| 339 #if defined(OS_CHROMEOS) | 303 #if defined(OS_CHROMEOS) |
| 340 policy::PolicyCertService* service = | 304 policy::PolicyCertService* service = |
| 341 policy::PolicyCertServiceFactory::GetForProfile( | 305 policy::PolicyCertServiceFactory::GetForProfile( |
| 342 Profile::FromBrowserContext(web_contents_->GetBrowserContext())); | 306 Profile::FromBrowserContext(web_contents_->GetBrowserContext())); |
| 343 if (service && service->UsedPolicyCertificates()) | 307 if (service && service->UsedPolicyCertificates()) |
| 344 return true; | 308 return true; |
| 345 #endif | 309 #endif |
| 346 return false; | 310 return false; |
| 347 } | 311 } |
| 348 | 312 |
| 349 bool ChromeSecurityStateModelClient::IsOriginSecure(const GURL& url) { | 313 bool ChromeSecurityStateModelClient::IsOriginSecure(const GURL& url) { |
| 350 return content::IsOriginSecure(url); | 314 return content::IsOriginSecure(url); |
| 351 } | 315 } |
| 352 | 316 |
| 353 void ChromeSecurityStateModelClient::GetVisibleSecurityState( | 317 void ChromeSecurityStateModelClient::GetVisibleSecurityState( |
| 354 SecurityStateModel::VisibleSecurityState* state) { | 318 SecurityStateModel::VisibleSecurityState* state) { |
| 355 content::NavigationEntry* entry = | 319 content::NavigationEntry* entry = |
| 356 web_contents_->GetController().GetVisibleEntry(); | 320 web_contents_->GetController().GetVisibleEntry(); |
| 357 if (!entry) { | 321 if (!entry) { |
| 358 *state = SecurityStateModel::VisibleSecurityState(); | 322 *state = SecurityStateModel::VisibleSecurityState(); |
| 359 return; | 323 return; |
| 360 } | 324 } |
| 361 | 325 |
| 362 if (entry->GetSSL().security_style == content::SECURITY_STYLE_UNKNOWN) { | 326 if (!entry->GetSSL().initialized) { |
| 363 *state = SecurityStateModel::VisibleSecurityState(); | 327 *state = SecurityStateModel::VisibleSecurityState(); |
| 364 // Connection security information is still being initialized, but malware | 328 // Connection security information is still being initialized, but malware |
| 365 // status might already be known. | 329 // status might already be known. |
| 366 CheckSafeBrowsingStatus(entry, web_contents_, state); | 330 CheckSafeBrowsingStatus(entry, web_contents_, state); |
| 367 return; | 331 return; |
| 368 } | 332 } |
| 369 | 333 |
| 370 state->connection_info_initialized = true; | 334 state->connection_info_initialized = true; |
| 371 state->url = entry->GetURL(); | 335 state->url = entry->GetURL(); |
| 372 const content::SSLStatus& ssl = entry->GetSSL(); | 336 const content::SSLStatus& ssl = entry->GetSSL(); |
| 373 state->initial_security_level = | |
| 374 GetSecurityLevelForSecurityStyle(ssl.security_style); | |
| 375 state->certificate = ssl.certificate; | 337 state->certificate = ssl.certificate; |
| 376 state->cert_status = ssl.cert_status; | 338 state->cert_status = ssl.cert_status; |
| 377 state->connection_status = ssl.connection_status; | 339 state->connection_status = ssl.connection_status; |
| 378 state->key_exchange_group = ssl.key_exchange_group; | 340 state->key_exchange_group = ssl.key_exchange_group; |
| 379 state->security_bits = ssl.security_bits; | 341 state->security_bits = ssl.security_bits; |
| 380 state->pkp_bypassed = ssl.pkp_bypassed; | 342 state->pkp_bypassed = ssl.pkp_bypassed; |
| 381 state->sct_verify_statuses.clear(); | 343 state->sct_verify_statuses.clear(); |
| 382 state->sct_verify_statuses.insert(state->sct_verify_statuses.begin(), | 344 state->sct_verify_statuses.insert(state->sct_verify_statuses.begin(), |
| 383 ssl.sct_statuses.begin(), | 345 ssl.sct_statuses.begin(), |
| 384 ssl.sct_statuses.end()); | 346 ssl.sct_statuses.end()); |
| 385 state->displayed_mixed_content = | 347 state->displayed_mixed_content = |
| 386 !!(ssl.content_status & content::SSLStatus::DISPLAYED_INSECURE_CONTENT); | 348 !!(ssl.content_status & content::SSLStatus::DISPLAYED_INSECURE_CONTENT); |
| 387 state->ran_mixed_content = | 349 state->ran_mixed_content = |
| 388 !!(ssl.content_status & content::SSLStatus::RAN_INSECURE_CONTENT); | 350 !!(ssl.content_status & content::SSLStatus::RAN_INSECURE_CONTENT); |
| 389 state->displayed_content_with_cert_errors = | 351 state->displayed_content_with_cert_errors = |
| 390 !!(ssl.content_status & | 352 !!(ssl.content_status & |
| 391 content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS); | 353 content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS); |
| 392 state->ran_content_with_cert_errors = | 354 state->ran_content_with_cert_errors = |
| 393 !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS); | 355 !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS); |
| 394 state->displayed_password_field_on_http = | 356 state->displayed_password_field_on_http = |
| 395 !!(ssl.content_status & | 357 !!(ssl.content_status & |
| 396 content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP); | 358 content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP); |
| 397 state->displayed_credit_card_field_on_http = | 359 state->displayed_credit_card_field_on_http = |
| 398 !!(ssl.content_status & | 360 !!(ssl.content_status & |
| 399 content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP); | 361 content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP); |
| 400 | 362 |
| 401 CheckSafeBrowsingStatus(entry, web_contents_, state); | 363 CheckSafeBrowsingStatus(entry, web_contents_, state); |
| 402 } | 364 } |
| OLD | NEW |