Attempt an on-demand time fetch when encountering a date invalid error

chrome/browser/ssl/ssl_error_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_error_handler.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/callback_helpers.h"
 #include "base/macros.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/stringprintf.h"
 #include "base/time/clock.h"
 #include "base/time/time.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/bad_clock_blocking_page.h"
 #include "chrome/browser/ssl/ssl_blocking_page.h"
 #include "chrome/browser/ssl/ssl_cert_reporter.h"
 #include "chrome/common/features.h"
+#include "components/network_time/network_time_tracker.h"
 #include "components/ssl_errors/error_classification.h"
 #include "components/ssl_errors/error_info.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "net/base/net_errors.h"
 
 #if BUILDFLAG(ENABLE_CAPTIVE_PORTAL_DETECTION)
 #include "chrome/browser/captive_portal/captive_portal_service.h"
@@ skipping 16 matching lines @@
 //   a captive portal interstitial is displayed.
 // - Otherwise, an SSL interstitial is displayed.
 int64_t g_interstitial_delay_in_milliseconds = 3000;
 
 // Callback to call when the interstitial timer is started. Used for testing.
 SSLErrorHandler::TimerStartedCallback* g_timer_started_callback = nullptr;
 
 // The clock to use when deciding which error type to display. Used for testing.
 base::Clock* g_testing_clock = nullptr;
 
+network_time::NetworkTimeTracker* g_network_time_tracker = nullptr;
+
 // Events for UMA.
 enum SSLErrorHandlerEvent {
   HANDLE_ALL,
   SHOW_CAPTIVE_PORTAL_INTERSTITIAL_NONOVERRIDABLE,
   SHOW_CAPTIVE_PORTAL_INTERSTITIAL_OVERRIDABLE,
   SHOW_SSL_INTERSTITIAL_NONOVERRIDABLE,
   SHOW_SSL_INTERSTITIAL_OVERRIDABLE,
   WWW_MISMATCH_FOUND,
   WWW_MISMATCH_URL_AVAILABLE,
   WWW_MISMATCH_URL_NOT_AVAILABLE,
@@ skipping 107 matching lines @@
     TimerStartedCallback* callback) {
   DCHECK(!callback || !callback->is_null());
   g_timer_started_callback = callback;
 }
 
 // static
 void SSLErrorHandler::SetClockForTest(base::Clock* testing_clock) {
   g_testing_clock = testing_clock;
 }
 
+// static
+void SSLErrorHandler::SetNetworkTimeTrackerForTest(
+    network_time::NetworkTimeTracker* tracker) {
+  g_network_time_tracker = tracker;
+}
+
 SSLErrorHandler::SSLErrorHandler(
     content::WebContents* web_contents,
     int cert_error,
     const net::SSLInfo& ssl_info,
     const GURL& request_url,
     int options_mask,
     std::unique_ptr<SSLCertReporter> ssl_cert_reporter,
     const base::Callback<void(content::CertificateRequestResultType)>& callback)
     : content::WebContentsObserver(web_contents),
       web_contents_(web_contents),
       cert_error_(cert_error),
       ssl_info_(ssl_info),
       request_url_(request_url),
       options_mask_(options_mask),
       callback_(callback),
       profile_(Profile::FromBrowserContext(web_contents->GetBrowserContext())),
-      ssl_cert_reporter_(std::move(ssl_cert_reporter)) {}
+      ssl_cert_reporter_(std::move(ssl_cert_reporter)),
+      weak_ptr_factory_(this) {}
 
 SSLErrorHandler::~SSLErrorHandler() {
 }
 
 void SSLErrorHandler::StartHandlingError() {
   RecordUMA(HANDLE_ALL);
 
-  const base::Time now = g_testing_clock == nullptr
-                             ? base::Time::NowFromSystemTime()
-                             : g_testing_clock->Now();
   if (ssl_errors::ErrorInfo::NetErrorToErrorType(cert_error_) ==
       ssl_errors::ErrorInfo::CERT_DATE_INVALID) {
-    ssl_errors::ClockState clock_state = ssl_errors::GetClockState(
-        now, g_browser_process->network_time_tracker());
-    if (clock_state == ssl_errors::CLOCK_STATE_FUTURE ||
-        clock_state == ssl_errors::CLOCK_STATE_PAST) {
-      ShowBadClockInterstitial(now, clock_state);
-      return;  // |this| is deleted after showing the interstitial.
-    }
+    HandleCertDateInvalidError();
+    return;
   }
 
   std::vector<std::string> dns_names;
   ssl_info_.cert->GetDNSNames(&dns_names);
   DCHECK(!dns_names.empty());
   GURL suggested_url;
   if (IsSSLCommonNameMismatchHandlingEnabled() &&
       cert_error_ == net::ERR_CERT_COMMON_NAME_INVALID &&
       IsErrorOverridable() && GetSuggestedUrl(dns_names, &suggested_url)) {
     RecordUMA(WWW_MISMATCH_FOUND);
@@ skipping 182 matching lines @@
     base::ResetAndReturn(&callback_)
         .Run(content::CERTIFICATE_REQUEST_RESULT_TYPE_DENY);
   }
   if (common_name_mismatch_handler_) {
     common_name_mismatch_handler_->Cancel();
     common_name_mismatch_handler_.reset();
   }
   // Deletes |this| and also destroys the timer.
   web_contents_->RemoveUserData(UserDataKey());
 }
+
+void SSLErrorHandler::HandleCertDateInvalidError() {
+  network_time::NetworkTimeTracker* tracker =
+      g_network_time_tracker ? g_network_time_tracker
+                             : g_browser_process->network_time_tracker();
+  timer_.Start(FROM_HERE, base::TimeDelta::FromMilliseconds(
+                              g_interstitial_delay_in_milliseconds),
+               base::Bind(&SSLErrorHandler::HandleCertDateInvalidErrorImpl,
+                          base::Unretained(this)));
+  // Try kicking off a time fetch to get an up-to-date estimate of the
+  // true time. This will only have an effect if network time is
+  // unavailable or if there is not already a query in progress.
+  //
+  // Pass a weak pointer as the callback; if the timer fires before the
+  // fetch completes and shows an interstitial, this SSLErrorHandler
+  // will be deleted.
+  if (!tracker->StartTimeFetch(
+          base::Bind(&SSLErrorHandler::HandleCertDateInvalidErrorImpl,
+                     weak_ptr_factory_.GetWeakPtr()))) {
+    HandleCertDateInvalidErrorImpl();
+    return;
+  }
+
+  if (g_timer_started_callback)
+    g_timer_started_callback->Run(web_contents_);
+}
+
+void SSLErrorHandler::HandleCertDateInvalidErrorImpl() {
+  network_time::NetworkTimeTracker* tracker =
+      g_network_time_tracker ? g_network_time_tracker
+                             : g_browser_process->network_time_tracker();
+  timer_.Stop();
+  const base::Time now = g_testing_clock == nullptr
+                             ? base::Time::NowFromSystemTime()
+                             : g_testing_clock->Now();
+  ssl_errors::ClockState clock_state = ssl_errors::GetClockState(now, tracker);
+  if (clock_state == ssl_errors::CLOCK_STATE_FUTURE ||
+      clock_state == ssl_errors::CLOCK_STATE_PAST) {
+    ShowBadClockInterstitial(now, clock_state);
+    return;  // |this| is deleted after showing the interstitial.
+  }
+  ShowSSLInterstitial();
+}