| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 5 #ifndef CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ |
| 6 #define CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 6 #define CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/time/time.h" | 11 #include "base/time/time.h" |
| 12 #include "content/public/browser/notification_observer.h" |
| 13 #include "content/public/browser/notification_registrar.h" |
| 12 #include "net/cert/x509_certificate.h" | 14 #include "net/cert/x509_certificate.h" |
| 13 #include "url/gurl.h" | 15 #include "url/gurl.h" |
| 14 | 16 |
| 17 namespace content { |
| 18 class WebContents; |
| 19 } |
| 20 |
| 15 // This class calculates the severity scores for the different type of SSL | 21 // This class calculates the severity scores for the different type of SSL |
| 16 // errors. | 22 // errors. |
| 17 class SSLErrorClassification { | 23 // |
| 24 // This class also checks whether any captive portals have been detected |
| 25 // or not. This class should only be used on the UI thread because its |
| 26 // implementation uses captive_portal::CaptivePortalService which can only be |
| 27 // accessed on the UI thread. |
| 28 class SSLErrorClassification : public content::NotificationObserver { |
| 18 public: | 29 public: |
| 19 SSLErrorClassification(const base::Time& current_time, | 30 SSLErrorClassification(content::WebContents* web_contents, |
| 31 const base::Time& current_time, |
| 20 const GURL& url, | 32 const GURL& url, |
| 33 int cert_error, |
| 21 const net::X509Certificate& cert); | 34 const net::X509Certificate& cert); |
| 22 ~SSLErrorClassification(); | 35 virtual ~SSLErrorClassification(); |
| 23 | 36 |
| 24 // Returns true if the system time is in the past. | 37 // Returns true if the system time is in the past. |
| 25 static bool IsUserClockInThePast(const base::Time& time_now); | 38 static bool IsUserClockInThePast(const base::Time& time_now); |
| 26 | 39 |
| 27 // Returns true if the system time is too far in the future or the user is | 40 // Returns true if the system time is too far in the future or the user is |
| 28 // using a version of Chrome which is more than 1 year old. | 41 // using a version of Chrome which is more than 1 year old. |
| 29 static bool IsUserClockInTheFuture(const base::Time& time_now); | 42 static bool IsUserClockInTheFuture(const base::Time& time_now); |
| 30 | 43 |
| 31 static bool IsWindowsVersionSP3OrLower(); | 44 static bool IsWindowsVersionSP3OrLower(); |
| 32 | 45 |
| 33 // A function which calculates the severity score when the ssl error is | 46 // A function which calculates the severity score when the ssl error is |
| 34 // CERT_DATE_INVALID, returns a score between 0.0 and 1.0, higher values | 47 // |CERT_DATE_INVALID|. The calculated score is between 0.0 and 1.0, higher |
| 35 // being more severe, indicating how severe the certificate's invalid | 48 // being more severe, indicating how severe the certificate's |
| 36 // date error is. | 49 // date invalid error is. |
| 37 float InvalidDateSeverityScore(int cert_error) const; | 50 void InvalidDateSeverityScore(); |
| 38 | 51 |
| 39 // A function which calculates the severity score when the ssl error is | 52 // A function which calculates the severity score when the ssl error is |
| 40 // when the SSL error is |CERT_COMMON_NAME_INVALID|, returns a score between | 53 // |CERT_COMMON_NAME_INVALID|. The calculated score is between 0.0 and 1.0, |
| 41 // between 0.0 and 1.0, higher values being more severe, indicating how | 54 // higher being more severe, indicating how severe the certificate's common |
| 42 // severe the certificate's common name invalid error is. | 55 // name invalid error is. |
| 43 float InvalidCommonNameSeverityScore(int cert_error) const; | 56 void InvalidCommonNameSeverityScore(); |
| 44 | 57 |
| 45 void RecordUMAStatistics(bool overridable, int cert_error); | 58 void RecordUMAStatistics(bool overridable) const; |
| 59 void RecordCaptivePortalUMAStatistics(bool overridable) const; |
| 46 base::TimeDelta TimePassedSinceExpiry() const; | 60 base::TimeDelta TimePassedSinceExpiry() const; |
| 47 | 61 |
| 48 private: | 62 private: |
| 49 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestDateInvalidScore); | 63 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestDateInvalidScore); |
| 50 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestNameMismatch); | 64 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestNameMismatch); |
| 51 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, | 65 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, |
| 52 TestHostNameHasKnownTLD); | 66 TestHostNameHasKnownTLD); |
| 53 | 67 |
| 54 typedef std::vector<std::string> Tokens; | 68 typedef std::vector<std::string> Tokens; |
| 55 | 69 |
| (...skipping 21 matching lines...) Expand all Loading... |
| 77 bool AnyNamesUnderName(const std::vector<Tokens>& potential_children, | 91 bool AnyNamesUnderName(const std::vector<Tokens>& potential_children, |
| 78 const Tokens& parent) const; | 92 const Tokens& parent) const; |
| 79 | 93 |
| 80 // Returns true if |hostname| is too broad for the scope of a wildcard | 94 // Returns true if |hostname| is too broad for the scope of a wildcard |
| 81 // certificate. E.g.: | 95 // certificate. E.g.: |
| 82 // | 96 // |
| 83 // a.b.example.com ~ *.example.com --> true | 97 // a.b.example.com ~ *.example.com --> true |
| 84 // b.example.com ~ *.example.com --> false | 98 // b.example.com ~ *.example.com --> false |
| 85 bool IsSubDomainOutsideWildcard(const Tokens& hostname) const; | 99 bool IsSubDomainOutsideWildcard(const Tokens& hostname) const; |
| 86 | 100 |
| 87 float CalculateScoreTimePassedSinceExpiry() const; | |
| 88 | |
| 89 static std::vector<Tokens> GetTokenizedDNSNames( | 101 static std::vector<Tokens> GetTokenizedDNSNames( |
| 90 const std::vector<std::string>& dns_names); | 102 const std::vector<std::string>& dns_names); |
| 91 | 103 |
| 92 // If |potential_subdomain| is a subdomain of |parent|, returns the | 104 // If |potential_subdomain| is a subdomain of |parent|, returns the |
| 93 // number of DNS labels by which |potential_subdomain| is under | 105 // number of DNS labels by which |potential_subdomain| is under |
| 94 // |parent|. Otherwise, returns 0. | 106 // |parent|. Otherwise, returns 0. |
| 95 // | 107 // |
| 96 // For example, | 108 // For example, |
| 97 // | 109 // |
| 98 // FindSubDomainDifference(Tokenize("a.b.example.com"), | 110 // FindSubDomainDifference(Tokenize("a.b.example.com"), |
| 99 // Tokenize("example.com")) | 111 // Tokenize("example.com")) |
| 100 // --> 2. | 112 // --> 2. |
| 101 size_t FindSubDomainDifference(const Tokens& potential_subdomain, | 113 size_t FindSubDomainDifference(const Tokens& potential_subdomain, |
| 102 const Tokens& parent) const; | 114 const Tokens& parent) const; |
| 103 | 115 |
| 104 static Tokens Tokenize(const std::string& name); | 116 static Tokens Tokenize(const std::string& name); |
| 105 | 117 |
| 118 float CalculateScoreTimePassedSinceExpiry() const; |
| 119 float CalculateScoreEnvironments() const; |
| 120 |
| 121 // content::NotificationObserver: |
| 122 virtual void Observe( |
| 123 int type, |
| 124 const content::NotificationSource& source, |
| 125 const content::NotificationDetails& details) OVERRIDE; |
| 126 |
| 127 content::WebContents* web_contents_; |
| 106 // This stores the current time. | 128 // This stores the current time. |
| 107 base::Time current_time_; | 129 base::Time current_time_; |
| 108 | |
| 109 const GURL& request_url_; | 130 const GURL& request_url_; |
| 110 | 131 int cert_error_; |
| 111 // This stores the certificate. | 132 // This stores the certificate. |
| 112 const net::X509Certificate& cert_; | 133 const net::X509Certificate& cert_; |
| 134 // Is captive portal detection enabled? |
| 135 bool captive_portal_detection_enabled_; |
| 136 // Did the probe complete before the interstitial was closed? |
| 137 bool captive_portal_probe_completed_; |
| 138 // Did the captive portal probe receive an error or get a non-HTTP response? |
| 139 bool captive_portal_no_response_; |
| 140 // Was a captive portal detected? |
| 141 bool captive_portal_detected_; |
| 142 |
| 143 content::NotificationRegistrar registrar_; |
| 113 }; | 144 }; |
| 114 | 145 |
| 115 #endif // CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 146 #endif // CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ |
| OLD | NEW |