OLD | NEW |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 5 #ifndef CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ |
6 #define CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 6 #define CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 #include <vector> | 9 #include <vector> |
10 | 10 |
11 #include "base/time/time.h" | 11 #include "base/time/time.h" |
| 12 #include "content/public/browser/notification_observer.h" |
| 13 #include "content/public/browser/notification_registrar.h" |
12 #include "net/cert/x509_certificate.h" | 14 #include "net/cert/x509_certificate.h" |
13 #include "url/gurl.h" | 15 #include "url/gurl.h" |
14 | 16 |
| 17 namespace content { |
| 18 class WebContents; |
| 19 } |
| 20 |
15 // This class calculates the severity scores for the different type of SSL | 21 // This class calculates the severity scores for the different type of SSL |
16 // errors. | 22 // errors. |
17 class SSLErrorClassification { | 23 // |
| 24 // This class also checks whether any captive portals have been detected |
| 25 // or not. This class should only be used on the UI thread because its |
| 26 // implementation uses captive_portal::CaptivePortalService which can only be |
| 27 // accessed on the UI thread. |
| 28 class SSLErrorClassification : public content::NotificationObserver { |
18 public: | 29 public: |
19 SSLErrorClassification(const base::Time& current_time, | 30 SSLErrorClassification(content::WebContents* web_contents, |
| 31 const base::Time& current_time, |
20 const GURL& url, | 32 const GURL& url, |
| 33 int cert_error, |
21 const net::X509Certificate& cert); | 34 const net::X509Certificate& cert); |
22 ~SSLErrorClassification(); | 35 virtual ~SSLErrorClassification(); |
23 | 36 |
24 // Returns true if the system time is in the past. | 37 // Returns true if the system time is in the past. |
25 static bool IsUserClockInThePast(const base::Time& time_now); | 38 static bool IsUserClockInThePast(const base::Time& time_now); |
26 | 39 |
27 // Returns true if the system time is too far in the future or the user is | 40 // Returns true if the system time is too far in the future or the user is |
28 // using a version of Chrome which is more than 1 year old. | 41 // using a version of Chrome which is more than 1 year old. |
29 static bool IsUserClockInTheFuture(const base::Time& time_now); | 42 static bool IsUserClockInTheFuture(const base::Time& time_now); |
30 | 43 |
31 static bool IsWindowsVersionSP3OrLower(); | 44 static bool IsWindowsVersionSP3OrLower(); |
32 | 45 |
33 // A function which calculates the severity score when the ssl error is | 46 // A function which calculates the severity score when the ssl error is |
34 // CERT_DATE_INVALID, returns a score between 0.0 and 1.0, higher values | 47 // |CERT_DATE_INVALID|. The calculated score is between 0.0 and 1.0, higher |
35 // being more severe, indicating how severe the certificate's invalid | 48 // being more severe, indicating how severe the certificate's |
36 // date error is. | 49 // date invalid error is. |
37 float InvalidDateSeverityScore(int cert_error) const; | 50 void InvalidDateSeverityScore(); |
38 | 51 |
39 // A function which calculates the severity score when the ssl error is | 52 // A function which calculates the severity score when the ssl error is |
40 // when the SSL error is |CERT_COMMON_NAME_INVALID|, returns a score between | 53 // |CERT_COMMON_NAME_INVALID|. The calculated score is between 0.0 and 1.0, |
41 // between 0.0 and 1.0, higher values being more severe, indicating how | 54 // higher being more severe, indicating how severe the certificate's common |
42 // severe the certificate's common name invalid error is. | 55 // name invalid error is. |
43 float InvalidCommonNameSeverityScore(int cert_error) const; | 56 void InvalidCommonNameSeverityScore(); |
44 | 57 |
45 void RecordUMAStatistics(bool overridable, int cert_error); | 58 void RecordUMAStatistics(bool overridable) const; |
| 59 void RecordCaptivePortalUMAStatistics(bool overridable) const; |
46 base::TimeDelta TimePassedSinceExpiry() const; | 60 base::TimeDelta TimePassedSinceExpiry() const; |
47 | 61 |
48 private: | 62 private: |
49 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestDateInvalidScore); | 63 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestDateInvalidScore); |
50 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestNameMismatch); | 64 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, TestNameMismatch); |
51 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, | 65 FRIEND_TEST_ALL_PREFIXES(SSLErrorClassificationTest, |
52 TestHostNameHasKnownTLD); | 66 TestHostNameHasKnownTLD); |
53 | 67 |
54 typedef std::vector<std::string> Tokens; | 68 typedef std::vector<std::string> Tokens; |
55 | 69 |
(...skipping 27 matching lines...) Expand all Loading... |
83 // a.b.example.com ~ *.example.com --> true | 97 // a.b.example.com ~ *.example.com --> true |
84 // b.example.com ~ *.example.com --> false | 98 // b.example.com ~ *.example.com --> false |
85 bool IsSubDomainOutsideWildcard(const Tokens& hostname) const; | 99 bool IsSubDomainOutsideWildcard(const Tokens& hostname) const; |
86 | 100 |
87 // Returns true if the certificate is a shared certificate. Note - This | 101 // Returns true if the certificate is a shared certificate. Note - This |
88 // function should be used with caution (only for UMA histogram) as an | 102 // function should be used with caution (only for UMA histogram) as an |
89 // attacker could easily get a certificate with more than 5 names in the SAN | 103 // attacker could easily get a certificate with more than 5 names in the SAN |
90 // fields. | 104 // fields. |
91 bool IsCertLikelyFromMultiTenantHosting() const; | 105 bool IsCertLikelyFromMultiTenantHosting() const; |
92 | 106 |
93 float CalculateScoreTimePassedSinceExpiry() const; | |
94 | |
95 static std::vector<Tokens> GetTokenizedDNSNames( | 107 static std::vector<Tokens> GetTokenizedDNSNames( |
96 const std::vector<std::string>& dns_names); | 108 const std::vector<std::string>& dns_names); |
97 | 109 |
98 // If |potential_subdomain| is a subdomain of |parent|, returns the | 110 // If |potential_subdomain| is a subdomain of |parent|, returns the |
99 // number of DNS labels by which |potential_subdomain| is under | 111 // number of DNS labels by which |potential_subdomain| is under |
100 // |parent|. Otherwise, returns 0. | 112 // |parent|. Otherwise, returns 0. |
101 // | 113 // |
102 // For example, | 114 // For example, |
103 // | 115 // |
104 // FindSubDomainDifference(Tokenize("a.b.example.com"), | 116 // FindSubDomainDifference(Tokenize("a.b.example.com"), |
105 // Tokenize("example.com")) | 117 // Tokenize("example.com")) |
106 // --> 2. | 118 // --> 2. |
107 size_t FindSubDomainDifference(const Tokens& potential_subdomain, | 119 size_t FindSubDomainDifference(const Tokens& potential_subdomain, |
108 const Tokens& parent) const; | 120 const Tokens& parent) const; |
109 | 121 |
110 static Tokens Tokenize(const std::string& name); | 122 static Tokens Tokenize(const std::string& name); |
111 | 123 |
| 124 float CalculateScoreTimePassedSinceExpiry() const; |
| 125 float CalculateScoreEnvironments() const; |
| 126 |
| 127 // content::NotificationObserver: |
| 128 virtual void Observe( |
| 129 int type, |
| 130 const content::NotificationSource& source, |
| 131 const content::NotificationDetails& details) OVERRIDE; |
| 132 |
| 133 content::WebContents* web_contents_; |
112 // This stores the current time. | 134 // This stores the current time. |
113 base::Time current_time_; | 135 base::Time current_time_; |
114 | |
115 const GURL& request_url_; | 136 const GURL& request_url_; |
116 | 137 int cert_error_; |
117 // This stores the certificate. | 138 // This stores the certificate. |
118 const net::X509Certificate& cert_; | 139 const net::X509Certificate& cert_; |
| 140 // Is captive portal detection enabled? |
| 141 bool captive_portal_detection_enabled_; |
| 142 // Did the probe complete before the interstitial was closed? |
| 143 bool captive_portal_probe_completed_; |
| 144 // Did the captive portal probe receive an error or get a non-HTTP response? |
| 145 bool captive_portal_no_response_; |
| 146 // Was a captive portal detected? |
| 147 bool captive_portal_detected_; |
| 148 |
| 149 content::NotificationRegistrar registrar_; |
119 }; | 150 }; |
120 | 151 |
121 #endif // CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ | 152 #endif // CHROME_BROWSER_SSL_SSL_ERROR_CLASSIFICATION_H_ |
OLD | NEW |