OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/ssl/ssl_error_info.h" | 5 #include "chrome/browser/ssl/ssl_error_info.h" |
6 | 6 |
7 #include "base/i18n/time_formatting.h" | 7 #include "base/i18n/time_formatting.h" |
8 #include "base/strings/string_number_conversions.h" | 8 #include "base/strings/string_number_conversions.h" |
9 #include "base/strings/utf_string_conversions.h" | 9 #include "base/strings/utf_string_conversions.h" |
10 #include "content/public/browser/cert_store.h" | 10 #include "content/public/browser/cert_store.h" |
11 #include "grit/chromium_strings.h" | 11 #include "grit/chromium_strings.h" |
12 #include "grit/generated_resources.h" | 12 #include "grit/generated_resources.h" |
13 #include "net/base/escape.h" | 13 #include "net/base/escape.h" |
14 #include "net/base/net_errors.h" | 14 #include "net/base/net_errors.h" |
15 #include "net/cert/cert_status_flags.h" | 15 #include "net/cert/cert_status_flags.h" |
16 #include "net/ssl/ssl_info.h" | 16 #include "net/ssl/ssl_info.h" |
17 #include "ui/base/l10n/l10n_util.h" | 17 #include "ui/base/l10n/l10n_util.h" |
18 #include "url/gurl.h" | 18 #include "url/gurl.h" |
19 | 19 |
20 using base::UTF8ToUTF16; | 20 using base::UTF8ToUTF16; |
21 | 21 |
22 SSLErrorInfo::SSLErrorInfo(const base::string16& title, | 22 SSLErrorInfo::SSLErrorInfo(const base::string16& details, |
23 const base::string16& details, | 23 const base::string16& short_description) |
24 const base::string16& short_description, | 24 : details_(details), |
25 const std::vector<base::string16>& extra_info) | 25 short_description_(short_description) { |
26 : title_(title), | |
27 details_(details), | |
28 short_description_(short_description), | |
29 extra_information_(extra_info) { | |
30 } | 26 } |
31 | 27 |
32 // static | 28 // static |
33 SSLErrorInfo SSLErrorInfo::CreateError(ErrorType error_type, | 29 SSLErrorInfo SSLErrorInfo::CreateError(ErrorType error_type, |
34 net::X509Certificate* cert, | 30 net::X509Certificate* cert, |
35 const GURL& request_url) { | 31 const GURL& request_url) { |
36 base::string16 title, details, short_description; | 32 base::string16 details, short_description; |
37 std::vector<base::string16> extra_info; | |
38 switch (error_type) { | 33 switch (error_type) { |
39 case CERT_COMMON_NAME_INVALID: { | 34 case CERT_COMMON_NAME_INVALID: { |
40 title = | |
41 l10n_util::GetStringUTF16(IDS_CERT_ERROR_COMMON_NAME_INVALID_TITLE); | |
42 // If the certificate contains multiple DNS names, we choose the most | 35 // If the certificate contains multiple DNS names, we choose the most |
43 // representative one -- either the DNS name that's also in the subject | 36 // representative one -- either the DNS name that's also in the subject |
44 // field, or the first one. If this heuristic turns out to be | 37 // field, or the first one. If this heuristic turns out to be |
45 // inadequate, we can consider choosing the DNS name that is the | 38 // inadequate, we can consider choosing the DNS name that is the |
46 // "closest match" to the host name in the request URL, or listing all | 39 // "closest match" to the host name in the request URL, or listing all |
47 // the DNS names with an HTML <ul>. | 40 // the DNS names with an HTML <ul>. |
48 std::vector<std::string> dns_names; | 41 std::vector<std::string> dns_names; |
49 cert->GetDNSNames(&dns_names); | 42 cert->GetDNSNames(&dns_names); |
50 DCHECK(!dns_names.empty()); | 43 DCHECK(!dns_names.empty()); |
51 size_t i = 0; | 44 size_t i = 0; |
52 for (; i < dns_names.size(); ++i) { | 45 for (; i < dns_names.size(); ++i) { |
53 if (dns_names[i] == cert->subject().common_name) | 46 if (dns_names[i] == cert->subject().common_name) |
54 break; | 47 break; |
55 } | 48 } |
56 if (i == dns_names.size()) | 49 if (i == dns_names.size()) |
57 i = 0; | 50 i = 0; |
58 details = | 51 details = |
59 l10n_util::GetStringFUTF16(IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS, | 52 l10n_util::GetStringFUTF16(IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS, |
60 UTF8ToUTF16(request_url.host()), | 53 UTF8ToUTF16(request_url.host()), |
61 net::EscapeForHTML( | 54 net::EscapeForHTML( |
62 UTF8ToUTF16(dns_names[i]))); | 55 UTF8ToUTF16(dns_names[i]))); |
63 short_description = l10n_util::GetStringUTF16( | 56 short_description = l10n_util::GetStringUTF16( |
64 IDS_CERT_ERROR_COMMON_NAME_INVALID_DESCRIPTION); | 57 IDS_CERT_ERROR_COMMON_NAME_INVALID_DESCRIPTION); |
65 extra_info.push_back( | |
66 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
67 extra_info.push_back( | |
68 l10n_util::GetStringFUTF16( | |
69 IDS_CERT_ERROR_COMMON_NAME_INVALID_EXTRA_INFO_2, | |
70 net::EscapeForHTML(UTF8ToUTF16(cert->subject().common_name)), | |
71 UTF8ToUTF16(request_url.host()))); | |
72 break; | 58 break; |
73 } | 59 } |
74 case CERT_DATE_INVALID: | 60 case CERT_DATE_INVALID: |
75 extra_info.push_back( | |
76 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
77 if (cert->HasExpired()) { | 61 if (cert->HasExpired()) { |
78 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_TITLE); | |
79 details = l10n_util::GetStringFUTF16( | 62 details = l10n_util::GetStringFUTF16( |
80 IDS_CERT_ERROR_EXPIRED_DETAILS, | 63 IDS_CERT_ERROR_EXPIRED_DETAILS, |
81 UTF8ToUTF16(request_url.host()), | 64 UTF8ToUTF16(request_url.host()), |
82 base::IntToString16( | 65 base::IntToString16( |
83 (base::Time::Now() - cert->valid_expiry()).InDays()), | 66 (base::Time::Now() - cert->valid_expiry()).InDays()), |
84 base::TimeFormatFriendlyDate(base::Time::Now())); | 67 base::TimeFormatFriendlyDate(base::Time::Now())); |
85 short_description = | 68 short_description = |
86 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DESCRIPTION); | 69 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DESCRIPTION); |
87 extra_info.push_back(l10n_util::GetStringUTF16( | |
88 IDS_CERT_ERROR_EXPIRED_DETAILS_EXTRA_INFO_2)); | |
89 } else { | 70 } else { |
90 // Then it must be not yet valid. We don't check that it is not yet | 71 // Then it must be not yet valid. We don't check that it is not yet |
91 // valid as there is still a very unlikely chance that the cert might | 72 // valid as there is still a very unlikely chance that the cert might |
92 // have become valid since the error occurred. | 73 // have become valid since the error occurred. |
93 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_TITLE); | |
94 details = l10n_util::GetStringFUTF16( | 74 details = l10n_util::GetStringFUTF16( |
95 IDS_CERT_ERROR_NOT_YET_VALID_DETAILS, | 75 IDS_CERT_ERROR_NOT_YET_VALID_DETAILS, |
96 UTF8ToUTF16(request_url.host()), | 76 UTF8ToUTF16(request_url.host()), |
97 base::IntToString16( | 77 base::IntToString16( |
98 (cert->valid_start() - base::Time::Now()).InDays())); | 78 (cert->valid_start() - base::Time::Now()).InDays())); |
99 short_description = | 79 short_description = |
100 l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DESCRIPTION); | 80 l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DESCRIPTION); |
101 extra_info.push_back( | |
102 l10n_util::GetStringUTF16( | |
103 IDS_CERT_ERROR_NOT_YET_VALID_DETAILS_EXTRA_INFO_2)); | |
104 } | 81 } |
105 break; | 82 break; |
106 case CERT_AUTHORITY_INVALID: | 83 case CERT_AUTHORITY_INVALID: |
107 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_AUTHORITY_INVALID_TITLE); | |
108 details = l10n_util::GetStringFUTF16( | 84 details = l10n_util::GetStringFUTF16( |
109 IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS, | 85 IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS, |
110 UTF8ToUTF16(request_url.host())); | 86 UTF8ToUTF16(request_url.host())); |
111 short_description = l10n_util::GetStringUTF16( | 87 short_description = l10n_util::GetStringUTF16( |
112 IDS_CERT_ERROR_AUTHORITY_INVALID_DESCRIPTION); | 88 IDS_CERT_ERROR_AUTHORITY_INVALID_DESCRIPTION); |
113 extra_info.push_back( | |
114 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
115 extra_info.push_back(l10n_util::GetStringFUTF16( | |
116 IDS_CERT_ERROR_AUTHORITY_INVALID_EXTRA_INFO_2, | |
117 UTF8ToUTF16(request_url.host()), | |
118 UTF8ToUTF16(request_url.host()))); | |
119 #if !defined(OS_IOS) | |
120 // The third paragraph advises users to install a private trust anchor, | |
121 // but that is not possible in Chrome for iOS at this time. | |
122 extra_info.push_back(l10n_util::GetStringUTF16( | |
123 IDS_CERT_ERROR_AUTHORITY_INVALID_EXTRA_INFO_3)); | |
124 #endif | |
125 break; | 89 break; |
126 case CERT_CONTAINS_ERRORS: | 90 case CERT_CONTAINS_ERRORS: |
127 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_TITLE); | |
128 details = l10n_util::GetStringFUTF16( | 91 details = l10n_util::GetStringFUTF16( |
129 IDS_CERT_ERROR_CONTAINS_ERRORS_DETAILS, | 92 IDS_CERT_ERROR_CONTAINS_ERRORS_DETAILS, |
130 UTF8ToUTF16(request_url.host())); | 93 UTF8ToUTF16(request_url.host())); |
131 short_description = | 94 short_description = |
132 l10n_util::GetStringUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DESCRIPTION); | 95 l10n_util::GetStringUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DESCRIPTION); |
133 extra_info.push_back( | |
134 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
135 extra_info.push_back(l10n_util::GetStringUTF16( | |
136 IDS_CERT_ERROR_CONTAINS_ERRORS_EXTRA_INFO_2)); | |
137 break; | 96 break; |
138 case CERT_NO_REVOCATION_MECHANISM: | 97 case CERT_NO_REVOCATION_MECHANISM: |
139 title = l10n_util::GetStringUTF16( | |
140 IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_TITLE); | |
141 details = l10n_util::GetStringUTF16( | 98 details = l10n_util::GetStringUTF16( |
142 IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DETAILS); | 99 IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DETAILS); |
143 short_description = l10n_util::GetStringUTF16( | 100 short_description = l10n_util::GetStringUTF16( |
144 IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DESCRIPTION); | 101 IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DESCRIPTION); |
145 break; | 102 break; |
146 case CERT_UNABLE_TO_CHECK_REVOCATION: | |
147 // TODO(felt): Hasn't this been deprecated? | |
148 title = l10n_util::GetStringFUTF16( | |
149 IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_TITLE, | |
150 UTF8ToUTF16(request_url.host())); | |
151 details = l10n_util::GetStringUTF16( | |
152 IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DETAILS); | |
153 short_description = l10n_util::GetStringUTF16( | |
154 IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DESCRIPTION); | |
155 break; | |
156 case CERT_REVOKED: | 103 case CERT_REVOKED: |
157 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_TITLE); | |
158 details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_REVOKED_CERT_DETAILS, | 104 details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_REVOKED_CERT_DETAILS, |
159 UTF8ToUTF16(request_url.host())); | 105 UTF8ToUTF16(request_url.host())); |
160 short_description = | 106 short_description = |
161 l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_DESCRIPTION); | 107 l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_DESCRIPTION); |
162 extra_info.push_back( | |
163 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
164 extra_info.push_back( | |
165 l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_EXTRA_INFO_2)); | |
166 break; | 108 break; |
167 case CERT_INVALID: | 109 case CERT_INVALID: |
168 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_INVALID_CERT_TITLE); | |
169 details = l10n_util::GetStringFUTF16( | 110 details = l10n_util::GetStringFUTF16( |
170 IDS_CERT_ERROR_INVALID_CERT_DETAILS, | 111 IDS_CERT_ERROR_INVALID_CERT_DETAILS, |
171 UTF8ToUTF16(request_url.host())); | 112 UTF8ToUTF16(request_url.host())); |
172 short_description = | 113 short_description = |
173 l10n_util::GetStringUTF16(IDS_CERT_ERROR_INVALID_CERT_DESCRIPTION); | 114 l10n_util::GetStringUTF16(IDS_CERT_ERROR_INVALID_CERT_DESCRIPTION); |
174 extra_info.push_back( | |
175 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
176 extra_info.push_back(l10n_util::GetStringUTF16( | |
177 IDS_CERT_ERROR_INVALID_CERT_EXTRA_INFO_2)); | |
178 break; | 115 break; |
179 case CERT_WEAK_SIGNATURE_ALGORITHM: | 116 case CERT_WEAK_SIGNATURE_ALGORITHM: |
180 title = l10n_util::GetStringUTF16( | |
181 IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_TITLE); | |
182 details = l10n_util::GetStringFUTF16( | 117 details = l10n_util::GetStringFUTF16( |
183 IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DETAILS, | 118 IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DETAILS, |
184 UTF8ToUTF16(request_url.host())); | 119 UTF8ToUTF16(request_url.host())); |
185 short_description = l10n_util::GetStringUTF16( | 120 short_description = l10n_util::GetStringUTF16( |
186 IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DESCRIPTION); | 121 IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DESCRIPTION); |
187 extra_info.push_back( | |
188 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
189 extra_info.push_back( | |
190 l10n_util::GetStringUTF16( | |
191 IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_EXTRA_INFO_2)); | |
192 break; | 122 break; |
193 case CERT_WEAK_KEY: | 123 case CERT_WEAK_KEY: |
194 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_WEAK_KEY_TITLE); | |
195 details = l10n_util::GetStringFUTF16( | 124 details = l10n_util::GetStringFUTF16( |
196 IDS_CERT_ERROR_WEAK_KEY_DETAILS, UTF8ToUTF16(request_url.host())); | 125 IDS_CERT_ERROR_WEAK_KEY_DETAILS, UTF8ToUTF16(request_url.host())); |
197 short_description = l10n_util::GetStringUTF16( | 126 short_description = l10n_util::GetStringUTF16( |
198 IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION); | 127 IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION); |
199 extra_info.push_back( | |
200 l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXTRA_INFO_1)); | |
201 extra_info.push_back( | |
202 l10n_util::GetStringUTF16( | |
203 IDS_CERT_ERROR_WEAK_KEY_EXTRA_INFO_2)); | |
204 break; | 128 break; |
205 case CERT_WEAK_KEY_DH: | 129 case CERT_WEAK_KEY_DH: |
206 title = l10n_util::GetStringUTF16( | |
207 IDS_ERRORPAGES_HEADING_WEAK_SERVER_EPHEMERAL_DH_KEY); | |
208 details = l10n_util::GetStringFUTF16( | 130 details = l10n_util::GetStringFUTF16( |
209 IDS_CERT_ERROR_WEAK_KEY_DETAILS, UTF8ToUTF16(request_url.host())); | 131 IDS_CERT_ERROR_WEAK_KEY_DETAILS, UTF8ToUTF16(request_url.host())); |
210 short_description = l10n_util::GetStringUTF16( | 132 short_description = l10n_util::GetStringUTF16( |
211 IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION); | 133 IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION); |
212 extra_info.push_back( | |
213 l10n_util::GetStringUTF16( | |
214 IDS_ERRORPAGES_SUMMARY_WEAK_SERVER_EPHEMERAL_DH_KEY)); | |
215 case CERT_NAME_CONSTRAINT_VIOLATION: | 134 case CERT_NAME_CONSTRAINT_VIOLATION: |
216 title = l10n_util::GetStringUTF16( | |
217 IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_TITLE); | |
218 details = l10n_util::GetStringFUTF16( | 135 details = l10n_util::GetStringFUTF16( |
219 IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DETAILS, | 136 IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DETAILS, |
220 UTF8ToUTF16(request_url.host())); | 137 UTF8ToUTF16(request_url.host())); |
221 short_description = l10n_util::GetStringUTF16( | 138 short_description = l10n_util::GetStringUTF16( |
222 IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DESCRIPTION); | 139 IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DESCRIPTION); |
223 break; | 140 break; |
224 case CERT_PINNED_KEY_MISSING: | 141 case CERT_PINNED_KEY_MISSING: |
225 title = l10n_util::GetStringUTF16( | |
226 IDS_ERRORPAGES_HEADING_PINNING_FAILURE); | |
227 details = l10n_util::GetStringUTF16( | 142 details = l10n_util::GetStringUTF16( |
228 IDS_ERRORPAGES_SUMMARY_PINNING_FAILURE); | 143 IDS_ERRORPAGES_SUMMARY_PINNING_FAILURE); |
229 short_description = l10n_util::GetStringUTF16( | 144 short_description = l10n_util::GetStringUTF16( |
230 IDS_ERRORPAGES_DETAILS_PINNING_FAILURE); | 145 IDS_ERRORPAGES_DETAILS_PINNING_FAILURE); |
231 case UNKNOWN: | 146 case UNKNOWN: |
232 title = l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_TITLE); | |
233 details = l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DETAILS); | 147 details = l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DETAILS); |
234 short_description = | 148 short_description = |
235 l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DESCRIPTION); | 149 l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DESCRIPTION); |
236 break; | 150 break; |
| 151 case CERT_UNABLE_TO_CHECK_REVOCATION: // Deprecated. |
237 default: | 152 default: |
238 NOTREACHED(); | 153 NOTREACHED(); |
239 } | 154 } |
240 return SSLErrorInfo(title, details, short_description, extra_info); | 155 return SSLErrorInfo(details, short_description); |
241 } | 156 } |
242 | 157 |
243 SSLErrorInfo::~SSLErrorInfo() { | 158 SSLErrorInfo::~SSLErrorInfo() { |
244 } | 159 } |
245 | 160 |
246 // static | 161 // static |
247 SSLErrorInfo::ErrorType SSLErrorInfo::NetErrorToErrorType(int net_error) { | 162 SSLErrorInfo::ErrorType SSLErrorInfo::NetErrorToErrorType(int net_error) { |
248 switch (net_error) { | 163 switch (net_error) { |
249 case net::ERR_CERT_COMMON_NAME_INVALID: | 164 case net::ERR_CERT_COMMON_NAME_INVALID: |
250 return CERT_COMMON_NAME_INVALID; | 165 return CERT_COMMON_NAME_INVALID; |
(...skipping 69 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
320 cert_id, &cert); | 235 cert_id, &cert); |
321 DCHECK(r); | 236 DCHECK(r); |
322 } | 237 } |
323 if (errors) | 238 if (errors) |
324 errors->push_back( | 239 errors->push_back( |
325 SSLErrorInfo::CreateError(kErrorTypes[i], cert.get(), url)); | 240 SSLErrorInfo::CreateError(kErrorTypes[i], cert.get(), url)); |
326 } | 241 } |
327 } | 242 } |
328 return count; | 243 return count; |
329 } | 244 } |
OLD | NEW |