net: show UI warnings for SSLv3.

chrome/browser/ui/website_settings/website_settings.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/website_settings/website_settings.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 533 matching lines @@
               IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_INSECURE_CONTENT_ERROR :
               IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTED_INSECURE_CONTENT_WARNING)));
     }
   }
 
   uint16 cipher_suite =
       net::SSLConnectionStatusToCipherSuite(ssl.connection_status);
   if (ssl.security_bits > 0 && cipher_suite) {
     int ssl_version =
         net::SSLConnectionStatusToVersion(ssl.connection_status);
+    const bool is_sslv3 = ssl_version == net::SSL_CONNECTION_VERSION_SSL3;

[msw, 2014/10/20 18:27:39]

nit: move this down to where it's used, or inline it.

     const char* ssl_version_str;
     net::SSLVersionToString(&ssl_version_str, ssl_version);
     site_connection_details_ += ASCIIToUTF16("\n\n");
     site_connection_details_ += l10n_util::GetStringFUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_SSL_VERSION,
         ASCIIToUTF16(ssl_version_str));
 
-    bool did_fallback = (ssl.connection_status &

[msw, 2014/10/20 18:27:39]

q: do you actually intend to remove SSL_CONNECTION_VERSION_FALLBACK as a trigger
for SITE_CONNECTION_STATUS_MIXED_CONTENT? (I'm not a knowledgeable reviewer for
this, but it caught my eye)

-                         net::SSL_CONNECTION_VERSION_FALLBACK) != 0;

[agl, 2014/10/20 18:55:19]

Yes, fallback to SSLv3 is getting removed in Chrome 39 (hopefully) thus we don't
need it any longer. We are now warning about SSLv3 in general to prepare for
removal in Chrome 40.

[msw, 2014/10/20 19:14:06]

Acknowledged.

     bool no_renegotiation =
         (ssl.connection_status &
         net::SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) != 0;
     const char *key_exchange, *cipher, *mac;
     bool is_aead;
     net::SSLCipherSuiteToStrings(
         &key_exchange, &cipher, &mac, &is_aead, cipher_suite);
 
     site_connection_details_ += ASCIIToUTF16("\n\n");
     if (is_aead) {
       site_connection_details_ += l10n_util::GetStringFUTF16(
           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTION_DETAILS_AEAD,
           ASCIIToUTF16(cipher), ASCIIToUTF16(key_exchange));
     } else {
       site_connection_details_ += l10n_util::GetStringFUTF16(
           IDS_PAGE_INFO_SECURITY_TAB_ENCRYPTION_DETAILS,
           ASCIIToUTF16(cipher), ASCIIToUTF16(mac), ASCIIToUTF16(key_exchange));
     }
 
-    if (did_fallback) {
-      // For now, only SSLv3 fallback will trigger a warning icon.
-      if (site_connection_status_ < SITE_CONNECTION_STATUS_MIXED_CONTENT)
-        site_connection_status_ = SITE_CONNECTION_STATUS_MIXED_CONTENT;
-      site_connection_details_ += ASCIIToUTF16("\n\n");
-      site_connection_details_ += l10n_util::GetStringUTF16(
-          IDS_PAGE_INFO_SECURITY_TAB_FALLBACK_MESSAGE);

[msw, 2014/10/20 18:27:39]

The IDS and string asset should be removed if they're no longer used.

[agl, 2014/10/20 18:55:19]

I did plan on removing this message but, having slept on it, I've decided that
it's still useful, so I've moved |did_fallback| down here and added it back in.

[msw, 2014/10/20 19:14:06]

Acknowledged.

+    if (is_sslv3 &&
+        site_connection_status_ < SITE_CONNECTION_STATUS_MIXED_CONTENT) {
+      site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
     }
+
     if (no_renegotiation) {
       site_connection_details_ += ASCIIToUTF16("\n\n");
       site_connection_details_ += l10n_util::GetStringUTF16(
           IDS_PAGE_INFO_SECURITY_TAB_RENEGOTIATION_MESSAGE);
     }
   }
 
   // Check if a user decision has been made to allow or deny certificates with
   // errors on this site.
   ChromeSSLHostStateDelegate* delegate =
@@ skipping 162 matching lines @@
   if (visited_before_today) {
     first_visit_text = l10n_util::GetStringFUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_VISITED_BEFORE_TODAY,
         base::TimeFormatShortDate(first_visit));
   } else {
     first_visit_text = l10n_util::GetStringUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_FIRST_VISITED_TODAY);
   }
   ui_->SetFirstVisit(first_visit_text);
 }