Add TLS-SRP (RFC 5054) support

chrome/browser/page_info_model.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/page_info_model.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/i18n/time_formatting.h"
@@ skipping 37 matching lines @@
         l10n_util::GetStringUTF16(IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
     empty_subject_name = true;
   }
 
   // Some of what IsCertStatusError classifies as errors we want to show as
   // warnings instead.
   static const int cert_warnings =
       net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION |
       net::CERT_STATUS_NO_REVOCATION_MECHANISM;
   int status_with_warnings_removed = ssl.cert_status() & ~cert_warnings;
+  bool show_secure_identity_msg = false;
 
   if (ssl.cert_id() &&
       CertStore::GetInstance()->RetrieveCert(ssl.cert_id(), &cert) &&
       !net::IsCertStatusError(status_with_warnings_removed)) {
+    show_secure_identity_msg = true;
     // No error found so far, check cert_status warnings.
     int cert_status = ssl.cert_status();
     if (cert_status & cert_warnings) {
       string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
       if (issuer_name.empty()) {
         issuer_name.assign(l10n_util::GetStringUTF16(
             IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
       }
       description.assign(l10n_util::GetStringFUTF16(
           IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY, issuer_name));
@@ skipping 54 matching lines @@
       else
         headline.assign(subject_name);
       string16 issuer_name(UTF8ToUTF16(cert->issuer().GetDisplayName()));
       if (issuer_name.empty()) {
         issuer_name.assign(l10n_util::GetStringUTF16(
             IDS_PAGE_INFO_SECURITY_TAB_UNKNOWN_PARTY));
       }
       description.assign(l10n_util::GetStringFUTF16(
           IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY, issuer_name));
     }
-  } else {
+    if (!ssl.tls_username().empty()) {
+      description += ASCIIToUTF16("\n\n");
+      description += l10n_util::GetStringUTF16(
+          IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_PLUS_SHARED_SECRET);
+    }
+  } else if (ssl.tls_username().empty() ||
+             (!ssl.tls_username().empty() && ssl.cert_id())) {
     // HTTP or HTTPS with errors (not warnings).
     description.assign(l10n_util::GetStringUTF16(
+        ssl.cert_id() && !ssl.tls_username().empty() ?
+        IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_BAD_CERT_OK_SHARED_SECRET :
         IDS_PAGE_INFO_SECURITY_TAB_INSECURE_IDENTITY));
     icon_id = ssl.security_style() == SECURITY_STYLE_UNAUTHENTICATED ?
         ICON_STATE_WARNING_MAJOR : ICON_STATE_ERROR;
 
     const string16 bullet = UTF8ToUTF16("\n • ");
     std::vector<SSLErrorInfo> errors;
     SSLErrorInfo::GetErrorsForCertStatus(ssl.cert_id(), ssl.cert_status(),
                                          url, &errors);
     for (size_t i = 0; i < errors.size(); ++i) {
       description += bullet;
       description += errors[i].short_description();
     }
 
     if (ssl.cert_status() & net::CERT_STATUS_NON_UNIQUE_NAME) {
       description += ASCIIToUTF16("\n\n");
       description += l10n_util::GetStringUTF16(
           IDS_PAGE_INFO_SECURITY_TAB_NON_UNIQUE_NAME);
     }
+  } else if (!ssl.tls_username().empty()) {
+    // HTTPS with TLS-SRP (with no certificate)
+    if (!description.empty())
+      description += ASCIIToUTF16("\n\n");
+    description += l10n_util::GetStringUTF16(
+        IDS_PAGE_INFO_SECURITY_TAB_SECURE_IDENTITY_SHARED_SECRET);
   }
+
+  if (!ssl.tls_username().empty()) {
+    description += ASCIIToUTF16("\n\n");
+    description += l10n_util::GetStringFUTF16(
+        IDS_PAGE_INFO_TLS_USER_IDENTITY, subject_name, ssl.tls_username());
+  }
+
   sections_.push_back(SectionInfo(
       icon_id,
       headline,
       description,
       SECTION_INFO_IDENTITY));
 
   // Connection section.
   // We consider anything less than 80 bits encryption to be weak encryption.
   // TODO(wtc): Bug 1198735: report mixed/unsafe content for unencrypted and
   // weakly encrypted connections.
   icon_id = ICON_STATE_OK;
   headline.clear();
   description.clear();
-  if (!ssl.cert_id()) {
+  if (!ssl.cert_id() && ssl.tls_username().empty()) {
     // Not HTTPS.
     DCHECK_EQ(ssl.security_style(), SECURITY_STYLE_UNAUTHENTICATED);
     icon_id = ssl.security_style() == SECURITY_STYLE_UNAUTHENTICATED ?
         ICON_STATE_WARNING_MAJOR : ICON_STATE_ERROR;
     description.assign(l10n_util::GetStringFUTF16(
         IDS_PAGE_INFO_SECURITY_TAB_NOT_ENCRYPTED_CONNECTION_TEXT,
         subject_name));
   } else if (ssl.security_bits() < 0) {
     // Security strength is unknown.  Say nothing.
     icon_id = ICON_STATE_ERROR;
@@ skipping 177 matching lines @@
 gfx::NativeImage PageInfoModel::GetBitmapNamed(int resource_id) {
   ResourceBundle& rb = ResourceBundle::GetSharedInstance();
   gfx::NativeImage image = rb.GetNativeImageNamed(resource_id);
 #if defined(OS_MACOSX)
   // Unlike other platforms, the Mac ResourceBundle does not keep a shared image
   // cache. These are released in the dtor.
   base::mac::NSObjectRetain(image);
 #endif
   return image;
 }