added clock interstitial to chrome://interstitials

chrome/browser/ssl/ssl_blocking_page.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_blocking_page.h"
 
 #include "base/build_time.h"
 #include "base/command_line.h"
 #include "base/i18n/rtl.h"
 #include "base/i18n/time_formatting.h"
@@ skipping 187 matching lines @@
 
 #endif
   // Don't add code here! (See the comment at the beginning of the function.)
 }
 
 bool IsErrorDueToBadClock(const base::Time& now, int error) {
   if (SSLErrorInfo::NetErrorToErrorType(error) !=
           SSLErrorInfo::CERT_DATE_INVALID) {
     return false;
   }
+

[lgarron, 2015/02/19 22:57:06]

Nit: I try to avoid introducing extra whitespace, just to make the diffs as
minimal and easy to read as possible.

[felt, 2015/02/20 16:01:53]

looks like you haven't addressed this?

[fahl, 2015/02/23 23:47:49]

Acknowledged.

   return SSLErrorClassification::IsUserClockInThePast(now) ||
       SSLErrorClassification::IsUserClockInTheFuture(now);
 }
 
 }  // namespace
 
 // static
 const void* SSLBlockingPage::kTypeForTesting =
     &SSLBlockingPage::kTypeForTesting;
 
 // Note that we always create a navigation entry with SSL errors.
 // No error happening loading a sub-resource triggers an interstitial so far.
 SSLBlockingPage::SSLBlockingPage(content::WebContents* web_contents,
                                  int cert_error,
                                  const net::SSLInfo& ssl_info,
                                  const GURL& request_url,
                                  int options_mask,
                                  const base::Callback<void(bool)>& callback)
     : SecurityInterstitialPage(web_contents, request_url),
       callback_(callback),
       cert_error_(cert_error),
       ssl_info_(ssl_info),
       overridable_(IsOptionsOverridable(options_mask)),
       danger_overridable_(true),
       strict_enforcement_((options_mask & STRICT_ENFORCEMENT) != 0),
       expired_but_previously_allowed_(
           (options_mask & EXPIRED_BUT_PREVIOUSLY_ALLOWED) != 0) {
-  interstitial_reason_ =
-      IsErrorDueToBadClock(base::Time::NowFromSystemTime(), cert_error_) ?
-      SSL_REASON_BAD_CLOCK : SSL_REASON_SSL;
+  // somehow we need to override the clockcheck - otherwise the interstitial
+  // will not be shown
+  std::string testHost("yourclockiswrong.com");

[lgarron, 2015/02/19 22:57:06]

If we have to hardcode a website, I think we should try to avoid something that
can conflict with a real website.

It seems the appropriate reserved TLD for this is .example:
https://tools.ietf.org/html/rfc2606#section-2
Maybe something like badclock.example?

I've spent a while trying to understand if this is needed; if you use the
"clock_error=1" URL parameter, does CERT_DATE_INVALID propagate here?

[felt, 2015/02/19 23:16:07]

We probably shouldn't be hardcoding anything for a test into production code. Is
there a better way to do this?

+  if ((SSLErrorInfo::NetErrorToErrorType(cert_error_) ==
+          SSLErrorInfo::CERT_DATE_INVALID) &&
+     (request_url.host().compare(testHost) == 0)) {
+    interstitial_reason_ = SSL_REASON_BAD_CLOCK;
+  } else {
+    interstitial_reason_ =
+        IsErrorDueToBadClock(base::Time::NowFromSystemTime(), cert_error_) ?
+        SSL_REASON_BAD_CLOCK : SSL_REASON_SSL;
+  }
 
   // We collapse the Rappor metric name to just "ssl" so we don't leak
   // the "overridable" bit.  We skip Rappor altogether for bad clocks.
   // This must be done after calculating |interstitial_reason_| above.
   metrics_helper_.reset(new SecurityInterstitialMetricsHelper(
       web_contents, request_url, GetUmaHistogramPrefix(), kSSLRapporPrefix,
       (interstitial_reason_ == SSL_REASON_BAD_CLOCK
            ? SecurityInterstitialMetricsHelper::SKIP_RAPPOR
            : SecurityInterstitialMetricsHelper::REPORT_RAPPOR),
       GetSamplingEventName()));
@@ skipping 312 matching lines @@
     event_name.append(kEventNotOverridable);
   event_name.append(net::ErrorToString(cert_error_));
   return event_name;
 }
 
 // static
 bool SSLBlockingPage::IsOptionsOverridable(int options_mask) {
   return (options_mask & SSLBlockingPage::OVERRIDABLE) &&
          !(options_mask & SSLBlockingPage::STRICT_ENFORCEMENT);
 }