summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorpalmer@chromium.org <palmer@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2012-01-17 22:00:08 +0000
committerpalmer@chromium.org <palmer@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98>2012-01-17 22:00:08 +0000
commite3cf2313e15f3e8660e1d2948aad4670f040fe91 (patch)
treec200f81aeb4c894ee206ed007bf9a66f4ae87ded /net
parent5922cb23df5b69ece5fb4a022521a591cad21cf4 (diff)
downloadchromium_src-e3cf2313e15f3e8660e1d2948aad4670f040fe91.zip
chromium_src-e3cf2313e15f3e8660e1d2948aad4670f040fe91.tar.gz
chromium_src-e3cf2313e15f3e8660e1d2948aad4670f040fe91.tar.bz2
Rename is_hsts_host to fatal.
Per wtc: the old name was too specific, and became confusing because we now also have certificate errors that users cannot override, but for reasons other than (although still closely related to) HSTS. BUG=109941 Review URL: https://chromiumcodereview.appspot.com/9188019 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@117968 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net')
-rw-r--r--net/proxy/proxy_script_fetcher_impl.cc2
-rw-r--r--net/url_request/url_request.cc4
-rw-r--r--net/url_request/url_request.h12
-rw-r--r--net/url_request/url_request_http_job.cc5
-rw-r--r--net/url_request/url_request_job.cc4
-rw-r--r--net/url_request/url_request_job.h3
-rw-r--r--net/url_request/url_request_test_util.cc6
-rw-r--r--net/url_request/url_request_test_util.h11
-rw-r--r--net/url_request/url_request_unittest.cc8
9 files changed, 29 insertions, 26 deletions
diff --git a/net/proxy/proxy_script_fetcher_impl.cc b/net/proxy/proxy_script_fetcher_impl.cc
index 8bd8858..def3382 100644
--- a/net/proxy/proxy_script_fetcher_impl.cc
+++ b/net/proxy/proxy_script_fetcher_impl.cc
@@ -190,7 +190,7 @@ void ProxyScriptFetcherImpl::OnAuthRequired(URLRequest* request,
void ProxyScriptFetcherImpl::OnSSLCertificateError(URLRequest* request,
const SSLInfo& ssl_info,
- bool is_hsts_host) {
+ bool fatal) {
DCHECK_EQ(request, cur_request_.get());
// Revocation check failures are not fatal.
if (IsCertStatusMinorError(ssl_info.cert_status)) {
diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
index 1a87fdf..3db51b4 100644
--- a/net/url_request/url_request.cc
+++ b/net/url_request/url_request.cc
@@ -838,9 +838,9 @@ void URLRequest::NotifyCertificateRequested(
}
void URLRequest::NotifySSLCertificateError(const SSLInfo& ssl_info,
- bool is_hsts_host) {
+ bool fatal) {
if (delegate_)
- delegate_->OnSSLCertificateError(this, ssl_info, is_hsts_host);
+ delegate_->OnSSLCertificateError(this, ssl_info, fatal);
}
bool URLRequest::CanGetCookies(const CookieList& cookie_list) const {
diff --git a/net/url_request/url_request.h b/net/url_request/url_request.h
index eb6b657..1d2c5a2 100644
--- a/net/url_request/url_request.h
+++ b/net/url_request/url_request.h
@@ -262,12 +262,13 @@ class NET_EXPORT URLRequest : NON_EXPORTED_BASE(public base::NonThreadSafe) {
// safe thing and Cancel() the request or decide to proceed by calling
// ContinueDespiteLastError(). cert_error is a ERR_* error code
// indicating what's wrong with the certificate.
- // If |is_hsts_host| is true then the host in question is an HSTS host
- // which demands a higher level of security. In this case, errors must not
- // be bypassable by the user.
+ // If |fatal| is true then the host in question demands a higher level
+ // of security (due e.g. to HTTP Strict Transport Security, user
+ // preference, or built-in policy). In this case, errors must not be
+ // bypassable by the user.
virtual void OnSSLCertificateError(URLRequest* request,
const SSLInfo& ssl_info,
- bool is_hsts_host);
+ bool fatal);
// Called when reading cookies to allow the delegate to block access to the
// cookie. This method will never be invoked when LOAD_DO_NOT_SEND_COOKIES
@@ -693,8 +694,7 @@ class NET_EXPORT URLRequest : NON_EXPORTED_BASE(public base::NonThreadSafe) {
void NotifyAuthRequired(AuthChallengeInfo* auth_info);
void NotifyAuthRequiredComplete(NetworkDelegate::AuthRequiredResponse result);
void NotifyCertificateRequested(SSLCertRequestInfo* cert_request_info);
- void NotifySSLCertificateError(const SSLInfo& ssl_info,
- bool is_hsts_host);
+ void NotifySSLCertificateError(const SSLInfo& ssl_info, bool fatal);
bool CanGetCookies(const CookieList& cookie_list) const;
bool CanSetCookie(const std::string& cookie_line,
CookieOptions* options) const;
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
index 4c586d8..8e0fb6d 100644
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -738,13 +738,12 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
// what we should do.
TransportSecurityState::DomainState domain_state;
- const bool is_hsts_host =
+ const bool fatal =
context_->transport_security_state() &&
context_->transport_security_state()->GetDomainState(
&domain_state, request_info_.url.host(),
SSLConfigService::IsSNIAvailable(context_->ssl_config_service()));
- NotifySSLCertificateError(transaction_->GetResponseInfo()->ssl_info,
- is_hsts_host);
+ NotifySSLCertificateError(transaction_->GetResponseInfo()->ssl_info, fatal);
} else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
NotifyCertificateRequested(
transaction_->GetResponseInfo()->cert_request_info);
diff --git a/net/url_request/url_request_job.cc b/net/url_request/url_request_job.cc
index f34fd27..b384ace 100644
--- a/net/url_request/url_request_job.cc
+++ b/net/url_request/url_request_job.cc
@@ -232,11 +232,11 @@ void URLRequestJob::NotifyCertificateRequested(
}
void URLRequestJob::NotifySSLCertificateError(const SSLInfo& ssl_info,
- bool is_hsts_host) {
+ bool fatal) {
if (!request_)
return; // The request was destroyed, so there is no more work to do.
- request_->NotifySSLCertificateError(ssl_info, is_hsts_host);
+ request_->NotifySSLCertificateError(ssl_info, fatal);
}
bool URLRequestJob::CanGetCookies(const CookieList& cookie_list) const {
diff --git a/net/url_request/url_request_job.h b/net/url_request/url_request_job.h
index e849bd0..cf98447 100644
--- a/net/url_request/url_request_job.h
+++ b/net/url_request/url_request_job.h
@@ -203,8 +203,7 @@ class NET_EXPORT URLRequestJob : public base::RefCounted<URLRequestJob>,
void NotifyCertificateRequested(SSLCertRequestInfo* cert_request_info);
// Notifies the job about an SSL certificate error.
- void NotifySSLCertificateError(const SSLInfo& ssl_info,
- bool is_hsts_host);
+ void NotifySSLCertificateError(const SSLInfo& ssl_info, bool fatal);
// Delegates to URLRequest::Delegate.
bool CanGetCookies(const CookieList& cookie_list) const;
diff --git a/net/url_request/url_request_test_util.cc b/net/url_request/url_request_test_util.cc
index 3ca6cc9..d9544ab 100644
--- a/net/url_request/url_request_test_util.cc
+++ b/net/url_request/url_request_test_util.cc
@@ -174,7 +174,7 @@ TestDelegate::TestDelegate()
received_data_before_response_(false),
request_failed_(false),
have_certificate_errors_(false),
- is_hsts_host_(false),
+ certificate_errors_are_fatal_(false),
auth_required_(false),
buf_(new net::IOBuffer(kBufferSize)) {
}
@@ -205,12 +205,12 @@ void TestDelegate::OnAuthRequired(net::URLRequest* request,
void TestDelegate::OnSSLCertificateError(net::URLRequest* request,
const net::SSLInfo& ssl_info,
- bool is_hsts_host) {
+ bool fatal) {
// The caller can control whether it needs all SSL requests to go through,
// independent of any possible errors, or whether it wants SSL errors to
// cancel the request.
have_certificate_errors_ = true;
- is_hsts_host_ = is_hsts_host;
+ certificate_errors_are_fatal_ = fatal;
if (allow_certificate_errors_)
request->ContinueDespiteLastError();
else
diff --git a/net/url_request/url_request_test_util.h b/net/url_request/url_request_test_util.h
index 41dc378..d6054c0 100644
--- a/net/url_request/url_request_test_util.h
+++ b/net/url_request/url_request_test_util.h
@@ -120,7 +120,9 @@ class TestDelegate : public net::URLRequest::Delegate {
}
bool request_failed() const { return request_failed_; }
bool have_certificate_errors() const { return have_certificate_errors_; }
- bool is_hsts_host() const { return is_hsts_host_; }
+ bool certificate_errors_are_fatal() const {
+ return certificate_errors_are_fatal_;
+ }
bool auth_required_called() const { return auth_required_; }
// net::URLRequest::Delegate:
@@ -128,9 +130,12 @@ class TestDelegate : public net::URLRequest::Delegate {
bool* defer_redirect) OVERRIDE;
virtual void OnAuthRequired(net::URLRequest* request,
net::AuthChallengeInfo* auth_info) OVERRIDE;
+ // NOTE: |fatal| causes |certificate_errors_are_fatal_| to be set to true.
+ // (Unit tests use this as a post-condition.) But for policy, this method
+ // consults |allow_certificate_errors_|.
virtual void OnSSLCertificateError(net::URLRequest* request,
const net::SSLInfo& ssl_info,
- bool is_hsts_host) OVERRIDE;
+ bool fatal) OVERRIDE;
virtual bool CanGetCookies(const net::URLRequest* request,
const net::CookieList& cookie_list) const OVERRIDE;
virtual bool CanSetCookie(const net::URLRequest* request,
@@ -166,7 +171,7 @@ class TestDelegate : public net::URLRequest::Delegate {
bool received_data_before_response_;
bool request_failed_;
bool have_certificate_errors_;
- bool is_hsts_host_;
+ bool certificate_errors_are_fatal_;
bool auth_required_;
std::string data_received_;
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 064ce7b..bafbd6f 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -1337,9 +1337,9 @@ TEST_F(HTTPSRequestTest, HTTPSExpiredTest) {
}
}
-// This tests that a load of www.google.com with a certificate error sets the
-// is_hsts_host flag correctly. This flag will cause the interstitial to be
-// fatal.
+// This tests that a load of www.google.com with a certificate error sets
+// the |certificate_errors_are_fatal| flag correctly. This flag will cause
+// the interstitial to be fatal.
TEST_F(HTTPSRequestTest, HTTPSPreloadedHSTSTest) {
TestServer::HTTPSOptions https_options(
TestServer::HTTPSOptions::CERT_MISMATCHED_NAME);
@@ -1376,7 +1376,7 @@ TEST_F(HTTPSRequestTest, HTTPSPreloadedHSTSTest) {
EXPECT_EQ(1, d.response_started_count());
EXPECT_FALSE(d.received_data_before_response());
EXPECT_TRUE(d.have_certificate_errors());
- EXPECT_TRUE(d.is_hsts_host());
+ EXPECT_TRUE(d.certificate_errors_are_fatal());
}
namespace {
generated by cgit v1.1 at 2025-03-10 18:57:10 +0000