diff options
Diffstat (limited to 'chrome/browser/ssl/ssl_error_handler.cc')
-rw-r--r-- | chrome/browser/ssl/ssl_error_handler.cc | 123 |
1 files changed, 94 insertions, 29 deletions
diff --git a/chrome/browser/ssl/ssl_error_handler.cc b/chrome/browser/ssl/ssl_error_handler.cc index 594a683..60cd2ae 100644 --- a/chrome/browser/ssl/ssl_error_handler.cc +++ b/chrome/browser/ssl/ssl_error_handler.cc @@ -11,6 +11,7 @@ #include "chrome/browser/profiles/profile.h" #include "chrome/browser/ssl/ssl_blocking_page.h" #include "chrome/browser/ssl/ssl_cert_reporter.h" +#include "chrome/browser/ssl/ssl_error_classification.h" #include "content/public/browser/notification_service.h" #include "content/public/browser/notification_source.h" #include "content/public/browser/web_contents.h" @@ -39,6 +40,8 @@ enum SSLErrorHandlerEvent { SHOW_CAPTIVE_PORTAL_INTERSTITIAL_OVERRIDABLE, SHOW_SSL_INTERSTITIAL_NONOVERRIDABLE, SHOW_SSL_INTERSTITIAL_OVERRIDABLE, + SHOW_COMMON_NAME_MISMATCH_INTERSTITIAL_NONOVERRIDABLE, + SHOW_COMMON_NAME_MISMATCH_INTERSTITIAL_OVERRIDABLE, SSL_ERROR_HANDLER_EVENT_COUNT }; @@ -48,10 +51,10 @@ void RecordUMA(SSLErrorHandlerEvent event) { SSL_ERROR_HANDLER_EVENT_COUNT); } -#if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) // The delay before displaying the SSL interstitial for cert errors. -// - If a "captive portal detected" result arrives in this many seconds, -// a captive portal interstitial is displayed. +// - If a "captive portal detected" or "suggested URL valid" result +// arrives in this many seconds, then a captive portal interstitial +// or a common name mismatch interstitial is displayed. // - Otherwise, an SSL interstitial is displayed. const int kDefaultInterstitialDisplayDelayInSeconds = 2; @@ -74,6 +77,7 @@ base::TimeDelta GetInterstitialDisplayDelay( return base::TimeDelta(); } +#if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) bool IsCaptivePortalInterstitialEnabled() { return base::FieldTrialList::FindFullName("CaptivePortalInterstitial") == "Enabled"; @@ -92,13 +96,6 @@ void SSLErrorHandler::HandleSSLError( int options_mask, scoped_ptr<SSLCertReporter> ssl_cert_reporter, const base::Callback<void(bool)>& callback) { -#if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) - CaptivePortalTabHelper* captive_portal_tab_helper = - CaptivePortalTabHelper::FromWebContents(web_contents); - if (captive_portal_tab_helper) { - captive_portal_tab_helper->OnSSLCertError(ssl_info); - } -#endif DCHECK(!FromWebContents(web_contents)); web_contents->SetUserData( UserDataKey(), @@ -137,15 +134,8 @@ SSLErrorHandler::SSLErrorHandler(content::WebContents* web_contents, request_url_(request_url), options_mask_(options_mask), callback_(callback), - ssl_cert_reporter_(ssl_cert_reporter.Pass()) { -#if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) - Profile* profile = Profile::FromBrowserContext( - web_contents->GetBrowserContext()); - registrar_.Add(this, - chrome::NOTIFICATION_CAPTIVE_PORTAL_CHECK_RESULT, - content::Source<Profile>(profile)); -#endif -} + profile_(Profile::FromBrowserContext(web_contents->GetBrowserContext())), + ssl_cert_reporter_(ssl_cert_reporter.Pass()) {} SSLErrorHandler::~SSLErrorHandler() { } @@ -153,7 +143,46 @@ SSLErrorHandler::~SSLErrorHandler() { void SSLErrorHandler::StartHandlingError() { RecordUMA(HANDLE_ALL); + std::vector<std::string> dns_names; + ssl_info_.cert->GetDNSNames(&dns_names); + DCHECK(!dns_names.empty()); + GURL suggested_url; + if (ssl_info_.cert_status == net::CERT_STATUS_COMMON_NAME_INVALID && + GetSuggestedUrl(dns_names, &suggested_url)) { + net::CertStatus extra_cert_errors = + ssl_info_.cert_status ^ net::CERT_STATUS_COMMON_NAME_INVALID; + + // Show the SSL intersitial if |CERT_STATUS_COMMON_NAME_INVALID| is not + // the only error. Need not check for captive portal in this case. + // (See the comment below). + if (net::IsCertStatusError(extra_cert_errors) && + !net::IsCertStatusMinorError(ssl_info_.cert_status)) { + ShowSSLInterstitial(); + return; + } + CheckSuggestedUrl(suggested_url); + timer_.Start(FROM_HERE, + GetInterstitialDisplayDelay(g_interstitial_delay_type), this, + &SSLErrorHandler::OnTimerExpired); + if (g_timer_started_callback) + g_timer_started_callback->Run(web_contents_); + + // Do not check for a captive portal in this case, because a captive + // portal most likely cannot serve a valid certificate which passes the + // similarity check. + return; + } + #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) + CaptivePortalTabHelper* captive_portal_tab_helper = + CaptivePortalTabHelper::FromWebContents(web_contents_); + if (captive_portal_tab_helper) { + captive_portal_tab_helper->OnSSLCertError(ssl_info_); + } + + registrar_.Add(this, chrome::NOTIFICATION_CAPTIVE_PORTAL_CHECK_RESULT, + content::Source<Profile>(profile_)); + if (IsCaptivePortalInterstitialEnabled()) { CheckForCaptivePortal(); timer_.Start(FROM_HERE, @@ -172,12 +201,34 @@ void SSLErrorHandler::OnTimerExpired() { ShowSSLInterstitial(); } +bool SSLErrorHandler::GetSuggestedUrl(const std::vector<std::string>& dns_names, + GURL* suggested_url) const { + return CommonNameMismatchHandler::GetSuggestedUrl(request_url_, dns_names, + suggested_url); +} + +void SSLErrorHandler::CheckSuggestedUrl(const GURL& suggested_url) { + scoped_refptr<net::URLRequestContextGetter> request_context( + profile_->GetRequestContext()); + common_name_mismatch_handler_.reset( + new CommonNameMismatchHandler(request_url_, request_context)); + + common_name_mismatch_handler_->CheckSuggestedUrl( + suggested_url, + base::Bind(&SSLErrorHandler::CommonNameMismatchHandlerCallback, + base::Unretained(this))); +} + +void SSLErrorHandler::NavigateToSuggestedURL(const GURL& suggested_url) { + content::NavigationController::LoadURLParams load_params(suggested_url); + load_params.transition_type = ui::PAGE_TRANSITION_TYPED; + web_contents()->GetController().LoadURLWithParams(load_params); +} + void SSLErrorHandler::CheckForCaptivePortal() { #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) - Profile* profile = Profile::FromBrowserContext( - web_contents_->GetBrowserContext()); CaptivePortalService* captive_portal_service = - CaptivePortalServiceFactory::GetForProfile(profile); + CaptivePortalServiceFactory::GetForProfile(profile_); captive_portal_service->DetectCaptivePortal(); #else NOTREACHED(); @@ -187,9 +238,7 @@ void SSLErrorHandler::CheckForCaptivePortal() { void SSLErrorHandler::ShowCaptivePortalInterstitial(const GURL& landing_url) { #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION) // Show captive portal blocking page. The interstitial owns the blocking page. - const Profile* const profile = - Profile::FromBrowserContext(web_contents_->GetBrowserContext()); - RecordUMA(SSLBlockingPage::IsOverridable(options_mask_, profile) + RecordUMA(SSLBlockingPage::IsOverridable(options_mask_, profile_) ? SHOW_CAPTIVE_PORTAL_INTERSTITIAL_OVERRIDABLE : SHOW_CAPTIVE_PORTAL_INTERSTITIAL_NONOVERRIDABLE); (new CaptivePortalBlockingPage(web_contents_, request_url_, landing_url, @@ -205,14 +254,14 @@ void SSLErrorHandler::ShowCaptivePortalInterstitial(const GURL& landing_url) { void SSLErrorHandler::ShowSSLInterstitial() { // Show SSL blocking page. The interstitial owns the blocking page. - const Profile* const profile = - Profile::FromBrowserContext(web_contents_->GetBrowserContext()); - RecordUMA(SSLBlockingPage::IsOverridable(options_mask_, profile) + RecordUMA(SSLBlockingPage::IsOverridable(options_mask_, profile_) ? SHOW_SSL_INTERSTITIAL_OVERRIDABLE : SHOW_SSL_INTERSTITIAL_NONOVERRIDABLE); + (new SSLBlockingPage(web_contents_, cert_error_, ssl_info_, request_url_, options_mask_, base::Time::NowFromSystemTime(), - ssl_cert_reporter_.Pass(), callback_))->Show(); + ssl_cert_reporter_.Pass(), callback_)) + ->Show(); // Once an interstitial is displayed, no need to keep the handler around. // This is the equivalent of "delete this". web_contents_->RemoveUserData(UserDataKey()); @@ -255,5 +304,21 @@ void SSLErrorHandler::DeleteSSLErrorHandler() { if (!callback_.is_null()) { base::ResetAndReturn(&callback_).Run(false); } + if (common_name_mismatch_handler_) { + common_name_mismatch_handler_->Cancel(); + common_name_mismatch_handler_.reset(); + } web_contents_->RemoveUserData(UserDataKey()); } + +void SSLErrorHandler::CommonNameMismatchHandlerCallback( + const CommonNameMismatchHandler::SuggestedUrlCheckResult& result, + const GURL& suggested_url) { + timer_.Stop(); + if (result == CommonNameMismatchHandler::SuggestedUrlCheckResult:: + SUGGESTED_URL_AVAILABLE) { + NavigateToSuggestedURL(suggested_url); + } else { + ShowSSLInterstitial(); + } +} |