123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282 |
- // Copyright 2015 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "components/ssl_errors/error_info.h"
- #include <stddef.h>
- #include "base/i18n/message_formatter.h"
- #include "base/notreached.h"
- #include "base/strings/escape.h"
- #include "base/strings/utf_string_conversions.h"
- #include "components/strings/grit/components_strings.h"
- #include "net/base/net_errors.h"
- #include "net/cert/cert_status_flags.h"
- #include "net/ssl/ssl_info.h"
- #include "ui/base/l10n/l10n_util.h"
- #include "url/gurl.h"
- using base::UTF8ToUTF16;
- namespace ssl_errors {
- ErrorInfo::ErrorInfo(const std::u16string& details,
- const std::u16string& short_description)
- : details_(details), short_description_(short_description) {}
- // static
- ErrorInfo ErrorInfo::CreateError(ErrorType error_type,
- net::X509Certificate* cert,
- const GURL& request_url) {
- std::u16string details, short_description;
- switch (error_type) {
- case CERT_COMMON_NAME_INVALID: {
- std::vector<std::string> dns_names;
- cert->GetSubjectAltName(&dns_names, nullptr);
- size_t i = 0;
- if (dns_names.empty()) {
- // The certificate had no DNS names, display an explanatory string.
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_NO_SUBJECT_ALTERNATIVE_NAMES_DETAILS,
- UTF8ToUTF16(request_url.host()));
- } else {
- // If the certificate contains multiple DNS names, we choose the most
- // representative one -- either the DNS name that's also in the subject
- // field, or the first one. If this heuristic turns out to be
- // inadequate, we can consider choosing the DNS name that is the
- // "closest match" to the host name in the request URL, or listing all
- // the DNS names with an HTML <ul>.
- for (; i < dns_names.size(); ++i) {
- if (dns_names[i] == cert->subject().common_name)
- break;
- }
- if (i == dns_names.size())
- i = 0;
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS,
- UTF8ToUTF16(request_url.host()),
- base::EscapeForHTML(UTF8ToUTF16(dns_names[i])));
- }
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_COMMON_NAME_INVALID_DESCRIPTION);
- break;
- }
- case CERT_DATE_INVALID:
- if (cert->HasExpired()) {
- // Make sure to round up to the smallest integer value not less than
- // the expiration value (https://crbug.com/476758).
- int expiration_value =
- (base::Time::Now() - cert->valid_expiry()).InDays() + 1;
- details = base::i18n::MessageFormatter::FormatWithNumberedArgs(
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DETAILS),
- request_url.host(), expiration_value, base::Time::Now());
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DESCRIPTION);
- } else if (base::Time::Now() < cert->valid_start()) {
- details = base::i18n::MessageFormatter::FormatWithNumberedArgs(
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DETAILS),
- request_url.host(),
- (cert->valid_start() - base::Time::Now()).InDays());
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DESCRIPTION);
- } else {
- // Two possibilities: (1) an intermediate or root certificate has
- // expired, or (2) the certificate has become valid since the error
- // occurred. Both are probably rare cases. To avoid giving the wrong
- // date, remove the information.
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_NOT_VALID_AT_THIS_TIME_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_NOT_VALID_AT_THIS_TIME_DESCRIPTION);
- }
- break;
- case CERT_KNOWN_INTERCEPTION_BLOCKED:
- case CERT_AUTHORITY_INVALID:
- case CERT_SYMANTEC_LEGACY:
- details =
- l10n_util::GetStringFUTF16(IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_AUTHORITY_INVALID_DESCRIPTION);
- break;
- case CERT_CONTAINS_ERRORS:
- details =
- l10n_util::GetStringFUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DESCRIPTION);
- break;
- case CERT_NO_REVOCATION_MECHANISM:
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DESCRIPTION);
- break;
- case CERT_REVOKED:
- details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_REVOKED_CERT_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_DESCRIPTION);
- break;
- case CERT_INVALID:
- details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_INVALID_CERT_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_INVALID_CERT_DESCRIPTION);
- break;
- case CERT_WEAK_SIGNATURE_ALGORITHM:
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DESCRIPTION);
- break;
- case CERT_WEAK_KEY:
- details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_WEAK_KEY_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION);
- break;
- case CERT_NAME_CONSTRAINT_VIOLATION:
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DESCRIPTION);
- break;
- case CERT_VALIDITY_TOO_LONG:
- details =
- l10n_util::GetStringFUTF16(IDS_CERT_ERROR_VALIDITY_TOO_LONG_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_VALIDITY_TOO_LONG_DESCRIPTION);
- break;
- case CERT_PINNED_KEY_MISSING:
- details = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_SUMMARY_PINNING_FAILURE_DETAILS);
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_SUMMARY_PINNING_FAILURE_DESCRIPTION);
- break;
- case CERT_UNABLE_TO_CHECK_REVOCATION:
- details = l10n_util::GetStringFUTF16(
- IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DETAILS,
- UTF8ToUTF16(request_url.host()));
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DESCRIPTION);
- break;
- case CERTIFICATE_TRANSPARENCY_REQUIRED:
- details = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_CERTIFICATE_TRANSPARENCY_REQUIRED_DETAILS);
- short_description = l10n_util::GetStringUTF16(
- IDS_CERT_ERROR_CERTIFICATE_TRANSPARENCY_REQUIRED_DESCRIPTION);
- break;
- case UNKNOWN:
- details = l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DETAILS);
- short_description =
- l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DESCRIPTION);
- break;
- default:
- NOTREACHED();
- }
- return ErrorInfo(details, short_description);
- }
- ErrorInfo::~ErrorInfo() {}
- // static
- ErrorInfo::ErrorType ErrorInfo::NetErrorToErrorType(int net_error) {
- switch (net_error) {
- case net::ERR_CERT_COMMON_NAME_INVALID:
- return CERT_COMMON_NAME_INVALID;
- case net::ERR_CERT_DATE_INVALID:
- return CERT_DATE_INVALID;
- case net::ERR_CERT_AUTHORITY_INVALID:
- return CERT_AUTHORITY_INVALID;
- case net::ERR_CERT_CONTAINS_ERRORS:
- return CERT_CONTAINS_ERRORS;
- case net::ERR_CERT_NO_REVOCATION_MECHANISM:
- return CERT_NO_REVOCATION_MECHANISM;
- case net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
- return CERT_UNABLE_TO_CHECK_REVOCATION;
- case net::ERR_CERT_REVOKED:
- return CERT_REVOKED;
- case net::ERR_CERT_INVALID:
- return CERT_INVALID;
- case net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
- return CERT_WEAK_SIGNATURE_ALGORITHM;
- case net::ERR_CERT_WEAK_KEY:
- return CERT_WEAK_KEY;
- case net::ERR_CERT_NAME_CONSTRAINT_VIOLATION:
- return CERT_NAME_CONSTRAINT_VIOLATION;
- case net::ERR_CERT_VALIDITY_TOO_LONG:
- return CERT_VALIDITY_TOO_LONG;
- case net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN:
- return CERT_PINNED_KEY_MISSING;
- case net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED:
- return CERTIFICATE_TRANSPARENCY_REQUIRED;
- case net::ERR_CERT_SYMANTEC_LEGACY:
- return CERT_SYMANTEC_LEGACY;
- case net::ERR_CERT_KNOWN_INTERCEPTION_BLOCKED:
- return CERT_KNOWN_INTERCEPTION_BLOCKED;
- default:
- NOTREACHED();
- return UNKNOWN;
- }
- }
- // static
- void ErrorInfo::GetErrorsForCertStatus(
- const scoped_refptr<net::X509Certificate>& cert,
- net::CertStatus cert_status,
- const GURL& url,
- std::vector<ErrorInfo>* errors) {
- const net::CertStatus kErrorFlags[] = {
- net::CERT_STATUS_COMMON_NAME_INVALID,
- net::CERT_STATUS_DATE_INVALID,
- net::CERT_STATUS_AUTHORITY_INVALID,
- net::CERT_STATUS_NO_REVOCATION_MECHANISM,
- net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION,
- net::CERT_STATUS_REVOKED,
- net::CERT_STATUS_INVALID,
- net::CERT_STATUS_WEAK_SIGNATURE_ALGORITHM,
- net::CERT_STATUS_WEAK_KEY,
- net::CERT_STATUS_NAME_CONSTRAINT_VIOLATION,
- net::CERT_STATUS_VALIDITY_TOO_LONG,
- net::CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED,
- net::CERT_STATUS_SYMANTEC_LEGACY,
- net::CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED,
- };
- const ErrorType kErrorTypes[] = {
- CERT_COMMON_NAME_INVALID,
- CERT_DATE_INVALID,
- CERT_AUTHORITY_INVALID,
- CERT_NO_REVOCATION_MECHANISM,
- CERT_UNABLE_TO_CHECK_REVOCATION,
- CERT_REVOKED,
- CERT_INVALID,
- CERT_WEAK_SIGNATURE_ALGORITHM,
- CERT_WEAK_KEY,
- CERT_NAME_CONSTRAINT_VIOLATION,
- CERT_VALIDITY_TOO_LONG,
- CERTIFICATE_TRANSPARENCY_REQUIRED,
- CERT_SYMANTEC_LEGACY,
- CERT_KNOWN_INTERCEPTION_BLOCKED,
- };
- DCHECK(std::size(kErrorFlags) == std::size(kErrorTypes));
- for (size_t i = 0; i < std::size(kErrorFlags); ++i) {
- if ((cert_status & kErrorFlags[i]) && errors) {
- errors->push_back(
- ErrorInfo::CreateError(kErrorTypes[i], cert.get(), url));
- }
- }
- }
- } // namespace ssl_errors
|