error_info.cc 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "components/ssl_errors/error_info.h"
  5. #include <stddef.h>
  6. #include "base/i18n/message_formatter.h"
  7. #include "base/notreached.h"
  8. #include "base/strings/escape.h"
  9. #include "base/strings/utf_string_conversions.h"
  10. #include "components/strings/grit/components_strings.h"
  11. #include "net/base/net_errors.h"
  12. #include "net/cert/cert_status_flags.h"
  13. #include "net/ssl/ssl_info.h"
  14. #include "ui/base/l10n/l10n_util.h"
  15. #include "url/gurl.h"
  16. using base::UTF8ToUTF16;
  17. namespace ssl_errors {
  18. ErrorInfo::ErrorInfo(const std::u16string& details,
  19. const std::u16string& short_description)
  20. : details_(details), short_description_(short_description) {}
  21. // static
  22. ErrorInfo ErrorInfo::CreateError(ErrorType error_type,
  23. net::X509Certificate* cert,
  24. const GURL& request_url) {
  25. std::u16string details, short_description;
  26. switch (error_type) {
  27. case CERT_COMMON_NAME_INVALID: {
  28. std::vector<std::string> dns_names;
  29. cert->GetSubjectAltName(&dns_names, nullptr);
  30. size_t i = 0;
  31. if (dns_names.empty()) {
  32. // The certificate had no DNS names, display an explanatory string.
  33. details = l10n_util::GetStringFUTF16(
  34. IDS_CERT_ERROR_NO_SUBJECT_ALTERNATIVE_NAMES_DETAILS,
  35. UTF8ToUTF16(request_url.host()));
  36. } else {
  37. // If the certificate contains multiple DNS names, we choose the most
  38. // representative one -- either the DNS name that's also in the subject
  39. // field, or the first one. If this heuristic turns out to be
  40. // inadequate, we can consider choosing the DNS name that is the
  41. // "closest match" to the host name in the request URL, or listing all
  42. // the DNS names with an HTML <ul>.
  43. for (; i < dns_names.size(); ++i) {
  44. if (dns_names[i] == cert->subject().common_name)
  45. break;
  46. }
  47. if (i == dns_names.size())
  48. i = 0;
  49. details = l10n_util::GetStringFUTF16(
  50. IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS,
  51. UTF8ToUTF16(request_url.host()),
  52. base::EscapeForHTML(UTF8ToUTF16(dns_names[i])));
  53. }
  54. short_description = l10n_util::GetStringUTF16(
  55. IDS_CERT_ERROR_COMMON_NAME_INVALID_DESCRIPTION);
  56. break;
  57. }
  58. case CERT_DATE_INVALID:
  59. if (cert->HasExpired()) {
  60. // Make sure to round up to the smallest integer value not less than
  61. // the expiration value (https://crbug.com/476758).
  62. int expiration_value =
  63. (base::Time::Now() - cert->valid_expiry()).InDays() + 1;
  64. details = base::i18n::MessageFormatter::FormatWithNumberedArgs(
  65. l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DETAILS),
  66. request_url.host(), expiration_value, base::Time::Now());
  67. short_description =
  68. l10n_util::GetStringUTF16(IDS_CERT_ERROR_EXPIRED_DESCRIPTION);
  69. } else if (base::Time::Now() < cert->valid_start()) {
  70. details = base::i18n::MessageFormatter::FormatWithNumberedArgs(
  71. l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DETAILS),
  72. request_url.host(),
  73. (cert->valid_start() - base::Time::Now()).InDays());
  74. short_description =
  75. l10n_util::GetStringUTF16(IDS_CERT_ERROR_NOT_YET_VALID_DESCRIPTION);
  76. } else {
  77. // Two possibilities: (1) an intermediate or root certificate has
  78. // expired, or (2) the certificate has become valid since the error
  79. // occurred. Both are probably rare cases. To avoid giving the wrong
  80. // date, remove the information.
  81. details = l10n_util::GetStringFUTF16(
  82. IDS_CERT_ERROR_NOT_VALID_AT_THIS_TIME_DETAILS,
  83. UTF8ToUTF16(request_url.host()));
  84. short_description = l10n_util::GetStringUTF16(
  85. IDS_CERT_ERROR_NOT_VALID_AT_THIS_TIME_DESCRIPTION);
  86. }
  87. break;
  88. case CERT_KNOWN_INTERCEPTION_BLOCKED:
  89. case CERT_AUTHORITY_INVALID:
  90. case CERT_SYMANTEC_LEGACY:
  91. details =
  92. l10n_util::GetStringFUTF16(IDS_CERT_ERROR_AUTHORITY_INVALID_DETAILS,
  93. UTF8ToUTF16(request_url.host()));
  94. short_description = l10n_util::GetStringUTF16(
  95. IDS_CERT_ERROR_AUTHORITY_INVALID_DESCRIPTION);
  96. break;
  97. case CERT_CONTAINS_ERRORS:
  98. details =
  99. l10n_util::GetStringFUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DETAILS,
  100. UTF8ToUTF16(request_url.host()));
  101. short_description =
  102. l10n_util::GetStringUTF16(IDS_CERT_ERROR_CONTAINS_ERRORS_DESCRIPTION);
  103. break;
  104. case CERT_NO_REVOCATION_MECHANISM:
  105. details = l10n_util::GetStringFUTF16(
  106. IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DETAILS,
  107. UTF8ToUTF16(request_url.host()));
  108. short_description = l10n_util::GetStringUTF16(
  109. IDS_CERT_ERROR_NO_REVOCATION_MECHANISM_DESCRIPTION);
  110. break;
  111. case CERT_REVOKED:
  112. details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_REVOKED_CERT_DETAILS,
  113. UTF8ToUTF16(request_url.host()));
  114. short_description =
  115. l10n_util::GetStringUTF16(IDS_CERT_ERROR_REVOKED_CERT_DESCRIPTION);
  116. break;
  117. case CERT_INVALID:
  118. details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_INVALID_CERT_DETAILS,
  119. UTF8ToUTF16(request_url.host()));
  120. short_description =
  121. l10n_util::GetStringUTF16(IDS_CERT_ERROR_INVALID_CERT_DESCRIPTION);
  122. break;
  123. case CERT_WEAK_SIGNATURE_ALGORITHM:
  124. details = l10n_util::GetStringFUTF16(
  125. IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DETAILS,
  126. UTF8ToUTF16(request_url.host()));
  127. short_description = l10n_util::GetStringUTF16(
  128. IDS_CERT_ERROR_WEAK_SIGNATURE_ALGORITHM_DESCRIPTION);
  129. break;
  130. case CERT_WEAK_KEY:
  131. details = l10n_util::GetStringFUTF16(IDS_CERT_ERROR_WEAK_KEY_DETAILS,
  132. UTF8ToUTF16(request_url.host()));
  133. short_description =
  134. l10n_util::GetStringUTF16(IDS_CERT_ERROR_WEAK_KEY_DESCRIPTION);
  135. break;
  136. case CERT_NAME_CONSTRAINT_VIOLATION:
  137. details = l10n_util::GetStringFUTF16(
  138. IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DETAILS,
  139. UTF8ToUTF16(request_url.host()));
  140. short_description = l10n_util::GetStringUTF16(
  141. IDS_CERT_ERROR_NAME_CONSTRAINT_VIOLATION_DESCRIPTION);
  142. break;
  143. case CERT_VALIDITY_TOO_LONG:
  144. details =
  145. l10n_util::GetStringFUTF16(IDS_CERT_ERROR_VALIDITY_TOO_LONG_DETAILS,
  146. UTF8ToUTF16(request_url.host()));
  147. short_description = l10n_util::GetStringUTF16(
  148. IDS_CERT_ERROR_VALIDITY_TOO_LONG_DESCRIPTION);
  149. break;
  150. case CERT_PINNED_KEY_MISSING:
  151. details = l10n_util::GetStringUTF16(
  152. IDS_CERT_ERROR_SUMMARY_PINNING_FAILURE_DETAILS);
  153. short_description = l10n_util::GetStringUTF16(
  154. IDS_CERT_ERROR_SUMMARY_PINNING_FAILURE_DESCRIPTION);
  155. break;
  156. case CERT_UNABLE_TO_CHECK_REVOCATION:
  157. details = l10n_util::GetStringFUTF16(
  158. IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DETAILS,
  159. UTF8ToUTF16(request_url.host()));
  160. short_description = l10n_util::GetStringUTF16(
  161. IDS_CERT_ERROR_UNABLE_TO_CHECK_REVOCATION_DESCRIPTION);
  162. break;
  163. case CERTIFICATE_TRANSPARENCY_REQUIRED:
  164. details = l10n_util::GetStringUTF16(
  165. IDS_CERT_ERROR_CERTIFICATE_TRANSPARENCY_REQUIRED_DETAILS);
  166. short_description = l10n_util::GetStringUTF16(
  167. IDS_CERT_ERROR_CERTIFICATE_TRANSPARENCY_REQUIRED_DESCRIPTION);
  168. break;
  169. case UNKNOWN:
  170. details = l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DETAILS);
  171. short_description =
  172. l10n_util::GetStringUTF16(IDS_CERT_ERROR_UNKNOWN_ERROR_DESCRIPTION);
  173. break;
  174. default:
  175. NOTREACHED();
  176. }
  177. return ErrorInfo(details, short_description);
  178. }
  179. ErrorInfo::~ErrorInfo() {}
  180. // static
  181. ErrorInfo::ErrorType ErrorInfo::NetErrorToErrorType(int net_error) {
  182. switch (net_error) {
  183. case net::ERR_CERT_COMMON_NAME_INVALID:
  184. return CERT_COMMON_NAME_INVALID;
  185. case net::ERR_CERT_DATE_INVALID:
  186. return CERT_DATE_INVALID;
  187. case net::ERR_CERT_AUTHORITY_INVALID:
  188. return CERT_AUTHORITY_INVALID;
  189. case net::ERR_CERT_CONTAINS_ERRORS:
  190. return CERT_CONTAINS_ERRORS;
  191. case net::ERR_CERT_NO_REVOCATION_MECHANISM:
  192. return CERT_NO_REVOCATION_MECHANISM;
  193. case net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
  194. return CERT_UNABLE_TO_CHECK_REVOCATION;
  195. case net::ERR_CERT_REVOKED:
  196. return CERT_REVOKED;
  197. case net::ERR_CERT_INVALID:
  198. return CERT_INVALID;
  199. case net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
  200. return CERT_WEAK_SIGNATURE_ALGORITHM;
  201. case net::ERR_CERT_WEAK_KEY:
  202. return CERT_WEAK_KEY;
  203. case net::ERR_CERT_NAME_CONSTRAINT_VIOLATION:
  204. return CERT_NAME_CONSTRAINT_VIOLATION;
  205. case net::ERR_CERT_VALIDITY_TOO_LONG:
  206. return CERT_VALIDITY_TOO_LONG;
  207. case net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN:
  208. return CERT_PINNED_KEY_MISSING;
  209. case net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED:
  210. return CERTIFICATE_TRANSPARENCY_REQUIRED;
  211. case net::ERR_CERT_SYMANTEC_LEGACY:
  212. return CERT_SYMANTEC_LEGACY;
  213. case net::ERR_CERT_KNOWN_INTERCEPTION_BLOCKED:
  214. return CERT_KNOWN_INTERCEPTION_BLOCKED;
  215. default:
  216. NOTREACHED();
  217. return UNKNOWN;
  218. }
  219. }
  220. // static
  221. void ErrorInfo::GetErrorsForCertStatus(
  222. const scoped_refptr<net::X509Certificate>& cert,
  223. net::CertStatus cert_status,
  224. const GURL& url,
  225. std::vector<ErrorInfo>* errors) {
  226. const net::CertStatus kErrorFlags[] = {
  227. net::CERT_STATUS_COMMON_NAME_INVALID,
  228. net::CERT_STATUS_DATE_INVALID,
  229. net::CERT_STATUS_AUTHORITY_INVALID,
  230. net::CERT_STATUS_NO_REVOCATION_MECHANISM,
  231. net::CERT_STATUS_UNABLE_TO_CHECK_REVOCATION,
  232. net::CERT_STATUS_REVOKED,
  233. net::CERT_STATUS_INVALID,
  234. net::CERT_STATUS_WEAK_SIGNATURE_ALGORITHM,
  235. net::CERT_STATUS_WEAK_KEY,
  236. net::CERT_STATUS_NAME_CONSTRAINT_VIOLATION,
  237. net::CERT_STATUS_VALIDITY_TOO_LONG,
  238. net::CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED,
  239. net::CERT_STATUS_SYMANTEC_LEGACY,
  240. net::CERT_STATUS_KNOWN_INTERCEPTION_BLOCKED,
  241. };
  242. const ErrorType kErrorTypes[] = {
  243. CERT_COMMON_NAME_INVALID,
  244. CERT_DATE_INVALID,
  245. CERT_AUTHORITY_INVALID,
  246. CERT_NO_REVOCATION_MECHANISM,
  247. CERT_UNABLE_TO_CHECK_REVOCATION,
  248. CERT_REVOKED,
  249. CERT_INVALID,
  250. CERT_WEAK_SIGNATURE_ALGORITHM,
  251. CERT_WEAK_KEY,
  252. CERT_NAME_CONSTRAINT_VIOLATION,
  253. CERT_VALIDITY_TOO_LONG,
  254. CERTIFICATE_TRANSPARENCY_REQUIRED,
  255. CERT_SYMANTEC_LEGACY,
  256. CERT_KNOWN_INTERCEPTION_BLOCKED,
  257. };
  258. DCHECK(std::size(kErrorFlags) == std::size(kErrorTypes));
  259. for (size_t i = 0; i < std::size(kErrorFlags); ++i) {
  260. if ((cert_status & kErrorFlags[i]) && errors) {
  261. errors->push_back(
  262. ErrorInfo::CreateError(kErrorTypes[i], cert.get(), url));
  263. }
  264. }
  265. }
  266. } // namespace ssl_errors