1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef CHROME_BROWSER_SSL_CHROME_SSL_HOST_STATE_DELEGATE_H_
6 #define CHROME_BROWSER_SSL_CHROME_SSL_HOST_STATE_DELEGATE_H_
8 #include "base/gtest_prod_util.h"
9 #include "base/memory/scoped_ptr.h"
10 #include "base/time/time.h"
11 #include "content/public/browser/ssl_host_state_delegate.h"
17 class DictionaryValue;
20 // Tracks whether the user has allowed a certificate error exception for a
21 // specific site, SSL fingerprint, and error. Based on command-line flags and
22 // experimental group, remembers this decision either until end-of-session or
23 // for a particular length of time.
24 class ChromeSSLHostStateDelegate : public content::SSLHostStateDelegate {
26 explicit ChromeSSLHostStateDelegate(Profile* profile);
27 virtual ~ChromeSSLHostStateDelegate();
29 // SSLHostStateDelegate:
30 virtual void AllowCert(const std::string& host,
31 const net::X509Certificate& cert,
32 net::CertStatus error) OVERRIDE;
33 virtual void Clear() OVERRIDE;
34 virtual CertJudgment QueryPolicy(const std::string& host,
35 const net::X509Certificate& cert,
36 net::CertStatus error,
37 bool* expired_previous_decision) OVERRIDE;
38 virtual void HostRanInsecureContent(const std::string& host,
40 virtual bool DidHostRunInsecureContent(const std::string& host,
41 int pid) const OVERRIDE;
43 // Revokes all SSL certificate error allow exceptions made by the user for
44 // |host| in the given Profile.
45 virtual void RevokeUserAllowExceptions(const std::string& host);
47 // RevokeUserAllowExceptionsHard is the same as RevokeUserAllowExceptions but
48 // additionally may close idle connections in the process. This should be used
49 // *only* for rare events, such as a user controlled button, as it may be very
50 // disruptive to the networking stack.
51 virtual void RevokeUserAllowExceptionsHard(const std::string& host);
53 // Returns whether the user has allowed a certificate error exception for
54 // |host|. This does not mean that *all* certificate errors are allowed, just
55 // that there exists an exception. To see if a particular certificate and
56 // error combination exception is allowed, use QueryPolicy().
57 virtual bool HasAllowException(const std::string& host) const;
60 // SetClock takes ownership of the passed in clock.
61 void SetClock(scoped_ptr<base::Clock> clock);
64 FRIEND_TEST_ALL_PREFIXES(ForgetInstantlySSLHostStateDelegateTest,
65 MakeAndForgetException);
66 FRIEND_TEST_ALL_PREFIXES(RememberSSLHostStateDelegateTest, AfterRestart);
67 FRIEND_TEST_ALL_PREFIXES(RememberSSLHostStateDelegateTest,
70 // Used to specify whether new content setting entries should be created if
71 // they don't already exist when querying the user's settings.
72 enum CreateDictionaryEntriesDisposition {
73 CREATE_DICTIONARY_ENTRIES,
74 DO_NOT_CREATE_DICTIONARY_ENTRIES
77 // Specifies whether user SSL error decisions should be forgetten at the end
78 // of this current session (the old style of remembering decisions), or
79 // whether they should be remembered across session restarts for a specified
80 // length of time, deteremined by
81 // |default_ssl_cert_decision_expiration_delta_|.
82 enum RememberSSLExceptionDecisionsDisposition {
83 FORGET_SSL_EXCEPTION_DECISIONS_AT_SESSION_END,
84 REMEMBER_SSL_EXCEPTION_DECISIONS_FOR_DELTA
87 // Returns a dictionary of certificate fingerprints and errors that have been
88 // allowed as exceptions by the user.
90 // |dict| specifies the user's full exceptions dictionary for a specific site
91 // in their content settings. Must be retrieved directly from a website
92 // setting in the the profile's HostContentSettingsMap.
94 // If |create_entries| specifies CreateDictionaryEntries, then
95 // GetValidCertDecisionsDict will create a new set of entries within the
96 // dictionary if they do not already exist. Otherwise will fail and return if
97 // NULL if they do not exist.
99 // |expired_previous_decision| is set to true if there had been a previous
100 // decision made by the user but it has expired. Otherwise it is set to false.
101 base::DictionaryValue* GetValidCertDecisionsDict(
102 base::DictionaryValue* dict,
103 CreateDictionaryEntriesDisposition create_entries,
104 bool* expired_previous_decision);
106 scoped_ptr<base::Clock> clock_;
107 RememberSSLExceptionDecisionsDisposition should_remember_ssl_decisions_;
108 base::TimeDelta default_ssl_cert_decision_expiration_delta_;
111 // A BrokenHostEntry is a pair of (host, process_id) that indicates the host
112 // contains insecure content in that renderer process.
113 typedef std::pair<std::string, int> BrokenHostEntry;
115 // Hosts which have been contaminated with insecure content in the
116 // specified process. Note that insecure content can travel between
117 // same-origin frames in one processs but cannot jump between processes.
118 std::set<BrokenHostEntry> ran_insecure_content_hosts_;
120 // This is a GUID to mark this unique session. Whenever a certificate decision
121 // expiration is set, the GUID is saved as well so Chrome can tell if it was
122 // last set during the current session. This is used by the
123 // FORGET_SSL_EXCEPTION_DECISIONS_AT_SESSION_END experimental group to
124 // determine if the expired_previous_decision bit should be set on queries.
126 // Why not just iterate over the set of current extensions and mark them all
127 // as expired when the session starts, rather than storing a GUID for the
128 // current session? Glad you asked! Unfortunately, content settings does not
129 // currently support iterating over all current *compound* content setting
130 // values (iteration only works for simple content settings). While this could
131 // be added, it would be a fair amount of work for what amounts to a temporary
132 // measurement problem, so it's not worth the complexity.
134 // TODO(jww): This is only used by the default and disable groups of the
135 // certificate memory decisions experiment to tell if a decision has expired
136 // since the last session. Since this is only used for UMA purposes, this
137 // should be removed after the experiment has finished, and a call to Clear()
138 // should be added to the constructor and destructor for members of the
139 // FORGET_SSL_EXCEPTION_DECISIONS_AT_SESSION_END groups. See
140 // https://crbug.com/418631 for more details.
141 const std::string current_expiration_guid_;
143 DISALLOW_COPY_AND_ASSIGN(ChromeSSLHostStateDelegate);
146 #endif // CHROME_BROWSER_SSL_CHROME_SSL_HOST_STATE_DELEGATE_H_