1 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "libcef/browser/ssl_host_state_delegate.h"
6
7 #include "base/callback.h"
8 #include "net/base/hash_value.h"
9
10 using content::SSLHostStateDelegate;
11
12 namespace internal {
13
CertPolicy()14 CertPolicy::CertPolicy() {}
~CertPolicy()15 CertPolicy::~CertPolicy() {}
16
17 // For an allowance, we consider a given |cert| to be a match to a saved
18 // allowed cert if the |error| is an exact match to or subset of the errors
19 // in the saved CertStatus.
Check(const net::X509Certificate & cert,int error) const20 bool CertPolicy::Check(const net::X509Certificate& cert, int error) const {
21 net::SHA256HashValue fingerprint = cert.CalculateChainFingerprint256();
22 const auto& allowed_iter = allowed_.find(fingerprint);
23 if ((allowed_iter != allowed_.end()) && (allowed_iter->second & error) &&
24 ((allowed_iter->second & error) == error)) {
25 return true;
26 }
27 return false;
28 }
29
Allow(const net::X509Certificate & cert,int error)30 void CertPolicy::Allow(const net::X509Certificate& cert, int error) {
31 // If this same cert had already been saved with a different error status,
32 // this will replace it with the new error status.
33 net::SHA256HashValue fingerprint = cert.CalculateChainFingerprint256();
34 allowed_[fingerprint] = error;
35 }
36
37 } // namespace internal
38
CefSSLHostStateDelegate()39 CefSSLHostStateDelegate::CefSSLHostStateDelegate() {}
40
~CefSSLHostStateDelegate()41 CefSSLHostStateDelegate::~CefSSLHostStateDelegate() {}
42
HostRanInsecureContent(const std::string & host,int child_id,InsecureContentType content_type)43 void CefSSLHostStateDelegate::HostRanInsecureContent(
44 const std::string& host,
45 int child_id,
46 InsecureContentType content_type) {
47 // Intentional no-op.
48 }
49
DidHostRunInsecureContent(const std::string & host,int child_id,InsecureContentType content_type)50 bool CefSSLHostStateDelegate::DidHostRunInsecureContent(
51 const std::string& host,
52 int child_id,
53 InsecureContentType content_type) {
54 // Intentional no-op.
55 return false;
56 }
57
AllowHttpForHost(const std::string & host,content::WebContents * web_content)58 void CefSSLHostStateDelegate::AllowHttpForHost(
59 const std::string& host,
60 content::WebContents* web_content) {
61 // Intentional no-op.
62 }
63
IsHttpAllowedForHost(const std::string & host,content::WebContents * web_content)64 bool CefSSLHostStateDelegate::IsHttpAllowedForHost(
65 const std::string& host,
66 content::WebContents* web_content) {
67 // Intentional no-op. Return value does not matter as HTTPS-Only Mode is not
68 // enabled.
69 return false;
70 }
71
AllowCert(const std::string & host,const net::X509Certificate & cert,int error,content::WebContents * web_contents)72 void CefSSLHostStateDelegate::AllowCert(const std::string& host,
73 const net::X509Certificate& cert,
74 int error,
75 content::WebContents* web_contents) {
76 cert_policy_for_host_[host].Allow(cert, error);
77 }
78
Clear(const base::RepeatingCallback<bool (const std::string &)> host_filter)79 void CefSSLHostStateDelegate::Clear(
80 const base::RepeatingCallback<bool(const std::string&)> host_filter) {
81 if (host_filter.is_null()) {
82 cert_policy_for_host_.clear();
83 return;
84 }
85
86 for (auto it = cert_policy_for_host_.begin();
87 it != cert_policy_for_host_.end();) {
88 auto next_it = std::next(it);
89
90 if (host_filter.Run(it->first))
91 cert_policy_for_host_.erase(it);
92
93 it = next_it;
94 }
95 }
96
QueryPolicy(const std::string & host,const net::X509Certificate & cert,int error,content::WebContents * web_contents)97 SSLHostStateDelegate::CertJudgment CefSSLHostStateDelegate::QueryPolicy(
98 const std::string& host,
99 const net::X509Certificate& cert,
100 int error,
101 content::WebContents* web_contents) {
102 return cert_policy_for_host_[host].Check(cert, error)
103 ? SSLHostStateDelegate::ALLOWED
104 : SSLHostStateDelegate::DENIED;
105 }
106
RevokeUserAllowExceptions(const std::string & host)107 void CefSSLHostStateDelegate::RevokeUserAllowExceptions(
108 const std::string& host) {
109 cert_policy_for_host_.erase(host);
110 }
111
HasAllowException(const std::string & host,content::WebContents * web_contents)112 bool CefSSLHostStateDelegate::HasAllowException(
113 const std::string& host,
114 content::WebContents* web_contents) {
115 auto policy_iterator = cert_policy_for_host_.find(host);
116 return policy_iterator != cert_policy_for_host_.end() &&
117 policy_iterator->second.HasAllowException();
118 }
119