Add support for certificate name checking

net/base/x509_certificate_openssl.cc

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
@@ skipping 360 matching lines @@
 
   if (dns_names->empty())
     dns_names->push_back(subject_.common_name);
 }
 
 int X509Certificate::Verify(const std::string& hostname,
                             int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
 
+  // TODO(joth): We should fetch the subjectAltNames directly rather than via

[wtc, 2010/11/03 00:29:49]

Please file a bug report for this work.

[joth, 2010/11/12 18:55:23]

Done.

+  // GetDNSNames, so we can apply special handling for IP addresses vs DNS
+  // names, etc.
+  std::vector<std::string> cert_names;
+  GetDNSNames(&cert_names);
+  if (!x509_openssl_util::VerifyHostname(hostname, cert_names))
+    verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
+
   ScopedSSL<X509_STORE_CTX, X509_STORE_CTX_free> ctx(X509_STORE_CTX_new());
 
   ScopedSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(sk_X509_new_null());
   if (!intermediates.get())
     return ERR_OUT_OF_MEMORY;
 
   for (OSCertHandles::const_iterator it = intermediate_ca_certs_.begin();
        it != intermediate_ca_certs_.end(); ++it) {
     if (!sk_X509_push(intermediates.get(), *it))
       return ERR_OUT_OF_MEMORY;
@@ skipping 30 matching lines @@
   // cache the DER (if not already cached via X509_set_ex_data).
   DERCache der_cache_a, der_cache_b;
 
   return GetDERAndCacheIfNeeded(a, &der_cache_a) &&
       GetDERAndCacheIfNeeded(b, &der_cache_b) &&
       der_cache_a.data_length == der_cache_b.data_length &&
       memcmp(der_cache_a.data, der_cache_b.data, der_cache_a.data_length) == 0;
 }
 
 } // namespace net