Distinguish between SCT invalidity reasons in UMA

net/cert/multi_log_ct_verifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_log_ct_verifier.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/values.h"
 #include "net/base/net_errors.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/ct_objects_extractor.h"
 #include "net/cert/ct_serialization.h"
 #include "net/cert/ct_signed_certificate_timestamp_log_param.h"
 #include "net/cert/ct_verify_result.h"
 #include "net/cert/sct_status_flags.h"
 #include "net/cert/x509_certificate.h"
 #include "net/log/net_log.h"
 
 namespace net {
 
 namespace {
 
 // Record SCT verification status. This metric would help detecting presence
 // of unknown CT logs as well as bad deployments (invalid SCTs).
 void LogSCTStatusToUMA(ct::SCTVerifyStatus status) {
-  UMA_HISTOGRAM_ENUMERATION(
-      "Net.CertificateTransparency.SCTStatus", status, ct::SCT_STATUS_MAX);
+  // Note SCT_STATUS_MAX + 1 is passed to the UMA_HISTOGRAM_ENUMERATION as that
+  // macro requires the values to be strictly less than the boundary value,
+  // and SCT_STATUS_MAX is the last valid value of the SCTVerifyStatus enum
+  // (since that enum is used for IPC as well).
+  UMA_HISTOGRAM_ENUMERATION("Net.CertificateTransparency.SCTStatus", status,
+                            ct::SCT_STATUS_MAX + 1);
 }
 
 // Record SCT origin enum. This metric measure the popularity
 // of the various channels of providing SCTs for a certificate.
 void LogSCTOriginToUMA(ct::SignedCertificateTimestamp::Origin origin) {
   UMA_HISTOGRAM_ENUMERATION("Net.CertificateTransparency.SCTOrigin",
                             origin,
                             ct::SignedCertificateTimestamp::SCT_ORIGIN_MAX);
 }
 
@@ skipping 150 matching lines @@
   if (it == logs_.end()) {
     DVLOG(1) << "SCT does not match any known log.";
     AddSCTAndLogStatus(sct, ct::SCT_STATUS_LOG_UNKNOWN, &(result->scts));
     return false;
   }
 
   sct->log_description = it->second->description();
 
   if (!it->second->Verify(expected_entry, *sct.get())) {
     DVLOG(1) << "Unable to verify SCT signature.";
-    AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID, &(result->scts));
+    AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID_SIGNATURE, &(result->scts));
     return false;
   }
 
   // SCT verified ok, just make sure the timestamp is legitimate.
   if (sct->timestamp > base::Time::Now()) {
     DVLOG(1) << "SCT is from the future!";
-    AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID, &(result->scts));
+    AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID_TIMESTAMP, &(result->scts));
     return false;
   }
 
   AddSCTAndLogStatus(sct, ct::SCT_STATUS_OK, &(result->scts));
   if (observer_)
     observer_->OnSCTVerified(cert, sct.get());
   return true;
 }
 
 } // namespace net