Disable commonName matching for certificates

net/cert/x509_certificate.h

Index: net/cert/x509_certificate.h
diff --git a/net/cert/x509_certificate.h b/net/cert/x509_certificate.h
index 0aff1be610067f0eb75fbe6b430fbb66cc665476..38818ae7a12bf1fc3d3105a22b447a842253d88f 100644
--- a/net/cert/x509_certificate.h
+++ b/net/cert/x509_certificate.h
@@ -287,11 +287,11 @@ class NET_EXPORT X509Certificate
   // Verifies that |hostname| matches this certificate.
   // Does not verify that the certificate is valid, only that the certificate
   // matches this host.
-  // Returns true if it matches, and updates |*common_name_fallback_used|,
-  // setting it to true if a fallback to the CN was used, rather than
-  // subjectAltName.
+  // If |allow_common_name_fallback| is set to true, then if no SANs are

[mattm, 2017/03/01 23:56:47]

nit: s/then/and/ ?

(Two "then" in the same sentence feels a bit weird.)

+  // present of type dNSName or iPAddress, then fallback to using the
+  // certificate's commonName field in the Subject.
   bool VerifyNameMatch(const std::string& hostname,
-                       bool* common_name_fallback_used) const;
+                       bool allow_common_name_fallback) const;
 
   // Obtains the DER encoded certificate data for |cert_handle|. On success,
   // returns true and writes the DER encoded certificate to |*der_encoded|.
@@ -420,14 +420,14 @@ class NET_EXPORT X509Certificate
   // extension, if present. Note these IP addresses are NOT ascii-encoded:
   // they must be 4 or 16 bytes of network-ordered data, for IPv4 and IPv6
   // addresses, respectively.
-  // |common_name_fallback_used| will be updated to true if cert_common_name
-  // was used to match the hostname, or false if either of the |cert_san_*|
-  // parameters was used to match the hostname.
+  // If |allow_common_name_fallback| is true, then the |cert_common_name| will
+  // be used if the |cert_san_dns_names| and |cert_san_ip_addrs| parameters are
+  // empty.
   static bool VerifyHostname(const std::string& hostname,
                              const std::string& cert_common_name,
                              const std::vector<std::string>& cert_san_dns_names,
                              const std::vector<std::string>& cert_san_ip_addrs,
-                             bool* common_name_fallback_used);
+                             bool allow_common_name_fallback);
 
   // Reads a single certificate from |pickle_iter| and returns a
   // platform-specific certificate handle. The format of the certificate