Add a DevTools warning for a missing subjectAltName

components/security_state/core/security_state.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/security_state/core/security_state.h"
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/metrics/field_trial.h"
@@ skipping 204 matching lines @@
   security_info->sct_verify_statuses =
       visible_security_state.sct_verify_statuses;
 
   security_info->malicious_content_status =
       visible_security_state.malicious_content_status;
 
   security_info->displayed_password_field_on_http =
       visible_security_state.displayed_password_field_on_http;
   security_info->displayed_credit_card_field_on_http =
       visible_security_state.displayed_credit_card_field_on_http;
+  if (visible_security_state.certificate) {

[elawrence, 2017/03/21 16:49:04]

Could we change this to:

if (visible_security_state.certificate &&(visible_security_state.cert_status &
net::COMMON_NAME_INVALID)) {

... to improve performance?

[Ryan Sleevi, 2017/03/21 16:50:39]

I intentionally omitted this, because like SHA-1, we also have an enterprise
policy that allows this to work, but support will be removed. So I think it's
appropriate to signal regardless of whether it was flagged as an error (no
policy set) or the policy was set and the error was suppressed.

+    std::vector<std::string> dns_names;
+    std::vector<std::string> ip_addrs;
+    visible_security_state.certificate.GetSubjectAltName(&dns_names, &ip_addrs);

[elawrence, 2017/03/21 16:22:54]

Would it make sense to just have a HasSubjectAltName() property on the
certificate itself?

[Ryan Sleevi, 2017/03/21 16:41:41]

No. Generally, I explicitly try to avoid adding those APIs, because we saw far
too rampant usage, or too much coercion to X509Certificate. Our goal is to make
X509Certificate as light as possible and basically just be a cache of some
UI-accessed fields, and everything else to be done by consumers parsing/using
accessors.

[elawrence, 2017/03/21 16:49:04]

Ok. I was slightly worried about the perf of doing the throwaway work (e.g. with
the Cloudflare certificates that contain ~100 SANs). But if we can limit to the
COMMON_NAME_INVALID case above, I'm less worried.

[Ryan Sleevi, 2017/03/21 16:50:39]

I don't think we can/should, but I think that makes a more compelling argument
for HasSubjectAltName to avoid the extra copying.

+    security_info->san_is_missing = dns_names.empty() && ip_addrs.empty();
+  }
 
   security_info->security_level = GetSecurityLevelForRequest(
       visible_security_state, used_policy_installed_certificate,
       is_origin_secure_callback, security_info->sha1_in_chain,
       security_info->mixed_content_status,
       security_info->content_with_cert_errors_status);
 }
 
 }  // namespace
 
 const base::Feature kHttpFormWarningFeature{"HttpFormWarning",
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
 SecurityInfo::SecurityInfo()
     : security_level(NONE),
       malicious_content_status(MALICIOUS_CONTENT_STATUS_NONE),
       sha1_in_chain(false),
       mixed_content_status(CONTENT_STATUS_NONE),
       content_with_cert_errors_status(CONTENT_STATUS_NONE),
       scheme_is_cryptographic(false),
       cert_status(0),
       security_bits(-1),
       connection_status(0),
       key_exchange_group(0),
       obsolete_ssl_status(net::OBSOLETE_SSL_NONE),
       pkp_bypassed(false),
       displayed_password_field_on_http(false),
-      displayed_credit_card_field_on_http(false) {}
+      displayed_credit_card_field_on_http(false),
+      san_is_missing(false) {}
 
 SecurityInfo::~SecurityInfo() {}
 
 void GetSecurityInfo(
     std::unique_ptr<VisibleSecurityState> visible_security_state,
     bool used_policy_installed_certificate,
     IsOriginSecureCallback is_origin_secure_callback,
     SecurityInfo* result) {
   SecurityInfoForRequest(*visible_security_state,
                          used_policy_installed_certificate,
@@ skipping 36 matching lines @@
               other.displayed_content_with_cert_errors &&
           ran_content_with_cert_errors == other.ran_content_with_cert_errors &&
           pkp_bypassed == other.pkp_bypassed &&
           displayed_password_field_on_http ==
               other.displayed_password_field_on_http &&
           displayed_credit_card_field_on_http ==
               other.displayed_credit_card_field_on_http);
 }
 
 }  // namespace security_state