Add a histogram for measuring the number of times we fall back to common name matching, when a cert…

net/cert/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_openssl.h"
 
 #include <openssl/x509v3.h>
 
 #include <string>
 #include <vector>
@@ skipping 154 matching lines @@
 
 int CertVerifyProcOpenSSL::VerifyInternal(
     X509Certificate* cert,
     const std::string& hostname,
     int flags,
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
   crypto::EnsureOpenSSLInit();
 
-  if (!cert->VerifyNameMatch(hostname))
+  if (!cert->VerifyNameMatch(hostname,
+                             &verify_result->common_name_fallback_used)) {
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
+  }
 
   crypto::ScopedOpenSSL<X509_STORE_CTX, X509_STORE_CTX_free> ctx(
       X509_STORE_CTX_new());
 
   crypto::ScopedOpenSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(
       sk_X509_new_null());
   if (!intermediates.get())
     return ERR_OUT_OF_MEMORY;
 
   const X509Certificate::OSCertHandles& os_intermediates =
@@ skipping 30 matching lines @@
   // TODO(joth): if the motivations described in
   // http://src.chromium.org/viewvc/chrome?view=rev&revision=80778 become an
   // issue on OpenSSL builds, we will need to embed a hardcoded list of well
   // known root CAs, as per the _mac and _win versions.
   verify_result->is_issued_by_known_root = true;
 
   return OK;
 }
 
 }  // namespace net