Add a histogram for measuring the number of times we fall back to common name matching, when a cert…

net/cert/x509_certificate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
@@ skipping 486 matching lines @@
 
 bool X509Certificate::Equals(const X509Certificate* other) const {
   return IsSameOSCert(cert_handle_, other->cert_handle_);
 }
 
 // static
 bool X509Certificate::VerifyHostname(
     const std::string& hostname,
     const std::string& cert_common_name,
     const std::vector<std::string>& cert_san_dns_names,
-    const std::vector<std::string>& cert_san_ip_addrs) {
+    const std::vector<std::string>& cert_san_ip_addrs,
+    bool* common_name_fallback_used) {
   DCHECK(!hostname.empty());
   // Perform name verification following http://tools.ietf.org/html/rfc6125.
   // The terminology used in this method is as per that RFC:-
   // Reference identifier == the host the local user/agent is intending to
   //                         access, i.e. the thing displayed in the URL bar.
   // Presented identifier(s) == name(s) the server knows itself as, in its cert.
 
   // CanonicalizeHost requires surrounding brackets to parse an IPv6 address.
   const std::string host_or_ip = hostname.find(':') != std::string::npos ?
       "[" + hostname + "]" : hostname;
   url_canon::CanonHostInfo host_info;
   std::string reference_name = CanonicalizeHost(host_or_ip, &host_info);
   // CanonicalizeHost does not normalize absolute vs relative DNS names. If
   // the input name was absolute (included trailing .), normalize it as if it
   // was relative.
   if (!reference_name.empty() && *reference_name.rbegin() == '.')
     reference_name.resize(reference_name.size() - 1);
   if (reference_name.empty())
     return false;
 
   // Allow fallback to Common name matching?
   const bool common_name_fallback = cert_san_dns_names.empty() &&
                                     cert_san_ip_addrs.empty();
+  *common_name_fallback_used = common_name_fallback;
 
   // Fully handle all cases where |hostname| contains an IP address.
   if (host_info.IsIPAddress()) {
     if (common_name_fallback &&
         host_info.family == url_canon::CanonHostInfo::IPV4) {
       // Fallback to Common name matching. As this is deprecated and only
       // supported for compatibility refuse it for IPv6 addresses.
       return reference_name == cert_common_name;
     }
     base::StringPiece ip_addr_string(
@@ skipping 101 matching lines @@
         !(pattern_begin.empty() && pattern_end.empty()))
       continue;
 
     if (reference_host.starts_with(pattern_begin) &&
         reference_host.ends_with(pattern_end))
       return true;
   }
   return false;
 }
 
-bool X509Certificate::VerifyNameMatch(const std::string& hostname) const {
+bool X509Certificate::VerifyNameMatch(const std::string& hostname,
+                                      bool* common_name_fallback_used) const {
   std::vector<std::string> dns_names, ip_addrs;
   GetSubjectAltName(&dns_names, &ip_addrs);
-  return VerifyHostname(hostname, subject_.common_name, dns_names, ip_addrs);
+  return VerifyHostname(hostname, subject_.common_name, dns_names, ip_addrs,
+                        common_name_fallback_used);
 }
 
 // static
 bool X509Certificate::GetPEMEncodedFromDER(const std::string& der_encoded,
                                            std::string* pem_encoded) {
   if (der_encoded.empty())
     return false;
   std::string b64_encoded;
   if (!base::Base64Encode(der_encoded, &b64_encoded) || b64_encoded.empty())
     return false;
@@ skipping 59 matching lines @@
     RemoveFromCache(cert_handle_);
     FreeOSCertHandle(cert_handle_);
   }
   for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
     RemoveFromCache(intermediate_ca_certs_[i]);
     FreeOSCertHandle(intermediate_ca_certs_[i]);
   }
 }
 
 }  // namespace net