Add a histogram for measuring the number of times we fall back to common name matching, when a cert…

net/cert/x509_certificate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_X509_CERTIFICATE_H_
 #define NET_CERT_X509_CERTIFICATE_H_
 
 #include <string.h>
 
 #include <string>
@@ skipping 295 matching lines @@
 
 #if defined(USE_OPENSSL)
   // Returns a handle to a global, in-memory certificate store. We
   // use it for test code, e.g. importing the test server's certificate.
   static X509_STORE* cert_store();
 #endif
 
   // Verifies that |hostname| matches this certificate.
   // Does not verify that the certificate is valid, only that the certificate
   // matches this host.
-  // Returns true if it matches.
-  bool VerifyNameMatch(const std::string& hostname) const;
+  // Returns true if it matches, and sets |common_name_fallback_used| to true
+  // if a fallback to the CN was used, rather than subjectAlternativeName.

[wtc, 2013/10/23 22:39:26]

Nit: it should be clarified that |common_name_fallback_used| is set whether the
function returns true or false.

+  bool VerifyNameMatch(const std::string& hostname,
+                       bool* common_name_fallback_used) const;
 
   // Obtains the DER encoded certificate data for |cert_handle|. On success,
   // returns true and writes the DER encoded certificate to |*der_encoded|.
   static bool GetDEREncoded(OSCertHandle cert_handle,
                             std::string* der_encoded);
 
   // Returns the PEM encoded data from a DER encoded certificate. If the return
   // value is true, then the PEM encoded certificate is written to
   // |pem_encoded|.
   static bool GetPEMEncodedFromDER(const std::string& der_encoded,
@@ skipping 89 matching lines @@
 #endif
 
   // Verifies that |hostname| matches one of the certificate names or IP
   // addresses supplied, based on TLS name matching rules - specifically,
   // following http://tools.ietf.org/html/rfc6125.
   // |cert_common_name| is the Subject CN, e.g. from X509Certificate::subject().
   // The members of |cert_san_dns_names| and |cert_san_ipaddrs| must be filled
   // from the dNSName and iPAddress components of the subject alternative name
   // extension, if present. Note these IP addresses are NOT ascii-encoded:
   // they must be 4 or 16 bytes of network-ordered data, for IPv4 and IPv6
   // addresses, respectively.

[wtc, 2013/10/23 22:39:26]

Document the common_name_fallback_used output parameter.

   static bool VerifyHostname(const std::string& hostname,
                              const std::string& cert_common_name,
                              const std::vector<std::string>& cert_san_dns_names,
-                             const std::vector<std::string>& cert_san_ip_addrs);
+                             const std::vector<std::string>& cert_san_ip_addrs,
+                             bool* common_name_fallback_used);

[wtc, 2013/10/23 22:39:26]

Having VerifyHostname return common_name_fallback_used is the most efficient
solution. However, a potentially more elegant API design could be a separate
method that returns whether the X509Certificate has a subject alternative name
extension. Then, it will be easy to remove when we are no longer interested in
this info.

[Ryan Sleevi, 2013/10/24 00:25:37]

We already expose GetSubjectAltName, which is a close approximation.

However, I wanted to keep this close to the actual verification code, so that
there's no risk of API drift. Having a separate method seems less than ideal,
short of making VerifyHostname also depend on it.

 
   // Reads a single certificate from |pickle_iter| and returns a
   // platform-specific certificate handle. The format of the certificate
   // stored in |pickle_iter| is not guaranteed to be the same across different
   // underlying cryptographic libraries, nor acceptable to CreateFromBytes().
   // Returns an invalid handle, NULL, on failure.
   // NOTE: This should not be used for any new code. It is provided for
   // migration purposes and should eventually be removed.
   static OSCertHandle ReadOSCertHandleFromPickle(PickleIterator* pickle_iter);
 
@@ skipping 36 matching lines @@
   // based on the type of the certificate.
   std::string default_nickname_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_X509_CERTIFICATE_H_