Update SSL error handling code to account for Subject CN deprecation

components/ssl_errors/error_classification.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/ssl_errors/error_classification.h"
 
 #include <limits.h>
 #include <stddef.h>
 
 #include <vector>
@@ skipping 20 matching lines @@
 #include "base/win/windows_version.h"
 #endif
 
 using base::Time;
 using base::TimeTicks;
 using base::TimeDelta;
 
 namespace ssl_errors {
 namespace {
 
-// Events for UMA. Do not reorder or change!
-enum SSLInterstitialCause {
-  CLOCK_PAST,
-  CLOCK_FUTURE,
-  WWW_SUBDOMAIN_MATCH,
-  SUBDOMAIN_MATCH,
-  SUBDOMAIN_INVERSE_MATCH,
-  SUBDOMAIN_OUTSIDE_WILDCARD,
-  HOST_NAME_NOT_KNOWN_TLD,
-  LIKELY_MULTI_TENANT_HOSTING,
-  LOCALHOST,
-  PRIVATE_URL,
-  AUTHORITY_ERROR_CAPTIVE_PORTAL,  // Deprecated in M47.
-  SELF_SIGNED,
-  EXPIRED_RECENTLY,
-  LIKELY_SAME_DOMAIN,
-  UNUSED_INTERSTITIAL_CAUSE_ENTRY,
-};
-
 void RecordSSLInterstitialCause(bool overridable, SSLInterstitialCause event) {
   if (overridable) {
     UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.cause.overridable", event,
-                              UNUSED_INTERSTITIAL_CAUSE_ENTRY);
+                              SSL_INTERSTITIAL_CAUSE_MAX);
   } else {
     UMA_HISTOGRAM_ENUMERATION("interstitial.ssl.cause.nonoverridable", event,
-                              UNUSED_INTERSTITIAL_CAUSE_ENTRY);
+                              SSL_INTERSTITIAL_CAUSE_MAX);
   }
 }
 
 std::vector<HostnameTokens> GetTokenizedDNSNames(
     const std::vector<std::string>& dns_names) {
   std::vector<HostnameTokens> dns_name_tokens;
   for (const auto& dns_name : dns_names) {
     HostnameTokens dns_name_token_single;
     if (dns_name.empty() || dns_name.find('\0') != std::string::npos ||
         !(HostNameHasKnownTLD(dns_name))) {
@@ skipping 25 matching lines @@
       return -1;
   }
   return diff_size;
 }
 
 // We accept the inverse case for www for historical reasons.
 bool IsWWWSubDomainMatch(const GURL& request_url,
                          const net::X509Certificate& cert) {
   std::string www_host;
   std::vector<std::string> dns_names;
-  cert.GetDNSNames(&dns_names);
+  cert.GetSubjectAltName(&dns_names, nullptr);
   return GetWWWSubDomainMatch(request_url, dns_names, &www_host);
 }
 
 // The time to use when doing build time operations in browser tests.
 base::LazyInstance<base::Time>::DestructorAtExit g_testing_build_time =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
 static ssl_errors::ErrorInfo::ErrorType RecordErrorType(int cert_error) {
@@ skipping 19 matching lines @@
       // Note: not reached when displaying the bad clock interstitial.
       // See |RecordUMAStatisticsForClockInterstitial| below.
       if (cert.HasExpired() &&
           (current_time - cert.valid_expiry()).InDays() < 28) {
         RecordSSLInterstitialCause(overridable, EXPIRED_RECENTLY);
       }
       break;
     }
     case ssl_errors::ErrorInfo::CERT_COMMON_NAME_INVALID: {
       std::string host_name = request_url.host();
+      std::vector<std::string> dns_names;
+      cert.GetSubjectAltName(&dns_names, nullptr);
+      std::vector<HostnameTokens> dns_name_tokens =
+          GetTokenizedDNSNames(dns_names);
+
+      if (dns_names.empty())
+        RecordSSLInterstitialCause(overridable, NO_SUBJECT_ALT_NAME);
+
       if (HostNameHasKnownTLD(host_name)) {
         HostnameTokens host_name_tokens = Tokenize(host_name);
         if (IsWWWSubDomainMatch(request_url, cert))
-          RecordSSLInterstitialCause(overridable, WWW_SUBDOMAIN_MATCH);
+          RecordSSLInterstitialCause(overridable, WWW_SUBDOMAIN_MATCH2);
         if (IsSubDomainOutsideWildcard(request_url, cert))
-          RecordSSLInterstitialCause(overridable, SUBDOMAIN_OUTSIDE_WILDCARD);
-        std::vector<std::string> dns_names;
-        cert.GetDNSNames(&dns_names);
-        std::vector<HostnameTokens> dns_name_tokens =
-            GetTokenizedDNSNames(dns_names);
+          RecordSSLInterstitialCause(overridable, SUBDOMAIN_OUTSIDE_WILDCARD2);
         if (NameUnderAnyNames(host_name_tokens, dns_name_tokens))
-          RecordSSLInterstitialCause(overridable, SUBDOMAIN_MATCH);
+          RecordSSLInterstitialCause(overridable, SUBDOMAIN_MATCH2);
         if (AnyNamesUnderName(dns_name_tokens, host_name_tokens))
-          RecordSSLInterstitialCause(overridable, SUBDOMAIN_INVERSE_MATCH);
+          RecordSSLInterstitialCause(overridable, SUBDOMAIN_INVERSE_MATCH2);
         if (IsCertLikelyFromMultiTenantHosting(request_url, cert))
-          RecordSSLInterstitialCause(overridable, LIKELY_MULTI_TENANT_HOSTING);
+          RecordSSLInterstitialCause(overridable, LIKELY_MULTI_TENANT_HOSTING2);
         if (IsCertLikelyFromSameDomain(request_url, cert))
-          RecordSSLInterstitialCause(overridable, LIKELY_SAME_DOMAIN);
+          RecordSSLInterstitialCause(overridable, LIKELY_SAME_DOMAIN2);
       } else {
         RecordSSLInterstitialCause(overridable, HOST_NAME_NOT_KNOWN_TLD);
       }
       break;
     }
     case ssl_errors::ErrorInfo::CERT_AUTHORITY_INVALID: {
       const std::string& hostname = request_url.HostNoBrackets();
       if (net::IsLocalhost(hostname))
         RecordSSLInterstitialCause(overridable, LOCALHOST);
       if (IsHostnameNonUniqueOrDotless(hostname))
@@ skipping 196 matching lines @@
     }
   }
   return row[str2.size()];
 }
 
 bool IsSubDomainOutsideWildcard(const GURL& request_url,
                                 const net::X509Certificate& cert) {
   std::string host_name = request_url.host();
   HostnameTokens host_name_tokens = Tokenize(host_name);
   std::vector<std::string> dns_names;
-  cert.GetDNSNames(&dns_names);
+  cert.GetSubjectAltName(&dns_names, nullptr);
   bool result = false;
 
   // This method requires that the host name be longer than the dns name on
   // the certificate.
   for (const auto& dns_name : dns_names) {
     if (dns_name.length() < 2 || dns_name.length() >= host_name.length() ||
         dns_name.find('\0') != std::string::npos ||
         !HostNameHasKnownTLD(dns_name) || dns_name[0] != '*' ||
         dns_name[1] != '.') {
       continue;
     }
 
     // Move past the "*.".
     std::string extracted_dns_name = dns_name.substr(2);
     if (FindSubdomainDifference(host_name_tokens,
                                 Tokenize(extracted_dns_name)) == 2) {
       return true;
     }
   }
   return result;
 }
 
 bool IsCertLikelyFromMultiTenantHosting(const GURL& request_url,
                                         const net::X509Certificate& cert) {
   std::string host_name = request_url.host();
   std::vector<std::string> dns_names;
   std::vector<std::string> dns_names_domain;
-  cert.GetDNSNames(&dns_names);
+  cert.GetSubjectAltName(&dns_names, nullptr);
   size_t dns_names_size = dns_names.size();
 
   // If there is only 1 DNS name then it is definitely not a shared certificate.
   if (dns_names_size == 0 || dns_names_size == 1)
     return false;
 
   // Check to see if all the domains in the SAN field in the SSL certificate are
   // the same or not.
   for (size_t i = 0; i < dns_names_size; ++i) {
     dns_names_domain.push_back(
@@ skipping 26 matching lines @@
         return false;
     }
   }
   return true;
 }
 
 bool IsCertLikelyFromSameDomain(const GURL& request_url,
                                 const net::X509Certificate& cert) {
   std::string host_name = request_url.host();
   std::vector<std::string> dns_names;
-  cert.GetDNSNames(&dns_names);
+  cert.GetSubjectAltName(&dns_names, nullptr);
+  if (dns_names.empty())
+    return false;
 
   dns_names.push_back(host_name);
   std::vector<std::string> dns_names_domain;
 
   for (const std::string& dns_name : dns_names) {
     dns_names_domain.push_back(
         net::registry_controlled_domains::GetDomainAndRegistry(
             dns_name,
             net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES));
   }
 
   DCHECK(!dns_names_domain.empty());
   const std::string& host_name_domain = dns_names_domain.back();
 
   // Last element is the original domain. So, excluding it.
   return std::find(dns_names_domain.begin(), dns_names_domain.end() - 1,
                    host_name_domain) != dns_names_domain.end() - 1;
 }
 
 bool IsHostnameNonUniqueOrDotless(const std::string& hostname) {
   return net::IsHostnameNonUnique(hostname) ||
          hostname.find('.') == std::string::npos;
 }
 
 }  // namespace ssl_errors