Update SSL error handling code to account for Subject CN deprecation

components/ssl_errors/error_classification_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/ssl_errors/error_classification.h"
 
 #include "base/files/file_path.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/strings/string_split.h"
 #include "base/test/histogram_tester.h"
 #include "base/test/simple_test_clock.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/default_clock.h"
 #include "base/time/default_tick_clock.h"
 #include "components/network_time/network_time_test_utils.h"
 #include "components/network_time/network_time_tracker.h"
 #include "components/prefs/testing_pref_service.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/test_certificate_data.h"
 #include "net/test/test_data_directory.h"
 #include "net/url_request/url_request_test_util.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
+using testing::ElementsAre;
+
 namespace {
 const char kNetworkTimeHistogram[] = "interstitial.ssl.clockstate.network3";
+const char kSslErrorCauseHistogram[] = "interstitial.ssl.cause.overridable";
 
 static std::unique_ptr<net::test_server::HttpResponse>
 NetworkErrorResponseHandler(const net::test_server::HttpRequest& request) {
   return std::unique_ptr<net::test_server::HttpResponse>(
       new net::test_server::RawHttpResponse("", ""));
 }
 
 }  // namespace
 
 class SSLErrorClassificationTest : public ::testing::Test {
  public:
   SSLErrorClassificationTest()
       : field_trial_test_(new network_time::FieldTrialTest()) {}
   network_time::FieldTrialTest* field_trial_test() {
     return field_trial_test_.get();
   }
 
  private:
   std::unique_ptr<network_time::FieldTrialTest> field_trial_test_;
 };
 
 TEST_F(SSLErrorClassificationTest, TestNameMismatch) {
-  scoped_refptr<net::X509Certificate> google_cert(
-      net::X509Certificate::CreateFromBytes(
-          reinterpret_cast<const char*>(google_der), sizeof(google_der)));
-  ASSERT_TRUE(google_cert.get());
-  std::vector<std::string> dns_names_google;
-  google_cert->GetDNSNames(&dns_names_google);
-  ASSERT_EQ(1u, dns_names_google.size());  // ["www.google.com"]
-  std::vector<std::string> hostname_tokens_google =
-      ssl_errors::Tokenize(dns_names_google[0]);
-  ASSERT_EQ(3u, hostname_tokens_google.size());  // ["www","google","com"]
-  std::vector<std::vector<std::string>> dns_name_tokens_google;
-  dns_name_tokens_google.push_back(hostname_tokens_google);
-  ASSERT_EQ(1u, dns_name_tokens_google.size());  // [["www","google","com"]]
+  scoped_refptr<net::X509Certificate> example_cert = net::ImportCertFromFile(
+      net::GetTestCertsDirectory(), "subjectAltName_www_example_com.pem");
+  ASSERT_TRUE(example_cert);
+  std::vector<std::string> dns_names_example;
+  example_cert->GetSubjectAltName(&dns_names_example, nullptr);
+  ASSERT_THAT(dns_names_example, ElementsAre("www.example.com"));
+  std::vector<std::string> hostname_tokens_example =
+      ssl_errors::Tokenize(dns_names_example[0]);
+  ASSERT_THAT(hostname_tokens_example, ElementsAre("www", "example", "com"));
+  std::vector<std::vector<std::string>> dns_name_tokens_example;
+  dns_name_tokens_example.push_back(hostname_tokens_example);
+  ASSERT_EQ(1u, dns_name_tokens_example.size());  // [["www","example","com"]]
+  ASSERT_THAT(dns_name_tokens_example[0], ElementsAre("www", "example", "com"));
 
   {
-    GURL origin("https://google.com");
+    GURL origin("https://example.com");
     std::string www_host;
     std::vector<std::string> host_name_tokens = base::SplitString(
         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
     EXPECT_TRUE(
-        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_google, &www_host));
-    EXPECT_EQ("www.google.com", www_host);
+        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
+    EXPECT_EQ("www.example.com", www_host);
     EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
-                                               dns_name_tokens_google));
-    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_google,
+                                               dns_name_tokens_example));
+    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
                                                host_name_tokens));
-    EXPECT_FALSE(ssl_errors::IsSubDomainOutsideWildcard(origin, *google_cert));
+    EXPECT_FALSE(ssl_errors::IsSubDomainOutsideWildcard(origin, *example_cert));
     EXPECT_FALSE(
-        ssl_errors::IsCertLikelyFromMultiTenantHosting(origin, *google_cert));
-    EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *google_cert));
+        ssl_errors::IsCertLikelyFromMultiTenantHosting(origin, *example_cert));
+    EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
   }
 
   {
-    GURL origin("https://foo.blah.google.com");
+    GURL origin("https://foo.blah.example.com");
     std::string www_host;
     std::vector<std::string> host_name_tokens = base::SplitString(
         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
     EXPECT_FALSE(
-        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_google, &www_host));
+        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
     EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
-                                               dns_name_tokens_google));
-    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_google,
+                                               dns_name_tokens_example));
+    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
                                                host_name_tokens));
-    EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *google_cert));
+    EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
   }
 
   {
-    GURL origin("https://foo.www.google.com");
+    GURL origin("https://foo.www.example.com");
     std::string www_host;
     std::vector<std::string> host_name_tokens = base::SplitString(
         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
     EXPECT_FALSE(
-        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_google, &www_host));
+        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
     EXPECT_TRUE(ssl_errors::NameUnderAnyNames(host_name_tokens,
-                                              dns_name_tokens_google));
-    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_google,
+                                              dns_name_tokens_example));
+    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
                                                host_name_tokens));
-    EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *google_cert));
+    EXPECT_TRUE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
   }
 
   {
-    GURL origin("https://www.google.com.foo");
+    GURL origin("https://www.example.com.foo");
     std::string www_host;
     std::vector<std::string> host_name_tokens = base::SplitString(
         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
     EXPECT_FALSE(
-        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_google, &www_host));
+        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
     EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
-                                               dns_name_tokens_google));
-    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_google,
+                                               dns_name_tokens_example));
+    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
                                                host_name_tokens));
-    EXPECT_FALSE(ssl_errors::IsCertLikelyFromSameDomain(origin, *google_cert));
+    EXPECT_FALSE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
   }
 
   {
-    GURL origin("https://www.foogoogle.com.");
+    GURL origin("https://www.fooexample.com.");
     std::string www_host;
     std::vector<std::string> host_name_tokens = base::SplitString(
         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
     EXPECT_FALSE(
-        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_google, &www_host));
+        ssl_errors::GetWWWSubDomainMatch(origin, dns_names_example, &www_host));
     EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
-                                               dns_name_tokens_google));
-    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_google,
+                                               dns_name_tokens_example));
+    EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_example,
                                                host_name_tokens));
-    EXPECT_FALSE(ssl_errors::IsCertLikelyFromSameDomain(origin, *google_cert));
+    EXPECT_FALSE(ssl_errors::IsCertLikelyFromSameDomain(origin, *example_cert));
   }
 
-  scoped_refptr<net::X509Certificate> webkit_cert(
-      net::X509Certificate::CreateFromBytes(
-          reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der)));
-  ASSERT_TRUE(webkit_cert.get());
-  std::vector<std::string> dns_names_webkit;
-  webkit_cert->GetDNSNames(&dns_names_webkit);
-  ASSERT_EQ(2u, dns_names_webkit.size());  // ["*.webkit.org", "webkit.org"]
-  std::vector<std::string> hostname_tokens_webkit_0 =
-      ssl_errors::Tokenize(dns_names_webkit[0]);
-  ASSERT_EQ(3u, hostname_tokens_webkit_0.size());  // ["*", "webkit","org"]
-  std::vector<std::string> hostname_tokens_webkit_1 =
-      ssl_errors::Tokenize(dns_names_webkit[1]);
-  ASSERT_EQ(2u, hostname_tokens_webkit_1.size());  // ["webkit","org"]
-  std::vector<std::vector<std::string>> dns_name_tokens_webkit;
-  dns_name_tokens_webkit.push_back(hostname_tokens_webkit_0);
-  dns_name_tokens_webkit.push_back(hostname_tokens_webkit_1);
-  ASSERT_EQ(2u, dns_name_tokens_webkit.size());
+  // Ensure that a certificate with no SubjectAltName does not fall back to
+  // the Subject CN when evaluating hostnames.
   {
+    scoped_refptr<net::X509Certificate> google_cert(
+        net::X509Certificate::CreateFromBytes(
+            reinterpret_cast<const char*>(google_der), sizeof(google_der)));
+    ASSERT_TRUE(google_cert);
+
+    GURL origin("https://google.com");
+
+    base::HistogramTester histograms;
+    ssl_errors::RecordUMAStatistics(true, base::Time::NowFromSystemTime(),
+                                    origin, net::ERR_CERT_COMMON_NAME_INVALID,
+                                    *google_cert);
+
+    // Verify that we recorded only NO_SUBJECT_ALT_NAME and no other causes.
+    histograms.ExpectUniqueSample(kSslErrorCauseHistogram,
+                                  ssl_errors::NO_SUBJECT_ALT_NAME, 1);
+  }
+
+  {
+    scoped_refptr<net::X509Certificate> webkit_cert(
+        net::X509Certificate::CreateFromBytes(
+            reinterpret_cast<const char*>(webkit_der), sizeof(webkit_der)));
+    ASSERT_TRUE(webkit_cert);
+    std::vector<std::string> dns_names_webkit;
+    webkit_cert->GetSubjectAltName(&dns_names_webkit, nullptr);
+    ASSERT_THAT(dns_names_webkit, ElementsAre("*.webkit.org", "webkit.org"));
+    std::vector<std::string> hostname_tokens_webkit_0 =
+        ssl_errors::Tokenize(dns_names_webkit[0]);
+    ASSERT_THAT(hostname_tokens_webkit_0, ElementsAre("*", "webkit", "org"));
+    std::vector<std::string> hostname_tokens_webkit_1 =
+        ssl_errors::Tokenize(dns_names_webkit[1]);
+    ASSERT_THAT(hostname_tokens_webkit_1, ElementsAre("webkit", "org"));
+    std::vector<std::vector<std::string>> dns_name_tokens_webkit;
+    dns_name_tokens_webkit.push_back(hostname_tokens_webkit_0);
+    dns_name_tokens_webkit.push_back(hostname_tokens_webkit_1);
+    ASSERT_EQ(2u, dns_name_tokens_webkit.size());
     GURL origin("https://a.b.webkit.org");
     std::string www_host;
     std::vector<std::string> host_name_tokens = base::SplitString(
         origin.host(), ".", base::KEEP_WHITESPACE, base::SPLIT_WANT_ALL);
     EXPECT_FALSE(
         ssl_errors::GetWWWSubDomainMatch(origin, dns_names_webkit, &www_host));
     EXPECT_FALSE(ssl_errors::NameUnderAnyNames(host_name_tokens,
                                                dns_name_tokens_webkit));
     EXPECT_FALSE(ssl_errors::AnyNamesUnderName(dns_name_tokens_webkit,
                                                host_name_tokens));
@@ skipping 274 matching lines @@
   clock->Advance(base::TimeDelta::FromDays(1));
   // GetClockState() will fall back to the build time heuristic.
   ssl_errors::GetClockState(clock->Now(), &network_time_tracker);
   histograms.ExpectTotalCount(kNetworkTimeHistogram, 8);
   histograms.ExpectBucketCount(
       kNetworkTimeHistogram, ssl_errors::NETWORK_CLOCK_STATE_UNKNOWN_SYNC_LOST,
       1);
 
   io_thread.Stop();
 }