Skip to content
This repository was archived by the owner on Jul 9, 2025. It is now read-only.

Commit f6a0d56

Browse files
fquezefqueze
committed
Bug 1944631 - Migrate histograms to use Glean APIs for CERT_*, r=chutten.
Differential Revision: https://phabricator.services.mozilla.com/D235664
1 parent 0810a4a commit f6a0d56

11 files changed

+253
-87
lines changed

‎security/certverifier/CertVerifier.h

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
#include "RootCertificateTelemetryUtils.h"
1515
#include "ScopedNSSTypes.h"
1616
#include "mozilla/EnumSet.h"
17-
#include "mozilla/Telemetry.h"
1817
#include "mozilla/TimeStamp.h"
1918
#include "mozilla/UniquePtr.h"
2019
#include "mozilla/glean/bindings/MetricTypes.h"
@@ -93,7 +92,8 @@ class PinningTelemetryInfo {
9392

9493
// Should we accumulate pinning telemetry for the result?
9594
bool accumulateResult;
96-
Maybe<Telemetry::HistogramID> certPinningResultHistogram;
95+
bool isMoz;
96+
bool testMode;
9797
int32_t certPinningResultBucket;
9898
// Should we accumulate telemetry for the root?
9999
bool accumulateForRoot;
@@ -102,6 +102,8 @@ class PinningTelemetryInfo {
102102
void Reset() {
103103
accumulateForRoot = false;
104104
accumulateResult = false;
105+
isMoz = false;
106+
testMode = false;
105107
}
106108
};
107109

‎security/manager/ssl/PublicKeyPinningService.cpp

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -286,23 +286,17 @@ static nsresult CheckPinsForHostname(
286286
return NS_ERROR_FAILURE;
287287
}
288288

289-
Telemetry::HistogramID histogram;
290289
int32_t bucket;
291290
// We can collect per-host pinning violations for this host because it is
292291
// operationally critical to Firefox.
293292
if (staticFingerprints->mIsMoz) {
294-
histogram = staticFingerprints->mTestMode
295-
? Telemetry::CERT_PINNING_MOZ_TEST_RESULTS_BY_HOST
296-
: Telemetry::CERT_PINNING_MOZ_RESULTS_BY_HOST;
297293
bucket = staticFingerprints->mId * 2 + (enforceTestModeResult ? 1 : 0);
298294
} else {
299-
histogram = staticFingerprints->mTestMode
300-
? Telemetry::CERT_PINNING_TEST_RESULTS
301-
: Telemetry::CERT_PINNING_RESULTS;
302295
bucket = enforceTestModeResult ? 1 : 0;
303296
}
297+
pinningTelemetryInfo->isMoz = staticFingerprints->mIsMoz;
298+
pinningTelemetryInfo->testMode = staticFingerprints->mTestMode;
304299
pinningTelemetryInfo->accumulateResult = true;
305-
pinningTelemetryInfo->certPinningResultHistogram = Some(histogram);
306300
pinningTelemetryInfo->certPinningResultBucket = bucket;
307301

308302
// We only collect per-CA pinning statistics upon failures.

‎security/manager/ssl/RootCertificateTelemetryUtils.cpp

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -124,16 +124,5 @@ int32_t RootCABinNumber(Span<const uint8_t> cert) {
124124
return ROOT_CERTIFICATE_UNKNOWN;
125125
}
126126

127-
// Attempt to increment the appropriate bin in the provided Telemetry probe ID.
128-
// If there was a hash failure, we do nothing.
129-
void AccumulateTelemetryForRootCA(mozilla::Telemetry::HistogramID probe,
130-
const Span<const uint8_t> cert) {
131-
int32_t binId = RootCABinNumber(cert);
132-
133-
if (binId != ROOT_CERTIFICATE_HASH_FAILURE) {
134-
Accumulate(probe, binId);
135-
}
136-
}
137-
138127
} // namespace psm
139128
} // namespace mozilla

‎security/manager/ssl/RootCertificateTelemetryUtils.h

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
#define RootCertificateTelemetryUtils_h
99

1010
#include "mozilla/Span.h"
11-
#include "mozilla/Telemetry.h"
1211

1312
namespace mozilla {
1413
namespace psm {
@@ -28,9 +27,6 @@ namespace psm {
2827

2928
int32_t RootCABinNumber(Span<const uint8_t> cert);
3029

31-
void AccumulateTelemetryForRootCA(mozilla::Telemetry::HistogramID probe,
32-
const Span<const uint8_t> cert);
33-
3430
} // namespace psm
3531
} // namespace mozilla
3632

‎security/manager/ssl/SSLServerCertVerification.cpp

Lines changed: 35 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -504,8 +504,11 @@ void GatherCertificateTransparencyTelemetry(
504504
// Report CT Policy compliance by CA.
505505
if (info.policyCompliance.isSome() &&
506506
*info.policyCompliance != ct::CTPolicyCompliance::Compliant) {
507-
AccumulateTelemetryForRootCA(
508-
Telemetry::SSL_CT_POLICY_NON_COMPLIANT_CONNECTIONS_BY_CA_2, rootCert);
507+
int32_t binId = RootCABinNumber(rootCert);
508+
if (binId != ROOT_CERTIFICATE_HASH_FAILURE) {
509+
Telemetry::Accumulate(
510+
Telemetry::SSL_CT_POLICY_NON_COMPLIANT_CONNECTIONS_BY_CA_2, binId);
511+
}
509512
}
510513
}
511514

@@ -523,33 +526,52 @@ static void CollectCertTelemetry(
523526
uint32_t evStatus = (aCertVerificationResult != Success) ? 0 // 0 = Failure
524527
: (aEVStatus != EVStatus::EV) ? 1 // 1 = DV
525528
: 2; // 2 = EV
526-
Telemetry::Accumulate(Telemetry::CERT_EV_STATUS, evStatus);
529+
glean::cert::ev_status.AccumulateSingleSample(evStatus);
527530

528531
if (aOcspStaplingStatus != CertVerifier::OCSP_STAPLING_NEVER_CHECKED) {
529532
Telemetry::Accumulate(Telemetry::SSL_OCSP_STAPLING, aOcspStaplingStatus);
530533
}
531534

532535
if (aKeySizeStatus != KeySizeStatus::NeverChecked) {
533-
Telemetry::Accumulate(Telemetry::CERT_CHAIN_KEY_SIZE_STATUS,
534-
static_cast<uint32_t>(aKeySizeStatus));
536+
glean::cert::chain_key_size_status.AccumulateSingleSample(
537+
static_cast<uint32_t>(aKeySizeStatus));
535538
}
536539

537540
if (aPinningTelemetryInfo.accumulateForRoot) {
538-
Telemetry::Accumulate(Telemetry::CERT_PINNING_FAILURES_BY_CA_2,
539-
aPinningTelemetryInfo.rootBucket);
541+
glean::cert_pinning::failures_by_ca.AccumulateSingleSample(
542+
aPinningTelemetryInfo.rootBucket);
540543
}
541544

542545
if (aPinningTelemetryInfo.accumulateResult) {
543-
MOZ_ASSERT(aPinningTelemetryInfo.certPinningResultHistogram.isSome());
544-
Telemetry::Accumulate(
545-
aPinningTelemetryInfo.certPinningResultHistogram.value(),
546-
aPinningTelemetryInfo.certPinningResultBucket);
546+
if (aPinningTelemetryInfo.isMoz) {
547+
if (aPinningTelemetryInfo.testMode) {
548+
glean::cert_pinning::moz_test_results_by_host.AccumulateSingleSample(
549+
aPinningTelemetryInfo.certPinningResultBucket);
550+
} else {
551+
glean::cert_pinning::moz_results_by_host.AccumulateSingleSample(
552+
aPinningTelemetryInfo.certPinningResultBucket);
553+
}
554+
} else {
555+
if (aPinningTelemetryInfo.testMode) {
556+
glean::cert_pinning::test_results
557+
.EnumGet(static_cast<glean::cert_pinning::TestResultsLabel>(
558+
aPinningTelemetryInfo.certPinningResultBucket))
559+
.Add();
560+
} else {
561+
glean::cert_pinning::results
562+
.EnumGet(static_cast<glean::cert_pinning::ResultsLabel>(
563+
aPinningTelemetryInfo.certPinningResultBucket))
564+
.Add();
565+
}
566+
}
547567
}
548568

549569
if (aCertVerificationResult == Success && aBuiltCertChain.Length() > 0) {
550570
const nsTArray<uint8_t>& rootCert = aBuiltCertChain.LastElement();
551-
AccumulateTelemetryForRootCA(Telemetry::CERT_VALIDATION_SUCCESS_BY_CA_2,
552-
rootCert);
571+
int32_t binId = RootCABinNumber(rootCert);
572+
if (binId != ROOT_CERTIFICATE_HASH_FAILURE) {
573+
glean::cert::validation_success_by_ca.AccumulateSingleSample(binId);
574+
}
553575

554576
mozilla::glean::tls::certificate_verifications.Add(1);
555577
if (issuerSources.contains(IssuerSource::TLSHandshake)) {

‎security/manager/ssl/metrics.yaml

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,3 +358,204 @@ security:
358358
- dkeeler@mozilla.com
359359
expires: never
360360
telemetry_mirror: SECURITY_CLIENT_AUTH_CERT_USAGE
361+
362+
cert:
363+
ev_status:
364+
type: custom_distribution
365+
description: >
366+
EV status of a certificate, recorded on each TLS connection. 0=invalid,
367+
1=DV, 2=EV
368+
369+
This metric was generated to correspond to the Legacy Telemetry enumerated
370+
histogram CERT_EV_STATUS.
371+
range_min: 0
372+
range_max: 10
373+
bucket_count: 11
374+
histogram_type: linear
375+
bugs:
376+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254653
377+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
378+
data_reviews:
379+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1254653
380+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
381+
notification_emails:
382+
- seceng-telemetry@mozilla.com
383+
expires: never
384+
telemetry_mirror: CERT_EV_STATUS
385+
386+
validation_success_by_ca:
387+
type: custom_distribution
388+
description: >
389+
Successful SSL server cert validations by CA (see RootHashes.inc for names
390+
of CAs)
391+
392+
This metric was generated to correspond to the Legacy Telemetry enumerated
393+
histogram CERT_VALIDATION_SUCCESS_BY_CA_2.
394+
range_min: 0
395+
range_max: 256
396+
bucket_count: 257
397+
histogram_type: linear
398+
bugs:
399+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1364159
400+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1369747
401+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1441550
402+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1909978
403+
data_reviews:
404+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1364159
405+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1369747
406+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1441550
407+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1909978
408+
notification_emails:
409+
- seceng-telemetry@mozilla.com
410+
- dkeeler@mozilla.com
411+
expires: never
412+
telemetry_mirror: CERT_VALIDATION_SUCCESS_BY_CA_2
413+
414+
chain_key_size_status:
415+
type: custom_distribution
416+
description: >
417+
Does enforcing a larger minimum RSA key size cause verification failures?
418+
1 = no, 2 = yes, 3 = another error prevented finding a verified chain
419+
420+
This metric was generated to correspond to the Legacy Telemetry enumerated
421+
histogram CERT_CHAIN_KEY_SIZE_STATUS.
422+
range_min: 0
423+
range_max: 4
424+
bucket_count: 5
425+
histogram_type: linear
426+
bugs:
427+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
428+
data_reviews:
429+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
430+
notification_emails:
431+
- seceng-telemetry@mozilla.com
432+
expires: never
433+
telemetry_mirror: CERT_CHAIN_KEY_SIZE_STATUS
434+
435+
validation_http_request_result:
436+
type: custom_distribution
437+
description: >
438+
HTTP result of OCSP, etc.. (0=canceled, 1=OK, 2=FAILED, 3=internal-error)
439+
440+
This metric was generated to correspond to the Legacy Telemetry enumerated
441+
histogram CERT_VALIDATION_HTTP_REQUEST_RESULT.
442+
range_min: 0
443+
range_max: 16
444+
bucket_count: 17
445+
histogram_type: linear
446+
bugs:
447+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
448+
data_reviews:
449+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
450+
notification_emails:
451+
- seceng-telemetry@mozilla.com
452+
expires: never
453+
telemetry_mirror: CERT_VALIDATION_HTTP_REQUEST_RESULT
454+
455+
cert_pinning:
456+
failures_by_ca:
457+
type: custom_distribution
458+
description: >
459+
Pinning failures by CA (see RootHashes.inc for names of CAs)
460+
461+
This metric was generated to correspond to the Legacy Telemetry enumerated
462+
histogram CERT_PINNING_FAILURES_BY_CA_2.
463+
range_min: 0
464+
range_max: 256
465+
bucket_count: 257
466+
histogram_type: linear
467+
bugs:
468+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
469+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1909978
470+
data_reviews:
471+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
472+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1909978
473+
notification_emails:
474+
- pinning@mozilla.org
475+
- dkeeler@mozilla.com
476+
expires: never
477+
telemetry_mirror: CERT_PINNING_FAILURES_BY_CA_2
478+
479+
results:
480+
type: labeled_counter
481+
description: >
482+
Certificate pinning results (0 = failure, 1 = success)
483+
484+
This metric was generated to correspond to the Legacy Telemetry boolean
485+
histogram CERT_PINNING_RESULTS.
486+
labels:
487+
- "false"
488+
- "true"
489+
bugs:
490+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
491+
data_reviews:
492+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
493+
notification_emails:
494+
- pinning@mozilla.org
495+
expires: never
496+
telemetry_mirror: h#CERT_PINNING_RESULTS
497+
498+
test_results:
499+
type: labeled_counter
500+
description: >
501+
Certificate pinning test results (0 = failure, 1 = success)
502+
503+
This metric was generated to correspond to the Legacy Telemetry boolean
504+
histogram CERT_PINNING_TEST_RESULTS.
505+
labels:
506+
- "false"
507+
- "true"
508+
bugs:
509+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
510+
data_reviews:
511+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1862062
512+
notification_emails:
513+
- pinning@mozilla.org
514+
expires: never
515+
telemetry_mirror: h#CERT_PINNING_TEST_RESULTS
516+
517+
moz_results_by_host:
518+
type: custom_distribution
519+
description: >
520+
Certificate pinning results by host for Mozilla operational sites
521+
522+
This metric was generated to correspond to the Legacy Telemetry enumerated
523+
histogram CERT_PINNING_MOZ_RESULTS_BY_HOST.
524+
range_min: 0
525+
range_max: 512
526+
bucket_count: 513
527+
histogram_type: linear
528+
bugs:
529+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1007844
530+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1521940
531+
data_reviews:
532+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1007844
533+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1521940
534+
notification_emails:
535+
- dkeeler@mozilla.com
536+
- pinning@mozilla.org
537+
expires: never
538+
telemetry_mirror: CERT_PINNING_MOZ_RESULTS_BY_HOST
539+
540+
moz_test_results_by_host:
541+
type: custom_distribution
542+
description: >
543+
Certificate pinning test results by host for Mozilla operational sites
544+
545+
This metric was generated to correspond to the Legacy Telemetry enumerated
546+
histogram CERT_PINNING_MOZ_TEST_RESULTS_BY_HOST.
547+
range_min: 0
548+
range_max: 512
549+
bucket_count: 513
550+
histogram_type: linear
551+
bugs:
552+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1007844
553+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1521940
554+
data_reviews:
555+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1007844
556+
- https://bugzilla.mozilla.org/show_bug.cgi?id=1521940
557+
notification_emails:
558+
- dkeeler@mozilla.com
559+
- pinning@mozilla.org
560+
expires: never
561+
telemetry_mirror: CERT_PINNING_MOZ_TEST_RESULTS_BY_HOST

‎security/manager/ssl/nsNSSCallbacks.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -158,17 +158,17 @@ nsresult OCSPRequest::DispatchToMainThreadAndWait() {
158158
// If mStartTime was never set, we consider this an internal error.
159159
// Otherwise, we managed to at least send the request.
160160
if (mStartTime.IsNull()) {
161-
Telemetry::Accumulate(Telemetry::CERT_VALIDATION_HTTP_REQUEST_RESULT, 3);
161+
glean::cert::validation_http_request_result.AccumulateSingleSample(3);
162162
} else if (mResponseResult == NS_ERROR_NET_TIMEOUT) {
163-
Telemetry::Accumulate(Telemetry::CERT_VALIDATION_HTTP_REQUEST_RESULT, 0);
163+
glean::cert::validation_http_request_result.AccumulateSingleSample(0);
164164
mozilla::glean::ocsp_request_time::cancel.AccumulateRawDuration(
165165
TimeStamp::Now() - mStartTime);
166166
} else if (NS_SUCCEEDED(mResponseResult)) {
167-
Telemetry::Accumulate(Telemetry::CERT_VALIDATION_HTTP_REQUEST_RESULT, 1);
167+
glean::cert::validation_http_request_result.AccumulateSingleSample(1);
168168
mozilla::glean::ocsp_request_time::success.AccumulateRawDuration(
169169
TimeStamp::Now() - mStartTime);
170170
} else {
171-
Telemetry::Accumulate(Telemetry::CERT_VALIDATION_HTTP_REQUEST_RESULT, 2);
171+
glean::cert::validation_http_request_result.AccumulateSingleSample(2);
172172
mozilla::glean::ocsp_request_time::failure.AccumulateRawDuration(
173173
TimeStamp::Now() - mStartTime);
174174
}

0 commit comments

Comments
 (0)