Certificate Transparency: Fetching of Signed Tree Heads (DRAFT)

chrome/browser/io_thread.h

Index: chrome/browser/io_thread.h
diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index b165d4a6d03e14b9bf0a23dc25897d52aaba89e1..12155a7922754a82ac213f4decb54a93bab5694d 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h
@@ -21,6 +21,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/browser_thread_delegate.h"
 #include "net/base/network_change_notifier.h"
+#include "net/cert/ct_verifier.h"
 #include "net/http/http_network_session.h"
 #include "net/socket/next_proto.h"
 
@@ -47,7 +48,7 @@ class CertPolicyEnforcer;
 class CertVerifier;
 class ChannelIDService;
 class CookieStore;
-class CTVerifier;
+class CTLogVerifier;
 class FtpTransactionFactory;
 class HostMappingRules;
 class HostResolver;
@@ -127,6 +128,7 @@ class IOThread : public content::BrowserThreadDelegate {
     // used to enforce pinning for system requests and will only use built-in
     // pins.
     scoped_ptr<net::TransportSecurityState> transport_security_state;
+    std::vector<linked_ptr<net::CTLogVerifier>> ct_logs;

[Ryan Sleevi, 2015/06/29 11:58:12]

XXX - Replacing linked_ptr<> w/ making net::CTLogVerifier explicitly RefCounted

[Eran Messeri, 2015/07/10 13:15:48]

Done.

     scoped_ptr<net::CTVerifier> cert_transparency_verifier;
     scoped_ptr<net::CertPolicyEnforcer> cert_policy_enforcer;
     scoped_refptr<net::SSLConfigService> ssl_config_service;
@@ -156,6 +158,11 @@ class IOThread : public content::BrowserThreadDelegate {
     // |system_cookie_store| and |system_channel_id_service| are shared
     // between |proxy_script_fetcher_context| and |system_request_context|.
     scoped_refptr<net::CookieStore> system_cookie_store;
+    // |cert_transparency_observer| is shared between
+    // |proxy_script_fetcher_context| and |system_request_context|. Since
+    // it may be performing URLRequests of its own it must be destroyed
+    // before both URLRequestContexts.
+    scoped_ptr<net::CTVerifier::Observer> cert_transparency_observer;

[Ryan Sleevi, 2015/06/29 11:58:13]

XXX - sanity check this with eroman to make sure having this for
|proxy_script_fetcher| makes sense

[Eran Messeri, 2015/07/10 13:15:48]

Another option is to have a CTVerifier for the proxy_script_fetcher_context that
does not have an observer set so it will only validate received SCTs.

 #if defined(ENABLE_EXTENSIONS)
     scoped_refptr<extensions::EventRouterForwarder>
         extension_event_router_forwarder;