Add a info flag set when certs fails to conform to the CT policy.

net/quic/crypto/proof_verifier_chromium.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/proof_verifier_chromium.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
 #include "base/compiler_specific.h"
@@ skipping 241 matching lines @@
   const CertStatus cert_status = cert_verify_result.cert_status;
   if (result == OK && policy_enforcer_ &&
       (cert_verify_result.cert_status & CERT_STATUS_IS_EV)) {
     // QUIC does not support OCSP stapling or the CT TLS extension; as a
     // result, CT can never be verified, thus the result is always empty.
     ct::CTVerifyResult empty_ct_result;
     if (!policy_enforcer_->DoesConformToCTEVPolicy(
             cert_verify_result.verified_cert.get(),
             SSLConfigService::GetEVCertsWhitelist().get(), empty_ct_result,
             net_log_)) {
+      verify_details_->cert_verify_result.cert_status |=
+          CERT_STATUS_CT_COMPLIANCE_FAILED;
       verify_details_->cert_verify_result.cert_status &= ~CERT_STATUS_IS_EV;
     }
   }
 
   // TODO(estark): replace 0 below with the port of the connection.
   if (transport_security_state_ &&
       (result == OK ||
        (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
       !transport_security_state_->CheckPublicKeyPins(
           HostPortPair(hostname_, 0),
@@ skipping 136 matching lines @@
   }
   return status;
 }
 
 void ProofVerifierChromium::OnJobComplete(Job* job) {
   active_jobs_.erase(job);
   delete job;
 }
 
 }  // namespace net