QUIC - Code to verify SCT tag with certificate transparency verifier

net/quic/quic_chromium_client_session.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_chromium_client_session.h"
 
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
@@ skipping 482 matching lines @@
   ssl_info->public_key_hashes = cert_verify_result_->public_key_hashes;
   ssl_info->is_issued_by_known_root =
       cert_verify_result_->is_issued_by_known_root;
 
   ssl_info->connection_status = ssl_connection_status;
   ssl_info->client_cert_sent = false;
   ssl_info->channel_id_sent = crypto_stream_->WasChannelIDSent();
   ssl_info->security_bits = security_bits;
   ssl_info->handshake_type = SSLInfo::HANDSHAKE_FULL;
   ssl_info->pinning_failure_log = pinning_failure_log_;
+
+  ssl_info->UpdateSignedCertificateTimestamps(*ct_verify_result_);
+
   return true;
 }
 
 int QuicChromiumClientSession::CryptoConnect(
     bool require_confirmation,
     const CompletionCallback& callback) {
   require_confirmation_ = require_confirmation;
   handshake_start_ = base::TimeTicks::Now();
   RecordHandshakeState(STATE_STARTED);
   DCHECK(flow_controller());
@@ skipping 280 matching lines @@
 }
 
 void QuicChromiumClientSession::OnProofVerifyDetailsAvailable(
     const ProofVerifyDetails& verify_details) {
   const ProofVerifyDetailsChromium* verify_details_chromium =
       reinterpret_cast<const ProofVerifyDetailsChromium*>(&verify_details);
   CertVerifyResult* result_copy = new CertVerifyResult;
   result_copy->CopyFrom(verify_details_chromium->cert_verify_result);
   cert_verify_result_.reset(result_copy);
   pinning_failure_log_ = verify_details_chromium->pinning_failure_log;
+  ct::CTVerifyResult* ct_verify_result_copy = new ct::CTVerifyResult;

[Eran Messeri, 2015/11/23 17:35:19]

Nit: In the past the use of scoped_ptr was recommended to me, any reason not to:
scoped_ptr<ct::CTVerifyResult> ct_verify_result_copy(new ct::CTVerifyResult);
*ct_verify_result_copy = verify_details_chromium->ct_verify_result;
ct_verify_result_ = ct_verify_result_copy.Pass();

?

(even better if the CTVerifyResult had a copy c'tor).

[ramant (doing other things), 2015/11/23 17:57:41]

Acknowledged.

Will modify CTVerifyResult and CertVerifyResult to use scoped_ptr and then call
Pass(). (I am guessing the previous reviewer preferred the current style of
coding. Will switch to using scoped_ptr here and the unittests).

+  *ct_verify_result_copy = verify_details_chromium->ct_verify_result;
+  ct_verify_result_.reset(ct_verify_result_copy);
   logger_->OnCertificateVerified(*cert_verify_result_);
 }
 
 void QuicChromiumClientSession::StartReading() {
   packet_reader_.StartReading();
 }
 
 void QuicChromiumClientSession::CloseSessionOnError(int error,
                                                     QuicErrorCode quic_error) {
   RecordAndCloseSessionOnError(error, quic_error);
@@ skipping 150 matching lines @@
     return;
 
   // TODO(rch): re-enable this code once beta is cut.
   //  if (stream_factory_)
   //    stream_factory_->OnSessionConnectTimeout(this);
   //  CloseAllStreams(ERR_QUIC_HANDSHAKE_FAILED);
   //  DCHECK_EQ(0u, GetNumOpenStreams());
 }
 
 }  // namespace net