QUIC - Code to verify SCT tag with certificate transparency verifier

net/quic/quic_chromium_client_session.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_chromium_client_session.h"
 
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/thread_task_runner_handle.h"
 #include "base/values.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/network_activity_monitor.h"
+#include "net/cert/cert_verify_result.h"
 #include "net/http/transport_security_state.h"
 #include "net/quic/crypto/proof_verifier_chromium.h"
 #include "net/quic/crypto/quic_server_info.h"
 #include "net/quic/quic_connection_helper.h"
 #include "net/quic/quic_crypto_client_stream_factory.h"
 #include "net/quic/quic_server_id.h"
 #include "net/quic/quic_stream_factory.h"
 #include "net/spdy/spdy_session.h"
 #include "net/ssl/channel_id_service.h"
 #include "net/ssl/ssl_connection_status_flags.h"
@@ skipping 464 matching lines @@
   ssl_info->public_key_hashes = cert_verify_result_->public_key_hashes;
   ssl_info->is_issued_by_known_root =
       cert_verify_result_->is_issued_by_known_root;
 
   ssl_info->connection_status = ssl_connection_status;
   ssl_info->client_cert_sent = false;
   ssl_info->channel_id_sent = crypto_stream_->WasChannelIDSent();
   ssl_info->security_bits = security_bits;
   ssl_info->handshake_type = SSLInfo::HANDSHAKE_FULL;
   ssl_info->pinning_failure_log = pinning_failure_log_;
+
+  // TODO(rtenneti): Move the following code into ssl_util.cc a new file.

[Ryan Hamilton, 2015/11/18 20:57:26]

+1. Or, it could be a static method of SSLInfo:

SSLInfo::UpdateSignedCertificateTimestamps(info, ct_verify_result_);

[ramant (doing other things), 2015/11/21 00:27:03]

Done.

+  for (ct::SCTList::const_iterator iter =
+           ct_verify_result_->verified_scts.begin();
+       iter != ct_verify_result_->verified_scts.end(); ++iter) {

[Ryan Hamilton, 2015/11/18 20:57:26]

Can you use a c++11 range based for loop here:

for (const auto& sct : ct_verify_result_->verified_scts) {
  ssl_info->signed_certificate_timestamps.push_back(
      SignedCertificateTimestampAndStatus(sct, ct::SCT_STATUS_OK));
}

[ramant (doing other things), 2015/11/21 00:27:03]

Done.

+    ssl_info->signed_certificate_timestamps.push_back(
+        SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_OK));
+  }
+  for (ct::SCTList::const_iterator iter =
+           ct_verify_result_->invalid_scts.begin();
+       iter != ct_verify_result_->invalid_scts.end(); ++iter) {
+    ssl_info->signed_certificate_timestamps.push_back(
+        SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_INVALID));
+  }
+  for (ct::SCTList::const_iterator iter =
+           ct_verify_result_->unknown_logs_scts.begin();
+       iter != ct_verify_result_->unknown_logs_scts.end(); ++iter) {
+    ssl_info->signed_certificate_timestamps.push_back(
+        SignedCertificateTimestampAndStatus(*iter, ct::SCT_STATUS_LOG_UNKNOWN));
+  }
+
   return true;
 }
 
 int QuicChromiumClientSession::CryptoConnect(
     bool require_confirmation,
     const CompletionCallback& callback) {
   require_confirmation_ = require_confirmation;
   handshake_start_ = base::TimeTicks::Now();
   RecordHandshakeState(STATE_STARTED);
   DCHECK(flow_controller());
@@ skipping 280 matching lines @@
 }
 
 void QuicChromiumClientSession::OnProofVerifyDetailsAvailable(
     const ProofVerifyDetails& verify_details) {
   const ProofVerifyDetailsChromium* verify_details_chromium =
       reinterpret_cast<const ProofVerifyDetailsChromium*>(&verify_details);
   CertVerifyResult* result_copy = new CertVerifyResult;
   result_copy->CopyFrom(verify_details_chromium->cert_verify_result);
   cert_verify_result_.reset(result_copy);
   pinning_failure_log_ = verify_details_chromium->pinning_failure_log;
+  ct::CTVerifyResult* ct_verify_result_copy = new ct::CTVerifyResult;
+  *ct_verify_result_copy = verify_details_chromium->ct_verify_result;
+  ct_verify_result_.reset(ct_verify_result_copy);
   logger_->OnCertificateVerified(*cert_verify_result_);
 }
 
 void QuicChromiumClientSession::StartReading() {
   packet_reader_.StartReading();
 }
 
 void QuicChromiumClientSession::CloseSessionOnError(int error,
                                                     QuicErrorCode quic_error) {
   RecordAndCloseSessionOnError(error, quic_error);
@@ skipping 150 matching lines @@
     return;
 
   // TODO(rch): re-enable this code once beta is cut.
   //  if (stream_factory_)
   //    stream_factory_->OnSessionConnectTimeout(this);
   //  CloseAllStreams(ERR_QUIC_HANDSHAKE_FAILED);
   //  DCHECK_EQ(0u, GetNumOpenStreams());
 }
 
 }  // namespace net