Add information to SSLInfo about CT EV policy compliance

net/cert/ct_verify_result.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CT_VERIFY_RESULT_H_
 #define NET_CERT_CT_VERIFY_RESULT_H_
 
 #include <vector>
 
+#include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/signed_certificate_timestamp.h"
 
 namespace net {
 
 namespace ct {
 
 typedef std::vector<scoped_refptr<SignedCertificateTimestamp> > SCTList;
 
-// Holds Signed Certificate Timestamps, depending on their verification results.
-// More information could be tracked here about SCTs, but for the current UI
-// this categorization is enough.
+// Holds Signed Certificate Timestamps, depending on their verification
+// results, and information about CT policies that were applied on the
+// connection.
 struct NET_EXPORT CTVerifyResult {
   CTVerifyResult();
   ~CTVerifyResult();
 
   // SCTs from known logs where the signature verified correctly.
   SCTList verified_scts;
   // SCTs from known logs where the signature failed to verify.
   SCTList invalid_scts;
   // SCTs from unknown logs and as such are unverifiable.
   SCTList unknown_logs_scts;
+
+  // True if any CT policies were applied on this connection.
+  bool ct_policies_applied;
+  // The result of evaluating whether the connection complies with the
+  // EV CT policy.
+  CTPolicyEnforcer::EVPolicyCompliance ev_policy_compliance;

[Eran Messeri, 2016/02/10 17:41:09]

Wouldn't it make sense to have the EVPolicyCompliance definition here, rather
than refer to the ct_policy_enforcer?
It seems to me that pulling the ct_policy_enforcer header pulls in some other
dependencies (like the NetLog) which aren't necessary for a plain data object.

[Ryan Sleevi, 2016/02/10 17:57:06]

That would seem to defeat the goal of making CTPolicyEnforcer no longer depend
on CTVerifyResult (which I think is a reasonable goal)

If you visualize out the dependencies, it sounds like a separate header may be
better, much like CertStatus.

[estark, 2016/02/11 01:54:21]

Done. (separate header)

 };
 
 }  // namespace ct
 
 }  // namespace net
 
 #endif  // NET_CERT_CT_VERIFY_RESULT_H_