Add information to SSLInfo about CT EV policy compliance

net/cert/ct_verify_result.h

Index: net/cert/ct_verify_result.h
diff --git a/net/cert/ct_verify_result.h b/net/cert/ct_verify_result.h
index aa90164193b0cdf9c532d5e13ba2994491348766..e46e4210cfc04185d70fd988b3676c737f2259b0 100644
--- a/net/cert/ct_verify_result.h
+++ b/net/cert/ct_verify_result.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/signed_certificate_timestamp.h"
 
 namespace net {
@@ -15,9 +16,9 @@ namespace ct {
 
 typedef std::vector<scoped_refptr<SignedCertificateTimestamp> > SCTList;
 
-// Holds Signed Certificate Timestamps, depending on their verification results.
-// More information could be tracked here about SCTs, but for the current UI
-// this categorization is enough.
+// Holds Signed Certificate Timestamps, depending on their verification
+// results, and information about CT policies that were applied on the
+// connection.
 struct NET_EXPORT CTVerifyResult {
   CTVerifyResult();
   ~CTVerifyResult();
@@ -28,6 +29,12 @@ struct NET_EXPORT CTVerifyResult {
   SCTList invalid_scts;
   // SCTs from unknown logs and as such are unverifiable.
   SCTList unknown_logs_scts;
+
+  // True if CT policies were applied on this connection.

[Ryan Sleevi, 2016/02/05 02:09:25]

I'm not sure what this is meant to communicate - is this /any/ CT policies? Or
the DV policy? Or something else?

[estark, 2016/02/08 08:36:26]

Any. (Added that to the comment. The DV policy is in the follow-up CL, not this
one.) My goal with this field is for UI to be able to say "CT policies not
available" or some such explanatory sentence when we don't have any CT policy
info attached to a response (whether that was because the embedder didn't
provide a CTPolicyEnforcer for the connection, or the response was read from
cache, or some other reason).

I suppose an alternative might be to have an UNKNOWN enum value for each policy,
and when all policies are UNKNOWN, that signals that no policy information is
available. WDYT?

+  bool ct_policies_applied;
+  // The result of evaluating whether the connection complies with the
+  // EV CT policy.
+  CTPolicyEnforcer::EVPolicyCompliance ev_policy_compliance;
 };
 
 }  // namespace ct