Addition of Certificate Transparency details to Security panel of DevTools

content/browser/loader/resource_loader.cc

Index: content/browser/loader/resource_loader.cc
diff --git a/content/browser/loader/resource_loader.cc b/content/browser/loader/resource_loader.cc
index eee044c6aaf87a0119371de0a8722a239657692f..5bfc9aa3665a2d9edb2c25ee61ab924da1b1cf18 100644
--- a/content/browser/loader/resource_loader.cc
+++ b/content/browser/loader/resource_loader.cc
@@ -27,7 +27,6 @@
 #include "content/public/browser/cert_store.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/resource_dispatcher_host_login_delegate.h"
-#include "content/public/browser/signed_certificate_timestamp_store.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
@@ -37,6 +36,7 @@
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "net/ssl/client_cert_store.h"
+#include "net/ssl/signed_certificate_timestamp_and_status.h"
 #include "net/ssl/ssl_platform_key.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/url_request/redirect_info.h"
@@ -48,20 +48,6 @@ using base::TimeTicks;
 namespace content {
 namespace {
 
-void StoreSignedCertificateTimestamps(
-    const net::SignedCertificateTimestampAndStatusList& sct_list,
-    int process_id,
-    SignedCertificateTimestampIDStatusList* sct_ids) {
-  SignedCertificateTimestampStore* sct_store(
-      SignedCertificateTimestampStore::GetInstance());
-
-  for (auto iter = sct_list.begin(); iter != sct_list.end(); ++iter) {
-    const int sct_id(sct_store->Store(iter->sct.get(), process_id));
-    sct_ids->push_back(
-        SignedCertificateTimestampIDAndStatus(sct_id, iter->status));
-  }
-}
-
 void GetSSLStatusForRequest(const GURL& url,
                             const net::SSLInfo& ssl_info,
                             int child_id,
@@ -71,13 +57,9 @@ void GetSSLStatusForRequest(const GURL& url,
   int cert_id =
       CertStore::GetInstance()->StoreCert(ssl_info.cert.get(), child_id);
 
-  SignedCertificateTimestampIDStatusList signed_certificate_timestamp_ids;
-  StoreSignedCertificateTimestamps(ssl_info.signed_certificate_timestamps,
-                                   child_id, &signed_certificate_timestamp_ids);
-
   *ssl_status = SSLStatus(SSLPolicy::GetSecurityStyleForResource(
                               url, cert_id, ssl_info.cert_status),
-                          cert_id, signed_certificate_timestamp_ids, ssl_info);
+                          cert_id, ssl_info);
 }
 
 void PopulateResourceResponse(ResourceRequestInfoImpl* info,
@@ -117,9 +99,11 @@ void PopulateResourceResponse(ResourceRequestInfoImpl* info,
     GetSSLStatusForRequest(request->url(), request->ssl_info(),
                            info->GetChildID(), &ssl_status);
     response->head.security_info = SerializeSecurityInfo(ssl_status);
-    response->head.has_major_certificate_errors =
+    response->head.has_major_certificate_errors = true;

[estark, 2016/03/22 15:51:12]

This change doesn't look right.

[dwaxweiler, 2016/03/22 20:47:43]

Acknowledged.

         net::IsCertStatusError(ssl_status.cert_status) &&
         !net::IsCertStatusMinorError(ssl_status.cert_status);
+    response->head.signed_certificate_timestamps =
+        request->ssl_info().signed_certificate_timestamps;

[dwaxweiler, 2016/03/21 23:03:44]

I set the head.signed_certificate_timestamps here, but in web_url_loader_impl.cc
it is empty again.

[estark, 2016/03/22 15:51:12]

You probably need to add the field to content::ResourceResponseInfo in
content/common/resource_messages.h

[dwaxweiler, 2016/03/22 20:47:43]

Yes, you are right. Thanks! However, the compiler is complaining now because IPC
does not seem to support scoped_refpt. Do you have an idea about how to proceed?

[estark, 2016/03/23 01:08:52]

The scoped_refptr<net::HttpResponseHeaders> in that same message struct might be
a good example; take a look at
https://code.google.com/p/chromium/codesearch#chromium/src/content/common/res...
I think you should be able to use the existing
SignedCertificateTimestamp::Persist() and CreateFromPickle() methods to send the
object across the IPC boundary?

[dwaxweiler, 2016/03/23 15:50:52]

Done.

   } else {
     // We should not have any SSL state.
     DCHECK(!request->ssl_info().cert_status);