Require a CTVerifier and CTPolicyEnforcer for TLS/QUIC sockets

extensions/browser/api/socket/tls_socket.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/socket/tls_socket.h"
 
 #include <utility>
 
 #include "base/callback_helpers.h"
 #include "base/logging.h"
@@ skipping 163 matching lines @@
 Socket::SocketType TLSSocket::GetSocketType() const {
   return Socket::TYPE_TLS;
 }
 
 // static
 void TLSSocket::UpgradeSocketToTLS(
     Socket* socket,
     scoped_refptr<net::SSLConfigService> ssl_config_service,
     net::CertVerifier* cert_verifier,
     net::TransportSecurityState* transport_security_state,
+    net::CTVerifier* ct_verifier,
+    net::CTPolicyEnforcer* ct_policy_enforcer,
     const std::string& extension_id,
     api::socket::SecureOptions* options,
     const TLSSocket::SecureCallback& callback) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
   TCPSocket* tcp_socket = static_cast<TCPSocket*>(socket);
   std::unique_ptr<net::SSLClientSocket> null_sock;
 
   if (!tcp_socket || tcp_socket->GetSocketType() != Socket::TYPE_TCP ||
       !tcp_socket->ClientStream() || !tcp_socket->IsConnected() ||
       tcp_socket->HasPendingRead()) {
@@ skipping 40 matching lines @@
   // only one active here). Then have the old socket release ownership on
   // that client stream.
   socket_handle->SetSocket(
       std::unique_ptr<net::StreamSocket>(tcp_socket->ClientStream()));
   tcp_socket->Release();
 
   DCHECK(transport_security_state);
   net::SSLClientSocketContext context;
   context.cert_verifier = cert_verifier;
   context.transport_security_state = transport_security_state;
+  context.cert_transparency_verifier = ct_verifier;
+  context.ct_policy_enforcer = ct_policy_enforcer;
 
   // Fill in the SSL socket params.
   net::SSLConfig ssl_config;
   ssl_config_service->GetSSLConfig(&ssl_config);
   if (options && options->tls_version.get()) {
     uint16_t version_min = 0, version_max = 0;
     api::socket::TLSVersionConstraints* versions = options->tls_version.get();
     if (versions->min.get()) {
       version_min = SSLProtocolVersionFromString(*versions->min.get());
     }
@@ skipping 45 matching lines @@
     if (status != net::OK) {
       DVLOG(1) << "Status is not OK or IO-pending: "
                << net::ErrorToString(status);
     }
     connect_cb.Run(status);
   }
 }
 
 }  // namespace extensions