Require a CTVerifier and CTPolicyEnforcer for TLS/QUIC sockets

net/quic/crypto/proof_verifier_chromium.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/proof_verifier_chromium.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 132 matching lines @@
     int cert_verify_flags,
     const BoundNetLog& net_log)
     : proof_verifier_(proof_verifier),
       verifier_(cert_verifier),
       policy_enforcer_(ct_policy_enforcer),
       transport_security_state_(transport_security_state),
       cert_transparency_verifier_(cert_transparency_verifier),
       cert_verify_flags_(cert_verify_flags),
       next_state_(STATE_NONE),
       start_time_(base::TimeTicks::Now()),
-      net_log_(net_log) {}
+      net_log_(net_log) {
+  DCHECK(proof_verifier_);
+  DCHECK(verifier_);
+  DCHECK(policy_enforcer_);
+  DCHECK(transport_security_state_);
+  DCHECK(cert_transparency_verifier_);
+}
 
 ProofVerifierChromium::Job::~Job() {
   base::TimeTicks end_time = base::TimeTicks::Now();
   UMA_HISTOGRAM_TIMES("Net.QuicSession.VerifyProofTime",
                       end_time - start_time_);
   // |hostname_| will always be canonicalized to lowercase.
   if (hostname_.compare("www.google.com") == 0) {
     UMA_HISTOGRAM_TIMES("Net.QuicSession.VerifyProofTime.google",
                         end_time - start_time_);
   }
@@ skipping 40 matching lines @@
   }
   cert_ = X509Certificate::CreateFromDERCertChain(cert_pieces);
   if (!cert_.get()) {
     *error_details = "Failed to create certificate chain";
     DLOG(WARNING) << *error_details;
     verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID;
     *verify_details = std::move(verify_details_);
     return QUIC_FAILURE;
   }
 
-  if (cert_transparency_verifier_ && !cert_sct.empty()) {
+  if (!cert_sct.empty()) {
     // Note that this is a completely synchronous operation: The CT Log Verifier
     // gets all the data it needs for SCT verification and does not do any
     // external communication.
     cert_transparency_verifier_->Verify(cert_.get(), std::string(), cert_sct,
                                         &verify_details_->ct_verify_result,
                                         net_log_);
   }
 
   // We call VerifySignature first to avoid copying of server_config and
   // signature.
@@ skipping 71 matching lines @@
                  base::Unretained(this)),
       &cert_verifier_request_, net_log_);
 }
 
 int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) {
   cert_verifier_request_.reset();
 
   const CertVerifyResult& cert_verify_result =
       verify_details_->cert_verify_result;
   const CertStatus cert_status = cert_verify_result.cert_status;
-  verify_details_->ct_verify_result.ct_policies_applied =
-      (result == OK && policy_enforcer_ != nullptr);
+  verify_details_->ct_verify_result.ct_policies_applied = result == OK;
   verify_details_->ct_verify_result.ev_policy_compliance =
       ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY;
-  if (result == OK && policy_enforcer_) {
+  if (result == OK) {
     if ((cert_verify_result.cert_status & CERT_STATUS_IS_EV)) {
       ct::EVPolicyCompliance ev_policy_compliance =
           policy_enforcer_->DoesConformToCTEVPolicy(
               cert_verify_result.verified_cert.get(),
               SSLConfigService::GetEVCertsWhitelist().get(),
               verify_details_->ct_verify_result.verified_scts, net_log_);
       verify_details_->ct_verify_result.ev_policy_compliance =
           ev_policy_compliance;
       if (ev_policy_compliance !=
               ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY &&
           ev_policy_compliance !=
               ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_WHITELIST &&
           ev_policy_compliance !=
               ct::EVPolicyCompliance::EV_POLICY_COMPLIES_VIA_SCTS) {
         verify_details_->cert_verify_result.cert_status |=
             CERT_STATUS_CT_COMPLIANCE_FAILED;
         verify_details_->cert_verify_result.cert_status &= ~CERT_STATUS_IS_EV;
       }
     }
 
     verify_details_->ct_verify_result.cert_policy_compliance =
         policy_enforcer_->DoesConformToCertPolicy(
             cert_verify_result.verified_cert.get(),
             verify_details_->ct_verify_result.verified_scts, net_log_);
   }
 
-  if (transport_security_state_ &&
-      (result == OK ||
+  if ((result == OK ||
        (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
       !transport_security_state_->CheckPublicKeyPins(
           HostPortPair(hostname_, port_),
           cert_verify_result.is_issued_by_known_root,
           cert_verify_result.public_key_hashes, cert_.get(),
           cert_verify_result.verified_cert.get(),
           TransportSecurityState::ENABLE_PIN_REPORTS,
           &verify_details_->pinning_failure_log)) {
     if (cert_verify_result.is_issued_by_known_root)
       result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
@@ skipping 84 matching lines @@
 }
 
 ProofVerifierChromium::ProofVerifierChromium(
     CertVerifier* cert_verifier,
     CTPolicyEnforcer* ct_policy_enforcer,
     TransportSecurityState* transport_security_state,
     CTVerifier* cert_transparency_verifier)
     : cert_verifier_(cert_verifier),
       ct_policy_enforcer_(ct_policy_enforcer),
       transport_security_state_(transport_security_state),
-      cert_transparency_verifier_(cert_transparency_verifier) {}
+      cert_transparency_verifier_(cert_transparency_verifier) {
+  DCHECK(cert_verifier_);
+  DCHECK(ct_policy_enforcer_);
+  DCHECK(transport_security_state_);
+  DCHECK(cert_transparency_verifier_);
+}
 
 ProofVerifierChromium::~ProofVerifierChromium() {
   STLDeleteElements(&active_jobs_);
 }
 
 QuicAsyncStatus ProofVerifierChromium::VerifyProof(
     const std::string& hostname,
     const uint16_t port,
     const std::string& server_config,
     QuicVersion quic_version,
@@ skipping 23 matching lines @@
   }
   return status;
 }
 
 void ProofVerifierChromium::OnJobComplete(Job* job) {
   active_jobs_.erase(job);
   delete job;
 }
 
 }  // namespace net