Require a CTVerifier and CTPolicyEnforcer for TLS/QUIC sockets

remoting/signaling/xmpp_signal_strategy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/signaling/xmpp_signal_strategy.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "base/rand_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/threading/thread_checker.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "jingle/glue/proxy_resolving_client_socket.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_policy_enforcer.h"
+#include "net/cert/multi_log_ct_verifier.h"
 #include "net/http/transport_security_state.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "remoting/base/buffered_socket_writer.h"
 #include "remoting/signaling/xmpp_login_handler.h"
 #include "remoting/signaling/xmpp_stream_parser.h"
 #include "third_party/webrtc/libjingle/xmllite/xmlelement.h"
 
@@ skipping 79 matching lines @@
 
   void SendKeepAlive();
 
   net::ClientSocketFactory* socket_factory_;
   scoped_refptr<net::URLRequestContextGetter> request_context_getter_;
   XmppServerConfig xmpp_server_config_;
 
   // Used by the |socket_|.
   std::unique_ptr<net::CertVerifier> cert_verifier_;
   std::unique_ptr<net::TransportSecurityState> transport_security_state_;
+  std::unique_ptr<net::CTVerifier> cert_transparency_verifier_;
+  std::unique_ptr<net::CTPolicyEnforcer> ct_policy_enforcer_;
 
   std::unique_ptr<net::StreamSocket> socket_;
   std::unique_ptr<BufferedSocketWriter> writer_;
   scoped_refptr<net::IOBuffer> read_buffer_;
   bool read_pending_ = false;
 
   TlsState tls_state_ = TlsState::NOT_REQUESTED;
 
   std::unique_ptr<XmppLoginHandler> login_handler_;
   std::unique_ptr<XmppStreamParser> stream_parser_;
@@ skipping 154 matching lines @@
   writer_.reset();
 
   DCHECK(!read_pending_);
 
   std::unique_ptr<net::ClientSocketHandle> socket_handle(
       new net::ClientSocketHandle());
   socket_handle->SetSocket(std::move(socket_));
 
   cert_verifier_ = net::CertVerifier::CreateDefault();
   transport_security_state_.reset(new net::TransportSecurityState());
+  cert_transparency_verifier_.reset(new net::MultiLogCTVerifier());
+  ct_policy_enforcer_.reset(new net::CTPolicyEnforcer());
   net::SSLClientSocketContext context;
   context.cert_verifier = cert_verifier_.get();
   context.transport_security_state = transport_security_state_.get();
+  context.cert_transparency_verifier = cert_transparency_verifier_.get();
+  context.ct_policy_enforcer = ct_policy_enforcer_.get();
 
   socket_ = socket_factory_->CreateSSLClientSocket(
       std::move(socket_handle),
       net::HostPortPair(xmpp_server_config_.host, kDefaultHttpsPort),
       net::SSLConfig(), context);
 
   int result = socket_->Connect(
       base::Bind(&Core::OnTlsConnected, base::Unretained(this)));
   if (result != net::ERR_IO_PENDING)
     OnTlsConnected(result);
@@ skipping 223 matching lines @@
 std::string XmppSignalStrategy::GetNextId() {
   return base::Uint64ToString(base::RandUint64());
 }
 
 void XmppSignalStrategy::SetAuthInfo(const std::string& username,
                                      const std::string& auth_token) {
   core_->SetAuthInfo(username, auth_token);
 }
 
 }  // namespace remoting