Require a CTVerifier and CTPolicyEnforcer for TLS/QUIC sockets

content/browser/renderer_host/pepper/ssl_context_helper.cc

Index: content/browser/renderer_host/pepper/ssl_context_helper.cc
diff --git a/content/browser/renderer_host/pepper/ssl_context_helper.cc b/content/browser/renderer_host/pepper/ssl_context_helper.cc
index aed882303916cbb914e2b6a52931c6d9cfb69408..0596302ce3a640d147904fe46581af682587e79b 100644
--- a/content/browser/renderer_host/pepper/ssl_context_helper.cc
+++ b/content/browser/renderer_host/pepper/ssl_context_helper.cc
@@ -5,6 +5,8 @@
 #include "content/browser/renderer_host/pepper/ssl_context_helper.h"
 
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_policy_enforcer.h"
+#include "net/cert/multi_log_ct_verifier.h"
 #include "net/http/transport_security_state.h"
 
 namespace content {
@@ -25,4 +27,16 @@ net::TransportSecurityState* SSLContextHelper::GetTransportSecurityState() {
   return transport_security_state_.get();
 }
 
+net::CTVerifier* SSLContextHelper::GetCertTransparencyVerifier() {
+  if (!cert_transparency_verifier_)
+    cert_transparency_verifier_.reset(new net::MultiLogCTVerifier());

[Eran Messeri, 2016/06/20 09:32:02]

I'll note that AddLogs with the known logs is never called here so the created
cert_transparency_verifier_ will always say all SCTs are from unknown logs.

[Ryan Sleevi, 2016/06/20 16:27:27]

Yes. This is all intentional. There are a number of cleanups needed around the
handling of CT, but the behaviour of this CL still behaves correctly. That is,
it doesn't validate any CT information (a simple 'pass through' implementation)
for these platforms.

+  return cert_transparency_verifier_.get();
+}
+
+net::CTPolicyEnforcer* SSLContextHelper::GetCTPolicyEnforcer() {
+  if (!ct_policy_enforcer_)
+    ct_policy_enforcer_.reset(new net::CTPolicyEnforcer());
+  return ct_policy_enforcer_.get();
+}
+
 }  // namespace content