Introduce the ability to require CT for specific hosts

net/spdy/spdy_session.cc

Index: net/spdy/spdy_session.cc
diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index 0c97fa5daffdcc46a98037e92cc156b54847b097..434b752cc34c80dd71564cffd37c1f7c61b861da 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -31,6 +31,7 @@
 #include "net/base/proxy_delegate.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_verify_result.h"
+#include "net/cert/ct_policy_status.h"
 #include "net/http/http_log_util.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_server_properties.h"
@@ -667,6 +668,13 @@ bool SpdySession::CanPool(TransportSecurityState* transport_security_state,
     return false;
   }
 
+  if (ssl_info.ct_cert_policy_compliance !=
+          ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS &&
+      transport_security_state->ShouldRequireCT(
+          new_hostname, ssl_info.cert.get(), ssl_info.public_key_hashes)) {
+    return false;
+  }
+
   return true;
 }