DO NOT REVIEW: Certificate Transparency: Extend SCT verify result enum.

net/cert/ct_verify_result.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CT_VERIFY_RESULT_H_
 #define NET_CERT_CT_VERIFY_RESULT_H_
 
+#include <utility>
 #include <vector>
 
+#include "net/cert/sct_status_flags.h"
 #include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/signed_certificate_timestamp.h"
 
 namespace net {
 
 namespace ct {
 
 enum class CertPolicyCompliance;
 enum class EVPolicyCompliance;
 
 typedef std::vector<scoped_refptr<SignedCertificateTimestamp> > SCTList;
+// TODO(eranm): Move net/ssl/signed_certificate_timestamp_and_status.h to
+// net/cert
+// then switch to using that.

[Ryan Sleevi, 2016/08/03 19:19:40]

Why? :)

+typedef std::vector<
+    std::pair<scoped_refptr<SignedCertificateTimestamp>, SCTVerifyStatus>>
+    SCTAndStatusList;
 
 // Holds Signed Certificate Timestamps, depending on their verification
 // results, and information about CT policies that were applied on the
 // connection.
 struct NET_EXPORT CTVerifyResult {
   CTVerifyResult();
   CTVerifyResult(const CTVerifyResult& other);
   ~CTVerifyResult();
 
   // SCTs from known logs where the signature verified correctly.
   SCTList verified_scts;
-  // SCTs from known logs where the signature failed to verify.
-  SCTList invalid_scts;
+  // SCTs from known logs where the signature failed to verify or the timestamp
+  // is invalid.
+  SCTAndStatusList invalid_scts;

[Ryan Sleevi, 2016/08/03 19:19:40]

From a design standpoint, could you explain more your reasoning for this change?

One approach could have been to leave it as an SCTList (that is, not surface the
additional details beyond this API point yet)

Another could have been to combine all three vectors into a single vector, since
you're now tracking SCTVerifyStatus with the SCT.

But it's unclear why you did a little of A and a little of B

   // SCTs from unknown logs and as such are unverifiable.
   SCTList unknown_logs_scts;
 
   // True if any CT policies were applied on this connection.
   bool ct_policies_applied;
   // The result of evaluating whether the connection complies with the
   // CT certificate policy.
   CertPolicyCompliance cert_policy_compliance;
   // The result of evaluating whether the connection complies with the
   // EV CT policy.
   EVPolicyCompliance ev_policy_compliance;
 };
 
 }  // namespace ct
 
 }  // namespace net
 
 #endif  // NET_CERT_CT_VERIFY_RESULT_H_