Certificate Transparency: Change CTVerifyResult to have a single list

net/cert/ct_signed_certificate_timestamp_log_param.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_signed_certificate_timestamp_log_param.h"
 
 #include <algorithm>
 #include <memory>
 #include <string>
 #include <utility>
@@ skipping 42 matching lines @@
   out->SetString("hash_algorithm",
                  HashAlgorithmToString(sct.signature.hash_algorithm));
   out->SetString("signature_algorithm",
                  SignatureAlgorithmToString(sct.signature.signature_algorithm));
   SetBinaryData("signature_data", sct.signature.signature_data, out.get());
 
   return out;
 }
 
 // Given a list of SCTs, return a ListValue instance where each item in the
 // list is a dictionary created by SCTToDictionary.

[estark, 2016/08/09 20:02:04]

nit: perhaps update this comment to note that we only output SCTs matching
|match_status|

[Eran Messeri, 2016/08/10 22:05:07]

Done.

 std::unique_ptr<base::ListValue> SCTListToPrintableValues(
-    const ct::SCTList& sct_list) {
+    const SignedCertificateTimestampAndStatusList& sct_and_status_list,
+    ct::SCTVerifyStatus match_status) {
   std::unique_ptr<base::ListValue> output_scts(new base::ListValue());
-  for (const auto& sct : sct_list)
-    output_scts->Append(SCTToDictionary(*(sct.get())));
+  for (const auto& sct_and_status : sct_and_status_list)
+    if (sct_and_status.status == match_status)
+      output_scts->Append(SCTToDictionary(*(sct_and_status.sct.get())));
 
   return output_scts;
 }
 
 }  // namespace
 
 std::unique_ptr<base::Value> NetLogSignedCertificateTimestampCallback(
     const ct::CTVerifyResult* ct_result,
     NetLogCaptureMode capture_mode) {
   std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
 
   dict->Set("verified_scts",
-            SCTListToPrintableValues(ct_result->verified_scts));
+            SCTListToPrintableValues(ct_result->scts, ct::SCT_STATUS_OK));

[eroman, 2016/08/10 19:00:40]

Is there a need to preserve the old format?

AFAICT there isn't a consumer that relies on this structure (just getting dumped
into NetLog right)?

In that case, can you re-structure it to match the code organization?

For instance add an "scts" parameter that is an array of all the SCTs.

This should be more informative when debugging issues (in case order ends up
mattering), and also means if a new veryfstatus is added don't need to remember
to update this.

If you do not make that change, then please add a breadcrumb to inform callers
that this needs to be updated. Something like this would suffice:

static_assert(ct::SCT_STATUS_MAX == 4, "When adding new verify status add it to
the NetLog here");

[Eran Messeri, 2016/08/10 22:05:07]

Re-structured as suggested. Now the status is passed all the way to
SCTToDictionary and is added to the dictionary as an integer value there.

Note this affects the MultiLogCTVerifier unit test.

 
   dict->Set("invalid_scts",
-            SCTListToPrintableValues(ct_result->invalid_scts));
+            SCTListToPrintableValues(ct_result->scts, ct::SCT_STATUS_INVALID));
 
-  dict->Set("unknown_logs_scts",
-            SCTListToPrintableValues(ct_result->unknown_logs_scts));
+  dict->Set(
+      "unknown_logs_scts",
+      SCTListToPrintableValues(ct_result->scts, ct::SCT_STATUS_LOG_UNKNOWN));
 
   return std::move(dict);
 }
 
 std::unique_ptr<base::Value> NetLogRawSignedCertificateTimestampCallback(
     const std::string* embedded_scts,
     const std::string* sct_list_from_ocsp,
     const std::string* sct_list_from_tls_extension,
     NetLogCaptureMode capture_mode) {
   std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
 
   SetBinaryData("embedded_scts", *embedded_scts, dict.get());
   SetBinaryData("scts_from_ocsp_response", *sct_list_from_ocsp, dict.get());
   SetBinaryData("scts_from_tls_extension", *sct_list_from_tls_extension,
                 dict.get());
 
   return std::move(dict);
 }
 
 }  // namespace net