Certificate Transparency: Remove the obsolete invalid sct status.

net/http/http_response_info.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_response_info.h"
 
 #include "base/logging.h"
 #include "base/pickle.h"
 #include "base/time/time.h"
 #include "net/base/auth.h"
@@ skipping 15 matching lines @@
     case 1:
       return X509Certificate::PICKLETYPE_SINGLE_CERTIFICATE;
     case 2:
       return X509Certificate::PICKLETYPE_CERTIFICATE_CHAIN_V2;
     case 3:
     default:
       return X509Certificate::PICKLETYPE_CERTIFICATE_CHAIN_V3;
   }
 }
 
+// 2 was used for SCT_STATUS_INVALID in SCTVerifyStatus enum but
+// was deprecated.
+uint64_t kObsoleteSCTInvalidStatus = 2;
+
 }  // namespace
 
 // These values can be bit-wise combined to form the flags field of the
 // serialized HttpResponseInfo.
 enum {
   // The version of the response info used when persisting response info.
   RESPONSE_INFO_VERSION = 3,
 
   // The minimum version supported for deserializing response info.
   RESPONSE_INFO_MINIMUM_VERSION = 1,
@@ skipping 186 matching lines @@
   if (flags & RESPONSE_INFO_HAS_SIGNED_CERTIFICATE_TIMESTAMPS) {
     int num_scts;
     if (!iter.ReadInt(&num_scts))
       return false;
     for (int i = 0; i < num_scts; ++i) {
       scoped_refptr<ct::SignedCertificateTimestamp> sct(
           ct::SignedCertificateTimestamp::CreateFromPickle(&iter));
       uint16_t status;
       if (!sct.get() || !iter.ReadUInt16(&status))
         return false;
+      if (status == kObsoleteSCTInvalidStatus)
+        return false;

[Ryan Sleevi, 2016/09/01 00:01:29]

Compare this with 286-289, as an example. This present approach can still lead
to crashes (as new values are introduced & such)

Something like CheckSCTStatus() seems better for this, but lifted propertly into
sct_status_flags.cc

NET_EXPORT bool IsValidSCTStatus(int status);

And then this check can defer to it, and CheckSCTStatus could be replaced with
it.

[Eran Messeri, 2016/09/01 14:16:34]

Done.

       ssl_info.signed_certificate_timestamps.push_back(
           SignedCertificateTimestampAndStatus(
               sct, static_cast<ct::SCTVerifyStatus>(status)));
     }
   }
 
   // Read vary-data
   if (flags & RESPONSE_INFO_HAS_VARY_DATA) {
     if (!vary_data.InitFromPickle(&iter))
       return false;
@@ skipping 190 matching lines @@
     case CONNECTION_INFO_HTTP1_0:
       return "http/1.0";
     case NUM_OF_CONNECTION_INFOS:
       break;
   }
   NOTREACHED();
   return "";
 }
 
 }  // namespace net