| Index: net/cert/multi_log_ct_verifier.cc
|
| diff --git a/net/cert/multi_log_ct_verifier.cc b/net/cert/multi_log_ct_verifier.cc
|
| index 8dc172677a502e92fff9c11eb118b754dbf30d16..61c07b6d4e560cb06eaa65e95cce5d25f7a37cd8 100644
|
| --- a/net/cert/multi_log_ct_verifier.cc
|
| +++ b/net/cert/multi_log_ct_verifier.cc
|
| @@ -15,8 +15,8 @@
|
| #include "net/cert/ct_objects_extractor.h"
|
| #include "net/cert/ct_serialization.h"
|
| #include "net/cert/ct_signed_certificate_timestamp_log_param.h"
|
| -#include "net/cert/ct_verify_result.h"
|
| #include "net/cert/sct_status_flags.h"
|
| +#include "net/cert/signed_certificate_timestamp_and_status.h"
|
| #include "net/cert/x509_certificate.h"
|
| #include "net/log/net_log_event_type.h"
|
| #include "net/log/net_log_parameters_callback.h"
|
| @@ -50,9 +50,9 @@ void LogSCTOriginToUMA(ct::SignedCertificateTimestamp::Origin origin) {
|
| // This metric would allow measuring:
|
| // * Of all SSL connections, how many had SCTs available for validation.
|
| // * When SCTs are available, how many are available per connection.
|
| -void LogNumSCTsToUMA(const ct::CTVerifyResult& result) {
|
| +void LogNumSCTsToUMA(const SignedCertificateTimestampAndStatusList& scts) {
|
| UMA_HISTOGRAM_CUSTOM_COUNTS("Net.CertificateTransparency.SCTsPerConnection",
|
| - result.scts.size(), 1, 10, 11);
|
| + scts.size(), 1, 10, 11);
|
| }
|
|
|
| void AddSCTAndLogStatus(scoped_refptr<ct::SignedCertificateTimestamp> sct,
|
| @@ -81,15 +81,16 @@ void MultiLogCTVerifier::SetObserver(Observer* observer) {
|
| observer_ = observer;
|
| }
|
|
|
| -int MultiLogCTVerifier::Verify(X509Certificate* cert,
|
| - const std::string& stapled_ocsp_response,
|
| - const std::string& sct_list_from_tls_extension,
|
| - ct::CTVerifyResult* result,
|
| - const NetLogWithSource& net_log) {
|
| +int MultiLogCTVerifier::Verify(
|
| + X509Certificate* cert,
|
| + const std::string& stapled_ocsp_response,
|
| + const std::string& sct_list_from_tls_extension,
|
| + SignedCertificateTimestampAndStatusList* output_scts,
|
| + const NetLogWithSource& net_log) {
|
| DCHECK(cert);
|
| - DCHECK(result);
|
| + DCHECK(output_scts);
|
|
|
| - result->scts.clear();
|
| + output_scts->clear();
|
|
|
| bool has_verified_scts = false;
|
|
|
| @@ -105,7 +106,8 @@ int MultiLogCTVerifier::Verify(X509Certificate* cert,
|
| cert->GetIntermediateCertificates().front(),
|
| &precert_entry) &&
|
| VerifySCTs(embedded_scts, precert_entry,
|
| - ct::SignedCertificateTimestamp::SCT_EMBEDDED, cert, result);
|
| + ct::SignedCertificateTimestamp::SCT_EMBEDDED, cert,
|
| + output_scts);
|
| }
|
|
|
| std::string sct_list_from_ocsp;
|
| @@ -127,22 +129,24 @@ int MultiLogCTVerifier::Verify(X509Certificate* cert,
|
|
|
| ct::LogEntry x509_entry;
|
| if (ct::GetX509LogEntry(cert->os_cert_handle(), &x509_entry)) {
|
| - has_verified_scts |= VerifySCTs(
|
| - sct_list_from_ocsp, x509_entry,
|
| - ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE, cert, result);
|
| -
|
| - has_verified_scts |= VerifySCTs(
|
| - sct_list_from_tls_extension, x509_entry,
|
| - ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION, cert, result);
|
| + has_verified_scts |=
|
| + VerifySCTs(sct_list_from_ocsp, x509_entry,
|
| + ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE, cert,
|
| + output_scts);
|
| +
|
| + has_verified_scts |=
|
| + VerifySCTs(sct_list_from_tls_extension, x509_entry,
|
| + ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION, cert,
|
| + output_scts);
|
| }
|
|
|
| NetLogParametersCallback net_log_checked_callback =
|
| - base::Bind(&NetLogSignedCertificateTimestampCallback, result);
|
| + base::Bind(&NetLogSignedCertificateTimestampCallback, output_scts);
|
|
|
| net_log.AddEvent(NetLogEventType::SIGNED_CERTIFICATE_TIMESTAMPS_CHECKED,
|
| net_log_checked_callback);
|
|
|
| - LogNumSCTsToUMA(*result);
|
| + LogNumSCTsToUMA(*output_scts);
|
|
|
| if (has_verified_scts)
|
| return OK;
|
| @@ -155,7 +159,7 @@ bool MultiLogCTVerifier::VerifySCTs(
|
| const ct::LogEntry& expected_entry,
|
| ct::SignedCertificateTimestamp::Origin origin,
|
| X509Certificate* cert,
|
| - ct::CTVerifyResult* result) {
|
| + SignedCertificateTimestampAndStatusList* output_scts) {
|
| if (logs_.empty())
|
| return false;
|
|
|
| @@ -179,7 +183,7 @@ bool MultiLogCTVerifier::VerifySCTs(
|
| }
|
| decoded_sct->origin = origin;
|
|
|
| - verified |= VerifySingleSCT(decoded_sct, expected_entry, cert, result);
|
| + verified |= VerifySingleSCT(decoded_sct, expected_entry, cert, output_scts);
|
| }
|
|
|
| return verified;
|
| @@ -189,12 +193,12 @@ bool MultiLogCTVerifier::VerifySingleSCT(
|
| scoped_refptr<ct::SignedCertificateTimestamp> sct,
|
| const ct::LogEntry& expected_entry,
|
| X509Certificate* cert,
|
| - ct::CTVerifyResult* result) {
|
| + SignedCertificateTimestampAndStatusList* output_scts) {
|
| // Assume this SCT is untrusted until proven otherwise.
|
| const auto& it = logs_.find(sct->log_id);
|
| if (it == logs_.end()) {
|
| DVLOG(1) << "SCT does not match any known log.";
|
| - AddSCTAndLogStatus(sct, ct::SCT_STATUS_LOG_UNKNOWN, &(result->scts));
|
| + AddSCTAndLogStatus(sct, ct::SCT_STATUS_LOG_UNKNOWN, output_scts);
|
| return false;
|
| }
|
|
|
| @@ -202,18 +206,18 @@ bool MultiLogCTVerifier::VerifySingleSCT(
|
|
|
| if (!it->second->Verify(expected_entry, *sct.get())) {
|
| DVLOG(1) << "Unable to verify SCT signature.";
|
| - AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID_SIGNATURE, &(result->scts));
|
| + AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID_SIGNATURE, output_scts);
|
| return false;
|
| }
|
|
|
| // SCT verified ok, just make sure the timestamp is legitimate.
|
| if (sct->timestamp > base::Time::Now()) {
|
| DVLOG(1) << "SCT is from the future!";
|
| - AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID_TIMESTAMP, &(result->scts));
|
| + AddSCTAndLogStatus(sct, ct::SCT_STATUS_INVALID_TIMESTAMP, output_scts);
|
| return false;
|
| }
|
|
|
| - AddSCTAndLogStatus(sct, ct::SCT_STATUS_OK, &(result->scts));
|
| + AddSCTAndLogStatus(sct, ct::SCT_STATUS_OK, output_scts);
|
| if (observer_)
|
| observer_->OnSCTVerified(cert, sct.get());
|
| return true;
|
|
|