Add a do-nothing CTVerifier to //net

net/cert/do_nothing_ct_verifier.h

Index: net/cert/do_nothing_ct_verifier.h
diff --git a/net/cert/do_nothing_ct_verifier.h b/net/cert/do_nothing_ct_verifier.h
new file mode 100644
index 0000000000000000000000000000000000000000..0588e8322bc9a98385f805b8a5d4608bb6ed2aa4
--- /dev/null
+++ b/net/cert/do_nothing_ct_verifier.h
@@ -0,0 +1,60 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_DO_NOTHING_CT_VERIFIER_H_
+#define NET_CERT_DO_NOTHING_CT_VERIFIER_H_
+
+#include "net/base/net_export.h"
+#include "net/cert/ct_verifier.h"
+
+namespace net {
+
+// An implementation of CTVerifier that does not validate SCTs.
+//
+// SECURITY NOTE:
+// As Certificate Transparency is an essential part in safeguarding TLS
+// connections, disabling Certificate Transparency enforcement is a decision
+// that should not be taken lightly, and it should be made an explicit
+// decision rather than a potential accidental decision (such as allowing

[eroman, 2016/12/02 01:46:22]

potential accidental --> potentially accidental?

+// for a nullptr instance). By checking Certificate Transparency information,
+// typically via a net::MultiLogCTVerifier, and enforcing policies related
+// to Certificate Transparency provided by a net::CTPolicyEnforcer, developers
+// can help protect their users by ensuring that misissued TLS certificates
+// are detected.
+//
+// However, not every consumer of TLS certificates is using the Web PKI. For
+// example, they may be using connections authenticated out of band, or may
+// be using private or local PKIs for which Certificate Transparency is not
+// relevant. Alternatively, as a 'healthy' client for Certificate Transparency

[eroman, 2016/12/02 01:46:22]

not convinced that quotes should be included around 'healthy' here (or below).

I suggest either removing the quote, or picking a word you don't feel
necessitates quotes. Perhaps 'robust' or 'secure'?

+// is one that is regularly updated, much like a 'healthy' TLS client has a
+// regularly updated root certificate store, it may be intended to disable
+// Certificate Transparency and opt for the less-secure interaction, due to
+// concerns related to updates.
+//
+// As such, consumers of this class should generally try to get a security
+// or design review to discuss the type of net::X509Certificates they will
+// be validating, and determine whether or not Certificate Transparency is
+// right for them.
+//
+// Because of these complex nuances, it's not unexpected that consumers of

[eroman, 2016/12/02 01:46:22]

style-nit: the double negative here could be simplified.

+// CTVerifiers will want to require a CTVerifier be supplied, so that the

[eroman, 2016/12/02 01:46:23]

If you really want to raise eyebrows in codereviews, consider a name like
InsecureCTVerify, or DeliberatelyInsecureCTVerifier

+// caller makes an intentional decision to disable Certificate Transparency,
+// rather than accidentally supplying a nullptr. This class is intended to
+// indicate an intentional consideration of CT, and a decision to not
+// support it, to resolve any ambiguity on intent.
+class NET_EXPORT DoNothingCTVerifier : public CTVerifier {
+ public:
+  DoNothingCTVerifier();
+  ~DoNothingCTVerifier() override;
+
+  int Verify(X509Certificate* cert,
+             const std::string& stapled_ocsp_response,
+             const std::string& sct_list_from_tls_extension,
+             SignedCertificateTimestampAndStatusList* output_scts,
+             const NetLogWithSource& net_log) override;
+};

[eroman, 2016/12/02 01:46:23]

DISALLOW_COPY_AND_ASSIGN ?

+
+}  // namespace net
+
+#endif  // NET_CERT_DO_NOTHING_CT_VERIFIER_H_