Disable Certificate Transparency enforcement for Chromecast.

chromecast/browser/url_request_context_factory.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromecast/browser/url_request_context_factory.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/threading/worker_pool.h"
 #include "chromecast/base/chromecast_switches.h"
 #include "chromecast/browser/cast_http_user_agent_settings.h"
 #include "chromecast/browser/cast_network_delegate.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/cookie_store_factory.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/ct_policy_enforcer.h"
-#include "net/cert/multi_log_ct_verifier.h"
+#include "net/cert/ct_policy_status.h"
+#include "net/cert/do_nothing_ct_verifier.h"
 #include "net/cert_net/nss_ocsp.h"
 #include "net/cookies/cookie_store.h"
 #include "net/dns/host_resolver.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_network_layer.h"
 #include "net/http/http_server_properties_impl.h"
 #include "net/http/http_stream_factory.h"
 #include "net/proxy/proxy_service.h"
 #include "net/ssl/channel_id_service.h"
 #include "net/ssl/default_channel_id_store.h"
 #include "net/ssl/ssl_config_service_defaults.h"
 #include "net/url_request/data_protocol_handler.h"
 #include "net/url_request/file_protocol_handler.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_intercepting_job_factory.h"
 #include "net/url_request/url_request_job_factory_impl.h"
 
 namespace chromecast {
 namespace shell {
 
 namespace {
 
 const char kCookieStoreFile[] = "Cookies";
 
+// A CTPolicyEnforcer that accepts all certificates.
+class IgnoresCTPolicyEnforcer : public net::CTPolicyEnforcer {
+ public:
+  IgnoresCTPolicyEnforcer() = default;
+  ~IgnoresCTPolicyEnforcer() override = default;
+
+  net::ct::CertPolicyCompliance DoesConformToCertPolicy(
+      net::X509Certificate* cert,
+      const net::SCTList& verified_scts,
+      const net::NetLogWithSource& net_log) override {
+    return net::ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS;
+  }
+
+  net::ct::EVPolicyCompliance DoesConformToCTEVPolicy(
+      net::X509Certificate* cert,
+      const net::ct::EVCertsWhitelist* ev_whitelist,
+      const net::SCTList& verified_scts,
+      const net::NetLogWithSource& net_log) override {
+    return net::ct::EVPolicyCompliance::EV_POLICY_DOES_NOT_APPLY;
+  }
+};
+
 }  // namespace
 
 // Private classes to expose URLRequestContextGetter that call back to the
 // URLRequestContextFactory to create the URLRequestContext on demand.
 //
 // The URLRequestContextFactory::URLRequestContextGetter class is used for both
 // the system and media URLRequestCotnexts.
 class URLRequestContextFactory::URLRequestContextGetter
     : public net::URLRequestContextGetter {
  public:
@@ skipping 138 matching lines @@
 }
 
 void URLRequestContextFactory::InitializeSystemContextDependencies() {
   if (system_dependencies_initialized_)
     return;
 
   host_resolver_ = net::HostResolver::CreateDefaultResolver(NULL);
   cert_verifier_ = net::CertVerifier::CreateDefault();
   ssl_config_service_ = new net::SSLConfigServiceDefaults;
   transport_security_state_.reset(new net::TransportSecurityState());
-  cert_transparency_verifier_.reset(new net::MultiLogCTVerifier());
-  ct_policy_enforcer_.reset(new net::CTPolicyEnforcer());
+  // Certificate transparency is current disabled for Chromecast.
+  cert_transparency_verifier_.reset(new net::DoNothingCTVerifier());
+  ct_policy_enforcer_.reset(new IgnoresCTPolicyEnforcer());
 
   http_auth_handler_factory_ =
       net::HttpAuthHandlerFactory::CreateDefault(host_resolver_.get());
 
   // TODO(lcwu): http://crbug.com/392352. For performance reasons,
   // a persistent (on-disk) HttpServerProperties might be desirable
   // in the future.
   http_server_properties_.reset(new net::HttpServerPropertiesImpl);
 
   proxy_service_ = net::ProxyService::CreateUsingSystemProxyResolver(
@@ skipping 178 matching lines @@
 
 void URLRequestContextFactory::InitializeNetworkDelegates() {
   app_network_delegate_->Initialize(false);
   LOG(INFO) << "Initialized app network delegate.";
   system_network_delegate_->Initialize(false);
   LOG(INFO) << "Initialized system network delegate.";
 }
 
 }  // namespace shell
 }  // namespace chromecast