Allow QUIC to honor SCTs delivered in X509 certificates.

Allow QUIC to honor SCTs delivered in X509 certificates.

BUG=688482
Review-Url: https://codereview.chromium.org/2669403004
Cr-Commit-Position: refs/heads/master@{#448112}
Committed: https://chromium.googlesource.com/chromium/src/+/71bd233700d7a0b8d8cab0f4ec995e97b8e7a197

[Ryan Hamilton, 2017-02-03 19:46:16]

rch@chromium.org changed reviewers:
+ nharper@chromium.org

[nharper, 2017-02-03 21:17:12]

nharper@chromium.org changed reviewers:
+ rsleevi@chromium.org

[nharper, 2017-02-03 21:17:13]

lgtm

[Ryan Sleevi, 2017-02-03 21:41:25]

LGTM w/ a question/nit

If you want to disable CT (which we do for several tools, especially those not
intended to load 'real web pages securely'), you can use a DoNothingCTVerifier()
[to turn off CT verification] or subclass CTPolicyEnforcer [to turn off CT
policies]

https://codereview.chromium.org/2669403004/diff/1/net/tools/quic/quic_client_...
File net/tools/quic/quic_client_bin.cc (right):

https://codereview.chromium.org/2669403004/diff/1/net/tools/quic/quic_client_...
net/tools/quic/quic_client_bin.cc:264:
ct_verifier->AddLogs(net::ct::CreateLogVerifiersForKnownLogs());
Should the QUIC client instead be disabling CT enforcement? Is there a risk of
people using this in anything 'real'?

(context: CreateLogVerifiersForKnownLogs == safe (for the ecosystem) for 6 week
update cycles, unsafe for >)

This will work either way, but potentially cause ecosystem damage if people
started building products on this.

[Ryan Hamilton, 2017-02-03 22:02:37]

https://codereview.chromium.org/2669403004/diff/1/net/tools/quic/quic_client_...
File net/tools/quic/quic_client_bin.cc (right):

https://codereview.chromium.org/2669403004/diff/1/net/tools/quic/quic_client_...
net/tools/quic/quic_client_bin.cc:264:
ct_verifier->AddLogs(net::ct::CreateLogVerifiersForKnownLogs());
On 2017/02/03 21:41:25, Ryan Sleevi wrote:
> Should the QUIC client instead be disabling CT enforcement? Is there a risk of
> people using this in anything 'real'?
> 
> (context: CreateLogVerifiersForKnownLogs == safe (for the ecosystem) for 6
week
> update cycles, unsafe for >)
> 
> This will work either way, but potentially cause ecosystem damage if people
> started building products on this.

Ah! Thanks for checking. I believe there is no danger of anyone doing anything
"real" with this code. It's simply our toy client. Nobody should be building
anything real out of this.

I'd prefer not to disable CT because it's desirable for this client to serve as
a stand-in for chrome when debugging QUIC issues.

[Ryan Hamilton, 2017-02-03 22:02:50]

The CQ bit was checked by rch@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-03 22:04:16]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-03 23:17:30]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-03 23:17:31]

Dry run: This issue passed the CQ dry run.

[Ryan Hamilton, 2017-02-03 23:49:36]

The CQ bit was checked by rch@chromium.org

[commit-bot: I haz the power, 2017-02-03 23:49:57]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-04 00:06:51]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1486165776144690, "parent_rev":
"ce65aff6d1ecab7ec4e6c1bc34eadd0a983c3879", "commit_rev":
"71bd233700d7a0b8d8cab0f4ec995e97b8e7a197"}

[commit-bot: I haz the power, 2017-02-04 00:07:29]

Description was changed from

==========
Allow QUIC to honor SCTs delivered in X509 certificates.

BUG=688482
==========

to

==========
Allow QUIC to honor SCTs delivered in X509 certificates.

BUG=688482

Review-Url: https://codereview.chromium.org/2669403004
Cr-Commit-Position: refs/heads/master@{#448112}
Committed:
https://chromium.googlesource.com/chromium/src/+/71bd233700d7a0b8d8cab0f4ec99...
==========

[commit-bot: I haz the power, 2017-02-04 00:07:30]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/chromium/src/+/71bd233700d7a0b8d8cab0f4ec99...