Allow QUIC to honor SCTs delivered in X509 certificates.

net/tools/quic/quic_client_bin.cc

Index: net/tools/quic/quic_client_bin.cc
diff --git a/net/tools/quic/quic_client_bin.cc b/net/tools/quic/quic_client_bin.cc
index c221a55a145c69ca26a19a843a36c75f089d6f6d..45ed463d933bf10967051594b68e5fa175954100 100644
--- a/net/tools/quic/quic_client_bin.cc
+++ b/net/tools/quic/quic_client_bin.cc
@@ -46,6 +46,8 @@
 #include "net/base/net_errors.h"
 #include "net/base/privacy_mode.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_known_logs.h"
+#include "net/cert/ct_log_verifier.h"
 #include "net/cert/multi_log_ct_verifier.h"
 #include "net/http/transport_security_state.h"
 #include "net/quic/chromium/crypto/proof_verifier_chromium.h"
@@ -258,7 +260,8 @@ int main(int argc, char* argv[]) {
   std::unique_ptr<CertVerifier> cert_verifier(CertVerifier::CreateDefault());
   std::unique_ptr<TransportSecurityState> transport_security_state(
       new TransportSecurityState);
-  std::unique_ptr<CTVerifier> ct_verifier(new MultiLogCTVerifier());
+  std::unique_ptr<MultiLogCTVerifier> ct_verifier(new MultiLogCTVerifier());
+  ct_verifier->AddLogs(net::ct::CreateLogVerifiersForKnownLogs());

[Ryan Sleevi, 2017/02/03 21:41:25]

Should the QUIC client instead be disabling CT enforcement? Is there a risk of
people using this in anything 'real'?

(context: CreateLogVerifiersForKnownLogs == safe (for the ecosystem) for 6 week
update cycles, unsafe for >)

This will work either way, but potentially cause ecosystem damage if people
started building products on this.

[Ryan Hamilton, 2017/02/03 22:02:37]

Ah! Thanks for checking. I believe there is no danger of anyone doing anything
"real" with this code. It's simply our toy client. Nobody should be building
anything real out of this.

I'd prefer not to disable CT because it's desirable for this client to serve as
a stand-in for chrome when debugging QUIC issues.

   std::unique_ptr<CTPolicyEnforcer> ct_policy_enforcer(new CTPolicyEnforcer());
   std::unique_ptr<ProofVerifier> proof_verifier;
   if (line->HasSwitch("disable-certificate-verification")) {