Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(108)

Side by Side Diff: net/quic/chromium/crypto/proof_verifier_chromium.cc

Issue 2850033002: Check Expect-CT at connection setup (Closed)
Patch Set: fix CanPool check Created 3 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/quic/chromium/crypto/proof_verifier_chromium.h" 5 #include "net/quic/chromium/crypto/proof_verifier_chromium.h"
6 6
7 #include <utility> 7 #include <utility>
8 8
9 #include "base/bind.h" 9 #include "base/bind.h"
10 #include "base/bind_helpers.h" 10 #include "base/bind_helpers.h"
(...skipping 407 matching lines...) Expand 10 before | Expand all | Expand 10 after
418 verify_details_->ct_verify_result.cert_policy_compliance = 418 verify_details_->ct_verify_result.cert_policy_compliance =
419 policy_enforcer_->DoesConformToCertPolicy( 419 policy_enforcer_->DoesConformToCertPolicy(
420 cert_verify_result.verified_cert.get(), verified_scts, net_log_); 420 cert_verify_result.verified_cert.get(), verified_scts, net_log_);
421 421
422 int ct_result = OK; 422 int ct_result = OK;
423 if (verify_details_->ct_verify_result.cert_policy_compliance != 423 if (verify_details_->ct_verify_result.cert_policy_compliance !=
424 ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS && 424 ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS &&
425 verify_details_->ct_verify_result.cert_policy_compliance != 425 verify_details_->ct_verify_result.cert_policy_compliance !=
426 ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY && 426 ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY &&
427 transport_security_state_->ShouldRequireCT( 427 transport_security_state_->ShouldRequireCT(
428 hostname_, cert_verify_result.verified_cert.get(), 428 HostPortPair(hostname_, port_),
429 cert_verify_result.public_key_hashes)) { 429 cert_verify_result.is_issued_by_known_root,
430 cert_verify_result.public_key_hashes,
431 cert_verify_result.verified_cert.get(), cert_.get(),
432 verify_details_->ct_verify_result.scts,
433 TransportSecurityState::ENABLE_EXPECT_CT_REPORTS)) {
430 verify_details_->cert_verify_result.cert_status |= 434 verify_details_->cert_verify_result.cert_status |=
431 CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED; 435 CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED;
432 ct_result = ERR_CERTIFICATE_TRANSPARENCY_REQUIRED; 436 ct_result = ERR_CERTIFICATE_TRANSPARENCY_REQUIRED;
433 } 437 }
434 438
435 TransportSecurityState::PKPStatus pin_validity = 439 TransportSecurityState::PKPStatus pin_validity =
436 transport_security_state_->CheckPublicKeyPins( 440 transport_security_state_->CheckPublicKeyPins(
437 HostPortPair(hostname_, port_), 441 HostPortPair(hostname_, port_),
438 cert_verify_result.is_issued_by_known_root, 442 cert_verify_result.is_issued_by_known_root,
439 cert_verify_result.public_key_hashes, cert_.get(), 443 cert_verify_result.public_key_hashes, cert_.get(),
(...skipping 167 matching lines...) Expand 10 before | Expand all | Expand 10 after
607 active_jobs_[job_ptr] = std::move(job); 611 active_jobs_[job_ptr] = std::move(job);
608 } 612 }
609 return status; 613 return status;
610 } 614 }
611 615
612 void ProofVerifierChromium::OnJobComplete(Job* job) { 616 void ProofVerifierChromium::OnJobComplete(Job* job) {
613 active_jobs_.erase(job); 617 active_jobs_.erase(job);
614 } 618 }
615 619
616 } // namespace net 620 } // namespace net
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698