Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(630)

Unified Diff: net/spdy/chromium/spdy_session.cc

Issue 2850033002: Check Expect-CT at connection setup (Closed)
Patch Set: fix CanPool check Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: net/spdy/chromium/spdy_session.cc
diff --git a/net/spdy/chromium/spdy_session.cc b/net/spdy/chromium/spdy_session.cc
index 96768b6f0f16127e30ca6ea034a24303eb215352..c3633c73cbc399350ef13875588dd09ea7eb3c68 100644
--- a/net/spdy/chromium/spdy_session.cc
+++ b/net/spdy/chromium/spdy_session.cc
@@ -715,8 +715,13 @@ bool SpdySession::CanPool(TransportSecurityState* transport_security_state,
ct::CertPolicyCompliance::CERT_POLICY_COMPLIES_VIA_SCTS &&
ssl_info.ct_cert_policy_compliance !=
ct::CertPolicyCompliance::CERT_POLICY_BUILD_NOT_TIMELY &&
+ // As with CheckPublicKeyPins above, disable Expect-CT reports.
transport_security_state->ShouldRequireCT(
- new_hostname, ssl_info.cert.get(), ssl_info.public_key_hashes)) {
+ HostPortPair(new_hostname, 0), ssl_info.is_issued_by_known_root,
+ ssl_info.public_key_hashes, ssl_info.cert.get(),
+ ssl_info.unverified_cert.get(),
+ ssl_info.signed_certificate_timestamps,
+ TransportSecurityState::DISABLE_EXPECT_CT_REPORTS)) {
return false;
}

Powered by Google App Engine
This is Rietveld 408576698