Revert of Update SCT serialization format in Expect-CT reports

chrome/browser/ssl/chrome_expect_ct_reporter.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_expect_ct_reporter.h"
 
 #include <string>
 
 #include "base/base64.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/json/json_writer.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "chrome/common/chrome_features.h"
-#include "net/cert/ct_serialization.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/report_sender.h"
 
 namespace {
 
 std::string TimeToISO8601(const base::Time& t) {
   base::Time::Exploded exploded;
   t.UTCExplode(&exploded);
   return base::StringPrintf(
       "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", exploded.year, exploded.month,
@@ skipping 14 matching lines @@
 
   return result;
 }
 
 std::string SCTOriginToString(
     net::ct::SignedCertificateTimestamp::Origin origin) {
   switch (origin) {
     case net::ct::SignedCertificateTimestamp::SCT_EMBEDDED:
       return "embedded";
     case net::ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION:
-      return "tls-extension";
+      return "from-tls-extension";
     case net::ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE:
-      return "ocsp";
-    case net::ct::SignedCertificateTimestamp::SCT_ORIGIN_MAX:
+      return "from-ocsp-response";
+    default:
       NOTREACHED();
   }
   return "";
 }
 
-void AddSCT(const net::SignedCertificateTimestampAndStatus& sct,
-            base::ListValue* list) {
+void AddUnknownSCT(
+    const net::SignedCertificateTimestampAndStatus& sct_and_status,
+    base::ListValue* list) {
   std::unique_ptr<base::DictionaryValue> list_item(new base::DictionaryValue());
-  // Chrome implements RFC6962, not 6962-bis, so the reports contain v1 SCTs.
-  list_item->SetInteger("version", 1);
-  std::string status;
-  switch (sct.status) {
-    case net::ct::SCT_STATUS_LOG_UNKNOWN:
-      status = "unknown";
-      break;
-    case net::ct::SCT_STATUS_INVALID_SIGNATURE:
-    case net::ct::SCT_STATUS_INVALID_TIMESTAMP:
-      status = "invalid";
-      break;
-    case net::ct::SCT_STATUS_OK:
-      status = "valid";
-      break;
-    case net::ct::SCT_STATUS_NONE:
-      NOTREACHED();
-  }
-  list_item->SetString("status", status);
-  list_item->SetString("source", SCTOriginToString(sct.sct->origin));
-  std::string serialized_sct;
-  net::ct::EncodeSignedCertificateTimestamp(sct.sct, &serialized_sct);
-  std::string encoded_serialized_sct;
-  base::Base64Encode(serialized_sct, &encoded_serialized_sct);
-  list_item->SetString("serialized_sct", encoded_serialized_sct);
+  list_item->SetString("origin", SCTOriginToString(sct_and_status.sct->origin));
   list->Append(std::move(list_item));
 }
 
+void AddInvalidSCT(
+    const net::SignedCertificateTimestampAndStatus& sct_and_status,
+    base::ListValue* list) {
+  std::unique_ptr<base::DictionaryValue> list_item(new base::DictionaryValue());
+  list_item->SetString("origin", SCTOriginToString(sct_and_status.sct->origin));
+  std::string log_id;
+  base::Base64Encode(sct_and_status.sct->log_id, &log_id);
+  list_item->SetString("id", log_id);
+  list->Append(std::move(list_item));
+}
+
+void AddValidSCT(const net::SignedCertificateTimestampAndStatus& sct_and_status,
+                 base::ListValue* list) {
+  std::unique_ptr<base::DictionaryValue> list_item(new base::DictionaryValue());
+  list_item->SetString("origin", SCTOriginToString(sct_and_status.sct->origin));
+
+  // The structure of the SCT object is defined in
+  // http://tools.ietf.org/html/rfc6962#section-4.1.
+  std::unique_ptr<base::DictionaryValue> sct(new base::DictionaryValue());
+  sct->SetInteger("sct_version", sct_and_status.sct->version);
+  std::string log_id;
+  base::Base64Encode(sct_and_status.sct->log_id, &log_id);
+  sct->SetString("id", log_id);
+  base::TimeDelta timestamp =
+      sct_and_status.sct->timestamp - base::Time::UnixEpoch();
+  sct->SetString("timestamp", base::Int64ToString(timestamp.InMilliseconds()));
+  std::string extensions;
+  base::Base64Encode(sct_and_status.sct->extensions, &extensions);
+  sct->SetString("extensions", extensions);
+  std::string signature;
+  base::Base64Encode(sct_and_status.sct->signature.signature_data, &signature);
+  sct->SetString("signature", signature);
+
+  list_item->Set("sct", std::move(sct));
+  list->Append(std::move(list_item));
+}
+
 // Records an UMA histogram of the net errors when Expect CT reports
 // fail to send.
 void RecordUMAOnFailure(const GURL& report_uri,
                         int net_error,
                         int http_response_code) {
   UMA_HISTOGRAM_SPARSE_SLOWLY("SSL.ExpectCTReportFailure2", -net_error);
 }
 
 constexpr net::NetworkTrafficAnnotationTag kTrafficAnnotation =
     net::DefineNetworkTrafficAnnotation("chrome_expect_ct_reporter", R"(
@@ skipping 36 matching lines @@
     const net::X509Certificate* validated_certificate_chain,
     const net::X509Certificate* served_certificate_chain,
     const net::SignedCertificateTimestampAndStatusList&
         signed_certificate_timestamps) {
   if (report_uri.is_empty())
     return;
 
   if (!base::FeatureList::IsEnabled(features::kExpectCTReporting))
     return;
 
-  base::DictionaryValue outer_report;
-  base::DictionaryValue* report = outer_report.SetDictionary(
-      "expect-ct-report", base::MakeUnique<base::DictionaryValue>());
-  report->SetString("hostname", host_port_pair.host());
-  report->SetInteger("port", host_port_pair.port());
-  report->SetString("date-time", TimeToISO8601(base::Time::Now()));
-  report->SetString("effective-expiration-date", TimeToISO8601(expiration));
-  report->Set("served-certificate-chain",
-              GetPEMEncodedChainAsList(served_certificate_chain));
-  report->Set("validated-certificate-chain",
-              GetPEMEncodedChainAsList(validated_certificate_chain));
+  base::DictionaryValue report;
+  report.SetString("hostname", host_port_pair.host());
+  report.SetInteger("port", host_port_pair.port());
+  report.SetString("date-time", TimeToISO8601(base::Time::Now()));
+  report.SetString("effective-expiration-date", TimeToISO8601(expiration));
+  report.Set("served-certificate-chain",
+             GetPEMEncodedChainAsList(served_certificate_chain));
+  report.Set("validated-certificate-chain",
+             GetPEMEncodedChainAsList(validated_certificate_chain));
 
-  std::unique_ptr<base::ListValue> scts(new base::ListValue());
+  std::unique_ptr<base::ListValue> unknown_scts(new base::ListValue());
+  std::unique_ptr<base::ListValue> invalid_scts(new base::ListValue());
+  std::unique_ptr<base::ListValue> valid_scts(new base::ListValue());
+
   for (const auto& sct_and_status : signed_certificate_timestamps) {
-    AddSCT(sct_and_status, scts.get());
+    switch (sct_and_status.status) {
+      case net::ct::SCT_STATUS_LOG_UNKNOWN:
+        AddUnknownSCT(sct_and_status, unknown_scts.get());
+        break;
+      case net::ct::SCT_STATUS_INVALID_SIGNATURE:
+      case net::ct::SCT_STATUS_INVALID_TIMESTAMP:
+        AddInvalidSCT(sct_and_status, invalid_scts.get());
+        break;
+      case net::ct::SCT_STATUS_OK:
+        AddValidSCT(sct_and_status, valid_scts.get());
+        break;
+      default:
+        NOTREACHED();
+    }
   }
-  report->Set("scts", std::move(scts));
+
+  report.Set("unknown-scts", std::move(unknown_scts));
+  report.Set("invalid-scts", std::move(invalid_scts));
+  report.Set("valid-scts", std::move(valid_scts));
 
   std::string serialized_report;
-  if (!base::JSONWriter::Write(outer_report, &serialized_report)) {
+  if (!base::JSONWriter::Write(report, &serialized_report)) {
     LOG(ERROR) << "Failed to serialize Expect CT report";
     return;
   }
 
   UMA_HISTOGRAM_BOOLEAN("SSL.ExpectCTReportSendingAttempt", true);
 
   report_sender_->Send(report_uri, "application/json; charset=utf-8",
                        serialized_report, base::Callback<void()>(),
                        base::Bind(RecordUMAOnFailure));
 }