Certificate Transparency: Require SCTs for EV certificates.

net/url_request/url_request_context.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This class represents contextual information (cookies, cache, etc.)
 // that's useful when processing resource requests.
 // The class is reference-counted so that it can be cleaned up after any
 // requests that are using it have been completed.
 
 #ifndef NET_URL_REQUEST_URL_REQUEST_CONTEXT_H_
 #define NET_URL_REQUEST_URL_REQUEST_CONTEXT_H_
 
 #include <set>
 #include <string>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/threading/non_thread_safe.h"
 #include "net/base/net_export.h"
 #include "net/base/net_log.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_server_properties.h"
 #include "net/http/transport_security_state.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/url_request/url_request.h"
 
 namespace net {
+class CertPolicyEnforcer;
 class CertVerifier;
 class ChannelIDService;
 class CookieStore;
 class CTVerifier;
 class FraudulentCertificateReporter;
 class HostResolver;
 class HttpAuthHandlerFactory;
 class HttpTransactionFactory;
 class HttpUserAgentSettings;
 class NetworkDelegate;
@@ skipping 124 matching lines @@
     transport_security_state_ = state;
   }
 
   CTVerifier* cert_transparency_verifier() const {
     return cert_transparency_verifier_;
   }
   void set_cert_transparency_verifier(CTVerifier* verifier) {
     cert_transparency_verifier_ = verifier;
   }
 
+  CertPolicyEnforcer* cert_policy_enforcer() const {
+    return cert_policy_enforcer_;
+  }
+  void set_cert_policy_enforcer(CertPolicyEnforcer* policy_enforcer) {
+    cert_policy_enforcer_ = policy_enforcer;
+  }

[mmenke, 2014/11/05 19:32:36]

Does this need to be part of the context?

You're not setting it in a number of the contexts created for a profile, and I'm
wondering if we really need it at this layer, or if we should fix that.

[Eran Messeri, 2014/11/19 10:00:23]

Matt says:
"..I'm not suggesting it not be added to the HttpNetworkSession. Just that it
not be added as part of the URLRequestContext"
Further suggesting that the CertPolicyenforcer is set for the
HttpNetworkSession::Params in IOThread::InitializeNetworkSessionParams.

Regarding thread safety:
"In terms of lifetimes, it's safe. IOThread outlives ProfileIOData for all
profiles
They basically all depend on IOThread::Globals, so already not safe to destroy
them after the IOThread
(And the destruction of the IOThread object is the last thing the IO Thread
does, IIRC)"

+
   const URLRequestJobFactory* job_factory() const { return job_factory_; }
   void set_job_factory(const URLRequestJobFactory* job_factory) {
     job_factory_ = job_factory;
   }
 
   // May be NULL.
   URLRequestThrottlerManager* throttler_manager() const {
     return throttler_manager_;
   }
   void set_throttler_manager(URLRequestThrottlerManager* throttler_manager) {
@@ skipping 44 matching lines @@
   FraudulentCertificateReporter* fraudulent_certificate_reporter_;
   HttpAuthHandlerFactory* http_auth_handler_factory_;
   ProxyService* proxy_service_;
   scoped_refptr<SSLConfigService> ssl_config_service_;
   NetworkDelegate* network_delegate_;
   base::WeakPtr<HttpServerProperties> http_server_properties_;
   HttpUserAgentSettings* http_user_agent_settings_;
   scoped_refptr<CookieStore> cookie_store_;
   TransportSecurityState* transport_security_state_;
   CTVerifier* cert_transparency_verifier_;
+  CertPolicyEnforcer* cert_policy_enforcer_;
   HttpTransactionFactory* http_transaction_factory_;
   const URLRequestJobFactory* job_factory_;
   URLRequestThrottlerManager* throttler_manager_;
   SdchManager* sdch_manager_;
 
   // ---------------------------------------------------------------------------
   // Important: When adding any new members below, consider whether they need to
   // be added to CopyFrom.
   // ---------------------------------------------------------------------------
 
   scoped_ptr<std::set<const URLRequest*> > url_requests_;
 
   DISALLOW_COPY_AND_ASSIGN(URLRequestContext);
 };
 
 }  // namespace net
 
 #endif  // NET_URL_REQUEST_URL_REQUEST_CONTEXT_H_