Certificate Transparency: Require SCTs for EV certificates.

net/socket/client_socket_pool_manager_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_pool_manager_impl.h"
 
 #include "base/logging.h"
 #include "base/values.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_proxy_client_socket_pool.h"
@@ skipping 24 matching lines @@
 }  // namespace
 
 ClientSocketPoolManagerImpl::ClientSocketPoolManagerImpl(
     NetLog* net_log,
     ClientSocketFactory* socket_factory,
     HostResolver* host_resolver,
     CertVerifier* cert_verifier,
     ChannelIDService* channel_id_service,
     TransportSecurityState* transport_security_state,
     CTVerifier* cert_transparency_verifier,
+    CertPolicyEnforcer* cert_policy_enforcer,
     const std::string& ssl_session_cache_shard,
     ProxyService* proxy_service,
     SSLConfigService* ssl_config_service,
     bool enable_ssl_connect_job_waiting,
     ProxyDelegate* proxy_delegate,
     HttpNetworkSession::SocketPoolType pool_type)
     : net_log_(net_log),
       socket_factory_(socket_factory),
       host_resolver_(host_resolver),
       cert_verifier_(cert_verifier),
       channel_id_service_(channel_id_service),
       transport_security_state_(transport_security_state),
       cert_transparency_verifier_(cert_transparency_verifier),
+      cert_policy_enforcer_(cert_policy_enforcer),
       ssl_session_cache_shard_(ssl_session_cache_shard),
       proxy_service_(proxy_service),
       ssl_config_service_(ssl_config_service),
       enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting),
       pool_type_(pool_type),
       transport_pool_histograms_("TCP"),
       transport_socket_pool_(
           pool_type == HttpNetworkSession::WEBSOCKET_SOCKET_POOL
               ? new WebSocketTransportClientSocketPool(
                     max_sockets_per_pool(pool_type),
@@ skipping 10 matching lines @@
                                               net_log)),
       ssl_pool_histograms_("SSL2"),
       ssl_socket_pool_(new SSLClientSocketPool(max_sockets_per_pool(pool_type),
                                                max_sockets_per_group(pool_type),
                                                &ssl_pool_histograms_,
                                                host_resolver,
                                                cert_verifier,
                                                channel_id_service,
                                                transport_security_state,
                                                cert_transparency_verifier,
+                                               cert_policy_enforcer,
                                                ssl_session_cache_shard,
                                                socket_factory,
                                                transport_socket_pool_.get(),
                                                NULL /* no socks proxy */,
                                                NULL /* no http proxy */,
                                                ssl_config_service,
                                                enable_ssl_connect_job_waiting,
                                                net_log)),
       transport_for_socks_pool_histograms_("TCPforSOCKS"),
       socks_pool_histograms_("SOCK"),
@@ skipping 192 matching lines @@
                   max_sockets_per_group(pool_type_),
                   &transport_for_https_proxy_pool_histograms_,
                   host_resolver_,
                   socket_factory_,
                   net_log_)));
   DCHECK(tcp_https_ret.second);
 
   std::pair<SSLSocketPoolMap::iterator, bool> ssl_https_ret =
       ssl_socket_pools_for_https_proxies_.insert(std::make_pair(
           http_proxy,
-          new SSLClientSocketPool(max_sockets_per_proxy_server(pool_type_),
-                                  max_sockets_per_group(pool_type_),
-                                  &ssl_for_https_proxy_pool_histograms_,
-                                  host_resolver_,
-                                  cert_verifier_,
-                                  channel_id_service_,
-                                  transport_security_state_,
-                                  cert_transparency_verifier_,
-                                  ssl_session_cache_shard_,
-                                  socket_factory_,
-                                  tcp_https_ret.first->second /* https proxy */,
-                                  NULL /* no socks proxy */,
-                                  NULL /* no http proxy */,
-                                  ssl_config_service_.get(),
-                                  enable_ssl_connect_job_waiting_,
-                                  net_log_)));
+          new SSLClientSocketPool(
+              max_sockets_per_proxy_server(pool_type_),
+              max_sockets_per_group(pool_type_),
+              &ssl_for_https_proxy_pool_histograms_, host_resolver_,
+              cert_verifier_, channel_id_service_, transport_security_state_,
+              cert_transparency_verifier_, cert_policy_enforcer_,
+              ssl_session_cache_shard_, socket_factory_,
+              tcp_https_ret.first->second /* https proxy */,
+              NULL /* no socks proxy */, NULL /* no http proxy */,
+              ssl_config_service_.get(), enable_ssl_connect_job_waiting_,
+              net_log_)));
   DCHECK(tcp_https_ret.second);
 
   std::pair<HTTPProxySocketPoolMap::iterator, bool> ret =
       http_proxy_socket_pools_.insert(
           std::make_pair(
               http_proxy,
               new HttpProxyClientSocketPool(
                   max_sockets_per_proxy_server(pool_type_),
                   max_sockets_per_group(pool_type_),
                   &http_proxy_pool_histograms_,
                   host_resolver_,
                   tcp_http_ret.first->second,
                   ssl_https_ret.first->second,
                   proxy_delegate_,
                   net_log_)));
 
   return ret.first->second;
 }
 
 SSLClientSocketPool* ClientSocketPoolManagerImpl::GetSocketPoolForSSLWithProxy(
     const HostPortPair& proxy_server) {
   SSLSocketPoolMap::const_iterator it =
       ssl_socket_pools_for_proxies_.find(proxy_server);
   if (it != ssl_socket_pools_for_proxies_.end())
     return it->second;
 
   SSLClientSocketPool* new_pool = new SSLClientSocketPool(
       max_sockets_per_proxy_server(pool_type_),
-      max_sockets_per_group(pool_type_),
-      &ssl_pool_histograms_,
-      host_resolver_,
-      cert_verifier_,
-      channel_id_service_,
-      transport_security_state_,
-      cert_transparency_verifier_,
-      ssl_session_cache_shard_,
-      socket_factory_,
+      max_sockets_per_group(pool_type_), &ssl_pool_histograms_, host_resolver_,
+      cert_verifier_, channel_id_service_, transport_security_state_,
+      cert_transparency_verifier_, cert_policy_enforcer_,
+      ssl_session_cache_shard_, socket_factory_,
       NULL, /* no tcp pool, we always go through a proxy */
       GetSocketPoolForSOCKSProxy(proxy_server),
-      GetSocketPoolForHTTPProxy(proxy_server),
-      ssl_config_service_.get(),
-      enable_ssl_connect_job_waiting_,
-      net_log_);
+      GetSocketPoolForHTTPProxy(proxy_server), ssl_config_service_.get(),
+      enable_ssl_connect_job_waiting_, net_log_);
 
   std::pair<SSLSocketPoolMap::iterator, bool> ret =
       ssl_socket_pools_for_proxies_.insert(std::make_pair(proxy_server,
                                                           new_pool));
 
   return ret.first->second;
 }
 
 base::Value* ClientSocketPoolManagerImpl::SocketPoolInfoToValue() const {
   base::ListValue* list = new base::ListValue();
@@ skipping 37 matching lines @@
   // We should not flush the socket pools if we added trust to a
   // cert.
   //
   // Since the OnCACertChanged method doesn't tell us what
   // kind of change it is, we have to flush the socket
   // pools to be safe.
   FlushSocketPoolsWithError(ERR_NETWORK_CHANGED);
 }
 
 }  // namespace net