Certificate Transparency: Require SCTs for EV certificates.

net/socket/ssl_client_socket_pool.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_pool.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
@@ skipping 179 matching lines @@
       params_(params),
       transport_pool_(transport_pool),
       socks_pool_(socks_pool),
       http_proxy_pool_(http_proxy_pool),
       client_socket_factory_(client_socket_factory),
       host_resolver_(host_resolver),
       context_(context.cert_verifier,
                context.channel_id_service,
                context.transport_security_state,
                context.cert_transparency_verifier,
+               context.cert_policy_enforcer,
                (params->privacy_mode() == PRIVACY_MODE_ENABLED
                     ? "pm/" + context.ssl_session_cache_shard
                     : context.ssl_session_cache_shard)),
       io_callback_(
           base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
       messenger_(NULL),
       get_messenger_callback_(get_messenger_callback),
       weak_factory_(this) {
 }
 
@@ skipping 417 matching lines @@
 
 SSLClientSocketPool::SSLClientSocketPool(
     int max_sockets,
     int max_sockets_per_group,
     ClientSocketPoolHistograms* histograms,
     HostResolver* host_resolver,
     CertVerifier* cert_verifier,
     ChannelIDService* channel_id_service,
     TransportSecurityState* transport_security_state,
     CTVerifier* cert_transparency_verifier,
+    CertPolicyEnforcer* cert_policy_enforcer,
     const std::string& ssl_session_cache_shard,
     ClientSocketFactory* client_socket_factory,
     TransportClientSocketPool* transport_pool,
     SOCKSClientSocketPool* socks_pool,
     HttpProxyClientSocketPool* http_proxy_pool,
     SSLConfigService* ssl_config_service,
     bool enable_ssl_connect_job_waiting,
     NetLog* net_log)
     : transport_pool_(transport_pool),
       socks_pool_(socks_pool),
       http_proxy_pool_(http_proxy_pool),
       base_(this,
             max_sockets,
             max_sockets_per_group,
             histograms,
             ClientSocketPool::unused_idle_socket_timeout(),
             ClientSocketPool::used_idle_socket_timeout(),
             new SSLConnectJobFactory(
                 transport_pool,
                 socks_pool,
                 http_proxy_pool,
                 client_socket_factory,
                 host_resolver,
                 SSLClientSocketContext(cert_verifier,
                                        channel_id_service,
                                        transport_security_state,
                                        cert_transparency_verifier,
+                                       cert_policy_enforcer,
                                        ssl_session_cache_shard),
                 base::Bind(
                     &SSLClientSocketPool::GetOrCreateSSLConnectJobMessenger,
                     base::Unretained(this)),
                 net_log)),
       ssl_config_service_(ssl_config_service),
       enable_ssl_connect_job_waiting_(enable_ssl_connect_job_waiting) {
   if (ssl_config_service_.get())
     ssl_config_service_->AddObserver(this);
   if (transport_pool_)
@@ skipping 170 matching lines @@
   CHECK(it != messenger_map_.end());
   delete it->second;
   messenger_map_.erase(it);
 }
 
 void SSLClientSocketPool::OnSSLConfigChanged() {
   FlushWithError(ERR_NETWORK_CHANGED);
 }
 
 }  // namespace net