Certificate Transparency: Require SCTs for EV certificates.

net/cert/ct_verifier.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CT_VERIFIER_H_
 #define NET_CERT_CT_VERIFIER_H_
 
+#include <stdint.h>
+#include <string>
+
 #include "net/base/net_export.h"
 
 namespace net {
 
 namespace ct {
 struct CTVerifyResult;
 }  // namespace ct
 
 class BoundNetLog;
 class X509Certificate;
@@ skipping 11 matching lines @@
   // (embedding, TLS extension or OCSP stapling). If no stapled OCSP response
   // is available, |stapled_ocsp_response| should be an empty string. If no SCT
   // TLS extension was negotiated, |sct_list_from_tls_extension| should be an
   // empty string. |result| will be filled with the SCTs present, divided into
   // categories based on the verification result.
   virtual int Verify(X509Certificate* cert,
                      const std::string& stapled_ocsp_response,
                      const std::string& sct_list_from_tls_extension,
                      ct::CTVerifyResult* result,
                      const BoundNetLog& net_log) = 0;
+
+  // Returns the number of known CT logs. Needed for CT/EV policy
+  // enforcement. May go away when more than 3 logs are available.
+  virtual uint32_t GetNumKnownLogs() = 0;

[Ryan Sleevi, 2014/10/22 19:48:36]

size_t

That said, this is a layering violation that the CTVerifier is exposing details
about the number of known logs, which this interface hides the details of. I'd
rather not expose this, and get the information passed through another way.

[Eran Messeri, 2014/10/24 12:12:36]

Removed this method entirely.

 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CT_VERIFIER_H_