Certificate Transparency: Require SCTs for EV certificates.

net/url_request/url_request_context.h

Index: net/url_request/url_request_context.h
diff --git a/net/url_request/url_request_context.h b/net/url_request/url_request_context.h
index 992f985f0332b441af1c21614e27a5c48974cd4f..c084f07f61638ab7883850139afd700c538bfd21 100644
--- a/net/url_request/url_request_context.h
+++ b/net/url_request/url_request_context.h
@@ -27,6 +27,7 @@
 #include "net/url_request/url_request.h"
 
 namespace net {
+class CertPolicyEnforcer;
 class CertVerifier;
 class ChannelIDService;
 class CookieStore;
@@ -171,6 +172,13 @@ class NET_EXPORT URLRequestContext
     cert_transparency_verifier_ = verifier;
   }
 
+  CertPolicyEnforcer* cert_policy_enforcer() const {
+    return cert_policy_enforcer_;
+  }
+  void set_cert_policy_enforcer(CertPolicyEnforcer* policy_enforcer) {
+    cert_policy_enforcer_ = policy_enforcer;
+  }

[mmenke, 2014/11/05 19:32:36]

Does this need to be part of the context?

You're not setting it in a number of the contexts created for a profile, and I'm
wondering if we really need it at this layer, or if we should fix that.

[Eran Messeri, 2014/11/19 10:00:23]

Matt says:
"..I'm not suggesting it not be added to the HttpNetworkSession. Just that it
not be added as part of the URLRequestContext"
Further suggesting that the CertPolicyenforcer is set for the
HttpNetworkSession::Params in IOThread::InitializeNetworkSessionParams.

Regarding thread safety:
"In terms of lifetimes, it's safe. IOThread outlives ProfileIOData for all
profiles
They basically all depend on IOThread::Globals, so already not safe to destroy
them after the IOThread
(And the destruction of the IOThread object is the last thing the IO Thread
does, IIRC)"

+
   const URLRequestJobFactory* job_factory() const { return job_factory_; }
   void set_job_factory(const URLRequestJobFactory* job_factory) {
     job_factory_ = job_factory;
@@ -235,6 +243,7 @@ class NET_EXPORT URLRequestContext
   scoped_refptr<CookieStore> cookie_store_;
   TransportSecurityState* transport_security_state_;
   CTVerifier* cert_transparency_verifier_;
+  CertPolicyEnforcer* cert_policy_enforcer_;
   HttpTransactionFactory* http_transaction_factory_;
   const URLRequestJobFactory* job_factory_;
   URLRequestThrottlerManager* throttler_manager_;