Certificate Transparency: Require SCTs for EV certificates.

net/cert/ct_verifier.h

Index: net/cert/ct_verifier.h
diff --git a/net/cert/ct_verifier.h b/net/cert/ct_verifier.h
index 290a0474a649138733c902fdc5a8e47b6210f12d..5adc94514fe00ba295f5889b0a5f3eb8179a8faf 100644
--- a/net/cert/ct_verifier.h
+++ b/net/cert/ct_verifier.h
@@ -5,6 +5,9 @@
 #ifndef NET_CERT_CT_VERIFIER_H_
 #define NET_CERT_CT_VERIFIER_H_
 
+#include <stdint.h>
+#include <string>
+
 #include "net/base/net_export.h"
 
 namespace net {
@@ -36,6 +39,10 @@ class NET_EXPORT CTVerifier {
                      const std::string& sct_list_from_tls_extension,
                      ct::CTVerifyResult* result,
                      const BoundNetLog& net_log) = 0;
+
+  // Returns the number of known CT logs. Needed for CT/EV policy
+  // enforcement. May go away when more than 3 logs are available.
+  virtual uint32_t GetNumKnownLogs() = 0;

[Ryan Sleevi, 2014/10/22 19:48:36]

size_t

That said, this is a layering violation that the CTVerifier is exposing details
about the number of known logs, which this interface hides the details of. I'd
rather not expose this, and get the information passed through another way.

[Eran Messeri, 2014/10/24 12:12:36]

Removed this method entirely.

 };
 
 }  // namespace net