Enable Certificate Transparency in the OpenSSL port.

net/socket/ssl_client_socket_openssl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_
 
 #include <string>
 
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/cert/cert_verify_result.h"
+#include "net/cert/ct_verify_result.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/ssl/channel_id_service.h"
 #include "net/ssl/ssl_client_cert_type.h"
 #include "net/ssl/ssl_config_service.h"
 
 // Avoid including misc OpenSSL headers, i.e.:
 // <openssl/bio.h>
 typedef struct bio_st BIO;
 // <openssl/evp.h>
 typedef struct evp_pkey_st EVP_PKEY;
 // <openssl/ssl.h>
 typedef struct ssl_st SSL;
 // <openssl/x509.h>
 typedef struct x509_st X509;
 // <openssl/ossl_type.h>
 typedef struct x509_store_ctx_st X509_STORE_CTX;
 
 namespace net {
 
 class CertVerifier;
+class CTVerifier;
 class SingleRequestCertVerifier;
 class SSLCertRequestInfo;
 class SSLInfo;
 
 // An SSL client socket implemented with OpenSSL.
 class SSLClientSocketOpenSSL : public SSLClientSocket {
  public:
   // Takes ownership of the transport_socket, which may already be connected.
   // The given hostname will be compared with the name(s) in the server's
   // certificate during the SSL handshake.  ssl_config specifies the SSL
@@ skipping 67 matching lines @@
   void OnHandshakeCompletion();
 
   bool DoTransportIO();
   int DoHandshake();
   int DoChannelIDLookup();
   int DoChannelIDLookupComplete(int result);
   int DoVerifyCert(int result);
   int DoVerifyCertComplete(int result);
   void DoConnectCallback(int result);
   X509Certificate* UpdateServerCert();
+  void VerifyCT();
 
   void OnHandshakeIOComplete(int result);
   void OnSendComplete(int result);
   void OnRecvComplete(int result);
 
   int DoHandshakeLoop(int last_io_result);
   int DoReadLoop(int result);
   int DoWriteLoop(int result);
   int DoPayloadRead();
   int DoPayloadWrite();
@@ skipping 32 matching lines @@
                           int cmd,
                           const char *argp, int argi, long argl,
                           long retvalue);
 
   // Callback that is used to obtain information about the state of the SSL
   // handshake.
   static void InfoCallback(const SSL* ssl, int type, int val);
 
   void CheckIfHandshakeFinished();
 
+  // Adds the SignedCertificateTimestamps from ct_verify_result_ to |ssl_info|.
+  // SCTs are held in three separate vectors in ct_verify_result, each
+  // vetor representing a particular verification state, this method associates
+  // each of the SCTs with the corresponding SCTVerifyStatus as it adds it to
+  // the |ssl_info|.signed_certificate_timestamps list.
+  void AddSCTInfoToSSLInfo(SSLInfo* ssl_info) const;
+
   bool transport_send_busy_;
   bool transport_recv_busy_;
 
   scoped_refptr<DrainableIOBuffer> send_buffer_;
   scoped_refptr<IOBuffer> recv_buffer_;
 
   CompletionCallback user_connect_callback_;
   CompletionCallback user_read_callback_;
   CompletionCallback user_write_callback_;
 
@@ skipping 41 matching lines @@
   // allowed by the server.
   std::vector<std::string> cert_authorities_;
   // List of SSLClientCertType values for client certificates allowed by the
   // server.
   std::vector<SSLClientCertType> cert_key_types_;
 
   CertVerifier* const cert_verifier_;
   scoped_ptr<SingleRequestCertVerifier> verifier_;
   base::TimeTicks start_cert_verification_time_;
 
+  // Certificate Transparency: Verifier and result holder.
+  ct::CTVerifyResult ct_verify_result_;
+  CTVerifier* cert_transparency_verifier_;
+
   // The service for retrieving Channel ID keys.  May be NULL.
   ChannelIDService* channel_id_service_;
 
   // Callback that is invoked when the connection finishes.
   //
   // Note: this callback will be run in Disconnect(). It will not alter
   // any member variables of the SSLClientSocketOpenSSL.
   base::Closure handshake_completion_callback_;
 
   // OpenSSL stuff
@@ skipping 41 matching lines @@
   // TransportSecurityState::CheckPublicKeyPins in the event of a
   // pinning failure. It is a (somewhat) human-readable string.
   std::string pinning_failure_log_;
 
   BoundNetLog net_log_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_OPENSSL_H_