Certificate Transparency: Code for unpacking EV cert hashes whitelist

net/quic/crypto/proof_verifier_chromium.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/crypto/proof_verifier_chromium.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
 #include "base/compiler_specific.h"
@@ skipping 232 matching lines @@
       (result == OK ||
        (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
       !transport_security_state_->CheckPublicKeyPins(
           hostname_,
           cert_verify_result.is_issued_by_known_root,
           cert_verify_result.public_key_hashes,
           &verify_details_->pinning_failure_log)) {
     result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
   }
 
+  scoped_refptr<ct::EVCertsWhitelist> ev_whitelist =
+      SSLConfigService::GetEVCertsWhitelist();
+  if ((cert_status & CERT_STATUS_IS_EV) && ev_whitelist.get() &&
+      ev_whitelist->IsValid()) {
+    const SHA256HashValue fingerprint(
+        X509Certificate::CalculateFingerprint256(cert_->os_cert_handle()));
+
+    UMA_HISTOGRAM_BOOLEAN(
+        "Net.SSL_EVCertificateInWhitelist",
+        ev_whitelist->ContainsCertificateHash(
+            std::string(reinterpret_cast<const char*>(fingerprint.data), 8)));
+  }
+
   if (result != OK) {
     std::string error_string = ErrorToString(result);
     error_details_ = StringPrintf("Failed to verify certificate chain: %s",
                                   error_string.c_str());
     DLOG(WARNING) << error_details_;
   }
 
   // Exit DoLoop and return the result to the caller to VerifyProof.
   DCHECK_EQ(STATE_NONE, next_state_);
   return result;
@@ skipping 113 matching lines @@
   }
   return status;
 }
 
 void ProofVerifierChromium::OnJobComplete(Job* job) {
   active_jobs_.erase(job);
   delete job;
 }
 
 }  // namespace net