Certificate Transparency: Code for unpacking EV cert hashes whitelist

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index dd644d14dc8f8e51f6ce6190b6763e348e87d0d7..0eb14514ff294badfd1be39a988b565b29b3cce4 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -93,6 +93,7 @@
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_ev_whitelist.h"
 #include "net/cert/ct_objects_extractor.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/ct_verify_result.h"
@@ -3426,6 +3427,21 @@ int SSLClientSocketNSS::DoVerifyCertComplete(int result) {
     result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
   }
 
+  if (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV) {
+    scoped_refptr<ct::EVCertsWhitelist> ev_whitelist =
+        SSLConfigService::GetEVCertsWhitelist();
+    if (ev_whitelist->IsValid()) {
+      const SHA256HashValue fingerprint(
+          X509Certificate::CalculateFingerprint256(
+              server_cert_verify_result_.verified_cert->os_cert_handle()));
+
+      UMA_HISTOGRAM_BOOLEAN(
+          "Net.SSL_EVCertificateInWhitelist",
+          ev_whitelist->ContainsCertificateHash(
+              std::string(reinterpret_cast<const char*>(fingerprint.data), 8)));
+    }
+  }

[Ryan Sleevi, 2014/09/11 23:44:39]

This is the wrong layer to be logging this.

This sort of logic likely belongs somewhere much higher - perhaps the
ResourceLoader - or much lower - within the CertVerifier.

[Eran Messeri, 2014/10/01 16:08:36]

Re putting this logic in the CertVerifier, that makes sense, but means adding
another parameter to the CertVerifier::Verify method, and there's already a TODO
there with your name on it to remove the CRLSet. Where did you want to remove
the CRLSet to? Perhaps I can supply the CRLSet and the EVCertsWhitelist in the
same manner.

Re ResourceLoader, could you clarify exactly where? Also, the ultimate goal is
to take away the EV state if the cert is not in the whitelist, don't we want
this reflected in the cert_status field?

+
   if (result == OK) {
     // Only check Certificate Transparency if there were no other errors with
     // the connection.