Certificate Transparency: Code for unpacking EV cert hashes whitelist

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index c5869fc3503a5ddfa53abb1b9ba0aecbabbfb442..f6e065b65a9e6dfdd24dda5bec71e0bd645c70ff 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -93,6 +93,7 @@
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_ev_whitelist.h"
 #include "net/cert/ct_objects_extractor.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/ct_verify_result.h"
@@ -3423,6 +3424,19 @@ int SSLClientSocketNSS::DoVerifyCertComplete(int result) {
     result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
   }
 
+  if (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV) {

[Ryan Sleevi, 2014/10/01 20:15:43]

BUG: Need this logic for OpenSSL. Easy to forget to change both places.

[Eran Messeri, 2014/10/03 12:00:11]

For now I copied the logic as-is to ssl_client_socket_openssl, once there's a
clear plan on how to unify policy-related checks I'll move the code.

+    if (ssl_config_.ev_certs_whitelist->IsValid()) {

[Ryan Sleevi, 2014/10/01 20:15:43]

Should ev_certs_whitelist just be optional, the same as it is with CRLSets?

[Eran Messeri, 2014/10/03 12:00:11]

Done. Note that the IsValid method on the EVCertsWhitelist remained because the
EVCertsWhitelist instances are immutable, so in order to figure out if we should
replace the existing EVCertsWhitelist instance with a newly-created one (from
fresh data)  the IsValid method is used.

+      const SHA256HashValue fingerprint(
+          X509Certificate::CalculateFingerprint256(
+              server_cert_verify_result_.verified_cert->os_cert_handle()));
+
+      UMA_HISTOGRAM_BOOLEAN(
+          "Net.SSL_EVCertificateInWhitelist",
+          ssl_config_.ev_certs_whitelist->ContainsCertificateHash(
+              std::string(reinterpret_cast<const char*>(fingerprint.data), 8)));
+    }
+  }
+
   if (result == OK) {
     // Only check Certificate Transparency if there were no other errors with
     // the connection.