Certificate Transparency: Threading the CT verifier into the SSL client socket.

net/socket/client_socket_pool_manager_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_pool_manager_impl.h"
 
 #include "base/logging.h"
 #include "base/values.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_proxy_client_socket_pool.h"
@@ skipping 22 matching lines @@
 
 }  // namespace
 
 ClientSocketPoolManagerImpl::ClientSocketPoolManagerImpl(
     NetLog* net_log,
     ClientSocketFactory* socket_factory,
     HostResolver* host_resolver,
     CertVerifier* cert_verifier,
     ServerBoundCertService* server_bound_cert_service,
     TransportSecurityState* transport_security_state,
+    CTVerifier* cert_transparency_verifier,
     const std::string& ssl_session_cache_shard,
     ProxyService* proxy_service,
     SSLConfigService* ssl_config_service,
     HttpNetworkSession::SocketPoolType pool_type)
     : net_log_(net_log),
       socket_factory_(socket_factory),
       host_resolver_(host_resolver),
       cert_verifier_(cert_verifier),
       server_bound_cert_service_(server_bound_cert_service),
       transport_security_state_(transport_security_state),
+      cert_transparency_verifier_(cert_transparency_verifier),
       ssl_session_cache_shard_(ssl_session_cache_shard),
       proxy_service_(proxy_service),
       ssl_config_service_(ssl_config_service),
       pool_type_(pool_type),
       transport_pool_histograms_("TCP"),
       transport_socket_pool_(new TransportClientSocketPool(
           max_sockets_per_pool(pool_type), max_sockets_per_group(pool_type),
           &transport_pool_histograms_,
           host_resolver,
           socket_factory_,
           net_log)),
       ssl_pool_histograms_("SSL2"),
       ssl_socket_pool_(new SSLClientSocketPool(
           max_sockets_per_pool(pool_type), max_sockets_per_group(pool_type),
           &ssl_pool_histograms_,
           host_resolver,
           cert_verifier,
           server_bound_cert_service,
           transport_security_state,
+          cert_transparency_verifier,
           ssl_session_cache_shard,
           socket_factory,
           transport_socket_pool_.get(),
           NULL /* no socks proxy */,
           NULL /* no http proxy */,
           ssl_config_service,
           net_log)),
       transport_for_socks_pool_histograms_("TCPforSOCKS"),
       socks_pool_histograms_("SOCK"),
       transport_for_http_proxy_pool_histograms_("TCPforHTTPProxy"),
@@ skipping 197 matching lines @@
   std::pair<SSLSocketPoolMap::iterator, bool> ssl_https_ret =
       ssl_socket_pools_for_https_proxies_.insert(std::make_pair(
           http_proxy,
           new SSLClientSocketPool(max_sockets_per_proxy_server(pool_type_),
                                   max_sockets_per_group(pool_type_),
                                   &ssl_for_https_proxy_pool_histograms_,
                                   host_resolver_,
                                   cert_verifier_,
                                   server_bound_cert_service_,
                                   transport_security_state_,
+                                  cert_transparency_verifier_,
                                   ssl_session_cache_shard_,
                                   socket_factory_,
                                   tcp_https_ret.first->second /* https proxy */,
                                   NULL /* no socks proxy */,
                                   NULL /* no http proxy */,
                                   ssl_config_service_.get(),
                                   net_log_)));
   DCHECK(tcp_https_ret.second);
 
   std::pair<HTTPProxySocketPoolMap::iterator, bool> ret =
@@ skipping 20 matching lines @@
     return it->second;
 
   SSLClientSocketPool* new_pool = new SSLClientSocketPool(
       max_sockets_per_proxy_server(pool_type_),
       max_sockets_per_group(pool_type_),
       &ssl_pool_histograms_,
       host_resolver_,
       cert_verifier_,
       server_bound_cert_service_,
       transport_security_state_,
+      cert_transparency_verifier_,
       ssl_session_cache_shard_,
       socket_factory_,
       NULL, /* no tcp pool, we always go through a proxy */
       GetSocketPoolForSOCKSProxy(proxy_server),
       GetSocketPoolForHTTPProxy(proxy_server),
       ssl_config_service_.get(),
       net_log_);
 
   std::pair<SSLSocketPoolMap::iterator, bool> ret =
       ssl_socket_pools_for_proxies_.insert(std::make_pair(proxy_server,
@@ skipping 44 matching lines @@
   // We should not flush the socket pools if we added trust to a
   // cert.
   //
   // Since the OnCACertChanged method doesn't tell us what
   // kind of change it is, we have to flush the socket
   // pools to be safe.
   FlushSocketPoolsWithError(ERR_NETWORK_CHANGED);
 }
 
 }  // namespace net