Certificate Transparency: Threading the CT verifier into the SSL client socket.

net/cert/multi_log_ct_verifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_log_ct_verifier.h"
 
 #include "net/base/net_errors.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/ct_objects_extractor.h"
 #include "net/cert/ct_serialization.h"
@@ skipping 42 matching lines @@
             cert->GetIntermediateCertificates().front(),
             &precert_entry) &&
         VerifySCTs(
             embedded_scts,
             precert_entry,
             ct::SignedCertificateTimestamp::SCT_EMBEDDED,
             result);
   }
 
   ct::LogEntry x509_entry;
-  if (!ct::GetX509LogEntry(cert->os_cert_handle(), &x509_entry))
-    return has_verified_scts ? OK : ERR_FAILED;
+  if (ct::GetX509LogEntry(cert->os_cert_handle(), &x509_entry)) {
+    has_verified_scts |= VerifySCTs(
+        sct_list_from_ocsp,
+        x509_entry,
+        ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE,
+        result);
 
-  has_verified_scts |= VerifySCTs(
-      sct_list_from_ocsp,
-      x509_entry,
-      ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE,
-      result);
-
-  has_verified_scts |= VerifySCTs(
-      sct_list_from_tls_extension,
-      x509_entry,
-      ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION,
-      result);
+    has_verified_scts |= VerifySCTs(
+        sct_list_from_tls_extension,
+        x509_entry,
+        ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION,
+        result);
+  }
 
   if (has_verified_scts)
     return OK;
 
-  return ERR_FAILED;
+  return ERR_CT_NO_SCTS_VERIFIED_OK;
 }
 
 bool MultiLogCTVerifier::VerifySCTs(
     const std::string& encoded_sct_list,
     const ct::LogEntry& expected_entry,
     ct::SignedCertificateTimestamp::Origin origin,
     ct::CTVerifyResult* result) {
   if (logs_.empty())
     return false;
 
@@ skipping 20 matching lines @@
 
   return verified;
 }
 
 bool MultiLogCTVerifier::VerifySingleSCT(
     scoped_refptr<ct::SignedCertificateTimestamp> sct,
     const ct::LogEntry& expected_entry,
     ct::CTVerifyResult* result) {
 
   // Assume this SCT is untrusted until proven otherwise.
-
   IDToLogMap::iterator it = logs_.find(sct->log_id);
   if (it == logs_.end()) {
     DVLOG(1) << "SCT does not match any known log.";
     result->unknown_logs_scts.push_back(sct);
     return false;
   }
 
   if (!it->second->Verify(expected_entry, *sct)) {
     DVLOG(1) << "Unable to verify SCT signature.";
     result->unverified_scts.push_back(sct);
     return false;
   }
 
   // SCT verified ok, just make sure the timestamp is legitimate.
   if (sct->timestamp > base::Time::Now()) {
     DVLOG(1) << "SCT is from the future!";
     result->unverified_scts.push_back(sct);
     return false;
   }
 
   result->verified_scts.push_back(sct);
   return true;
 }
 
 } // namespace net