Certificate Transparency: Threading the CT verifier into the SSL client socket.

net/cert/ct_known_logs_keys.h

Index: net/cert/ct_known_logs_keys.h
diff --git a/net/cert/ct_known_logs_keys.h b/net/cert/ct_known_logs_keys.h
new file mode 100644
index 0000000000000000000000000000000000000000..0464282ff00a74dc98784312d871884ab0369edd
--- /dev/null
+++ b/net/cert/ct_known_logs_keys.h
@@ -0,0 +1,36 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_CT_KNOWN_LOGS_KEYS_H_
+#define NET_CERT_CT_KNOWN_LOGS_KEYS_H_
+
+namespace net {
+
+static const char kGooglePilotLogKey[] =

[Ryan Sleevi, 2013/11/25 06:49:31]

This should be unsigned char; you should get a warning in one of the compilers
(IIRC, it's MSVC)

[Eran M. (Google), 2013/11/25 17:18:33]

As discussed offline, the warning is only if I use literals, which I'm not doing
here - keeping as char.

+    "\x30\x59\x30\x13\x06\x07\x2a\x86\x48\xce\x3d\x02\x01\x06\x08\x2a\x86\x48"
+    "\xce\x3d\x03\x01\x07\x03\x42\x00\x04\x7d\xa8\x4b\x12\x29\x80\xa3\x3d\xad"
+    "\xd3\x5a\x77\xb8\xcc\xe2\x88\xb3\xa5\xfd\xf1\xd3\x0c\xcd\x18\x0c\xe8\x41"
+    "\x46\xe8\x81\x01\x1b\x15\xe1\x4b\xf1\x1b\x62\xdd\x36\x0a\x08\x18\xba\xed"
+    "\x0b\x35\x84\xd0\x9e\x40\x3c\x2d\x9e\x9b\x82\x65\xbd\x1f\x04\x10\x41\x4c"
+    "\xa0";
+
+static const int kGooglePilotLogKeyLength = arraysize(kGooglePilotLogKey) - 1;

[Ryan Sleevi, 2013/11/25 06:49:31]

So this file is a little weird. You're exposing these in the header, meaning
we're relying on duplicate variable folding. However, because they're exposed in
the header, the caller can always take arraysize(var) - 1, because it's known at
call time.

It would seem 'better' to take the approach of content_switches.h/.cc, and use

extern const unsigned char kGooglePilotLogKey[];
extern const size_t kGooglePilotLogKeyLength;

and then initialize in the .cc file.

Note also the conversion from int to size_t, since you're dealing with buffer
sizes.

[Eran M. (Google), 2013/11/25 17:18:33]

Done - applied both suggestions.

+
+static const char kGooglePilotLogName[] = "Google CT Pilot";

[Ryan Sleevi, 2013/11/25 06:49:31]

I'm really uncomfortable with putting what will be user-visible strings in net/.
We already have this issue with some cert-related settings, and it's non-ideal.

We don't support doing localized strings in net_resources, but I suspect that we
need to move the I18N up a few layers.

[Eran M. (Google), 2013/11/25 17:18:33]

What would you suggest?

In this case I'd argue this is an entity's name, not a string that should be
translated.
Personally, when reading a Hebrew UI, I do not expect entities' names to be
translated, and in the 'identity' section of the connection information dialogue
I'd already expect the CA's name to be in English regardless of the UI
localization (IMHO it makes sense as long as the directionality of the text is
not messed up when a non-English sentence contains names in English). 

+
+static const char kGoogleTestLogKey[] =
+    "\x30\x59\x30\x13\x06\x07\x2a\x86\x48\xce\x3d\x02\x01\x06\x08\x2a\x86\x48"
+    "\xce\x3d\x03\x01\x07\x03\x42\x00\x04\xd7\xf4\xcc\x69\xb2\xe4\x0e\x90\xa3"
+    "\x8a\xea\x5a\x70\x09\x4f\xef\x13\x62\xd0\x8d\x49\x60\xff\x1b\x40\x50\x07"
+    "\x0c\x6d\x71\x86\xda\x25\x49\x8d\x65\xe1\x08\x0d\x47\x34\x6b\xbd\x27\xbc"
+    "\x96\x21\x3e\x34\xf5\x87\x76\x31\xb1\x7f\x1d\xc9\x85\x3b\x0d\xf7\x1f\x3f"
+    "\xe9";
+
+static const int kGoogleTestLogKeyLength = arraysize(kGoogleTestLogKey) - 1;
+
+static const char kGoogleTestLogName[] = "Google CT Test (Aviator)";
+
+}  // namespace net
+
+#endif  // NET_CERT_CT_KNOWN_LOGS_KEYS_H_