Certificate Transparency: Adding finch and NetLog logging for EV certs

net/cert/cert_policy_enforcer.cc

Index: net/cert/cert_policy_enforcer.cc
diff --git a/net/cert/cert_policy_enforcer.cc b/net/cert/cert_policy_enforcer.cc
index c9ce7cc4a0873268a0fc910bb7906ff69ae44350..8e155d8bb8ecec69b152aa8e44e0a394eb7ddf27 100644
--- a/net/cert/cert_policy_enforcer.cc
+++ b/net/cert/cert_policy_enforcer.cc
@@ -6,15 +6,20 @@
 
 #include <algorithm>
 
+#include "base/bind.h"
 #include "base/build_time.h"
+#include "base/callback_helpers.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/values.h"
+#include "net/base/net_log.h"
 #include "net/cert/ct_ev_whitelist.h"
 #include "net/cert/ct_verify_result.h"
 #include "net/cert/signed_certificate_timestamp.h"
 #include "net/cert/x509_certificate.h"
+#include "net/cert/x509_certificate_net_log_param.h"
 
 namespace net {
 
@@ -65,6 +70,16 @@ void LogCTComplianceStatusToUMA(CTComplianceStatus status) {
                             CT_COMPLIANCE_MAX);
 }
 
+base::Value* NetLogNonCompliantCertCallback(X509Certificate* cert,
+                                            NetLog::LogLevel log_level) {
+  base::DictionaryValue* dict = new base::DictionaryValue();
+
+  dict->Set("non_compliant_cert",
+            NetLogX509CertificateCallback(cert, log_level));
+

[davidben, 2014/12/08 22:42:35]

Style nit: I probably wouldn't bother with the blank lines since the function's
so short.

[Eran Messeri, 2014/12/09 19:58:15]

Done.

+  return dict;
+}
+
 }  // namespace
 
 CertPolicyEnforcer::CertPolicyEnforcer(size_t num_ct_logs,
@@ -78,7 +93,8 @@ CertPolicyEnforcer::~CertPolicyEnforcer() {
 bool CertPolicyEnforcer::DoesConformToCTEVPolicy(
     X509Certificate* cert,
     const ct::EVCertsWhitelist* ev_whitelist,
-    const ct::CTVerifyResult& ct_result) {
+    const ct::CTVerifyResult& ct_result,
+    const BoundNetLog& net_log) {
   if (!require_ct_for_ev_)
     return true;
 
@@ -96,6 +112,12 @@ bool CertPolicyEnforcer::DoesConformToCTEVPolicy(
   }
 
   LogCTComplianceStatusToUMA(CT_NOT_COMPLIANT);
+
+  NetLog::ParametersCallback net_log_callback =
+      base::Bind(&NetLogNonCompliantCertCallback, base::Unretained(cert));
+
+  net_log.AddEvent(NetLog::TYPE_NON_COMPLIANT_EV_CERT_ENCOUNTERED,
+                   net_log_callback);
   return false;
 }