Certificate Transparency: Adding finch and NetLog logging for EV certs

net/cert/cert_policy_enforcer.h

Index: net/cert/cert_policy_enforcer.h
diff --git a/net/cert/cert_policy_enforcer.h b/net/cert/cert_policy_enforcer.h
index 68039b3cd8c73976b558d0c8f76cee3e342901f7..d4e182edb5a12fac63242571d99ec25d5a378b2b 100644
--- a/net/cert/cert_policy_enforcer.h
+++ b/net/cert/cert_policy_enforcer.h
@@ -7,6 +7,7 @@
 #include <stddef.h>
 
 #include "net/base/net_export.h"
+#include "net/base/net_log.h"
 
 namespace net {
 
@@ -19,6 +20,12 @@ class EVCertsWhitelist;
 
 class X509Certificate;
 
+namespace {
+
+struct PolicyComplianceResult;
+
+}  // namespace

[Ryan Sleevi, 2014/12/10 20:09:26]

This is a .h file. You can't use unnamed namespaces here.

Just forward declare this struct as a private member struct of
CertPolicyEnforcer. eg: line 52

private:
  struct CertPolicyEnforcer;

  bool IsCertificateInWhitelist(...);

[Eran Messeri, 2014/12/12 12:44:56]

Done.

+
 // Class for checking that a given certificate conforms to security-related
 // policies.
 class NET_EXPORT CertPolicyEnforcer {
@@ -32,13 +39,15 @@ class NET_EXPORT CertPolicyEnforcer {
   virtual ~CertPolicyEnforcer();
 
   // Returns true if the collection of SCTs for the given certificate
-  // conforms with the CT/EV policy.
+  // conforms with the CT/EV policy. If it is non-conforming, the certificate
+  // is logged to |net_log|.
   // |cert| is the certificate for which the SCTs apply.
   // |ct_result| must contain the result of verifying any SCTs associated with
   // |cert| prior to invoking this method.
   bool DoesConformToCTEVPolicy(X509Certificate* cert,
                                const ct::EVCertsWhitelist* ev_whitelist,
-                               const ct::CTVerifyResult& ct_result);
+                               const ct::CTVerifyResult& ct_result,
+                               const BoundNetLog& net_log);
 
  private:
   bool IsCertificateInWhitelist(X509Certificate* cert,
@@ -47,6 +56,11 @@ class NET_EXPORT CertPolicyEnforcer {
   bool HasRequiredNumberOfSCTs(X509Certificate* cert,
                                const ct::CTVerifyResult& ct_result);
 
+  void CheckCTEVPolicyCompliance(X509Certificate* cert,
+                                 const ct::EVCertsWhitelist* ev_whitelist,
+                                 const ct::CTVerifyResult& ct_result,
+                                 PolicyComplianceResult* result);
+
   size_t num_ct_logs_;
   bool require_ct_for_ev_;
 };