Certificate Transparency: Logging SCTs to the NetLog.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 75 matching lines @@
 #include "crypto/scoped_nss_types.h"
 #include "net/base/address_list.h"
 #include "net/base/connection_type_histograms.h"
 #include "net/base/dns_util.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
+#include "net/cert/ct_signed_certificate_timestamp_log_param.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/scoped_nss_types.h"
 #include "net/cert/single_request_cert_verifier.h"
 #include "net/cert/x509_certificate_net_log_param.h"
 #include "net/cert/x509_util.h"
 #include "net/http/transport_security_state.h"
 #include "net/ocsp/nss_ocsp.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/nss_ssl_util.h"
 #include "net/socket/ssl_error_params.h"
@@ skipping 3368 matching lines @@
   if (!cert_transparency_verifier_)
     return;
 
   // Note that this is a completely synchronous operation: The CT Log Verifier
   // gets all the data it needs for SCT verification and does not do any
   // external communication.
   int result = cert_transparency_verifier_->Verify(
       server_cert_verify_result_.verified_cert,
       std::string(), // SCT list from OCSP response
       std::string(),  // SCT list from TLS extension
-      &ct_verify_result_);
+      &ct_verify_result_,
+      net_log_);
 
   VLOG(1) << "CT Verification complete: result " << result
           << " Unverified scts: " << ct_verify_result_.unverified_scts.size()
           << " Verified scts: " << ct_verify_result_.verified_scts.size()
           << " scts from unknown logs: "
           << ct_verify_result_.unknown_logs_scts.size();
 
+  NetLog::ParametersCallback net_log_callback =
+    base::Bind(&NetLogSignedCertificateTimestampCallback,
+        &ct_verify_result_);
+
+  net_log_.AddEvent(
+      NetLog::TYPE_SSL_SIGNED_CERTIFICATE_TIMESTAMPS_CHECKED,

[wtc, 2013/11/27 16:00:58]

1. I think this event should be added inside the
cert_transparency_verifier_->Verify() function. It has everything it needs (only
|ct_verify_result_| is needed) to create the event.

2. Nit: CHECKED => VERIFIED?

This matches the method name (cert_transparency_verifier_->Verify).

Are you trying to avoid "VERIFIED" being misinterpreted as "verified valid"?

[Eran M. (Google), 2013/11/27 22:08:50]

1. Done.

2. Yes, I want to distinct "verified valid" and "checked". Will be happy to
re-word, though.

+      net_log_callback);
   if (!ct_verify_result_.unverified_scts.empty() ||
       !ct_verify_result_.unknown_logs_scts.empty() ||
       !ct_verify_result_.verified_scts.empty()) {
+

[wtc, 2013/11/27 16:00:58]

Nit: delete this blank line.

I would also add a blank line before this if statement.

[Eran M. (Google), 2013/11/27 22:08:50]

Done.

     // Saving CT state in cert_status bits, in addition to the SCTs themselves
     // (which will be threaded into the SSLInfo, as well as into the HTTP
     // cache).
     // This persists the CT status and simplifies UI code for figuring out
     // the right CT info to display.
     int ct_state;
     if (!ct_verify_result_.verified_scts.empty() && result == OK)
       ct_state = CERT_TRANSPARENCY_SCT_VALIDATED_OK;
     else if (!ct_verify_result_.unverified_scts.empty())
       ct_state = CERT_TRANSPARENCY_SCT_FAILED_VALIDATION;
@@ skipping 43 matching lines @@
   EnsureThreadIdAssigned();
   base::AutoLock auto_lock(lock_);
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net