Certificate Transparency: Logging SCTs to the NetLog.

net/cert/multi_log_ct_verifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_log_ct_verifier.h"
 
+#include "base/bind.h"
+#include "base/callback_helpers.h"
 #include "net/base/net_errors.h"
+#include "net/base/net_log.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/ct_objects_extractor.h"
 #include "net/cert/ct_serialization.h"
+#include "net/cert/ct_signed_certificate_timestamp_log_param.h"
 #include "net/cert/ct_verify_result.h"
 #include "net/cert/x509_certificate.h"
 
 namespace net {
 
 MultiLogCTVerifier::MultiLogCTVerifier() { }
 
 MultiLogCTVerifier::~MultiLogCTVerifier() { }
 
 void MultiLogCTVerifier::AddLog(scoped_ptr<CTLogVerifier> log_verifier) {
   DCHECK(log_verifier);
   if (!log_verifier)
     return;
 
   linked_ptr<CTLogVerifier> log(log_verifier.release());
   logs_[log->key_id()] = log;
 }
 
 int MultiLogCTVerifier::Verify(
     X509Certificate* cert,
     const std::string& sct_list_from_ocsp,
     const std::string& sct_list_from_tls_extension,
-    ct::CTVerifyResult* result)  {
+    ct::CTVerifyResult* result,
+    const BoundNetLog& net_log)  {
   DCHECK(cert);
   DCHECK(result);
 
   result->verified_scts.clear();
   result->unverified_scts.clear();
   result->unknown_logs_scts.clear();
 
   bool has_verified_scts = false;
 
   std::string embedded_scts;
   if (!cert->GetIntermediateCertificates().empty() &&
       ct::ExtractEmbeddedSCTList(
           cert->os_cert_handle(),
           &embedded_scts)) {
     ct::LogEntry precert_entry;
 
     has_verified_scts =
         ct::GetPrecertLogEntry(
             cert->os_cert_handle(),
             cert->GetIntermediateCertificates().front(),
             &precert_entry) &&
         VerifySCTs(
             embedded_scts,
             precert_entry,
             ct::SignedCertificateTimestamp::SCT_EMBEDDED,
             result);
   }
 
+  // Log to Net Log here, after extracting embedded SCTs but before

[eroman, 2013/11/27 22:33:46]

nit: Remove "here,"

[Eran M. (Google), 2013/11/29 11:14:44]

Done.

+  // possibly failing on X.509 entry creation.
+  NetLog::ParametersCallback net_log_callback =
+    base::Bind(&NetLogRawSignedCertificateTimestampCallback,

[eroman, 2013/11/27 22:33:46]

style: Indent continued lines by 4.

[Eran M. (Google), 2013/11/29 11:14:44]

Done.

[Eran M. (Google), 2013/11/29 11:14:44]

Done.

+        &embedded_scts, &sct_list_from_ocsp, &sct_list_from_tls_extension);
+
+  net_log.AddEvent(
+      NetLog::TYPE_SIGNED_CERTIFICATE_TIMESTAMPS_RECEIVED,
+      net_log_callback);
+
   ct::LogEntry x509_entry;
-  if (!ct::GetX509LogEntry(cert->os_cert_handle(), &x509_entry))
-    return has_verified_scts ? OK : ERR_FAILED;
+  if (ct::GetX509LogEntry(cert->os_cert_handle(), &x509_entry)) {
+    has_verified_scts |= VerifySCTs(
+        sct_list_from_ocsp,
+        x509_entry,
+        ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE,
+        result);
 
-  has_verified_scts |= VerifySCTs(
-      sct_list_from_ocsp,
-      x509_entry,
-      ct::SignedCertificateTimestamp::SCT_FROM_OCSP_RESPONSE,
-      result);
+    has_verified_scts |= VerifySCTs(
+        sct_list_from_tls_extension,
+        x509_entry,
+        ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION,
+        result);
+  }
 
-  has_verified_scts |= VerifySCTs(
-      sct_list_from_tls_extension,
-      x509_entry,
-      ct::SignedCertificateTimestamp::SCT_FROM_TLS_EXTENSION,
-      result);
+  NetLog::ParametersCallback net_log_checked_callback =
+    base::Bind(&NetLogSignedCertificateTimestampCallback, result);

[eroman, 2013/11/27 22:33:46]

indent continued lines by 4.

[Eran M. (Google), 2013/11/29 11:14:44]

Done.

+
+  net_log.AddEvent(
+      NetLog::TYPE_SIGNED_CERTIFICATE_TIMESTAMPS_CHECKED,
+      net_log_checked_callback);
 
   if (has_verified_scts)
     return OK;
 
   return ERR_FAILED;
 }
 
 bool MultiLogCTVerifier::VerifySCTs(
     const std::string& encoded_sct_list,
     const ct::LogEntry& expected_entry,
@@ skipping 50 matching lines @@
     DVLOG(1) << "SCT is from the future!";
     result->unverified_scts.push_back(sct);
     return false;
   }
 
   result->verified_scts.push_back(sct);
   return true;
 }
 
 } // namespace net