Certificate Transparency: Logging SCTs to the NetLog.

net/base/net_log_event_type_list.h

Index: net/base/net_log_event_type_list.h
diff --git a/net/base/net_log_event_type_list.h b/net/base/net_log_event_type_list.h
index f31bccae3656a6b07a77054f779b16d8c7dd63b9..b57fa3b0eccd538e9212958766a7dfa7eb8f0207 100644
--- a/net/base/net_log_event_type_list.h
+++ b/net/base/net_log_event_type_list.h
@@ -558,6 +558,38 @@ EVENT_TYPE(SOCKET_WRITE_ERROR)
 //  }
 EVENT_TYPE(SSL_CERTIFICATES_RECEIVED)
 
+// Signed Certificate Timestamps were received from the server.
+// The following parameters are attached to the event:
+// {
+//    "embedded_scts": Base64-encoded SignedCertificateTimestampList,
+//    "scts_from_ocsp_response": Base64-encoded SignedCertificateTimestampList,
+//    "scts_from_tls_extension": Base64-encoded SignedCertificateTimestampList,
+// }
+//
+// The SignedCertificateTimestampList is defined in RFC6962 and is exactly as
+// received from the server.
+EVENT_TYPE(SSL_SIGNED_CERTIFICATE_TIMESTAMPS_RECEIVED)

[wtc, 2013/11/27 16:00:58]

Consider using "CT_" instead of "SSL_" for these event names because these
events are really the events of a CTVerifier.

[eroman, 2013/11/27 20:39:55]

I actually like the name SSL_* here, as it is consistent with
"SSL_CERTIFICATES_RECEIVED" above.

Since the name already contains "CERTIFICATE_TIMESTAMS" a "CT_" prefix would be
redundant (these are purely names and don't need to worry about having a
consistent prefix). So you can drop the "SSL_" if you wanted.

[Eran M. (Google), 2013/11/27 22:08:50]

Dropped the SSL_  prefix. This should satisfy both comments :)

+
+// Signed Certificate Timestamps were checked.
+// The following parameters are attached to the event:
+// {
+//    "verified_scts": <A list of SCTs>,
+//    "failed_to_verify_scts": <A list of SCTs>,
+//    "scts_from_unknown_logs": <A list of SCTs>,
+// }
+//
+// Where each SCT is an object:
+// {
+//    "origin": <one of: embedded_in_certificate, tls_extension, ocsp>,
+//    "version": <numeric version>,
+//    "log_id": <base64-encoded log id>,
+//    "timestamp": <numeric timestamp in milliseconds since epoch>,

[wtc, 2013/11/27 16:00:58]

Nit: epoch => the Unix epoch

[Eran M. (Google), 2013/11/27 22:08:50]

Done.

+//    "hash_algorithm": <numeric indicator of hash algorithm>,
+//    "signature_algorithm": <numeric indicator of signature algorithm>,

[wtc, 2013/11/27 16:00:58]

It may be worthwhile to convert the algorithm numbers to strings, such as
"sha256" and "rsa". You can make this a TODO.

[Eran M. (Google), 2013/11/27 22:08:50]

Done - outputting the names now.

+//    "signature_data": <base64-encoded signature bytes>,
+// }
+EVENT_TYPE(SSL_SIGNED_CERTIFICATE_TIMESTAMPS_CHECKED)
+
 // ------------------------------------------------------------------------
 // DatagramSocket
 // ------------------------------------------------------------------------