SignedCertificateTimestamp storing & serialization code.

net/ssl/ssl_info.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_INFO_H_
 #define NET_SSL_SSL_INFO_H_
 
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
 #include "net/cert/cert_status_flags.h"
+#include "net/cert/sct_status_flags.h"
 #include "net/cert/x509_cert_types.h"
+#include "net/ssl/signed_certificate_timestamp_and_status.h"
+
+class Pickle;
+class PickleIterator;
 
 namespace net {
 
 class X509Certificate;
 
 // SSL connection info.
 // This is really a struct.  All members are public.
 class NET_EXPORT SSLInfo {
  public:
   // HandshakeType enumerates the possible resumption cases after an SSL
@@ skipping 43 matching lines @@
   bool client_cert_sent;
 
   // True if a channel ID was sent to the server.
   bool channel_id_sent;
 
   HandshakeType handshake_type;
 
   // The hashes, in several algorithms, of the SubjectPublicKeyInfos from
   // each certificate in the chain.
   HashValueVector public_key_hashes;
+
+  // List of SignedCertificateTimestamps and their corresponding validation
+  // status.
+  SignedCertificateTimestampAndStatusList signed_certificate_timestamps;

[wtc, 2013/11/28 01:28:02]

Another way to store the SCTs in an SSLInfo is to have three vectors of
SignedCertificateTimestamp, one for each validation status, just like
CTVerifyResult. Then you don't need the SignedCertificateTimestampAndStatus
struct.

I'll let you and Eran decide which form is better.

[alcutter, 2013/11/28 12:08:19]

Spoke with Eran about this, we figured that it's better this way since it's
possible we'll need to make the status richer in the future (e.g. with gossip
info, etc.)

Thank you for the suggestion, though.

[wtc, 2013/11/28 16:15:07]

Good. Thanks.

Another idea I considered would be to add a ct::SCTVerifyStatus member to the
SignedCertificateTimestamp struct. Then we won't need
SignedCertificateTimestampAndStatus and SignedCertificateTimestampAndStatusList.

But I think this idea may cause confusion because the SignedCertificateTimestamp
struct will contain a member that does not come from the serialized SCT. So I am
not sure if this is a good idea.

[alcutter, 2013/11/28 16:42:18]

Yeah, that could be a little surprising.

 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_INFO_H_