SignedCertificateTimestamp storing & serialization code.

net/ssl/ssl_info.h

Index: net/ssl/ssl_info.h
diff --git a/net/ssl/ssl_info.h b/net/ssl/ssl_info.h
index 3f1dd2df4e1ed3265e8bab76c44fb37383ffc19d..00a8815c79c69be30b0450d23bb3a5dd08c5e52a 100644
--- a/net/ssl/ssl_info.h
+++ b/net/ssl/ssl_info.h
@@ -10,7 +10,12 @@
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
 #include "net/cert/cert_status_flags.h"
+#include "net/cert/sct_status_flags.h"
 #include "net/cert/x509_cert_types.h"
+#include "net/ssl/signed_certificate_timestamp_and_status.h"
+
+class Pickle;
+class PickleIterator;
 
 namespace net {
 
@@ -74,6 +79,10 @@ class NET_EXPORT SSLInfo {
   // The hashes, in several algorithms, of the SubjectPublicKeyInfos from
   // each certificate in the chain.
   HashValueVector public_key_hashes;
+
+  // List of SignedCertificateTimestamps and their corresponding validation
+  // status.
+  SignedCertificateTimestampAndStatusList signed_certificate_timestamps;

[wtc, 2013/11/28 01:28:02]

Another way to store the SCTs in an SSLInfo is to have three vectors of
SignedCertificateTimestamp, one for each validation status, just like
CTVerifyResult. Then you don't need the SignedCertificateTimestampAndStatus
struct.

I'll let you and Eran decide which form is better.

[alcutter, 2013/11/28 12:08:19]

Spoke with Eran about this, we figured that it's better this way since it's
possible we'll need to make the status richer in the future (e.g. with gossip
info, etc.)

Thank you for the suggestion, though.

[wtc, 2013/11/28 16:15:07]

Good. Thanks.

Another idea I considered would be to add a ct::SCTVerifyStatus member to the
SignedCertificateTimestamp struct. Then we won't need
SignedCertificateTimestampAndStatus and SignedCertificateTimestampAndStatusList.

But I think this idea may cause confusion because the SignedCertificateTimestamp
struct will contain a member that does not come from the serialized SCT. So I am
not sure if this is a good idea.

[alcutter, 2013/11/28 16:42:18]

Yeah, that could be a little surprising.

 };
 
 }  // namespace net