Extract Certificate Transparency SCTs from stapled OCSP responses

net/socket/ssl_client_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
 
 #include <string>
 
 #include "net/base/completion_callback.h"
@@ skipping 115 matching lines @@
   // Returns true if a channel ID was sent on this connection.
   // This may be useful for protocols, like SPDY, which allow the same
   // connection to be shared between multiple domains, each of which need
   // a channel ID.
   //
   // Public for ssl_client_socket_openssl_unittest.cc.
   virtual bool WasChannelIDSent() const;
 
   // Returns true if the server sent Certificate Transparency SCTs
   // via a TLS extension.
-  // Temporary glue for testing while the CT code hasn't landed.
-  // TODO(ekasper): expose received SCTs via SSLInfo instead.
   virtual bool WereSignedCertTimestampsReceived() const;
 
+  // Returns true if the server sent a stapled OCSP response.
+  virtual bool WasStapledOCSPResponseReceived() const;

[Ryan Sleevi, 2013/12/10 21:06:09]

I'm not sure why we're exposing either of these (the other being
WereSCTReceived) on the socket object., when they only appear to be used for
test code.

Minimally, if the purpose is just for testing, we should move these to private
and let FRIEND_TEST (and friends, HAH) cover this.

Alternatively, we should let the unittests reach somewhat deeper into the socket
object.

My goal here is I don't know where there's a case where the caller would call
either of these two methods and do something differently. Even in the
EV-with-CT-only case, we wouldn't care about these boolean states - we'd care
about the validated SCTs.

[ekasper, 2013/12/11 15:40:51]

They were for testing indeed - I've removed them and given direct access to the
private members via FRIEND_TEST_ALL_PREFIXES which appears to be the chromium
version of FRIEND_TEST, right?

+
  protected:
   virtual void set_channel_id_sent(bool channel_id_sent);
 
   virtual void set_signed_cert_timestamps_received(
       bool signed_cert_timestamps_received);
 
+  virtual void set_stapled_ocsp_response_received(
+      bool stapled_ocsp_response_received);
+
   // Records histograms for channel id support during full handshakes - resumed
   // handshakes are ignored.
   static void RecordChannelIDSupport(
       ServerBoundCertService* server_bound_cert_service,
       bool negotiated_channel_id,
       bool channel_id_enabled,
       bool supports_ecc);
 
   // Returns whether TLS channel ID is enabled.
   static bool IsChannelIDEnabled(
       const SSLConfig& ssl_config,
       ServerBoundCertService* server_bound_cert_service);
 
  private:
   // True if NPN was responded to, independent of selecting SPDY or HTTP.
   bool was_npn_negotiated_;
   // True if NPN successfully negotiated SPDY.
   bool was_spdy_negotiated_;
   // Protocol that we negotiated with the server.
   NextProto protocol_negotiated_;
   // True if a channel ID was sent.
   bool channel_id_sent_;
   // True if SCTs were received via a TLS extension.
   bool signed_cert_timestamps_received_;
+  // True if a stapled OCSP response was received.
+  bool stapled_ocsp_response_received_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_