Extract Certificate Transparency SCTs from stapled OCSP responses

net/cert/multi_log_ct_verifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_log_ct_verifier.h"
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
@@ skipping 14 matching lines @@
   DCHECK(log_verifier);
   if (!log_verifier)
     return;
 
   linked_ptr<CTLogVerifier> log(log_verifier.release());
   logs_[log->key_id()] = log;
 }
 
 int MultiLogCTVerifier::Verify(
     X509Certificate* cert,
-    const std::string& sct_list_from_ocsp,
+    const std::string& stapled_ocsp_response,
     const std::string& sct_list_from_tls_extension,
     ct::CTVerifyResult* result,
     const BoundNetLog& net_log)  {
   DCHECK(cert);
   DCHECK(result);
 
   result->verified_scts.clear();
   result->invalid_scts.clear();
   result->unknown_logs_scts.clear();
 
@@ skipping 11 matching lines @@
             cert->os_cert_handle(),
             cert->GetIntermediateCertificates().front(),
             &precert_entry) &&
         VerifySCTs(
             embedded_scts,
             precert_entry,
             ct::SignedCertificateTimestamp::SCT_EMBEDDED,
             result);
   }
 
-  // Log to Net Log, after extracting embedded SCTs but before
-  // possibly failing on X.509 entry creation.
+  std::string sct_list_from_ocsp;
+  if (!stapled_ocsp_response.empty() &&
+      !cert->GetIntermediateCertificates().empty()) {
+    ct::ExtractSCTListFromOCSPResponse(
+        cert->GetIntermediateCertificates().front(), cert->serial_number(),
+        stapled_ocsp_response, &sct_list_from_ocsp);
+  }
+
+  // Log to Net Log, after extracting SCTs but before possibly failing on
+  // X.509 entry creation.
   NetLog::ParametersCallback net_log_callback =
       base::Bind(&NetLogRawSignedCertificateTimestampCallback,
           &embedded_scts, &sct_list_from_ocsp, &sct_list_from_tls_extension);
 
   net_log.AddEvent(
       NetLog::TYPE_SIGNED_CERTIFICATE_TIMESTAMPS_RECEIVED,
       net_log_callback);
 
   ct::LogEntry x509_entry;
   if (ct::GetX509LogEntry(cert->os_cert_handle(), &x509_entry)) {
@@ skipping 81 matching lines @@
     DVLOG(1) << "SCT is from the future!";
     result->invalid_scts.push_back(sct);
     return false;
   }
 
   result->verified_scts.push_back(sct);
   return true;
 }
 
 } // namespace net