Extract Certificate Transparency SCTs from stapled OCSP responses

net/socket/ssl_client_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_CLIENT_SOCKET_H_
 #define NET_SOCKET_SSL_CLIENT_SOCKET_H_
 
 #include <string>
 
+#include "base/gtest_prod_util.h"
 #include "net/base/completion_callback.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/socket/ssl_socket.h"
 #include "net/socket/stream_socket.h"
 
 namespace net {
 
 class CertVerifier;
 class CTVerifier;
@@ skipping 104 matching lines @@
   virtual ServerBoundCertService* GetServerBoundCertService() const = 0;
 
   // Returns true if a channel ID was sent on this connection.
   // This may be useful for protocols, like SPDY, which allow the same
   // connection to be shared between multiple domains, each of which need
   // a channel ID.
   //
   // Public for ssl_client_socket_openssl_unittest.cc.
   virtual bool WasChannelIDSent() const;
 
-  // Returns true if the server sent Certificate Transparency SCTs
-  // via a TLS extension.
-  // Temporary glue for testing while the CT code hasn't landed.
-  // TODO(ekasper): expose received SCTs via SSLInfo instead.
-  virtual bool WereSignedCertTimestampsReceived() const;
-
  protected:
   virtual void set_channel_id_sent(bool channel_id_sent);
 
   virtual void set_signed_cert_timestamps_received(
       bool signed_cert_timestamps_received);
 
+  virtual void set_stapled_ocsp_response_received(
+      bool stapled_ocsp_response_received);
+
   // Records histograms for channel id support during full handshakes - resumed
   // handshakes are ignored.
   static void RecordChannelIDSupport(
       ServerBoundCertService* server_bound_cert_service,
       bool negotiated_channel_id,
       bool channel_id_enabled,
       bool supports_ecc);
 
   // Returns whether TLS channel ID is enabled.
   static bool IsChannelIDEnabled(
       const SSLConfig& ssl_config,
       ServerBoundCertService* server_bound_cert_service);
 
  private:
+  // For signed_cert_timestamps_received_ and stapled_ocsp_response_received_.
+  FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
+                           ConnectSignedCertTimestampsEnabledTLSExtension);
+  FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
+                           ConnectSignedCertTimestampsEnabledOCSP);
+  FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest,
+                           ConnectSignedCertTimestampsDisabled);

[wtc, 2013/12/13 16:15:50]

Nit: add a blank line to separate the friend test declarations from the data
members.

[ekasper, 2013/12/13 17:26:10]

Done.

   // True if NPN was responded to, independent of selecting SPDY or HTTP.
   bool was_npn_negotiated_;
   // True if NPN successfully negotiated SPDY.
   bool was_spdy_negotiated_;
   // Protocol that we negotiated with the server.
   NextProto protocol_negotiated_;
   // True if a channel ID was sent.
   bool channel_id_sent_;
   // True if SCTs were received via a TLS extension.
   bool signed_cert_timestamps_received_;
+  // True if a stapled OCSP response was received.
+  bool stapled_ocsp_response_received_;
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_CLIENT_SOCKET_H_