Extract Certificate Transparency SCTs from stapled OCSP responses

net/cert/ct_objects_extractor_unittest.cc

Index: net/cert/ct_objects_extractor_unittest.cc
diff --git a/net/cert/ct_objects_extractor_unittest.cc b/net/cert/ct_objects_extractor_unittest.cc
index b5609662bebce27a59e09dc78d4121eeae5bb529..54e4639d4bc043c349b85ea2bd5d2f71a8c346d1 100644
--- a/net/cert/ct_objects_extractor_unittest.cc
+++ b/net/cert/ct_objects_extractor_unittest.cc
@@ -123,6 +123,23 @@ TEST_F(CTObjectsExtractorTest, ComplementarySCTVerifies) {
   EXPECT_TRUE(log_->Verify(entry, *sct));
 }
 
+// Test that the extractor can parse OCSP responses.
+TEST_F(CTObjectsExtractorTest, ExtractSCTListFromOCSPResponse) {

[wtc, 2013/12/03 01:18:06]

Do we need to put this unit test inside #if !defined(USE_OPENSSL) ?

[ekasper, 2013/12/03 13:50:51]

I think not - none of the objects extraction is implemented for OpenSSL so the
whole test suite is excluded in net.gyp (line 2095).

+  std::string der_test_cert(ct::GetDerEncodedFakeOCSPResponseCert());
+  scoped_refptr<X509Certificate> test_cert =
+      X509Certificate::CreateFromBytes(der_test_cert.data(),
+                                       der_test_cert.length());
+
+  std::string fake_sct_list = ct::GetFakeOCSPExtensionValue();
+  ASSERT_FALSE(fake_sct_list.empty());
+  std::string ocsp_response = ct::GetDerEncodedFakeOCSPResponse();
+
+  std::string extracted_sct_list;
+  EXPECT_TRUE(ct::ExtractSCTListFromOCSPResponse(
+      test_cert->os_cert_handle(), ocsp_response, &extracted_sct_list));
+  EXPECT_EQ(extracted_sct_list, fake_sct_list);
+}
+
 }  // namespace ct
 
 }  // namespace net