Extract Certificate Transparency SCTs from stapled OCSP responses

net/socket/ssl_client_socket.h

Index: net/socket/ssl_client_socket.h
diff --git a/net/socket/ssl_client_socket.h b/net/socket/ssl_client_socket.h
index 40840e457dda2e3fbf7ecbbf7177d6a1dfcef0dc..79a30db9a2b4ee2393e3908f93e541ae3c791edb 100644
--- a/net/socket/ssl_client_socket.h
+++ b/net/socket/ssl_client_socket.h
@@ -133,16 +133,20 @@ class NET_EXPORT SSLClientSocket : public SSLSocket {
 
   // Returns true if the server sent Certificate Transparency SCTs
   // via a TLS extension.
-  // Temporary glue for testing while the CT code hasn't landed.
-  // TODO(ekasper): expose received SCTs via SSLInfo instead.
   virtual bool WereSignedCertTimestampsReceived() const;
 
+  // Returns true if the server sent a stapled OCSP response.
+  virtual bool WasStapledOCSPResponseReceived() const;

[Ryan Sleevi, 2013/12/10 21:06:09]

I'm not sure why we're exposing either of these (the other being
WereSCTReceived) on the socket object., when they only appear to be used for
test code.

Minimally, if the purpose is just for testing, we should move these to private
and let FRIEND_TEST (and friends, HAH) cover this.

Alternatively, we should let the unittests reach somewhat deeper into the socket
object.

My goal here is I don't know where there's a case where the caller would call
either of these two methods and do something differently. Even in the
EV-with-CT-only case, we wouldn't care about these boolean states - we'd care
about the validated SCTs.

[ekasper, 2013/12/11 15:40:51]

They were for testing indeed - I've removed them and given direct access to the
private members via FRIEND_TEST_ALL_PREFIXES which appears to be the chromium
version of FRIEND_TEST, right?

+
  protected:
   virtual void set_channel_id_sent(bool channel_id_sent);
 
   virtual void set_signed_cert_timestamps_received(
       bool signed_cert_timestamps_received);
 
+  virtual void set_stapled_ocsp_response_received(
+      bool stapled_ocsp_response_received);
+
   // Records histograms for channel id support during full handshakes - resumed
   // handshakes are ignored.
   static void RecordChannelIDSupport(
@@ -167,6 +171,8 @@ class NET_EXPORT SSLClientSocket : public SSLSocket {
   bool channel_id_sent_;
   // True if SCTs were received via a TLS extension.
   bool signed_cert_timestamps_received_;
+  // True if a stapled OCSP response was received.
+  bool stapled_ocsp_response_received_;
 };
 
 }  // namespace net