Expose CT enforcement through NetworkSecurityPolicy

Bug: 28746284
Change-Id: I8b7f567554ea2ceec012b75220ab5487d347b565

2 files changed, 18 insertions, 0 deletions

diff --git a/luni/src/main/java/libcore/net/NetworkSecurityPolicy.java b/luni/src/main/java/libcore/net/NetworkSecurityPolicy.java
index 56b1b6a87b..d9c87a4176 100644
--- a/luni/src/main/java/libcore/net/NetworkSecurityPolicy.java
+++ b/luni/src/main/java/libcore/net/NetworkSecurityPolicy.java
@@ -71,6 +71,14 @@ public abstract class NetworkSecurityPolicy {
      */
     public abstract boolean isCleartextTrafficPermitted(String hostname);
 
+    /**
+     * Returns {@code true} if Certificate Transparency information is required to be presented by
+     * the server and verified by the client in TLS connections to {@code hostname}.
+     *
+     * <p>See RFC6962 section 3.3 for more details.
+     */
+    public abstract boolean isCertificateTransparencyVerificationRequired(String hostname);
+
     public static final class DefaultNetworkSecurityPolicy extends NetworkSecurityPolicy {
         @Override
         public boolean isCleartextTrafficPermitted() {
@@ -81,5 +89,10 @@ public abstract class NetworkSecurityPolicy {
         public boolean isCleartextTrafficPermitted(String hostname) {
             return isCleartextTrafficPermitted();
         }
+
+        @Override
+        public boolean isCertificateTransparencyVerificationRequired(String hostname) {
+            return false;
+        }
     }
 }
diff --git a/luni/src/test/java/libcore/net/NetworkSecurityPolicyTest.java b/luni/src/test/java/libcore/net/NetworkSecurityPolicyTest.java
index 7a57ac19d7..fc312fc033 100644
--- a/luni/src/test/java/libcore/net/NetworkSecurityPolicyTest.java
+++ b/luni/src/test/java/libcore/net/NetworkSecurityPolicyTest.java
@@ -359,5 +359,10 @@ public class NetworkSecurityPolicyTest extends TestCase {
 
             return isCleartextTrafficPermitted();
         }
+
+        @Override
+        public boolean isCertificateTransparencyVerificationRequired(String hostname) {
+            return false;
+        }
     }
 }