Certificate Transparency: Fetching of Signed Tree Heads (DRAFT)

net/cert/ct_log_verifier.h

Index: net/cert/ct_log_verifier.h
diff --git a/net/cert/ct_log_verifier.h b/net/cert/ct_log_verifier.h
index 38e0930eb6594ec60c77e01fc4dd77b05e32c8cf..2604c9895069044448f32aad368e363e6679b00d 100644
--- a/net/cert/ct_log_verifier.h
+++ b/net/cert/ct_log_verifier.h
@@ -35,9 +35,9 @@ class NET_EXPORT CTLogVerifier {
   // using |public_key|, which is a DER-encoded SubjectPublicKeyInfo.
   // If |public_key| refers to an unsupported public key, returns NULL.
   // |description| is a textual description of the log.
-  static scoped_ptr<CTLogVerifier> Create(
-      const base::StringPiece& public_key,
-      const base::StringPiece& description);
+  static scoped_ptr<CTLogVerifier> Create(const base::StringPiece& public_key,
+                                          const base::StringPiece& description,
+                                          const base::StringPiece& url);
 
   ~CTLogVerifier();
 
@@ -45,6 +45,8 @@ class NET_EXPORT CTLogVerifier {
   const std::string& key_id() const { return key_id_; }
   // Returns the log's human-readable description.
   const std::string& description() const { return description_; }
+  // Returns the log's URL
+  const std::string& url() const { return url_; }
 
   // Verifies that |sct| contains a valid signature for |entry|.
   bool Verify(const ct::LogEntry& entry,
@@ -53,16 +55,16 @@ class NET_EXPORT CTLogVerifier {
   // Verifies and sets |signed_tree_head|. If |signed_tree_head|'s signature is
   // valid, stores it and returns true. Otherwise, discards the sth and
   // returns false.
-  bool SetSignedTreeHead(scoped_ptr<ct::SignedTreeHead> signed_tree_head);
+  bool VerifySignedTreeHead(const ct::SignedTreeHead* signed_tree_head);

[Ryan Sleevi, 2015/04/24 10:42:08]

No need to pass as pointer - just pass as const-ref

[Eran Messeri, 2015/06/18 15:18:42]

Done.

 
  private:
   FRIEND_TEST_ALL_PREFIXES(CTLogVerifierTest, VerifySignature);
 
-  CTLogVerifier();
+  CTLogVerifier(const base::StringPiece& description,
+                const base::StringPiece& url);
 
   // Performs crypto-library specific initialization.
-  bool Init(const base::StringPiece& public_key,
-            const base::StringPiece& description);
+  bool Init(const base::StringPiece& public_key);
 
   // Performs the underlying verification using the selected public key. Note
   // that |signature| contains the raw signature data (eg: without any
@@ -76,9 +78,9 @@ class NET_EXPORT CTLogVerifier {
 
   std::string key_id_;
   std::string description_;
+  std::string url_;
   ct::DigitallySigned::HashAlgorithm hash_algorithm_;
   ct::DigitallySigned::SignatureAlgorithm signature_algorithm_;
-  scoped_ptr<ct::SignedTreeHead> signed_tree_head_;
 
 #if defined(USE_OPENSSL)
   EVP_PKEY* public_key_;