Certificate Transparency: Start tracking logs' state

components/certificate_transparency/single_tree_tracker.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
+#define COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
+
+#include <map>
+#include <string>
+
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/time/time.h"
+#include "net/cert/ct_observer.h"
+#include "net/cert/signed_tree_head.h"
+
+namespace net {
+class CTLogVerifier;
+class X509Certificate;
+
+namespace ct {
+struct SignedCertificateTimestamp;
+}  // namespace ct
+
+}  // namespace net
+
+namespace certificate_transparency {
+
+// Tracks the state of an individual CT log's Merkle Tree. By keeping the
+// latest Signed Tree Head for a log, this class can check inclusion for
+// observed SCTs.
+class SingleTreeTracker : public net::ct::CTObserver {
+ public:
+  // TODO(eranm): This enum will expand to include check success/failure,
+  // see crbug.com/506227
+  enum SCTInclusionStatus {
+    // SCT was not observed by this class.
+    SCT_NOT_OBSERVED,
+    // SCT was observed but the STH known to this class is not old

[Ryan Sleevi, 2016/04/14 16:56:16]

Readability: Newlines between 38/39, 41/42

[Eran Messeri, 2016/04/18 22:02:12]

Done.

+    // enough to check for inclusion.
+    SCT_PENDING_NEWER_STH,
+    // SCT is known and there's a new-enough STH to check inclusion against.
+    // Actual inclusion check has to be performed.
+    SCT_PENDING_INCLUSION_CHECK
+  };
+
+  explicit SingleTreeTracker(scoped_refptr<const net::CTLogVerifier>& ct_log);

[Ryan Sleevi, 2016/04/14 16:56:16]

If you're passing by ref, pass it const. But in the case of scoped_refptr<>,
pass by value.

[Eran Messeri, 2016/04/18 22:02:12]

Done.

+  ~SingleTreeTracker() override;
+
+  // net::ct::CTVerifier::Observer implementation.
+  // Performs an inclusion check for the given certificate if the latest
+  // STH known for this log is older than sct.timestamp + MMD, enqueues
+  // the SCT for future checking later on.

[Ryan Sleevi, 2016/04/14 16:56:16]

Does this do the checking synchronously? CT is already showing up in connection
latency costs, and considering this will add to the crypto operations, it may be
better to defer this work to the background.

[Eran Messeri, 2016/04/18 22:02:12]

No - it does not do the checking synchronously. Right now nothing is done in
this method (other than filing the SCT), I'll add a TODO not to do any
synchronous operations here (SCT verification does not need to happen again as
this callback is invoked only for SCTs that were verified already)

+  void OnSCTVerified(net::X509Certificate* cert,
+                     const net::ct::SignedCertificateTimestamp* sct) override;
+
+  // net::ct::STHObserver implementation.
+  // After verification of the signature over the |sth|, uses this
+  // STH for future inclusion checks.
+  void NewSTHObserved(const net::ct::SignedTreeHead& sth) override;
+
+  // Returns the status of a given log entry (that is assembled from
+  // |cert| and |sct|).
+  SCTInclusionStatus GetLogEntryInclusionStatus(
+      net::X509Certificate* cert,
+      const net::ct::SignedCertificateTimestamp* sct);
+
+ private:
+  // Logs an error and aborts if the provided log_id is not the same as the
+  // log id this instance knows of.
+  void CheckLogId(const std::string& log_id);
+
+  // Holds the latest STH fetched and verified for each log.
+  net::ct::SignedTreeHead verified_sth_;
+  // The log tracked.
+  scoped_refptr<const net::CTLogVerifier> ct_log_;
+  // List of log entries pending inclusion check.
+  // TODO(eranm): Rather than rely on the timestamp, extend to to use the
+  // whole MerkleTreeLeaf (RFC6962, section 3.4.) as a key. See crbug.com/506227
+  std::map<base::Time, SCTInclusionStatus> entries_status_;
+
+  DISALLOW_COPY_AND_ASSIGN(SingleTreeTracker);
+};
+
+}  // namespace certificate_transparency
+
+#endif  // COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_