Certificate Transparency: Start tracking logs' state

components/certificate_transparency/single_tree_tracker.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
+#define COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
+
+#include <map>
+#include <string>
+
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/time/time.h"
+#include "net/cert/ct_observer.h"
+#include "net/cert/signed_tree_head.h"
+
+namespace net {
+class CTLogVerifier;
+class X509Certificate;
+
+namespace ct {
+struct SignedCertificateTimestamp;
+}  // namespace ct
+
+}  // namespace net
+
+namespace certificate_transparency {
+
+// Tracks the state of an individual CT log's Merkle Tree. By keeping the
+// latest Signed Tree Head for a log, this class can check inclusion for
+// observed SCTs.
+class SingleTreeTracker : public net::ct::CTObserver {
+ public:
+  // TODO(eranm): This enum will expand to include check success/failure,
+  // see crbug.com/506227
+  enum SCTInclusionStatus {
+    // SCT was not observed by this class.
+    SCT_NOT_OBSERVED,
+
+    // SCT was observed but the STH known to this class is not old
+    // enough to check for inclusion.
+    SCT_PENDING_NEWER_STH,
+
+    // SCT is known and there's a new-enough STH to check inclusion against.
+    // Actual inclusion check has to be performed.
+    SCT_PENDING_INCLUSION_CHECK
+  };
+
+  explicit SingleTreeTracker(scoped_refptr<const net::CTLogVerifier> ct_log);
+  ~SingleTreeTracker() override;
+
+  // net::ct::CTVerifier::Observer implementation.
+  // Performs an inclusion check for the given certificate if the latest
+  // STH known for this log is older than sct.timestamp + MMD, enqueues
+  // the SCT for future checking later on.
+  // TODO(eranm): Make sure not to perform any synchronous, blocking operation
+  // here as this callback is invoked during certificate validation.
+  void OnSCTVerified(net::X509Certificate* cert,

[Ryan Sleevi, 2016/04/21 14:05:16]

Note: If you ever expect |cert| to be retained, you'll need to change this
signature. I'm not sure what your thoughts are for 56/57, but worth calling out
now.

[Eran Messeri, 2016/04/25 14:50:59]

Acknowledged - I don't yet know if the |cert| will be retained or portions
copied to address the TODO in lines 82-83.

Is there anywhere I can read on the life-cycle of X509Certificate objects?
Ideally I could just hold onto the pointer for calculating the leaf hash
asynchronously (i.e. after OnSCTVerified) was called. 

[Ryan Sleevi, 2016/04/27 23:05:58]

I'm not sure I know what you're asking. They're reference-counted. If you're
using it for just the invocation of the function, using X509Certificate* / const
X509Certificate& is fine. If you're storing it / handling asynchronously, make
your API contract clear about that by taking it as a reference-counted object
(as a scoped_refptr), so that callers know "This will be retained"

In short, think of it like "shared_ptr" - if it's naked, it's only valid for the
duration of the call, but if you want to retain it, you need to take it as
shared. Anything else is a recipe for lifetime/ownership hell.

+                     const net::ct::SignedCertificateTimestamp* sct) override;
+
+  // net::ct::STHObserver implementation.
+  // After verification of the signature over the |sth|, uses this
+  // STH for future inclusion checks.
+  void NewSTHObserved(const net::ct::SignedTreeHead& sth) override;
+
+  // Returns the status of a given log entry (that is assembled from
+  // |cert| and |sct|).
+  SCTInclusionStatus GetLogEntryInclusionStatus(
+      net::X509Certificate* cert,
+      const net::ct::SignedCertificateTimestamp* sct);
+
+ private:
+  // Logs an error and aborts if the provided log_id is not the same as the
+  // log id this instance knows of.
+  void CheckLogId(const std::string& log_id);
+
+  // Holds the latest STH fetched and verified for each log.
+  net::ct::SignedTreeHead verified_sth_;
+  // The log tracked.
+  scoped_refptr<const net::CTLogVerifier> ct_log_;
+  // List of log entries pending inclusion check.
+  // TODO(eranm): Rather than rely on the timestamp, extend to to use the
+  // whole MerkleTreeLeaf (RFC6962, section 3.4.) as a key. See crbug.com/506227
+  std::map<base::Time, SCTInclusionStatus> entries_status_;
+
+  DISALLOW_COPY_AND_ASSIGN(SingleTreeTracker);
+};
+
+}  // namespace certificate_transparency
+
+#endif  // COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_