Certificate Transparency: Start tracking logs' state

components/certificate_transparency/tree_state_tracker.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/certificate_transparency/tree_state_tracker.h"
+
+#include "components/certificate_transparency/single_tree_tracker.h"
+#include "net/cert/ct_log_verifier.h"
+#include "net/cert/signed_certificate_timestamp.h"
+#include "net/cert/signed_tree_head.h"
+#include "net/cert/x509_certificate.h"
+
+using net::X509Certificate;
+using net::CTLogVerifier;
+using net::ct::SignedCertificateTimestamp;
+using net::ct::SignedTreeHead;
+
+namespace certificate_transparency {
+
+TreeStateTracker::TreeStateTracker(
+    std::vector<scoped_refptr<const CTLogVerifier>> ct_logs) {
+  for (const auto& log : ct_logs)
+    tree_trackers_[log->key_id()].reset(new SingleTreeTracker(log));
+}
+
+TreeStateTracker::~TreeStateTracker() {}
+
+void TreeStateTracker::OnSCTVerified(X509Certificate* cert,
+                                     const SignedCertificateTimestamp* sct) {
+  auto it = tree_trackers_.find(sct->log_id);
+  // Is the SCT from a known log?

[Ryan Sleevi, 2016/05/09 17:03:49]

Isn't this part of the API contract? That is, that you must only be a
net::ct::CTVerifier::Observer or net::ct::STHObserver for logs registered in the
ctor?

As such, calling it either for 32/33 or for 41/42 should be a DCHECK/CHECK
error, because it means that additional logs are being added that aren't
registered, and that's a programmer error.

[Eran Messeri, 2016/05/10 20:01:10]

Good point, there's a difference between OnSCTVerified and NewSTHObserved:
- Since we don't currently allow modifying the logs list after start-up,
OnSCTVerified should not be called with a log_id that the TreeStateTracker does
not know about.
- However, STHs for unknown logs could be provided by the component updater (for
example, if we start pushing STHs for a new log, but old Chrome builds don't
know about it yet).

I've changed OnSCTVerified to DCHECK that the SCT is from a known log, but not
NewSTHObserved. I've added a TODO for NewSTHObserved to DCHECK as well when the
STHDistributor filters STHs from unknown logs.

+  if (it == tree_trackers_.end())
+    return;
+
+  it->second->OnSCTVerified(cert, sct);
+}
+
+void TreeStateTracker::NewSTHObserved(const SignedTreeHead& sth) {
+  auto it = tree_trackers_.find(sth.log_id);
+  // Is the STH from a known log?
+  if (it == tree_trackers_.end())
+    return;
+
+  it->second->NewSTHObserved(sth);
+}
+
+}  // namespace certificate_transparency