Certificate Transparency: Start tracking logs' state

components/certificate_transparency/tree_state_tracker.cc

Index: components/certificate_transparency/tree_state_tracker.cc
diff --git a/components/certificate_transparency/tree_state_tracker.cc b/components/certificate_transparency/tree_state_tracker.cc
new file mode 100644
index 0000000000000000000000000000000000000000..3405760dabc5e48547bd5d5315cf6fb62d248d62
--- /dev/null
+++ b/components/certificate_transparency/tree_state_tracker.cc
@@ -0,0 +1,48 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/certificate_transparency/tree_state_tracker.h"
+
+#include "components/certificate_transparency/single_tree_tracker.h"
+#include "net/cert/ct_log_verifier.h"
+#include "net/cert/signed_certificate_timestamp.h"
+#include "net/cert/signed_tree_head.h"
+#include "net/cert/x509_certificate.h"
+
+using net::X509Certificate;
+using net::CTLogVerifier;
+using net::ct::SignedCertificateTimestamp;
+using net::ct::SignedTreeHead;
+
+namespace certificate_transparency {
+
+TreeStateTracker::TreeStateTracker(
+    std::vector<scoped_refptr<const CTLogVerifier>> ct_logs) {
+  for (auto& log : ct_logs)

[Ryan Sleevi, 2016/05/18 16:58:19]

const auto&

[Eran Messeri, 2016/05/19 12:35:00]

Done.

+    tree_trackers_[log->key_id()].reset(new SingleTreeTracker(log));
+}
+
+TreeStateTracker::~TreeStateTracker() {}
+
+void TreeStateTracker::OnSCTVerified(X509Certificate* cert,
+                                     const SignedCertificateTimestamp* sct) {
+  auto it = tree_trackers_.find(sct->log_id);
+  // Ensure the SCT is from a known log.
+  CHECK(it != tree_trackers_.end());

[Ryan Sleevi, 2016/05/18 16:58:19]

See remarks in header. Having reviewed this again, the asymmetry is enough that
it's going to continue to bother me as I don't believe it's justified in this
class/headers (but is an implementation detail of how it's used), so I'd rather
soft-fail here and ignore it, for consistency, tighten up the calling code (in
both cases), and then move BOTH of these to stronger guarantees.

[Eran Messeri, 2016/05/19 12:35:00]

Done.

+
+  it->second->OnSCTVerified(cert, sct);
+}
+
+void TreeStateTracker::NewSTHObserved(const SignedTreeHead& sth) {
+  auto it = tree_trackers_.find(sth.log_id);
+  // Is the STH from a known log? Since STHs can be provided from external
+  // sources for logs not yet recognized by this client, return, rather than
+  // DCHECK.
+  if (it == tree_trackers_.end())
+    return;
+
+  it->second->NewSTHObserved(sth);
+}
+
+}  // namespace certificate_transparency