Certificate Transparency: Start tracking logs' state

components/certificate_transparency/tree_state_tracker.h

Index: components/certificate_transparency/tree_state_tracker.h
diff --git a/components/certificate_transparency/tree_state_tracker.h b/components/certificate_transparency/tree_state_tracker.h
new file mode 100644
index 0000000000000000000000000000000000000000..774d00cf97d4382699fb9014daf79b66f1640311
--- /dev/null
+++ b/components/certificate_transparency/tree_state_tracker.h
@@ -0,0 +1,71 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_TREE_STATE_TRACKER_H_
+#define COMPONENTS_CERTIFICATE_TRANSPARENCY_TREE_STATE_TRACKER_H_
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "base/memory/ref_counted.h"
+#include "net/cert/ct_verifier.h"
+#include "net/cert/sth_observer.h"
+
+namespace net {
+class CTLogVerifier;
+class X509Certificate;
+
+namespace ct {
+struct SignedCertificateTimestamp;
+struct SignedTreeHead;
+}  // namespace ct
+
+}  // namespace net
+
+namespace certificate_transparency {
+class SingleTreeTracker;
+
+// Starting point for handling observed Certificate Transparency data in
+// a particular browsing session.

[Ryan Sleevi, 2016/05/19 17:20:57]

This comment should be deleted. It's documenting how it's used (by something
above it) - not what it does.

[Eran Messeri, 2016/05/20 08:47:27]

Done.

+// This class receives notifications of new Signed Tree Heads (STHs) and
+// verified Signed Certificate Timestamps (SCTs) and delegates them to
+// the SingleTreeTracker tracking the CT log they relate to.
+// TODO(eranm): Export the inclusion check status of SCTs+Certs so it can
+// be used in the DevTools Security panel, for example - crbug.com/506227

[Ryan Sleevi, 2016/05/19 17:20:57]

Same remarks about
https://codereview.chromium.org/1845113003/diff/380001/components/certificate...
(and https)

[Eran Messeri, 2016/05/20 08:47:27]

Done (linked to comment 22 via https).

+class TreeStateTracker : public net::CTVerifier::Observer,
+                         public net::ct::STHObserver {
+ public:
+  // Tracks the state of the logs provided in |ct_logs|. An instance of this
+  // class only tracks the logs provided in the constructor. The implementation
+  // is based on the assumption that the list of recognized logs does not change
+  // during the object's life time.
+  // Observed STHs from logs not in this list will be simply ignored.
+  // As the assumption is that all recognized logs are known during creation
+  // time, there's a CHECK in OnSCTVerified that the verified SCT is from
+  // one of the logs in the list provided during construction.

[Ryan Sleevi, 2016/05/19 17:20:57]

You changed the implementation, but didn't update the comment here (which can be
removed for 46-48)

[Eran Messeri, 2016/05/20 08:47:27]

Done.

+  explicit TreeStateTracker(
+      std::vector<scoped_refptr<const net::CTLogVerifier>> ct_logs);
+  ~TreeStateTracker() override;
+
+  // net::ct::CTVerifier::Observer implementation.
+  // Delegates to the tree tracker corresponding to the log that issued the SCT.
+  void OnSCTVerified(net::X509Certificate* cert,
+                     const net::ct::SignedCertificateTimestamp* sct) override;
+
+  // net::ct::STHObserver implementation.
+  // Delegates to the tree tracker corresponding to the log that issued the STH.
+  void NewSTHObserved(const net::ct::SignedTreeHead& sth) override;
+
+ private:
+  // Holds the SingleTreeTracker for each log
+  std::map<std::string, std::unique_ptr<SingleTreeTracker>> tree_trackers_;
+
+  DISALLOW_COPY_AND_ASSIGN(TreeStateTracker);
+};
+
+}  // namespace certificate_transparency
+
+#endif  // COMPONENTS_CERTIFICATE_TRANSPARENCY_TREE_STATE_TRACKER_H_