DO NOT REVIEW: CT policy enforcement WIP

net/cert/ct_known_logs.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/ct_known_logs.h"
 
 #include <string.h>
 
 #include <algorithm>
 #include <iterator>
 
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/time/time.h"
 #include "crypto/sha2.h"
 
 #if !defined(OS_NACL)
 #include "net/cert/ct_log_verifier.h"
 #endif
 
 namespace net {
 
 namespace ct {
 
 namespace {
 
 #include "net/cert/ct_known_logs_static.h"
 
 bool CompareLogIDs(const char* log_id, const char* lookup_id) {
   return memcmp(log_id, lookup_id, crypto::kSHA256Length) < 0;
 }
 
+bool CompareDisqualifiedLogID(const DisqualifiedCTLogInfo& disqualified_log,
+                              const char* log_id) {
+  return memcmp(disqualified_log.log_id, log_id, crypto::kSHA256Length) < 0;
+}
+
 }  // namespace
 
 #if !defined(OS_NACL)
 std::vector<scoped_refptr<const CTLogVerifier>>
 CreateLogVerifiersForKnownLogs() {
   std::vector<scoped_refptr<const CTLogVerifier>> verifiers;
+  // Add all qualified logs.
   for (const auto& log : kCTLogList) {
     base::StringPiece key(log.log_key, log.log_key_length);
     verifiers.push_back(CTLogVerifier::Create(key, log.log_name, log.log_url));
     // Make sure no null logs enter verifiers. Parsing of all known logs should
     // succeed.
     CHECK(verifiers.back().get());
   }
 
+  // Add all disqualified logs. Callers are expected to filter via
+  // IsLogQualified().
+  for (const auto& disqualified_log : kDisqualifiedCTLogList) {
+    const CTLogInfo& log = disqualified_log.log_info;
+    base::StringPiece key(log.log_key, log.log_key_length);
+    verifiers.push_back(CTLogVerifier::Create(key, log.log_name, log.log_url));
+    // Make sure no null logs enter verifiers. Parsing of all known logs should
+    // succeed.
+    CHECK(verifiers.back().get());
+  }
+
   return verifiers;
 }
 #endif
 
 bool IsLogOperatedByGoogle(base::StringPiece log_id) {
   CHECK_EQ(log_id.size(), crypto::kSHA256Length);
 
   auto p = std::lower_bound(std::begin(kGoogleLogIDs), std::end(kGoogleLogIDs),
                             log_id.data(), &CompareLogIDs);
   if (p == std::end(kGoogleLogIDs) ||
       memcmp(log_id.data(), *p, crypto::kSHA256Length) != 0) {
     return false;
   }
 
   return true;
 }
 
+bool IsLogDisqualified(base::StringPiece log_id,
+                       base::Time* disqualification_date) {
+  DCHECK_EQ(log_id.size(), arraysize(kDisqualifiedCTLogList[0].log_id) - 1);
+
+  auto p = std::lower_bound(std::begin(kDisqualifiedCTLogList),
+                            std::end(kDisqualifiedCTLogList), log_id.data(),
+                            &CompareDisqualifiedLogID);
+  if (p == std::end(kDisqualifiedCTLogList) ||
+      log_id != base::StringPiece(p->log_id, crypto::kSHA256Length)) {
+    return false;
+  }
+
+  *disqualification_date =
+      base::Time::FromInternalValue(p->disqualification_date);
+  return true;
+}
+
 }  // namespace ct
 
 }  // namespace net