DO NOT REVIEW: CT policy enforcement WIP

net/cert/ct_known_logs.cc

Index: net/cert/ct_known_logs.cc
diff --git a/net/cert/ct_known_logs.cc b/net/cert/ct_known_logs.cc
index a6f2717fe7c220b0f594fc8cc4aecbe686882e16..f6c62d1a1e72db78f3a1dfa0ed91c723cfc9a857 100644
--- a/net/cert/ct_known_logs.cc
+++ b/net/cert/ct_known_logs.cc
@@ -11,6 +11,7 @@
 
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/time/time.h"
 #include "crypto/sha2.h"
 
 #if !defined(OS_NACL)
@@ -29,12 +30,18 @@ bool CompareLogIDs(const char* log_id, const char* lookup_id) {
   return memcmp(log_id, lookup_id, crypto::kSHA256Length) < 0;
 }
 
+bool CompareDisqualifiedLogID(const DisqualifiedCTLogInfo& disqualified_log,
+                              const char* log_id) {
+  return memcmp(disqualified_log.log_id, log_id, crypto::kSHA256Length) < 0;
+}
+
 }  // namespace
 
 #if !defined(OS_NACL)
 std::vector<scoped_refptr<const CTLogVerifier>>
 CreateLogVerifiersForKnownLogs() {
   std::vector<scoped_refptr<const CTLogVerifier>> verifiers;
+  // Add all qualified logs.
   for (const auto& log : kCTLogList) {
     base::StringPiece key(log.log_key, log.log_key_length);
     verifiers.push_back(CTLogVerifier::Create(key, log.log_name, log.log_url));
@@ -43,6 +50,17 @@ CreateLogVerifiersForKnownLogs() {
     CHECK(verifiers.back().get());
   }
 
+  // Add all disqualified logs. Callers are expected to filter via
+  // IsLogQualified().
+  for (const auto& disqualified_log : kDisqualifiedCTLogList) {
+    const CTLogInfo& log = disqualified_log.log_info;
+    base::StringPiece key(log.log_key, log.log_key_length);
+    verifiers.push_back(CTLogVerifier::Create(key, log.log_name, log.log_url));
+    // Make sure no null logs enter verifiers. Parsing of all known logs should
+    // succeed.
+    CHECK(verifiers.back().get());
+  }
+
   return verifiers;
 }
 #endif
@@ -60,6 +78,23 @@ bool IsLogOperatedByGoogle(base::StringPiece log_id) {
   return true;
 }
 
+bool IsLogDisqualified(base::StringPiece log_id,
+                       base::Time* disqualification_date) {
+  DCHECK_EQ(log_id.size(), arraysize(kDisqualifiedCTLogList[0].log_id) - 1);
+
+  auto p = std::lower_bound(std::begin(kDisqualifiedCTLogList),
+                            std::end(kDisqualifiedCTLogList), log_id.data(),
+                            &CompareDisqualifiedLogID);
+  if (p == std::end(kDisqualifiedCTLogList) ||
+      log_id != base::StringPiece(p->log_id, crypto::kSHA256Length)) {
+    return false;
+  }
+
+  *disqualification_date =
+      base::Time::FromInternalValue(p->disqualification_date);
+  return true;
+}
+
 }  // namespace ct
 
 }  // namespace net