Add Certificate Transparency logs auditing

components/certificate_transparency/single_tree_tracker.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
 #define COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
 
-#include <map>
+#include <set>
 #include <string>
 
 #include "base/memory/ref_counted.h"
 #include "base/time/time.h"
 #include "net/cert/ct_verifier.h"
+#include "net/cert/merkle_tree_leaf.h"
 #include "net/cert/signed_tree_head.h"
 #include "net/cert/sth_observer.h"
 
 namespace net {
 class CTLogVerifier;
 class X509Certificate;
 
 namespace ct {
 struct SignedCertificateTimestamp;
 }  // namespace ct
 
 }  // namespace net
 
 namespace certificate_transparency {
+struct OrderByTimestamp {
+  bool operator()(const net::ct::MerkleTreeLeaf& lhs,
+                  const net::ct::MerkleTreeLeaf& rhs);
+};
 
 // Tracks the state of an individual Certificate Transparency Log's Merkle Tree.
 // A CT Log constantly issues Signed Tree Heads, for which every older STH must
 // be incorporated into the current/newer STH. As new certificates are logged,
 // new SCTs are produced, and eventually, those SCTs are incorporated into the
 // log and a new STH is produced, with there being an inclusion proof between
 // the SCTs and the new STH, and a consistency proof between the old STH and the
 // new STH.
 // This class receives STHs provided by/observed by the embedder, with the
 // assumption that STHs have been checked for consistency already. As SCTs are
@@ skipping 51 matching lines @@
 
   // Returns the status of a given log entry that is assembled from
   // |cert| and |sct|. If |cert| and |sct| were not previously observed,
   // |sct| is not an SCT for |cert| or |sct| is not for this log,
   // SCT_NOT_OBSERVED will be returned.
   SCTInclusionStatus GetLogEntryInclusionStatus(
       net::X509Certificate* cert,
       const net::ct::SignedCertificateTimestamp* sct);
 
  private:
+  // Returns true if |leaf| is pending a newer STH.
+  bool EntryPendingNewSTH(const net::ct::MerkleTreeLeaf& leaf);
+
+  // Returns true if |leaf| is pending inclusion check.
+  bool EntryPendingInclusionProof(const net::ct::MerkleTreeLeaf& leaf);
+
   // Holds the latest STH fetched and verified for this log.
   net::ct::SignedTreeHead verified_sth_;
 
   // The log being tracked.
   scoped_refptr<const net::CTLogVerifier> ct_log_;
 
-  // List of log entries pending inclusion check.
-  // TODO(eranm): Rather than rely on the timestamp, extend to to use the
-  // whole MerkleTreeLeaf (RFC6962, section 3.4.) as a key. See
-  // https://crbug.com/506227#c22 and https://crbug.com/613495
-  std::map<base::Time, SCTInclusionStatus> entries_status_;
+  // Set of log entries pending a fresh STH.
+  std::set<net::ct::MerkleTreeLeaf, OrderByTimestamp> pending_new_sth_;

[Rob Percival, 2016/05/26 17:33:15]

Are you thinking of adding a timestamp to MerkleTreeLeaf for recording the time
of observation (or something like that)? Otherwise, a set might be a bad choice.

[Eran Messeri, 2016/06/30 19:58:28]

I've added another class.

+
+  // Set of log entries pending inclusion check.
+  std::set<net::ct::MerkleTreeLeaf, OrderByTimestamp> pending_inclusion_check_;
 
   DISALLOW_COPY_AND_ASSIGN(SingleTreeTracker);
 };
 
 }  // namespace certificate_transparency
 
 #endif  // COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_