Add Certificate Transparency logs auditing

components/certificate_transparency/single_tree_tracker.h

Index: components/certificate_transparency/single_tree_tracker.h
diff --git a/components/certificate_transparency/single_tree_tracker.h b/components/certificate_transparency/single_tree_tracker.h
index f7afe72c3b449ed80396f12f54744cce005f38cf..644c54484777a1a75f5c3329bde4c485dcc523a9 100644
--- a/components/certificate_transparency/single_tree_tracker.h
+++ b/components/certificate_transparency/single_tree_tracker.h
@@ -9,7 +9,6 @@
 #include <string>
 
 #include "base/memory/ref_counted.h"
-#include "base/time/time.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/signed_tree_head.h"
 #include "net/cert/sth_observer.h"
@@ -25,7 +24,6 @@ struct SignedCertificateTimestamp;
 }  // namespace net
 
 namespace certificate_transparency {
-

[Ryan Sleevi, 2016/07/18 23:38:01]

keep this. Consider the examples in
https://google.github.io/styleguide/cppguide.html#Namespaces as equally
normative, and you'll see that the namespaces all have newlines separating,
except for incredibly small forward declarations (e.g. 20/21)

I would even argue that we should have a newline at 16/17

[Eran Messeri, 2016/09/21 21:10:43]

Done - for consistency I've added newlines after each namespace.

 // Tracks the state of an individual Certificate Transparency Log's Merkle Tree.
 // A CT Log constantly issues Signed Tree Heads, for which every older STH must
 // be incorporated into the current/newer STH. As new certificates are logged,
@@ -96,17 +94,25 @@ class SingleTreeTracker : public net::CTVerifier::Observer,
       const net::ct::SignedCertificateTimestamp* sct);
 
  private:
+  struct EntryToAudit;
+
+  // Orders instances by the timestamp of the SCT they contain.
+  struct OrderByTimestamp {
+    bool operator()(const EntryToAudit& lhs, const EntryToAudit& rhs) const;
+  };
+
+  // Returns true if |leaf| has been observed in the past.
+  bool EntryAlreadyEncountered(const EntryToAudit& entry);
+
   // Holds the latest STH fetched and verified for this log.
   net::ct::SignedTreeHead verified_sth_;
 
   // The log being tracked.
   scoped_refptr<const net::CTLogVerifier> ct_log_;
 
-  // List of log entries pending inclusion check.
-  // TODO(eranm): Rather than rely on the timestamp, extend to to use the
-  // whole MerkleTreeLeaf (RFC6962, section 3.4.) as a key. See
-  // https://crbug.com/506227#c22 and https://crbug.com/613495
-  std::map<base::Time, SCTInclusionStatus> entries_status_;
+  // Map of log entries to their state.
+  std::map<EntryToAudit, SCTInclusionStatus, OrderByTimestamp>
+      observed_entries_;
 
   DISALLOW_COPY_AND_ASSIGN(SingleTreeTracker);
 };