Add Certificate Transparency logs auditing

components/certificate_transparency/single_tree_tracker.h

Index: components/certificate_transparency/single_tree_tracker.h
diff --git a/components/certificate_transparency/single_tree_tracker.h b/components/certificate_transparency/single_tree_tracker.h
index f7afe72c3b449ed80396f12f54744cce005f38cf..89a9a3c9831d6fd19c6d01564ba6f124d1c4d281 100644
--- a/components/certificate_transparency/single_tree_tracker.h
+++ b/components/certificate_transparency/single_tree_tracker.h
@@ -5,11 +5,12 @@
 #ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
 #define COMPONENTS_CERTIFICATE_TRANSPARENCY_SINGLE_TREE_TRACKER_H_
 
-#include <map>
+#include <set>
 #include <string>
 
 #include "base/memory/ref_counted.h"
 #include "base/time/time.h"
+#include "components/certificate_transparency/observed_leaf.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/signed_tree_head.h"
 #include "net/cert/sth_observer.h"
@@ -25,6 +26,11 @@ struct SignedCertificateTimestamp;
 }  // namespace net
 
 namespace certificate_transparency {
+// Orders ObservedLeaf instances by the timestamp of the MerkleTreeLeaf they
+// contain, *not* the observation time.
+struct OrderByTimestamp {
+  bool operator()(const ObservedLeaf& lhs, const ObservedLeaf& rhs);
+};

[Ryan Sleevi, 2016/06/30 22:48:19]

Does not need to be global; should be a private class instance.

[Eran Messeri, 2016/07/01 13:24:01]

Done.

 
 // Tracks the state of an individual Certificate Transparency Log's Merkle Tree.
 // A CT Log constantly issues Signed Tree Heads, for which every older STH must
@@ -96,17 +102,23 @@ class SingleTreeTracker : public net::CTVerifier::Observer,
       const net::ct::SignedCertificateTimestamp* sct);
 
  private:
+  // Returns true if |leaf| is pending a newer STH.

[Ryan Sleevi, 2016/06/30 22:48:19]

From reading this header, it's unclear what this method does.

[Eran Messeri, 2016/07/01 13:24:01]

This method is gone, replaced with LeafAlreadyEncountered.

+  bool EntryPendingNewSTH(const ObservedLeaf& leaf);
+
+  // Returns true if |leaf| is pending inclusion check.

[Ryan Sleevi, 2016/06/30 22:48:19]

Grammatically, this reads weird. It feels like an article is missing (pending an
inclusion check? pending being checked for inclusion?)

[Eran Messeri, 2016/07/01 13:24:00]

This method is gone.

+  bool EntryPendingInclusionProof(const ObservedLeaf& leaf);
+
   // Holds the latest STH fetched and verified for this log.
   net::ct::SignedTreeHead verified_sth_;
 
   // The log being tracked.
   scoped_refptr<const net::CTLogVerifier> ct_log_;
 
-  // List of log entries pending inclusion check.
-  // TODO(eranm): Rather than rely on the timestamp, extend to to use the
-  // whole MerkleTreeLeaf (RFC6962, section 3.4.) as a key. See
-  // https://crbug.com/506227#c22 and https://crbug.com/613495
-  std::map<base::Time, SCTInclusionStatus> entries_status_;
+  // Set of log entries pending a fresh STH.
+  std::set<ObservedLeaf, OrderByTimestamp> pending_new_sth_;
+
+  // Set of log entries pending inclusion check.

[Ryan Sleevi, 2016/06/30 22:48:19]

grammatically, this reads weird. It feels like there is disagreement between the
subject and verb (pending being checked for inclusion? pending inclusion
checks?)

[Eran Messeri, 2016/07/01 13:24:00]

I now use a map of (MerkleTreeLeaf, LeafState), so should be easier to reason
about.

+  std::set<ObservedLeaf, OrderByTimestamp> pending_inclusion_check_;
 
   DISALLOW_COPY_AND_ASSIGN(SingleTreeTracker);
 };