Certificate Transparency: Collect metrics on age of SCT vs STH

components/certificate_transparency/single_tree_tracker.cc

Index: components/certificate_transparency/single_tree_tracker.cc
diff --git a/components/certificate_transparency/single_tree_tracker.cc b/components/certificate_transparency/single_tree_tracker.cc
index 7946208ca753303a7589260e7a60fd34a58bb5e0..7b95611b5081bcef564998376a97001603bc2997 100644
--- a/components/certificate_transparency/single_tree_tracker.cc
+++ b/components/certificate_transparency/single_tree_tracker.cc
@@ -6,12 +6,43 @@
 
 #include <utility>
 
+#include "base/metrics/histogram_macros.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/signed_certificate_timestamp.h"
 #include "net/cert/x509_certificate.h"
 
 using net::ct::SignedTreeHead;
 
+namespace {
+
+enum SCTCanBeCheckedForInclusion {

[Alexei Svitkine (slow), 2016/07/22 13:37:33]

Add a comment not to renumber these since they're used in uma.

[Eran Messeri, 2016/07/25 13:22:52]

Done.

+  VALID_STH_REQUIRED = 0,
+  NEWER_STH_REQUIRED = 1,
+  CAN_BE_CHECKED = 2,

[Ryan Sleevi, 2016/07/22 16:57:30]

Document these. This is the perfect place to capture the subtlety :)

[Eran Messeri, 2016/07/25 13:22:52]

Done.

+  SCT_CAN_BE_CHECKED_MAX
+};
+
+// Measure how often clients encounter very new SCTs, by measuring whether an
+// SCT can be checked for inclusion upon first observation.
+//
+// When an SCT is observed, if the SingleTreeTracker instance has a valid STH
+// and the STH covers the SCT (the timestamp in the SCT is less than MMD +
+// timestamp in the STH), then it can be checked for inclusion.
+// set to true.
+// If the STH does not cover the SCT (the timestamp in the SCT is greater than
+// MMD + timestamp in the STH), then a newer STH is needed.
+//
+// If the SingleTreeTracker does not have a valid STH, then a valid STH is
+// first required to evaluate whether the SCT can be checked for inclusion
+// or not.
+void LogCanBeCheckedForInclusionToUMA(
+    SCTCanBeCheckedForInclusion can_be_checked) {
+  UMA_HISTOGRAM_ENUMERATION("Net.CertificateTransparency.CanInclusionCheckSCT",
+                            can_be_checked, SCT_CAN_BE_CHECKED_MAX);
+}
+
+}  // namespace
+
 namespace certificate_transparency {
 
 SingleTreeTracker::SingleTreeTracker(
@@ -34,15 +65,22 @@ void SingleTreeTracker::OnSCTVerified(
   if (verified_sth_.timestamp.is_null() ||
       (verified_sth_.timestamp <
        (sct->timestamp + base::TimeDelta::FromHours(24)))) {
-    // TODO(eranm): UMA - how often SCTs have to wait for a newer STH for
-    // inclusion check.
     entries_status_.insert(
         std::make_pair(sct->timestamp, SCT_PENDING_NEWER_STH));
+
+    // Do not log histogram if there's no STH for this log yet, as it does

[Ryan Sleevi, 2016/07/22 16:57:30]

Comment needs updating

[Eran Messeri, 2016/07/25 13:22:51]

Done.

+    // not provide any meaningful data on how fresh SCTs usually are.
+    if (!verified_sth_.timestamp.is_null()) {
+      LogCanBeCheckedForInclusionToUMA(NEWER_STH_REQUIRED);
+    } else {
+      LogCanBeCheckedForInclusionToUMA(VALID_STH_REQUIRED);
+    }
+
     return;
   }
 
+  LogCanBeCheckedForInclusionToUMA(CAN_BE_CHECKED);
   // TODO(eranm): Check inclusion here.
-  // TODO(eranm): UMA - how often inclusion can be checked immediately.
   entries_status_.insert(
       std::make_pair(sct->timestamp, SCT_PENDING_INCLUSION_CHECK));
 }