Adds a VerifyAuditProof method to CTLogVerifier

net/cert/ct_log_verifier.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CT_LOG_VERIFIER_H_
 #define NET_CERT_CT_LOG_VERIFIER_H_
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/strings/string_piece.h"
 #include "net/base/net_export.h"
 #include "net/cert/signed_certificate_timestamp.h"
 #include "url/gurl.h"
 
 // Forward declare the crypto types to avoid having to include the full
 // headers.
 typedef struct evp_pkey_st EVP_PKEY;
 
 namespace net {
 
 namespace ct {
-
+struct MerkleAuditProof;
+struct MerkleConsistencyProof;
 struct SignedTreeHead;
-struct MerkleConsistencyProof;
-
 }  // namespace ct
 
 // Class for verifying signatures of a single Certificate Transparency
 // log, whose identity is provided during construction.
 // Currently can verify Signed Certificate Timestamp (SCT) and Signed
 // Tree Head (STH) signatures.
 // Immutable: Does not hold any state beyond the log information it was
 // initialized with.
 class NET_EXPORT CTLogVerifier
     : public base::RefCountedThreadSafe<CTLogVerifier> {
@@ skipping 31 matching lines @@
   bool VerifySignedTreeHead(const ct::SignedTreeHead& signed_tree_head) const;
 
   // Verifies that |proof| is a valid consistency proof (RFC 6962, Section
   // 2.1.2) for this log, and which proves that |old_tree_hash| has
   // been fully incorporated into the Merkle tree represented by
   // |new_tree_hash|.
   bool VerifyConsistencyProof(const ct::MerkleConsistencyProof& proof,
                               const std::string& old_tree_hash,
                               const std::string& new_tree_hash) const;
 
+  // Verifies that |proof| is a valid audit proof (RFC 6962, Section 2.1.1) for
+  // this log, and which proves that the certificate represented by |leaf_hash|
+  // has been incorporated into the Merkle tree represented by |root_hash|.
+  // Returns true if verification succeeds, false otherwise.
+  bool VerifyAuditProof(const ct::MerkleAuditProof& proof,
+                        const std::string& root_hash,
+                        const std::string& leaf_hash) const;
+
  private:
   FRIEND_TEST_ALL_PREFIXES(CTLogVerifierTest, VerifySignature);
   friend class base::RefCountedThreadSafe<CTLogVerifier>;
 
   CTLogVerifier(const base::StringPiece& description,
                 const GURL& url,
                 const base::StringPiece& dns_domain);
   ~CTLogVerifier();
 
   // Performs crypto-library specific initialization.
@@ skipping 15 matching lines @@
   std::string dns_domain_;
   ct::DigitallySigned::HashAlgorithm hash_algorithm_;
   ct::DigitallySigned::SignatureAlgorithm signature_algorithm_;
 
   EVP_PKEY* public_key_;
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CT_LOG_VERIFIER_H_