Certificate Transparency: Parse Signed Tree Heads and validate them

net/cert/ct_serialization.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CT_SERIALIZATION_H_
 #define NET_CERT_CT_SERIALIZATION_H_
 
 #include <string>
 #include <vector>
 
 #include "base/strings/string_piece.h"
 #include "net/base/net_export.h"
 #include "net/cert/signed_certificate_timestamp.h"
+#include "net/cert/signed_tree_head.h"
 
 namespace net {
 
 // Utility functions for encoding/decoding structures used by Certificate
 // Transparency to/from the TLS wire format encoding.
 namespace ct {
 
 // If |input.signature_data| is less than kMaxSignatureLength, encodes the
 // |input| to |output| and returns true. Otherwise, returns false.
 NET_EXPORT_PRIVATE bool EncodeDigitallySigned(const DigitallySigned& input,
@@ skipping 17 matching lines @@
 // |serialized_log_entry| the log entry signed by the SCT.
 // |extensions| CT extensions.
 // Returns true if the extensions' length does not exceed
 // kMaxExtensionsLength, false otherwise.
 NET_EXPORT_PRIVATE bool EncodeV1SCTSignedData(
     const base::Time& timestamp,
     const std::string& serialized_log_entry,
     const std::string& extensions,
     std::string* output);
 
+// Encodes the data signed by a Signed Tree Head (STH) |sth| into |output|.
+// The signature included in the |sth| can then be verified over these bytes.
+NET_EXPORT_PRIVATE void EncodeTreeHeadSignature(const SignedTreeHead& sth,

[Ryan Sleevi, 2014/04/25 23:33:19]

s/sth/signed_tree_head/

or just tree_head (which would imply updating all the other locations). Just
eschew abbreviating CT types.

[Eran Messeri, 2014/04/29 15:22:24]

Done - changed sth to signed_tree_head.

+                                                std::string* output);
+
 // Decode a list of Signed Certificate Timestamps
 // (SignedCertificateTimestampList as defined in RFC6962): from a single
 // string in |input| to a vector of individually-encoded SCTs |output|.
 // This list is typically obtained from the CT extension in a certificate.
 // Returns true if the list could be read and decoded successfully, false
 // otherwise (note that the validity of each individual SCT should be checked
 // separately).
 NET_EXPORT_PRIVATE bool DecodeSCTList(base::StringPiece* input,
                                       std::vector<base::StringPiece>* output);
 
 // Decodes a single SCT from |input| to |output|.
 // Returns true if all fields in the SCT could be read and decoded, false
 // otherwise.
 NET_EXPORT_PRIVATE bool DecodeSignedCertificateTimestamp(
     base::StringPiece* input,
     scoped_refptr<ct::SignedCertificateTimestamp>* output);
 
 // Writes an SCTList into |output|, containing a single |sct|.
 NET_EXPORT_PRIVATE bool EncodeSCTListForTesting(const base::StringPiece& sct,
                                                 std::string* output);
 }  // namespace ct
 
 }  // namespace net
 
 #endif  // NET_CERT_CT_SERIALIZATION_H_