Certificate Transparency: Parse Signed Tree Heads and validate them

net/cert/ct_log_verifier.cc

Index: net/cert/ct_log_verifier.cc
diff --git a/net/cert/ct_log_verifier.cc b/net/cert/ct_log_verifier.cc
index 1c9374dfd941baf7bcff7bad5cfa8fbda633f788..d21999a50991cac780e86648c633c263fdb2e58f 100644
--- a/net/cert/ct_log_verifier.cc
+++ b/net/cert/ct_log_verifier.cc
@@ -6,6 +6,7 @@
 
 #include "base/logging.h"
 #include "net/cert/ct_serialization.h"
+#include "net/cert/signed_tree_head.h"
 
 namespace net {
 
@@ -26,15 +27,7 @@ bool CTLogVerifier::Verify(const ct::LogEntry& entry,
     return false;
   }
 
-  if (sct.signature.hash_algorithm != hash_algorithm_) {
-    DVLOG(1) << "Mismatched hash algorithm. Expected " << hash_algorithm_
-             << ", got " << sct.signature.hash_algorithm << ".";
-    return false;
-  }
-
-  if (sct.signature.signature_algorithm != signature_algorithm_) {
-    DVLOG(1) << "Mismatched sig algorithm. Expected " << signature_algorithm_
-             << ", got " << sct.signature.signature_algorithm << ".";
+  if (!SignatureParametersMatch(sct.signature)) {
     return false;
   }
 
@@ -53,4 +46,35 @@ bool CTLogVerifier::Verify(const ct::LogEntry& entry,
   return VerifySignature(serialized_data, sct.signature.signature_data);
 }
 
+bool CTLogVerifier::SetSignedTreeHead(scoped_ptr<ct::SignedTreeHead> sth) {
+  if (!SignatureParametersMatch(sth->signature)) {
+    return false;
+  }

[Ryan Sleevi, 2014/04/09 18:23:11]

nit: no braces here (or on 30/32), consistent with the existing code (eg: 18/19)

[Eran Messeri, 2014/04/10 21:08:29]

Done.

+
+  std::string serialized_data;
+  ct::EncodeTreeHeadSignature(*sth.get(), &serialized_data);
+  if (VerifySignature(serialized_data, sth->signature.signature_data)) {
+    sth_.reset(sth.release());
+    return true;
+  }
+  return false;
+}
+
+bool CTLogVerifier::SignatureParametersMatch(
+    const ct::DigitallySigned& signature) {
+  if (signature.hash_algorithm != hash_algorithm_) {
+    DVLOG(1) << "Mismatched hash algorithm. Expected " << hash_algorithm_
+             << ", got " << signature.hash_algorithm << ".";
+    return false;
+  }
+
+  if (signature.signature_algorithm != signature_algorithm_) {
+    DVLOG(1) << "Mismatched sig algorithm. Expected " << signature_algorithm_
+             << ", got " << signature.signature_algorithm << ".";
+    return false;
+  }
+
+  return true;
+}
+
 }  // namespace net