| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_DNS_CLIENT_H_ | 5 #ifndef COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_DNS_CLIENT_H_ |
| 6 #define COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_DNS_CLIENT_H_ | 6 #define COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_DNS_CLIENT_H_ |
| 7 | 7 |
| 8 #include <stdint.h> | 8 #include <stdint.h> |
| 9 | 9 |
| 10 #include <list> | 10 #include <list> |
| (...skipping 16 matching lines...) Expand all Loading... |
| 27 | 27 |
| 28 namespace certificate_transparency { | 28 namespace certificate_transparency { |
| 29 | 29 |
| 30 // Queries Certificate Transparency (CT) log servers via DNS. | 30 // Queries Certificate Transparency (CT) log servers via DNS. |
| 31 // All queries are performed asynchronously. | 31 // All queries are performed asynchronously. |
| 32 // For more information, see | 32 // For more information, see |
| 33 // https://github.com/google/certificate-transparency-rfcs/blob/master/dns/draft
-ct-over-dns.md. | 33 // https://github.com/google/certificate-transparency-rfcs/blob/master/dns/draft
-ct-over-dns.md. |
| 34 // It must be created and deleted on the same thread. It is not thread-safe. | 34 // It must be created and deleted on the same thread. It is not thread-safe. |
| 35 class LogDnsClient : public net::NetworkChangeNotifier::DNSObserver { | 35 class LogDnsClient : public net::NetworkChangeNotifier::DNSObserver { |
| 36 public: | 36 public: |
| 37 // Invoked when a leaf index query completes. | |
| 38 // If an error occured, |net_error| will be a net::Error code, otherwise it | |
| 39 // will be net::OK and |leaf_index| will be the leaf index that was received. | |
| 40 using LeafIndexCallback = | |
| 41 base::Callback<void(int net_error, uint64_t leaf_index)>; | |
| 42 // Invoked when an audit proof query completes. | 37 // Invoked when an audit proof query completes. |
| 43 // If an error occurred, |net_error| will be a net::Error code, otherwise it | 38 // If an error occurred, |net_error| will be a net::Error code, otherwise it |
| 44 // will be net::OK and |proof| will be the audit proof that was received. | 39 // will be net::OK and |proof| will be the audit proof that was received. |
| 45 // The log ID of |proof| will not be set, as that is not known by this class, | 40 // The log ID of |proof| will not be set, as that is not known by this class, |
| 46 // but the leaf index will be set. | 41 // but the leaf index will be set. |
| 47 using AuditProofCallback = | 42 using AuditProofCallback = |
| 48 base::Callback<void(int net_error, | 43 base::Callback<void(int net_error, |
| 49 std::unique_ptr<net::ct::MerkleAuditProof> proof)>; | 44 std::unique_ptr<net::ct::MerkleAuditProof> proof)>; |
| 50 | 45 |
| 51 // Creates a log client that will take ownership of |dns_client| and use it | 46 // Creates a log client that will take ownership of |dns_client| and use it |
| (...skipping 11 matching lines...) Expand all Loading... |
| 63 ~LogDnsClient() override; | 58 ~LogDnsClient() override; |
| 64 | 59 |
| 65 // Called by NetworkChangeNotifier when the DNS config changes. | 60 // Called by NetworkChangeNotifier when the DNS config changes. |
| 66 // The DnsClient's config will be updated in response. | 61 // The DnsClient's config will be updated in response. |
| 67 void OnDNSChanged() override; | 62 void OnDNSChanged() override; |
| 68 | 63 |
| 69 // Called by NetworkChangeNotifier when the DNS config is first read. | 64 // Called by NetworkChangeNotifier when the DNS config is first read. |
| 70 // The DnsClient's config will be updated in response. | 65 // The DnsClient's config will be updated in response. |
| 71 void OnInitialDNSConfigRead() override; | 66 void OnInitialDNSConfigRead() override; |
| 72 | 67 |
| 73 // Queries a CT log to discover the index of the leaf with |leaf_hash|. | 68 // Queries a CT log to retrieve an audit proof for the leaf with |leaf_hash|. |
| 74 // The log is identified by |domain_for_log|, which is the DNS name used as a | 69 // The |leaf_hash| is the SHA-256 Merkle leaf hash (see RFC6962, section 2.1). |
| 75 // suffix for all queries. | |
| 76 // The |leaf_hash| is the SHA-256 hash of a Merkle tree leaf in that log. | |
| 77 // The |callback| is invoked when the query is complete, or an error occurs. | |
| 78 void QueryLeafIndex(base::StringPiece domain_for_log, | |
| 79 base::StringPiece leaf_hash, | |
| 80 const LeafIndexCallback& callback); | |
| 81 | |
| 82 // Queries a CT log to retrieve an audit proof for the leaf at |leaf_index|. | |
| 83 // The size of the CT log tree must be provided in |tree_size|. | 70 // The size of the CT log tree must be provided in |tree_size|. |
| 84 // The log is identified by |domain_for_log|, which is the DNS name used as a | 71 // The log is identified by |domain_for_log|, which is the DNS name used as a |
| 85 // suffix for all queries. | 72 // suffix for all queries. |
| 86 // The |callback| is invoked when the query is complete, or an error occurs. | 73 // The |callback| is invoked when the query is complete, or an error occurs. |
| 87 void QueryAuditProof(base::StringPiece domain_for_log, | 74 void QueryAuditProof(const std::string& domain_for_log, |
| 88 uint64_t leaf_index, | 75 base::StringPiece leaf_hash, |
| 89 uint64_t tree_size, | 76 uint64_t tree_size, |
| 90 const AuditProofCallback& callback); | 77 const AuditProofCallback& callback); |
| 91 | 78 |
| 92 private: | 79 private: |
| 93 void QueryLeafIndexComplete(net::DnsTransaction* transaction, | 80 // An audit proof query that is in progress. |
| 94 int neterror, | 81 class AuditProofQuery; |
| 95 const net::DnsResponse* response); | |
| 96 | 82 |
| 97 // Queries a CT log to retrieve part of an audit |proof|. The |node_index| | 83 // Invoked when an audit proof query completes. |
| 98 // indicates which node of the audit proof/ should be requested. The CT log | 84 // |callback| is the user-provided callback that should be notified. |
| 99 // may return up to 7 nodes, starting from |node_index| (this is the maximum | 85 // |result| is a net::Error indicating success or failure. |
| 100 // that will fit in a DNS UDP packet). The nodes will be appended to | 86 // |query| is the query that has completed. |
| 101 // |proof->nodes|. | 87 // The query is removed from |audit_proof_queries_| by this method. |
| 102 void QueryAuditProofNodes(std::unique_ptr<net::ct::MerkleAuditProof> proof, | 88 void QueryAuditProofComplete(const AuditProofCallback& callback, |
| 103 base::StringPiece domain_for_log, | 89 int result, |
| 104 uint64_t tree_size, | 90 AuditProofQuery* query); |
| 105 uint64_t node_index, | |
| 106 const AuditProofCallback& callback); | |
| 107 | |
| 108 void QueryAuditProofNodesComplete( | |
| 109 std::unique_ptr<net::ct::MerkleAuditProof> proof, | |
| 110 base::StringPiece domain_for_log, | |
| 111 uint64_t tree_size, | |
| 112 net::DnsTransaction* transaction, | |
| 113 int net_error, | |
| 114 const net::DnsResponse* response); | |
| 115 | 91 |
| 116 // Returns true if the maximum number of queries are currently in flight. | 92 // Returns true if the maximum number of queries are currently in flight. |
| 117 // If the maximum number of concurrency queries is set to 0, this will always | 93 // If the maximum number of concurrency queries is set to 0, this will always |
| 118 // return false. | 94 // return false. |
| 119 bool HasMaxConcurrentQueriesInProgress() const; | 95 bool HasMaxConcurrentQueriesInProgress() const; |
| 120 | 96 |
| 121 // Updates the |dns_client_| config using NetworkChangeNotifier. | 97 // Updates the |dns_client_| config using NetworkChangeNotifier. |
| 122 void UpdateDnsConfig(); | 98 void UpdateDnsConfig(); |
| 123 | 99 |
| 124 // A DNS query that is in flight. | |
| 125 template <typename CallbackType> | |
| 126 struct Query { | |
| 127 std::unique_ptr<net::DnsTransaction> transaction; | |
| 128 CallbackType callback; | |
| 129 }; | |
| 130 | |
| 131 // Used to perform DNS queries. | 100 // Used to perform DNS queries. |
| 132 std::unique_ptr<net::DnsClient> dns_client_; | 101 std::unique_ptr<net::DnsClient> dns_client_; |
| 133 // Passed to the DNS client for logging. | 102 // Passed to the DNS client for logging. |
| 134 net::NetLogWithSource net_log_; | 103 net::NetLogWithSource net_log_; |
| 135 // Leaf index queries that haven't completed yet. | |
| 136 std::list<Query<LeafIndexCallback>> leaf_index_queries_; | |
| 137 // Audit proof queries that haven't completed yet. | 104 // Audit proof queries that haven't completed yet. |
| 138 std::list<Query<AuditProofCallback>> audit_proof_queries_; | 105 std::list<std::unique_ptr<AuditProofQuery>> audit_proof_queries_; |
| 139 // The maximum number of queries that can be in flight at one time. | 106 // The maximum number of queries that can be in flight at one time. |
| 140 size_t max_concurrent_queries_; | 107 size_t max_concurrent_queries_; |
| 141 // Creates weak_ptrs to this, for callback purposes. | 108 // Creates weak_ptrs to this, for callback purposes. |
| 142 base::WeakPtrFactory<LogDnsClient> weak_ptr_factory_; | 109 base::WeakPtrFactory<LogDnsClient> weak_ptr_factory_; |
| 143 | 110 |
| 144 DISALLOW_COPY_AND_ASSIGN(LogDnsClient); | 111 DISALLOW_COPY_AND_ASSIGN(LogDnsClient); |
| 145 }; | 112 }; |
| 146 | 113 |
| 147 } // namespace certificate_transparency | 114 } // namespace certificate_transparency |
| 148 #endif // COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_DNS_CLIENT_H_ | 115 #endif // COMPONENTS_CERTIFICATE_TRANSPARENCY_LOG_DNS_CLIENT_H_ |
| OLD | NEW |