Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/certificate_transparency/single_tree_tracker.h" | 5 #include "components/certificate_transparency/single_tree_tracker.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <iterator> | 8 #include <iterator> |
| 9 #include <list> | 9 #include <list> |
| 10 #include <utility> | 10 #include <utility> |
| 11 | 11 |
| 12 #include "base/bind.h" | 12 #include "base/bind.h" |
| 13 #include "base/metrics/histogram_macros.h" | 13 #include "base/metrics/histogram_macros.h" |
| 14 #include "base/strings/string_number_conversions.h" | 14 #include "base/strings/string_number_conversions.h" |
| 15 #include "base/values.h" | 15 #include "base/values.h" |
| 16 #include "components/certificate_transparency/log_dns_client.h" | 16 #include "components/certificate_transparency/log_dns_client.h" |
| 17 #include "crypto/sha2.h" | 17 #include "crypto/sha2.h" |
| 18 #include "net/base/hash_value.h" | 18 #include "net/base/hash_value.h" |
| 19 #include "net/base/net_errors.h" | 19 #include "net/base/net_errors.h" |
| 20 #include "net/cert/ct_log_verifier.h" | 20 #include "net/cert/ct_log_verifier.h" |
| 21 #include "net/cert/merkle_audit_proof.h" | 21 #include "net/cert/merkle_audit_proof.h" |
| 22 #include "net/cert/merkle_tree_leaf.h" | 22 #include "net/cert/merkle_tree_leaf.h" |
| 23 #include "net/cert/signed_certificate_timestamp.h" | 23 #include "net/cert/signed_certificate_timestamp.h" |
| 24 #include "net/cert/x509_certificate.h" | 24 #include "net/cert/x509_certificate.h" |
| 25 #include "net/log/net_log.h" | 25 #include "net/log/net_log.h" |
| 26 | 26 |
| 27 using net::SHA256HashValue; | 27 using net::SHA256HashValue; |
| 28 using net::ct::LogEntry; | |
| 29 using net::ct::MerkleAuditProof; | 28 using net::ct::MerkleAuditProof; |
| 30 using net::ct::MerkleTreeLeaf; | 29 using net::ct::MerkleTreeLeaf; |
| 31 using net::ct::SignedCertificateTimestamp; | 30 using net::ct::SignedCertificateTimestamp; |
| 32 using net::ct::SignedTreeHead; | 31 using net::ct::SignedTreeHead; |
| 33 | 32 |
| 34 // Overview of the process for auditing CT log entries | 33 // Overview of the process for auditing CT log entries |
| 35 // | 34 // |
| 36 // A CT log entry, represented by net::ct::LogEntry, is made up of the | |
| 37 // end-entity certificate and the Signed Certificate Timestamp associated with | |
| 38 // it. | |
|
mattm
2017/04/21 21:12:15
Feel free to suggest better text to put here too.
| |
| 39 // | |
| 40 // In this file, obsered CT log entries are audited for inclusion in the CT log. | 35 // In this file, obsered CT log entries are audited for inclusion in the CT log. |
| 41 // A pre-requirement for auditing a log entry is having a Signed Tree Head (STH) | 36 // A pre-requirement for auditing a log entry is having a Signed Tree Head (STH) |
| 42 // from that log that is 24 hours (MMD period) after the timestamp in the SCT. | 37 // from that log that is 24 hours (MMD period) after the timestamp in the SCT. |
| 43 // Log entries observed while the client has no STH from that log or an STH that | 38 // Log entries observed while the client has no STH from that log or an STH that |
| 44 // is too old start in the PENDING_NEWER_STH state. | 39 // is too old start in the PENDING_NEWER_STH state. |
| 45 // | 40 // |
| 46 // Once a fresh-enough STH is obtained, all entries that can be audited using | 41 // Once a fresh-enough STH is obtained, all entries that can be audited using |
| 47 // this STH move to the PENDING_INCLUSION_PROOF_REQUEST state. | 42 // this STH move to the PENDING_INCLUSION_PROOF_REQUEST state. |
| 48 // | 43 // |
| 49 // Requests for the entry index and inclusion proof are obtained using a | 44 // Requests for the entry index and inclusion proof are obtained using a |
| (...skipping 460 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 510 bool success) { | 505 bool success) { |
| 511 net::NetLogParametersCallback net_log_callback = | 506 net::NetLogParametersCallback net_log_callback = |
| 512 base::Bind(&NetLogEntryAuditingEventCallback, &entry.leaf_hash, | 507 base::Bind(&NetLogEntryAuditingEventCallback, &entry.leaf_hash, |
| 513 ct_log_->key_id(), success); | 508 ct_log_->key_id(), success); |
| 514 | 509 |
| 515 net_log_.AddEvent(net::NetLogEventType::CT_LOG_ENTRY_AUDITED, | 510 net_log_.AddEvent(net::NetLogEventType::CT_LOG_ENTRY_AUDITED, |
| 516 net_log_callback); | 511 net_log_callback); |
| 517 } | 512 } |
| 518 | 513 |
| 519 } // namespace certificate_transparency | 514 } // namespace certificate_transparency |
| OLD | NEW |