Certificate Transparency: Code for unpacking EV cert hashes whitelist

net/cert/ct_ev_whitelist.h

Index: net/cert/ct_ev_whitelist.h
diff --git a/net/cert/ct_ev_whitelist.h b/net/cert/ct_ev_whitelist.h
new file mode 100644
index 0000000000000000000000000000000000000000..cf1c86c78721cc0312909bff4635595c129e11c1
--- /dev/null
+++ b/net/cert/ct_ev_whitelist.h
@@ -0,0 +1,63 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_CT_EV_WHITELIST_H_
+#define NET_CERT_CT_EV_WHITELIST_H_
+
+#include <set>
+#include <string>
+
+#include "base/files/file_path.h"
+#include "net/base/net_export.h"

[wtc, 2014/08/14 02:04:43]

Nit: Remove this header. Actually, I think we will need it because the
BitStreamReader class needs to be declared with NET_EXPORT_PRIVATE for the unit
tests.

[Eran Messeri, 2014/08/14 11:55:07]

Added NET_EXPORT & NET_EXPORT_PRIVATE where (I think) necessary.

+
+namespace net {
+
+namespace ct {
+
+namespace internal {
+
+class BitStreamReader {

[wtc, 2014/08/14 02:04:43]

Nit: please add a short comment to summarize this class. It may be good to
explain why this class needs to be declared here (so that it can be tested).

[Eran Messeri, 2014/08/14 11:55:07]

Done.

[Eran Messeri, 2014/08/14 11:55:08]

Done.

+ public:
+  BitStreamReader(const char* source, size_t length);
+
+  // Reads unary-encoded number into |out|. Returns true if
+  // there was at least one bit to read, false otherwise.
+  bool ReadUnaryEncoding(uint64* out);
+  // Reads |num_bits| (up to 64) into |out|. Returns true if
+  // the stream had the requested |num_bits|, false otherwise.
+  bool ReadBits(uint8 num_bits, uint64* out);
+  // Returns the number of bits left in the stream.
+  uint64 BitsLeft();

[wtc, 2014/08/14 02:04:43]

Nit: Declare this method as const.

[Eran Messeri, 2014/08/14 11:55:08]

Done.

+
+ private:
+  // Returns true if there are more bits to read in the stream.
+  bool HasMoreBits();
+  // Reads a single bit.
+  uint8 ReadBit();
+
+  const char* source_;
+  const size_t length_;

[wtc, 2014/08/14 02:04:44]

Nit: To match this 'const', the |source_| member should be declared as follows:
  const char* const source_;

[Eran Messeri, 2014/08/14 11:55:07]

Done.

+
+  uint64 curr_byte_;
+  int8 curr_bit_;
+};
+
+bool UncompressEVWhitelist(
+    const std::string& compressed_whitelist,
+    std::set<std::string>* uncompressed_list);
+
+void SetEVWhitelistData(std::set<std::string> ev_whitelist);

[wtc, 2014/08/14 02:04:44]

Nit: Should the input parameter be a const reference?

[Eran Messeri, 2014/08/14 11:55:07]

No, because I'm using set.swap underneath. Will add a comment to clarify this.

+
+}  // namespace internal
+
+

[wtc, 2014/08/14 02:04:43]

Nit: delete a blank line.

[Eran Messeri, 2014/08/14 11:55:08]

Done.

+void SetEVWhitelistFromFile(const base::FilePath& compressed_whitelist_file);
+
+bool IsCertificateHashInWhitelist(const std::string& cert_hash);
+
+}  // namespace ct
+
+}  // namespace net
+
+#endif  // NET_CERT_CT_EV_WHITELIST_H_