Certificate Transparency: Add the high-level interface for verifying SCTs over multiple logs

net/cert/ct_verifier.h

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_CT_VERIFIER_H_
+#define NET_CERT_CT_VERIFIER_H_
+
+#include "net/base/net_export.h"
+
+namespace net {
+
+namespace ct {
+struct CTVerifyResult;
+}  // namespace ct
+
+class X509Certificate;
+
+// High-level interface for verifying Signed Certificate Timestamps

[wtc, 2013/11/21 02:05:02]

Nit: remove "High-level"? unless there is also a low-level interface for
verifying SCTs.

[Eran M. (Google), 2013/11/21 20:06:02]

Done.

+// over a certificate.
+class NET_EXPORT CTVerifier {
+ public:
+  virtual ~CTVerifier() {}
+
+  // Verifies either embedded SCTs or SCTs obtained via TLS handshake/
+  // OCSP stapling on the given |verified_cert|

[wtc, 2013/11/21 02:05:02]

Nit: TLS handshake/OCSP stapling => the signed_certificate_timestamp TLS
extension or OCSP

Update: I see that you already have the enum SCT_FROM_TLS_HANDSHAKE, so you can
ignore this suggested change.

[Eran M. (Google), 2013/11/21 20:06:02]

Changed the comment. Would you like me to change the enum as well?

[wtc, 2013/11/21 23:26:34]

Yes, please. The enum should match the parameter names of this function.

[Eran M. (Google), 2013/11/23 21:02:06]

Done.

+  // |result| will be filled with these SCTs, divided into categories based on
+  // the verification result.
+  virtual int Verify(X509Certificate* verified_cert,

[wtc, 2013/11/21 02:05:02]

Nit: the first parameter should be simply named |cert|.

[Eran M. (Google), 2013/11/21 20:06:02]

Done, in all classes.

+                     const std::string& sct_list_from_ocsp,
+                     const std::string& sct_list_from_tls_handshake,

[wtc, 2013/11/21 02:05:02]

1. Nit: I suggest changing "from_tls_handshake" to "from_tls_extension".

Note that OCSP stapling is also a TLS extension, but in theory we can get the
OCSP response directly using the OCSP protocol.

Update: I see that you already have the enum SCT_FROM_TLS_HANDSHAKE, so you can
ignore this suggested change.

2. Why are these two parameters std::string instead of
std::vector<SignedCertificateTimestamp>?

[Eran M. (Google), 2013/11/21 20:06:02]

1. Changed the name (in all classes), could also change the enum.

2. Because the parsing is done in this verifier - the strings here are the
encoded SignedCertificateTimestampList as defined in section 3.3. of RFC 6962.
That means the changes to the SSLClientSocket class are minimal - simply
extracting these encoded strings from OCSP or TLS extension and passing them
into the verified.

+                     ct::CTVerifyResult* result) = 0;
+
+};
+
+}  // namespace net
+
+#endif  // NET_CERT_CT_VERIFIER_H_