Certificate Transparency: Add the high-level interface for verifying SCTs over multiple logs

net/cert/ct_log_verifier.h

Index: net/cert/ct_log_verifier.h
diff --git a/net/cert/ct_log_verifier.h b/net/cert/ct_log_verifier.h
index b4ee52026746809a7c8b0e3657ceae77a1d0f6ad..f31d8141b3a4a2bcf83ea26eacf0eab9c1759f44 100644
--- a/net/cert/ct_log_verifier.h
+++ b/net/cert/ct_log_verifier.h
@@ -27,6 +27,14 @@ namespace net {
 // specific log (whose identity is provided during construction).
 class NET_EXPORT CTLogVerifier {
  public:
+  enum VerifyResult {

[Ryan Sleevi, 2013/11/20 01:09:42]

nit: Do you think the naming will be confusing with the CTVerifier's result
object that stores the result of all SCTs?

On an API level, how do you expect a caller to treat these differently? A
user-visible action? Something that is logged? Just making sure it's an API
distinction that we *need* and can only be accomplished by returning the
different error codes. This isn't an objection, so much as trying to think
whether it just makes more sense to always use a bool and VLOG, or if it's
something that, say, we'd surface to a NetLog or net-internals

[Eran M. (Google), 2013/11/20 19:45:06]

This isn't really necessary anymore now that the MultiLogCTVerifier knows which
log IDs it knows about.

As for the different treatment by the caller - yes, there will be a distinction
in the UI between SCTs from known and unknown logs. I plan to implement a SCT
viewer which will show the exact status for each SCT. We may want to log even
finer details to NetLog or net-internals but I think the basic distinction
between an unverified SCT and an SCT from unknown log is important enough to
remain.

Originally I considered adding a method to CTLogVerifier that will tell, for a
given SCT, if it's from a known log, but that seems superflous as this check is
performed in Verify() anyway.

+    SCT_VERIFIED_OK = 0,
+    SCT_NOT_FROM_THIS_LOG = 1,
+    SCT_ALGORITHM_MISMATCH = 2,
+    SCT_DATA_SERIALIZATION_FAILED = 3,
+    SCT_VERIFICATION_FAILED = 4,
+  };
+
   // Creates a new CTLogVerifier that will verify SignedCertificateTimestamps
   // using |public_key|, which is a DER-encoded SubjectPublicKeyInfo.
   // If |public_key| refers to an unsupported public key, returns NULL.
@@ -43,8 +51,8 @@ class NET_EXPORT CTLogVerifier {
   const std::string& description() const { return description_; }
 
   // Verifies that |sct| contains a valid signature for |entry|.
-  bool Verify(const ct::LogEntry& entry,
-              const ct::SignedCertificateTimestamp& sct);
+  VerifyResult Verify(const ct::LogEntry& entry,
+                      const ct::SignedCertificateTimestamp& sct);
 
  private:
   FRIEND_TEST_ALL_PREFIXES(CTLogVerifierTest, VerifySignature);