{"action":"created","comment":{"url":"https://api.github.com/repos/google/certificate-transparency/pulls/comments/36074235","id":36074235,"diff_hunk":"@@ -546,12 +588,311 @@ Cert::Status Cert::ExtensionStructure(int extension_nid,\n       LOG(WARNING) << \"Corrupt extension data\";\n       LOG_OPENSSL_ERRORS(WARNING);\n     }\n+\n     return FALSE;\n   }\n \n   return TRUE;\n }\n \n+bool IsRedactedHost(const string& hostname) {\n+  // Split the hostname on '.' characters\n+  const vector<string> tokens(util::split(hostname, '.'));\n+\n+  for (const string& str : tokens) {\n+    if (str == \"?\") {\n+      return true;\n+    }\n+  }\n+\n+  return false;\n+}\n+\n+bool IsValidRedactedHost(const string& hostname) {\n+  // Split the hostname on '.' characters\n+  const vector<string> tokens(util::split(hostname, '.'));\n+\n+  // Enforces the following rules: '?' must be to left of non redactions\n+  // If first label is '*' then treat it as if it was a redaction\n+  bool can_redact = true;\n+  for (int pos = 0; pos < tokens.size(); ++pos) {\n+    if (tokens[pos] == \"?\") {\n+      if (!can_redact) {\n+        return false;\n+      }\n+    } else {\n+      // Allow a leading '*' for redaction but once we've seen anything else\n+      // forbid further redactions\n+      if (tokens[pos] != \"*\") {\n+        can_redact = false;\n+      } else if (pos > 0) {\n+        // '*' is only valid at the left\n+        return false;\n+      }\n+    }\n+  }\n+\n+  return true;\n+}\n+\n+Cert::Status Cert::IsValidWildcardRedaction() const {\n+  if (!IsLoaded()) {\n+    LOG(ERROR) << \"Cert not loaded\";\n+    return Cert::ERROR;\n+  }\n+\n+  string common_name;\n+  vector<string> dns_alt_names;\n+  int redacted_name_count = 0;\n+\n+  // First. Check all the Subject Alt Name extension records. Any that are of\n+  // type DNS must pass validation if they are attempting to redact labels\n+  STACK_OF(GENERAL_NAME)* subject_alt_names = (STACK_OF(GENERAL_NAME)*)","path":"cpp/log/cert.cc","position":193,"original_position":193,"commit_id":"197c9f9bdeb3f76f2a3c8b5c218456729cad9b4d","original_commit_id":"197c9f9bdeb3f76f2a3c8b5c218456729cad9b4d","user":{"login":"Martin2112","id":13366863,"avatar_url":"https://avatars.githubusercontent.com/u/13366863?v=3","gravatar_id":"","url":"https://api.github.com/users/Martin2112","html_url":"https://github.com/Martin2112","followers_url":"https://api.github.com/users/Martin2112/followers","following_url":"https://api.github.com/users/Martin2112/following{/other_user}","gists_url":"https://api.github.com/users/Martin2112/gists{/gist_id}","starred_url":"https://api.github.com/users/Martin2112/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Martin2112/subscriptions","organizations_url":"https://api.github.com/users/Martin2112/orgs","repos_url":"https://api.github.com/users/Martin2112/repos","events_url":"https://api.github.com/users/Martin2112/events{/privacy}","received_events_url":"https://api.github.com/users/Martin2112/received_events","type":"User","site_admin":false},"body":"Not sure what the magic incantation for this would be? The free functions for these objects are macro expansions, which I don't think helps.","created_at":"2015-08-03T10:49:20Z","updated_at":"2015-08-03T10:49:20Z","html_url":"https://github.com/google/certificate-transparency/pull/859#discussion_r36074235","pull_request_url":"https://api.github.com/repos/google/certificate-transparency/pulls/859","_links":{"self":{"href":"https://api.github.com/repos/google/certificate-transparency/pulls/comments/36074235"},"html":{"href":"https://github.com/google/certificate-transparency/pull/859#discussion_r36074235"},"pull_request":{"href":"https://api.github.com/repos/google/certificate-transparency/pulls/859"}}},"pull_request":{"url":"https://api.github.com/repos/google/certificate-transparency/pulls/859","id":41323233,"html_url":"https://github.com/google/certificate-transparency/pull/859","diff_url":"https://github.com/google/certificate-transparency/pull/859.diff","patch_url":"https://github.com/google/certificate-transparency/pull/859.patch","issue_url":"https://api.github.com/repos/google/certificate-transparency/issues/859","number":859,"state":"open","locked":false,"title":"Add Draft RFC extension validation logic to Cert class","user":{"login":"Martin2112","id":13366863,"avatar_url":"https://avatars.githubusercontent.com/u/13366863?v=3","gravatar_id":"","url":"https://api.github.com/users/Martin2112","html_url":"https://github.com/Martin2112","followers_url":"https://api.github.com/users/Martin2112/followers","following_url":"https://api.github.com/users/Martin2112/following{/other_user}","gists_url":"https://api.github.com/users/Martin2112/gists{/gist_id}","starred_url":"https://api.github.com/users/Martin2112/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Martin2112/subscriptions","organizations_url":"https://api.github.com/users/Martin2112/orgs","repos_url":"https://api.github.com/users/Martin2112/repos","events_url":"https://api.github.com/users/Martin2112/events{/privacy}","received_events_url":"https://api.github.com/users/Martin2112/received_events","type":"User","site_admin":false},"body":"Starting work to implement the draft RFC features. Adds new extensions and\r\nvalidation logic to Cert class to check compliance with RFC sections\r\n2.3.3 and 2.3.4. Adds various test cases and the script that generates the\r\ntest certs.","created_at":"2015-07-31T09:42:53Z","updated_at":"2015-08-03T10:49:20Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5c67c71c02e6c9292df5470bf202fc504512d10c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/google/certificate-transparency/pulls/859/commits","review_comments_url":"https://api.github.com/repos/google/certificate-transparency/pulls/859/comments","review_comment_url":"https://api.github.com/repos/google/certificate-transparency/pulls/comments{/number}","comments_url":"https://api.github.com/repos/google/certificate-transparency/issues/859/comments","statuses_url":"https://api.github.com/repos/google/certificate-transparency/statuses/197c9f9bdeb3f76f2a3c8b5c218456729cad9b4d","head":{"label":"Martin2112:master","ref":"master","sha":"197c9f9bdeb3f76f2a3c8b5c218456729cad9b4d","user":{"login":"Martin2112","id":13366863,"avatar_url":"https://avatars.githubusercontent.com/u/13366863?v=3","gravatar_id":"","url":"https://api.github.com/users/Martin2112","html_url":"https://github.com/Martin2112","followers_url":"https://api.github.com/users/Martin2112/followers","following_url":"https://api.github.com/users/Martin2112/following{/other_user}","gists_url":"https://api.github.com/users/Martin2112/gists{/gist_id}","starred_url":"https://api.github.com/users/Martin2112/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Martin2112/subscriptions","organizations_url":"https://api.github.com/users/Martin2112/orgs","repos_url":"https://api.github.com/users/Martin2112/repos","events_url":"https://api.github.com/users/Martin2112/events{/privacy}","received_events_url":"https://api.github.com/users/Martin2112/received_events","type":"User","site_admin":false},"repo":{"id":39995539,"name":"certificate-transparency","full_name":"Martin2112/certificate-transparency","owner":{"login":"Martin2112","id":13366863,"avatar_url":"https://avatars.githubusercontent.com/u/13366863?v=3","gravatar_id":"","url":"https://api.github.com/users/Martin2112","html_url":"https://github.com/Martin2112","followers_url":"https://api.github.com/users/Martin2112/followers","following_url":"https://api.github.com/users/Martin2112/following{/other_user}","gists_url":"https://api.github.com/users/Martin2112/gists{/gist_id}","starred_url":"https://api.github.com/users/Martin2112/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Martin2112/subscriptions","organizations_url":"https://api.github.com/users/Martin2112/orgs","repos_url":"https://api.github.com/users/Martin2112/repos","events_url":"https://api.github.com/users/Martin2112/events{/privacy}","received_events_url":"https://api.github.com/users/Martin2112/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Martin2112/certificate-transparency","description":"Auditing for TLS certificates.","fork":true,"url":"https://api.github.com/repos/Martin2112/certificate-transparency","forks_url":"https://api.github.com/repos/Martin2112/certificate-transparency/forks","keys_url":"https://api.github.com/repos/Martin2112/certificate-transparency/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Martin2112/certificate-transparency/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Martin2112/certificate-transparency/teams","hooks_url":"https://api.github.com/repos/Martin2112/certificate-transparency/hooks","issue_events_url":"https://api.github.com/repos/Martin2112/certificate-transparency/issues/events{/number}","events_url":"https://api.github.com/repos/Martin2112/certificate-transparency/events","assignees_url":"https://api.github.com/repos/Martin2112/certificate-transparency/assignees{/user}","branches_url":"https://api.github.com/repos/Martin2112/certificate-transparency/branches{/branch}","tags_url":"https://api.github.com/repos/Martin2112/certificate-transparency/tags","blobs_url":"https://api.github.com/repos/Martin2112/certificate-transparency/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Martin2112/certificate-transparency/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Martin2112/certificate-transparency/git/refs{/sha}","trees_url":"https://api.github.com/repos/Martin2112/certificate-transparency/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Martin2112/certificate-transparency/statuses/{sha}","languages_url":"https://api.github.com/repos/Martin2112/certificate-transparency/languages","stargazers_url":"https://api.github.com/repos/Martin2112/certificate-transparency/stargazers","contributors_url":"https://api.github.com/repos/Martin2112/certificate-transparency/contributors","subscribers_url":"https://api.github.com/repos/Martin2112/certificate-transparency/subscribers","subscription_url":"https://api.github.com/repos/Martin2112/certificate-transparency/subscription","commits_url":"https://api.github.com/repos/Martin2112/certificate-transparency/commits{/sha}","git_commits_url":"https://api.github.com/repos/Martin2112/certificate-transparency/git/commits{/sha}","comments_url":"https://api.github.com/repos/Martin2112/certificate-transparency/comments{/number}","issue_comment_url":"https://api.github.com/repos/Martin2112/certificate-transparency/issues/comments{/number}","contents_url":"https://api.github.com/repos/Martin2112/certificate-transparency/contents/{+path}","compare_url":"https://api.github.com/repos/Martin2112/certificate-transparency/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Martin2112/certificate-transparency/merges","archive_url":"https://api.github.com/repos/Martin2112/certificate-transparency/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Martin2112/certificate-transparency/downloads","issues_url":"https://api.github.com/repos/Martin2112/certificate-transparency/issues{/number}","pulls_url":"https://api.github.com/repos/Martin2112/certificate-transparency/pulls{/number}","milestones_url":"https://api.github.com/repos/Martin2112/certificate-transparency/milestones{/number}","notifications_url":"https://api.github.com/repos/Martin2112/certificate-transparency/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Martin2112/certificate-transparency/labels{/name}","releases_url":"https://api.github.com/repos/Martin2112/certificate-transparency/releases{/id}","created_at":"2015-07-31T08:37:21Z","updated_at":"2015-07-31T08:37:23Z","pushed_at":"2015-07-31T14:43:52Z","git_url":"git://github.com/Martin2112/certificate-transparency.git","ssh_url":"git@github.com:Martin2112/certificate-transparency.git","clone_url":"https://github.com/Martin2112/certificate-transparency.git","svn_url":"https://github.com/Martin2112/certificate-transparency","homepage":"http://www.certificate-transparency.org/","size":24451,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"google:master","ref":"master","sha":"128b4aa41abe8269906d4d3159f54af51eeb9b10","user":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"repo":{"id":19989605,"name":"certificate-transparency","full_name":"google/certificate-transparency","owner":{"login":"google","id":1342004,"avatar_url":"https://avatars.githubusercontent.com/u/1342004?v=3","gravatar_id":"","url":"https://api.github.com/users/google","html_url":"https://github.com/google","followers_url":"https://api.github.com/users/google/followers","following_url":"https://api.github.com/users/google/following{/other_user}","gists_url":"https://api.github.com/users/google/gists{/gist_id}","starred_url":"https://api.github.com/users/google/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/google/subscriptions","organizations_url":"https://api.github.com/users/google/orgs","repos_url":"https://api.github.com/users/google/repos","events_url":"https://api.github.com/users/google/events{/privacy}","received_events_url":"https://api.github.com/users/google/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/google/certificate-transparency","description":"Auditing for TLS certificates.","fork":false,"url":"https://api.github.com/repos/google/certificate-transparency","forks_url":"https://api.github.com/repos/google/certificate-transparency/forks","keys_url":"https://api.github.com/repos/google/certificate-transparency/keys{/key_id}","collaborators_url":"https://api.github.com/repos/google/certificate-transparency/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/google/certificate-transparency/teams","hooks_url":"https://api.github.com/repos/google/certificate-transparency/hooks","issue_events_url":"https://api.github.com/repos/google/certificate-transparency/issues/events{/number}","events_url":"https://api.github.com/repos/google/certificate-transparency/events","assignees_url":"https://api.github.com/repos/google/certificate-transparency/assignees{/user}","branches_url":"https://api.github.com/repos/google/certificate-transparency/branches{/branch}","tags_url":"https://api.github.com/repos/google/certificate-transparency/tags","blobs_url":"https://api.github.com/repos/google/certificate-transparency/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/google/certificate-transparency/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/google/certificate-transparency/git/refs{/sha}","trees_url":"https://api.github.com/repos/google/certificate-transparency/git/trees{/sha}","statuses_url":"https://api.github.com/repos/google/certificate-transparency/statuses/{sha}","languages_url":"https://api.github.com/repos/google/certificate-transparency/languages","stargazers_url":"https://api.github.com/repos/google/certificate-transparency/stargazers","contributors_url":"https://api.github.com/repos/google/certificate-transparency/contributors","subscribers_url":"https://api.github.com/repos/google/certificate-transparency/subscribers","subscription_url":"https://api.github.com/repos/google/certificate-transparency/subscription","commits_url":"https://api.github.com/repos/google/certificate-transparency/commits{/sha}","git_commits_url":"https://api.github.com/repos/google/certificate-transparency/git/commits{/sha}","comments_url":"https://api.github.com/repos/google/certificate-transparency/comments{/number}","issue_comment_url":"https://api.github.com/repos/google/certificate-transparency/issues/comments{/number}","contents_url":"https://api.github.com/repos/google/certificate-transparency/contents/{+path}","compare_url":"https://api.github.com/repos/google/certificate-transparency/compare/{base}...{head}","merges_url":"https://api.github.com/repos/google/certificate-transparency/merges","archive_url":"https://api.github.com/repos/google/certificate-transparency/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/google/certificate-transparency/downloads","issues_url":"https://api.github.com/repos/google/certificate-transparency/issues{/number}","pulls_url":"https://api.github.com/repos/google/certificate-transparency/pulls{/number}","milestones_url":"https://api.github.com/repos/google/certificate-transparency/milestones{/number}","notifications_url":"https://api.github.com/repos/google/certificate-transparency/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/google/certificate-transparency/labels{/name}","releases_url":"https://api.github.com/repos/google/certificate-transparency/releases{/id}","created_at":"2014-05-20T17:03:47Z","updated_at":"2015-08-03T09:27:54Z","pushed_at":"2015-08-01T00:28:02Z","git_url":"git://github.com/google/certificate-transparency.git","ssh_url":"git@github.com:google/certificate-transparency.git","clone_url":"https://github.com/google/certificate-transparency.git","svn_url":"https://github.com/google/certificate-transparency","homepage":"http://www.certificate-transparency.org/","size":24451,"stargazers_count":147,"watchers_count":147,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":51,"mirror_url":null,"open_issues_count":47,"forks":51,"open_issues":47,"watchers":147,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/google/certificate-transparency/pulls/859"},"html":{"href":"https://github.com/google/certificate-transparency/pull/859"},"issue":{"href":"https://api.github.com/repos/google/certificate-transparency/issues/859"},"comments":{"href":"https://api.github.com/repos/google/certificate-transparency/issues/859/comments"},"review_comments":{"href":"https://api.github.com/repos/google/certificate-transparency/pulls/859/comments"},"review_comment":{"href":"https://api.github.com/repos/google/certificate-transparency/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/google/certificate-transparency/pulls/859/commits"},"statuses":{"href":"https://api.github.com/repos/google/certificate-transparency/statuses/197c9f9bdeb3f76f2a3c8b5c218456729cad9b4d"}}}}