hammer.go

// Copyright 2024 The Tessera authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// hammer is a tool to load test a Static CT API log.
package main

import (
	"bytes"
	"context"
	"crypto"
	"crypto/ecdh"
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/tls"
	"crypto/x509"
	"encoding/base64"
	"encoding/json"
	"encoding/pem"
	"errors"
	"flag"
	"fmt"
	"io"
	"log/slog"
	"math/rand/v2"
	"net"
	"net/http"
	"net/http/httptrace"
	"net/url"
	"os"
	"strconv"
	"strings"
	"sync"
	"time"

	tdnote "github.com/transparency-dev/formats/note"
	"github.com/transparency-dev/tesseract/internal/client"
	"github.com/transparency-dev/tesseract/internal/client/gcp"
	"github.com/transparency-dev/tesseract/internal/hammer/loadtest"
	"github.com/transparency-dev/tesseract/internal/types/rfc6962"
	"github.com/transparency-dev/tesseract/internal/types/staticct"
	tlstypes "github.com/transparency-dev/tesseract/internal/types/tls"
	"github.com/transparency-dev/tesseract/internal/x509util"
	"golang.org/x/mod/sumdb/note"
	"golang.org/x/net/http2"
)

func init() {
	flag.Var(&logURL, "log_url", "Log storage root URL (can be specified multiple times), e.g. https://log.server/and/path/")
	flag.Var(&writeLogURL, "write_log_url", "Root URL for writing to a log (can be specified multiple times), e.g. https://log.server/and/path/ (optional, defaults to log_url)")
}

var (
	logURL      multiStringFlag
	writeLogURL multiStringFlag

	origin                    = flag.String("origin", os.Getenv("CT_LOG_ORIGIN"), "Origin of the log, for checkpoints and the monitoring prefix. This is defaulted to the environment variable CT_LOG_ORIGIN")
	logPubKey                 = flag.String("log_public_key", os.Getenv("CT_LOG_PUBLIC_KEY"), "Public key for the log. This is defaulted to the environment variable CT_LOG_PUBLIC_KEY")
	intermediateCACertPath    = flag.String("intermediate_ca_cert_path", "./internal/hammer/testdata/test_intermediate_ca_cert.pem", "Intermediate CA certificate path for certificate generator")
	intermediateCAKeyPath     = flag.String("intermediate_ca_key_path", "./internal/hammer/testdata/test_intermediate_ca_private_key.pem", "Intermediate CA key path for certificate generator (Only RSA is accepted)")
	certSigningPrivateKeyPath = flag.String("cert_sign_private_key_path", "./internal/hammer/testdata/test_leaf_cert_signing_private_key.pem", "Certificate signing private key path for certificate generator (Only RSA is accepted)")

	maxReadOpsPerSecond = flag.Int("max_read_ops", 20, "The maximum number of read operations per second")
	numReadersRandom    = flag.Int("num_readers_random", 4, "The number of readers looking for random leaves")
	numReadersFull      = flag.Int("num_readers_full", 4, "The number of readers downloading the whole log")

	maxWriteOpsPerSecond = flag.Int("max_write_ops", 0, "The maximum number of write operations per second")
	numWriters           = flag.Int("num_writers", 0, "The number of independent write tasks to run")
	numMMDVerifiers      = flag.Int("num_mmd_verifiers", 0, "The number of MMD verifiers performing inclusion proof for the added leaves")
	mmdDuration          = flag.Duration("mmd_duration", 10*time.Second, "The Maximum Merge Delay (MMD) duration of the log")

	dupChance    = flag.Float64("dup_chance", 0.1, "The probability of a generated leaf being a duplicate of a previous value")
	serialOffset = flag.Int64("serial_offset", 0, "The certificate serial number offset")

	leafWriteGoal = flag.Int64("leaf_write_goal", 0, "Exit after writing this number of leaves, or 0 to keep going indefinitely")
	maxRunTime    = flag.Duration("max_runtime", 0, "Fail after this amount of time has passed, or 0 to keep going indefinitely")

	showUI = flag.Bool("show_ui", true, "Set to false to disable the text-based UI")

	bearerToken      = flag.String("bearer_token", "", "The bearer token for auth. For GCP this is the result of `gcloud auth print-access-token`")
	bearerTokenWrite = flag.String("bearer_token_write", "", "The bearer token for auth to write. For GCP this is the result of `gcloud auth print-identity-token`. If unset will default to --bearer_token.")

	httpTimeout = flag.Duration("http_timeout", 30*time.Second, "Timeout for HTTP requests")
	forceHTTP2  = flag.Bool("force_http2", false, "Use HTTP/2 connections *only*")
	slogLevel   = flag.Int("slog_level", 0, "The cut-off threshold for structured logging. Default is 0 (INFO). See https://pkg.go.dev/log/slog#Level for other levels.")

	hc *http.Client
)

func main() {
	flag.Parse()
	slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.Level(*slogLevel)})))

	hc = &http.Client{
		Transport: &http.Transport{
			MaxIdleConns:        *numWriters + *numReadersFull + *numReadersRandom,
			MaxIdleConnsPerHost: *numWriters + *numReadersFull + *numReadersRandom,
			DisableKeepAlives:   false,
		},
		Timeout: *httpTimeout,
	}
	if *forceHTTP2 {
		hc.Transport = &http2.Transport{
			// So http2.Transport doesn't complain the URL scheme isn't 'https'
			AllowHTTP: true,
			// Pretend we are dialing a TLS endpoint. (Note, we ignore the passed tls.Config)
			DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
				var d net.Dialer
				return d.DialContext(ctx, network, addr)
			},
		}
	}

	// If bearerTokenWrite is unset, default it to whatever bearerToken has (which may too be unset).
	if *bearerTokenWrite == "" {
		*bearerTokenWrite = *bearerToken
	}

	ctx, cancel := context.WithCancel(context.Background())

	logSigV, err := logSigVerifier(*origin, *logPubKey)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to create verifier", slog.Any("error", err))
		os.Exit(1)
	}

	pubKey, err := parseLogPublicKeyB64(*logPubKey)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to parse log public key", slog.Any("error", err))
		os.Exit(1)
	}

	r := mustCreateReaders(ctx, logURL)
	if len(writeLogURL) == 0 {
		writeLogURL = logURL
	}
	verifier, err := newAddChainResponseVerifier(pubKey)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to create add chain response verifier", slog.Any("error", err))
		os.Exit(1)
	}
	w := mustCreateWriters(writeLogURL, verifier)

	var cpRaw []byte
	cons := client.UnilateralConsensus(r.ReadCheckpoint)
	tracker, err := client.NewLogStateTracker(ctx, r.ReadCheckpoint, r.ReadTile, cpRaw, logSigV, logSigV.Name(), cons)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to create LogStateTracker", slog.Any("error", err))
		os.Exit(1)
	}
	// Fetch initial state of log
	_, _, _, err = tracker.Update(ctx)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to get initial state of the log", slog.Any("error", err))
		os.Exit(1)
	}

	ha := loadtest.NewHammerAnalyser(func() uint64 { return tracker.LatestConsistent.Size })
	ha.Run(ctx)

	intermediateCACert, err := loadIntermediateCACert(*intermediateCACertPath)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to load intermediate CA certificate", slog.String("path", *intermediateCACertPath), slog.Any("error", err))
		os.Exit(1)
	}
	intermediateCAKey, err := loadPrivateKey(*intermediateCAKeyPath)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to load intermediate CA private key", slog.String("path", *intermediateCAKeyPath), slog.Any("error", err))
		os.Exit(1)
	}
	if err := verifySupportedKeyAlgorithm(intermediateCAKey); err != nil {
		slog.ErrorContext(ctx, "Failed to support intermediate CA key algorithm for generating deterministic certificate", slog.Any("error", err))
		os.Exit(1)
	}
	privateKey, err := loadPrivateKey(*certSigningPrivateKeyPath)
	if err != nil {
		slog.ErrorContext(ctx, "Failed to load certificate signing private key", slog.String("path", *certSigningPrivateKeyPath), slog.Any("error", err))
		os.Exit(1)
	}
	if err := verifySupportedKeyAlgorithm(privateKey); err != nil {
		slog.ErrorContext(ctx, "Failed to support certificate signing private key algorithm for generating deterministic certificate", slog.Any("error", err))
		os.Exit(1)
	}

	gen := newLeafGenerator(tracker.LatestConsistent.Size, *dupChance, intermediateCACert, intermediateCAKey, privateKey)
	opts := loadtest.HammerOpts{
		MaxReadOpsPerSecond:  *maxReadOpsPerSecond,
		MaxWriteOpsPerSecond: *maxWriteOpsPerSecond,
		NumReadersRandom:     *numReadersRandom,
		NumReadersFull:       *numReadersFull,
		NumWriters:           *numWriters,
		NumMMDVerifiers:      *numMMDVerifiers,
		MMDDuration:          *mmdDuration,
	}
	hammer := loadtest.NewHammer(&tracker, r.ReadEntryBundle, w, gen, ha.SeqLeafChan, ha.ErrChan, opts)

	exitCode := 0
	if *leafWriteGoal > 0 {
		go func() {
			startTime := time.Now()
			goal := tracker.LatestConsistent.Size + uint64(*leafWriteGoal)
			slog.InfoContext(ctx, "Will exit once tree size is at least", slog.Uint64("goal", goal))
			tick := time.NewTicker(1 * time.Second)
			for {
				select {
				case <-ctx.Done():
					return
				case <-tick.C:
					if tracker.LatestConsistent.Size >= goal {
						elapsed := time.Since(startTime)
						slog.InfoContext(ctx, "Reached tree size goal; exiting", slog.Uint64("goal", goal), slog.Duration("elapsed", elapsed))
						cancel()
						return
					}
				}
			}
		}()
	}
	if *maxRunTime > 0 {
		go func() {
			slog.InfoContext(ctx, "Will fail after timeout", slog.Duration("timeout", *maxRunTime))
			for {
				select {
				case <-ctx.Done():
					return
				case <-time.After(*maxRunTime):
					slog.InfoContext(ctx, "Max runtime reached; exiting")
					exitCode = 1
					cancel()
					return
				}
			}
		}()
	}
	hammer.Run(ctx)

	if *showUI {
		c := loadtest.NewController(hammer, ha)
		c.Run(ctx)
	} else {
		<-ctx.Done()
	}
	os.Exit(exitCode)
}

// newLeafGenerator returns a function that generates values to append to a log.
// The generator can be used by concurrent threads.
//
// dupChance provides the probability that a new leaf will be a duplicate of a previous entry.
// Leaves will be unique if dupChance is 0, and if set to 1 then all values will be duplicates.
// startSize should be set to the initial size of the log so that repeated runs of the
// hammer can start seeding leaves to avoid duplicates with previous runs.
func newLeafGenerator(startSize uint64, dupChance float64, intermediateCACert *x509.Certificate, intermediateCAKey, leafCertSigningPrivateKey any) func() rfc6962.AddChainRequest {
	certGen := newChainGenerator(intermediateCACert, intermediateCAKey, publicKey(leafCertSigningPrivateKey))

	sizeLocked := startSize
	var mu sync.Mutex
	return func() rfc6962.AddChainRequest {
		mu.Lock()
		thisSize := sizeLocked

		if thisSize > 0 && rand.Float64() <= dupChance {
			thisSize = rand.Uint64N(thisSize)
		} else {
			sizeLocked++
		}
		mu.Unlock()

		// Do this outside of the protected block so that writers don't block on leaf generation (especially for larger leaves).
		return certGen.addChainRequestBody(int64(thisSize) + *serialOffset)
	}
}

// multiStringFlag allows a flag to be specified multiple times on the command
// line, and stores all of these values.
type multiStringFlag []string

func (ms *multiStringFlag) String() string {
	return strings.Join(*ms, ",")
}

func (ms *multiStringFlag) Set(w string) error {
	*ms = append(*ms, w)
	return nil
}

func loadPrivateKey(path string) (any, error) {
	keyBytes, err := os.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("failed to read key file: %w", err)
	}

	block, _ := pem.Decode(keyBytes)
	if block == nil {
		key, err := x509.ParsePKCS8PrivateKey(keyBytes)
		if err == nil {
			return key, nil
		}
		rsaKey, err := x509.ParsePKCS1PrivateKey(keyBytes)
		if err == nil {
			return rsaKey, nil
		}

		ecKey, err := x509.ParseECPrivateKey(keyBytes)
		if err == nil {
			return ecKey, nil
		}

		return nil, fmt.Errorf("failed to decode PEM block and failed to parse as DER: %w", err)
	}

	// Fix block type for testing keys.
	block.Type = testingKey(block.Type)

	switch block.Type {
	case "RSA PRIVATE KEY":
		return x509.ParsePKCS1PrivateKey(block.Bytes)
	case "EC PRIVATE KEY":
		return x509.ParseECPrivateKey(block.Bytes)
	case "PRIVATE KEY":
		return x509.ParsePKCS8PrivateKey(block.Bytes)
	default:
		return nil, fmt.Errorf("unsupported PEM block type: %s", block.Type)
	}
}

func loadIntermediateCACert(path string) (*x509.Certificate, error) {
	certBytes, err := os.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("failed to read certificate file: %w", err)
	}

	block, rest := pem.Decode(certBytes)
	if block == nil {
		return nil, fmt.Errorf("failed to decode PEM block")
	}
	if block.Type != "CERTIFICATE" {
		return nil, fmt.Errorf("expected PEM block type 'CERTIFICATE', got '%s'", block.Type)
	}
	if len(rest) > 0 {
		slog.InfoContext(context.Background(), "Warning: More than one PEM block found. Parsing only the first.")
	}

	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("failed to parse X.509 certificate: %w", err)
	}

	return cert, nil
}

// publicKey returns the public key associated with the private key.
func publicKey(privKey any) any {
	switch k := privKey.(type) {
	case *rsa.PrivateKey:
		return k.Public()
	case *ecdsa.PrivateKey:
		return k.Public()
	case *ed25519.PrivateKey:
		return k.Public()
	default:
		slog.ErrorContext(context.Background(), "Unknown private key type", slog.String("type", fmt.Sprintf("%T", privKey)))
		os.Exit(1)
		return nil // Or panic, or return an error
	}
}

func testingKey(s string) string {
	return strings.ReplaceAll(s, "TEST PRIVATE KEY", "PRIVATE KEY")
}

// verifySupportedKeyAlgorithm returns an error if the key algorithm is not
// supported for generating deterministic certificates.
func verifySupportedKeyAlgorithm(key any) error {
	switch key.(type) {
	case *rsa.PrivateKey:
		return nil

	case *ecdsa.PrivateKey:
		return errors.New("ecdsa is not supported")

	case ed25519.PrivateKey:
		return errors.New("ed25519 is not supported")

	case *ecdh.PrivateKey:
		return errors.New("ecdh is not supported")

	default:
		return fmt.Errorf("unknown key type: %T", key)
	}
}

// parseLogPublicKeyB64 decodes and parses a base64-encoded DER public key.
func parseLogPublicKeyB64(b64PubKey string) (crypto.PublicKey, error) {
	if b64PubKey == "" {
		return nil, errors.New("log public key cannot be empty")
	}
	derBytes, err := base64.StdEncoding.DecodeString(b64PubKey)
	if err != nil {
		return nil, fmt.Errorf("error decoding public key: %s", err)
	}
	pub, err := x509.ParsePKIXPublicKey(derBytes)
	if err != nil {
		return nil, fmt.Errorf("error parsing public key: %v", err)
	}
	return pub, nil
}

// logSigVerifier creates a note.Verifier for the Static CT API log by taking
// an origin string and a base64-encoded public key.
func logSigVerifier(origin, b64PubKey string) (note.Verifier, error) {
	if origin == "" {
		return nil, errors.New("origin cannot be empty")
	}
	pub, err := parseLogPublicKeyB64(b64PubKey)
	if err != nil {
		return nil, err
	}

	verifierKey, err := tdnote.RFC6962VerifierString(origin, pub)
	if err != nil {
		return nil, fmt.Errorf("error creating RFC6962 verifier string: %v", err)
	}
	logSigV, err := tdnote.NewVerifier(verifierKey)
	if err != nil {
		return nil, fmt.Errorf("error creating verifier: %v", err)
	}

	return logSigV, nil
}

func mustCreateReaders(ctx context.Context, us []string) loadtest.LogReader {
	r := []loadtest.LogReader{}
	for _, u := range us {
		if !strings.HasSuffix(u, "/") {
			u += "/"
		}
		rURL, err := url.Parse(u)
		if err != nil {
			slog.ErrorContext(ctx, "Invalid log reader URL", slog.String("url", u), slog.Any("error", err))
			os.Exit(1)
		}

		switch rURL.Scheme {
		case "http", "https":
			c, err := client.NewHTTPFetcher(rURL, hc)
			if err != nil {
				slog.ErrorContext(ctx, "Failed to create HTTP fetcher", slog.String("url", u), slog.Any("error", err))
				os.Exit(1)
			}
			c.EnableRetries(5)
			if *bearerToken != "" {
				c.SetAuthorizationHeader(fmt.Sprintf("Bearer %s", *bearerToken))
			}
			r = append(r, c)
		case "file":
			r = append(r, client.FileFetcher{Root: rURL.Path})
		case "gs":
			c, err := gcp.NewGSFetcher(ctx, rURL.Host, nil)
			if err != nil {
				slog.ErrorContext(ctx, "NewGSFetcher", slog.Any("error", err))
				os.Exit(1)
			}
			r = append(r, c)
		default:
			slog.ErrorContext(ctx, "Unsupported scheme on log URL", slog.String("scheme", rURL.Scheme))
			os.Exit(1)
		}
	}
	return loadtest.NewRoundRobinReader(r)
}

func mustCreateWriters(us []string, verifyWriteResponse func(reqBytes []byte, respBytes []byte) (uint64, uint64, error)) loadtest.LeafWriter {
	w := []loadtest.LeafWriter{}
	for _, u := range us {
		if !strings.HasSuffix(u, "/") {
			u += "/"
		}
		u += "ct/v1/add-chain"
		wURL, err := url.Parse(u)
		if err != nil {
			slog.ErrorContext(context.Background(), "Invalid log writer URL", slog.String("url", u), slog.Any("error", err))
			os.Exit(1)
		}
		w = append(w, httpWriter(wURL, hc, *bearerTokenWrite, verifyWriteResponse))
	}
	return loadtest.NewRoundRobinWriter(w)
}

func httpWriter(u *url.URL, hc *http.Client, bearerToken string, verifyWriteResponse func(reqBytes []byte, respBytes []byte) (uint64, uint64, error)) loadtest.LeafWriter {
	cTrace := &httptrace.ClientTrace{
		GotConn: func(info httptrace.GotConnInfo) {
			slog.InfoContext(context.Background(), "connection established", slog.String("info", fmt.Sprintf("%#v", info)))
		},
	}
	return func(ctx context.Context, newLeaf []byte) (uint64, uint64, error) {
		req, err := http.NewRequest(http.MethodPost, u.String(), bytes.NewReader(newLeaf))
		if err != nil {
			return 0, 0, fmt.Errorf("failed to create request: %v", err)
		}
		if bearerToken != "" {
			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", bearerToken))
		}
		reqCtx := req.Context()
		if slog.Default().Enabled(ctx, slog.LevelDebug) {
			reqCtx = httptrace.WithClientTrace(req.Context(), cTrace)
		}
		resp, err := hc.Do(req.WithContext(reqCtx))
		if err != nil {
			return 0, 0, fmt.Errorf("failed to write leaf: %v", err)
		}
		defer func() {
			// Drain all bytes left in the body and close it to allow socket reuse
			_, _ = io.Copy(io.Discard, resp.Body)
			_ = resp.Body.Close()
		}()
		body, err := io.ReadAll(resp.Body)
		if err != nil {
			return 0, 0, fmt.Errorf("failed to read body: %v", err)
		}
		switch resp.StatusCode {
		case http.StatusOK:
			if resp.Request.Method != http.MethodPost {
				return 0, 0, fmt.Errorf("write leaf was redirected to %s", resp.Request.URL)
			}
			// Continue below
		case http.StatusServiceUnavailable, http.StatusBadGateway, http.StatusGatewayTimeout, http.StatusTooManyRequests:
			// These status codes may indicate a delay before retrying, so handle that here:
			time.Sleep(retryDelay(resp.Header.Get("Retry-After"), time.Second))

			return 0, 0, fmt.Errorf("log not available. Status code: %d. Body: %q %w", resp.StatusCode, body, loadtest.ErrRetry)
		default:
			return 0, 0, fmt.Errorf("write leaf was not OK. Status code: %d. Body: %q", resp.StatusCode, body)
		}
		index, timestamp, err := verifyWriteResponse(newLeaf, body)
		if err != nil {
			return 0, 0, fmt.Errorf("write leaf failed to verify response: %v. Body: %q", err, body)
		}
		return index, timestamp, nil
	}
}

func retryDelay(retryAfter string, defaultDur time.Duration) time.Duration {
	if retryAfter == "" {
		return defaultDur
	}
	d, err := time.Parse(http.TimeFormat, retryAfter)
	if err == nil {
		return time.Until(d)
	}
	s, err := strconv.Atoi(retryAfter)
	if err == nil {
		return time.Duration(s) * time.Second
	}
	return defaultDur
}

type addChainResponseVerifier func(reqBytes []byte, respBytes []byte) (uint64, uint64, error)

// newAddChainResponseVerifier returns a verification callback that parses the add-chain
// response, verifies the SCT signature against the submitted request and log public
// key, and returns the leaf index from the extensions and timestamp from the response.
func newAddChainResponseVerifier(pubKey crypto.PublicKey) (addChainResponseVerifier, error) {
	if pubKey == nil {
		return func(reqBytes []byte, respBytes []byte) (uint64, uint64, error) {
			return 0, 0, errors.New("cannot verify SCT: log public key is nil")
		}, errors.New("log public key is nil")
	}
	pubBytes, err := x509.MarshalPKIXPublicKey(pubKey)
	if err != nil {
		return func(reqBytes []byte, respBytes []byte) (uint64, uint64, error) {
			return 0, 0, fmt.Errorf("failed to marshal public key: %w", err)
		}, fmt.Errorf("can't parse public key: %v", err)
	}
	expectedID := sha256.Sum256(pubBytes)

	return func(reqBytes []byte, respBytes []byte) (uint64, uint64, error) {
		if len(reqBytes) == 0 {
			return 0, 0, errors.New("cannot verify SCT: submitted request payload is empty")
		}

		var resp rfc6962.AddChainResponse
		if err := json.Unmarshal(respBytes, &resp); err != nil {
			return 0, 0, fmt.Errorf("can't parse add-chain response: %v", err)
		}

		extBytes, err := base64.StdEncoding.DecodeString(resp.Extensions)
		if err != nil {
			return 0, 0, fmt.Errorf("can't decode base64 extensions in response: %w", err)
		}

		leafIdx, err := staticct.ParseCTExtensionsBytes(extBytes)
		if err != nil {
			return 0, 0, fmt.Errorf("can't parse extensions: %v", err)
		}

		var req rfc6962.AddChainRequest
		if err := json.Unmarshal(reqBytes, &req); err != nil {
			return 0, 0, fmt.Errorf("can't unmarshal submitted request: %w", err)
		}
		if len(req.Chain) == 0 {
			return 0, 0, errors.New("submitted request chain is empty")
		}

		chainCerts := make([]*x509.Certificate, 0, len(req.Chain))
		for _, der := range req.Chain {
			cert, err := x509.ParseCertificate(der)
			if err != nil {
				return 0, 0, fmt.Errorf("can't parse cert in submitted chain: %w", err)
			}
			chainCerts = append(chainCerts, cert)
		}

		isPrecert, err := x509util.IsPrecertificate(chainCerts[0])
		if err != nil {
			return 0, 0, fmt.Errorf("failed to check if leaf is precertificate: %w", err)
		}

		entry, err := x509util.EntryFromChain(chainCerts, isPrecert, resp.Timestamp)
		if err != nil {
			return 0, 0, fmt.Errorf("failed to build entry from submitted chain: %w", err)
		}
		defer x509util.ReturnEntry(entry)

		var ikh [32]byte
		if isPrecert {
			copy(ikh[:], entry.IssuerKeyHash)
		}
		sctInput := *staticct.NewCertificateTimestamp(extBytes, resp.Timestamp, isPrecert, entry.Certificate, ikh)

		if !bytes.Equal(resp.ID, expectedID[:]) {
			return 0, 0, fmt.Errorf("SCT LogID mismatch: got %x, want %x", resp.ID, expectedID[:])
		}

		var ds rfc6962.DigitallySigned
		if rest, err := tlstypes.Unmarshal(resp.Signature, &ds); err != nil {
			return 0, 0, fmt.Errorf("failed to unmarshal DigitallySigned from AddChainResponse.Signature: %w", err)
		} else if len(rest) > 0 {
			return 0, 0, fmt.Errorf("extra data after DigitallySigned: %d bytes", len(rest))
		}

		data, err := tlstypes.Marshal(sctInput)
		if err != nil {
			return 0, 0, fmt.Errorf("failed to tlstypes.Marshal sctInput: %w", err)
		}
		digest := sha256.Sum256(data)

		switch pk := pubKey.(type) {
		case *ecdsa.PublicKey:
			if !ecdsa.VerifyASN1(pk, digest[:], ds.Signature) {
				return 0, 0, errors.New("SCT ECDSA signature verification failed")
			}
		default:
			return 0, 0, fmt.Errorf("unsupported public key type: %T", pubKey)
		}

		return uint64(leafIdx), resp.Timestamp, nil
	}, nil
}