Reduce the network timeout for NSS from 60 seconds to 15 seconds

net/ocsp/nss_ocsp.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ocsp/nss_ocsp.h"
 
 #include <certt.h>
 #include <certdb.h>
 #include <ocsp.h>
 #include <nspr.h>
@@ skipping 22 matching lines @@
 #include "net/base/load_flags.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 
 namespace {
 
 // Protects |g_request_context|.
 pthread_mutex_t g_request_context_lock = PTHREAD_MUTEX_INITIALIZER;
-static net::URLRequestContext* g_request_context = NULL;
+net::URLRequestContext* g_request_context = NULL;
+
+// The default timeout for OCSP in NSS is 60 seconds. Adjust this value to
+// 15 seconds, which matches the default on Windows.
+const int kOcspTimeoutInSecs = 15;
 
 class OCSPRequestSession;
 
 class OCSPIOLoop {
  public:
   void StartUsing() {
     base::AutoLock autolock(lock_);
     used_ = true;
     io_loop_ = MessageLoopForIO::current();
     DCHECK(io_loop_);
@@ skipping 484 matching lines @@
   ft->setPostDataFcn = OCSPSetPostData;
   ft->addHeaderFcn = OCSPAddHeader;
   ft->trySendAndReceiveFcn = OCSPTrySendAndReceive;
   ft->cancelFcn = NULL;
   ft->freeFcn = OCSPFree;
   SECStatus status = SEC_RegisterDefaultHttpClient(&client_fcn_);
   if (status != SECSuccess) {
     NOTREACHED() << "Error initializing OCSP: " << PR_GetError();
   }
 
+  // The default NSS value for OCSP timeouts is 60 seconds. Set this to be

[wtc, 2012/08/24 21:52:08]

Nit: omit this comment because it is already in front of
the kOcspTimeoutInSecs constant definition.

We should also change the default NSS OCSP timeout to a smaller
value. Rick Andrews and Scott Rea's Revocation document
does not recommend a specific timeout. I think 15 seconds
should be fine.

[Ryan Sleevi, 2012/08/24 21:58:24]

They suggest (no less than) 3 seconds, but I think that's as unrealistic as the
premise that OCSP responders answer within 300ms.

+  // something more sane.
+  CERT_SetOCSPTimeout(kOcspTimeoutInSecs);

[wtc, 2012/08/24 21:52:08]

I verified that this function always returns SECSuccess.
So it is fine to not check the return value.

IMPORTANT: please verify this function affects libpkix.
I seem to remember libpkix has its own hardcoded timeout:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/libpkix/...

http://mxr.mozilla.org/security/ident?i=PKIX_DEFAULT_COMM_TIMEOUT_SECONDS

If so, we'll need to cap the timeout inside OCSPCreate().

[Ryan Sleevi, 2012/08/24 21:58:24]

Yes, I checked this function, at least couldn't find it being hit in debug.

The NSS timeout seconds only appears to affect AIA fetches. However, we should
also have those capped at 15 seconds, so that's reason enough to ensure that
OCSPCreate also adds a cap. I will do that.

+
   // Work around NSS bugs 524013 and 564334.  NSS incorrectly thinks the
   // CRLs for Network Solutions Certificate Authority have bad signatures,
   // which causes certificates issued by that CA to be reported as revoked.
   // By using OCSP for those certificates, which don't have AIA extensions,
   // we can work around these bugs.  See http://crbug.com/41730.
   CERT_StringFromCertFcn old_callback = NULL;
   status = CERT_RegisterAlternateOCSPAIAInfoCallBack(
       GetAlternateOCSPAIAInfo, &old_callback);
   if (status == SECSuccess) {
     DCHECK(!old_callback);
@@ skipping 373 matching lines @@
 void SetURLRequestContextForNSSHttpIO(URLRequestContext* request_context) {
   pthread_mutex_lock(&g_request_context_lock);
   if (request_context) {
     DCHECK(!g_request_context);
   }
   g_request_context = request_context;
   pthread_mutex_unlock(&g_request_context_lock);
 }
 
 }  // namespace net