Reduce the network timeout for NSS from 60 seconds to 15 seconds

net/ocsp/nss_ocsp.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ocsp/nss_ocsp.h"
 
 #include <certt.h>
 #include <certdb.h>
 #include <ocsp.h>
 #include <nspr.h>
 #include <nss.h>
 #include <pthread.h>
 #include <secerr.h>
 
+#include <algorithm>
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/stl_util.h"
@@ skipping 13 matching lines @@
 #include "net/url_request/url_request_context.h"
 
 namespace net {
 
 namespace {
 
 // Protects |g_request_context|.
 pthread_mutex_t g_request_context_lock = PTHREAD_MUTEX_INITIALIZER;
 URLRequestContext* g_request_context = NULL;
 
+// The default timeout for network fetches in NSS is 60 seconds. Choose a
+// saner upper limit for OCSP/CRL/AIA fetches.
+const int kNetworkFetchTimeoutInSecs = 15;
+
 class OCSPRequestSession;
 
 class OCSPIOLoop {
  public:
   void StartUsing() {
     base::AutoLock autolock(lock_);
     used_ = true;
     io_loop_ = MessageLoopForIO::current();
     DCHECK(io_loop_);
   }
@@ skipping 377 matching lines @@
       return NULL;
     }
 
     std::string url_string(base::StringPrintf(
         "%s://%s%s",
         http_protocol_variant,
         host_and_port_.ToString().c_str(),
         path_and_query_string));
     VLOG(1) << "URL [" << url_string << "]";
     GURL url(url_string);
-    return new OCSPRequestSession(
-        url, http_request_method,
+
+    // NSS does not expose public functions to adjust the fetch timeout when
+    // using libpkix, so hardcode the upper limit for network fetches.
+    base::TimeDelta actual_timeout = std::min(
+        base::TimeDelta::FromSeconds(kNetworkFetchTimeoutInSecs),
         base::TimeDelta::FromMilliseconds(PR_IntervalToMilliseconds(timeout)));
+
+    return new OCSPRequestSession(url, http_request_method, actual_timeout);
   }
 
 
  private:
   HostPortPair host_and_port_;
 
   DISALLOW_COPY_AND_ASSIGN(OCSPServerSession);
 };
 
 OCSPIOLoop::OCSPIOLoop()
@@ skipping 470 matching lines @@
 void SetURLRequestContextForNSSHttpIO(URLRequestContext* request_context) {
   pthread_mutex_lock(&g_request_context_lock);
   if (request_context) {
     DCHECK(!g_request_context);
   }
   g_request_context = request_context;
   pthread_mutex_unlock(&g_request_context_lock);
 }
 
 }  // namespace net