Reduce the network timeout for NSS from 60 seconds to 15 seconds

net/ocsp/nss_ocsp.cc

Index: net/ocsp/nss_ocsp.cc
diff --git a/net/ocsp/nss_ocsp.cc b/net/ocsp/nss_ocsp.cc
index 273e341bdfa1703aca1feb3fb4405ee7b7a076b0..6af4c54d2ba6ca64c8764c41599abb1f31d06872 100644
--- a/net/ocsp/nss_ocsp.cc
+++ b/net/ocsp/nss_ocsp.cc
@@ -12,6 +12,7 @@
 #include <pthread.h>
 #include <secerr.h>
 
+#include <algorithm>
 #include <string>
 
 #include "base/basictypes.h"
@@ -40,7 +41,11 @@ namespace {
 
 // Protects |g_request_context|.
 pthread_mutex_t g_request_context_lock = PTHREAD_MUTEX_INITIALIZER;
-static net::URLRequestContext* g_request_context = NULL;
+net::URLRequestContext* g_request_context = NULL;
+
+// The default timeout for network fetches in NSS is 60 seconds. Choose a
+// saner upper limit for OCSP/CRL/AIA fetches.

[wtc, 2012/08/24 23:51:52]

Nit: OCSP responder location is also listed in the AIA extension.
Perhaps change "AIA" to "CA issuer" or "CA certificate"?

+const int kNetworkFetchTimeoutInSecs = 15;
 
 class OCSPRequestSession;
 
@@ -442,9 +447,14 @@ class OCSPServerSession {
                                               path_and_query_string));
     VLOG(1) << "URL [" << url_string << "]";
     GURL url(url_string);
-    return new OCSPRequestSession(
-        url, http_request_method,
+
+    // NSS does not expose public functions to adjust the fetch timeout when
+    // using libpkix, so hardcode the upper limit for network fetches.
+    base::TimeDelta actual_timeout = std::min(
+        base::TimeDelta::FromSeconds(kNetworkFetchTimeoutInSecs),
         base::TimeDelta::FromMilliseconds(PR_IntervalToMilliseconds(timeout)));
+
+    return new OCSPRequestSession(url, http_request_method, actual_timeout);
   }