Handle Origin Bound Certificate expiration.

net/base/origin_bound_cert_store.h

Index: net/base/origin_bound_cert_store.h
diff --git a/net/base/origin_bound_cert_store.h b/net/base/origin_bound_cert_store.h
index 094839b1e8f52bac105d8b65698e996b4c350220..66c19b5ca91e230e936d31e2a4f361691188619b 100644
--- a/net/base/origin_bound_cert_store.h
+++ b/net/base/origin_bound_cert_store.h
@@ -9,6 +9,7 @@
 #include <string>
 #include <vector>
 
+#include "base/time.h"
 #include "net/base/net_export.h"
 #include "net/base/ssl_client_cert_type.h"
 
@@ -30,6 +31,7 @@ class NET_EXPORT OriginBoundCertStore {
     OriginBoundCert();
     OriginBoundCert(const std::string& origin,
                     SSLClientCertType type,
+                    base::Time not_valid_after,

[wtc, 2011/12/14 02:03:39]

Nit: "expiration_time" or "expiry_time" may be easier to
understand than "not_valid_after".

I know you chose the not_valid_after name after the ASN.1
structure in the certificate:

Validity ::= SEQUENCE {
     notBefore      Time,
     notAfter       Time  }

[mattm, 2011/12/20 00:28:38]

Done.

                     const std::string& private_key,
                     const std::string& cert);
     ~OriginBoundCert();
@@ -38,6 +40,7 @@ class NET_EXPORT OriginBoundCertStore {
     const std::string& origin() const { return origin_; }
     // TLS ClientCertificateType.
     SSLClientCertType type() const { return type_; }
+    base::Time not_valid_after() const { return not_valid_after_; }

[wtc, 2011/12/14 02:03:39]

Please document this getter method.

[mattm, 2011/12/20 00:28:38]

Done.

     // The encoding of the private key depends on the type.
     // rsa_sign: DER-encoded PrivateKeyInfo struct.
     // ecdsa_sign: DER-encoded EncryptedPrivateKeyInfo struct.
@@ -48,6 +51,7 @@ class NET_EXPORT OriginBoundCertStore {
    private:
     std::string origin_;
     SSLClientCertType type_;
+    base::Time not_valid_after_;
     std::string private_key_;
     std::string cert_;
   };
@@ -63,6 +67,7 @@ class NET_EXPORT OriginBoundCertStore {
   virtual bool GetOriginBoundCert(
       const std::string& origin,
       SSLClientCertType* type,
+      base::Time* not_valid_after,

[wtc, 2011/12/14 02:03:39]

Please document the |type| and |not_valid_after| output
parameters.

[mattm, 2011/12/20 00:28:38]

Done.

       std::string* private_key_result,
       std::string* cert_result) = 0;
 
@@ -70,6 +75,7 @@ class NET_EXPORT OriginBoundCertStore {
   virtual void SetOriginBoundCert(
       const std::string& origin,
       SSLClientCertType type,
+      base::Time not_valid_after,
       const std::string& private_key,
       const std::string& cert) = 0;