Certificate Transparency: Correct month calculation.

net/cert/cert_policy_enforcer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_policy_enforcer.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/build_time.h"
@@ skipping 24 matching lines @@
 // TODO(eranm): Move to base or net/base
 bool IsBuildTimely() {
 #if defined(DONT_EMBED_BUILD_METADATA) && !defined(OFFICIAL_BUILD)
   return true;
 #else
   const base::Time build_time = base::GetBuildTime();
   // We consider built-in information to be timely for 10 weeks.
   return (base::Time::Now() - build_time).InDays() < 70 /* 10 weeks */;
 #endif
 }
 

[davidben, 2015/03/25 15:00:54]

Maybe add a comment here that this is the number of months, rounding down, since
"approximate" doesn't tell you exactly what it measures.

[Eran Messeri, 2015/03/25 18:27:28]

Done.

 uint32_t ApproximateMonthDifference(const base::Time& start,
                                     const base::Time& end) {
   base::Time::Exploded exploded_start;
   base::Time::Exploded exploded_expiry;
   start.UTCExplode(&exploded_start);
   end.UTCExplode(&exploded_expiry);
   uint32_t month_diff = (exploded_expiry.year - exploded_start.year) * 12 +
                         (exploded_expiry.month - exploded_start.month);

[davidben, 2015/03/25 15:00:54]

This still isn't quite right, is it? A certificate valid from 2015-03-31 to
2015-04-01 would give 1 here, but, rounding down, it's 0.

(Also, doesn't really matter since code elsewhere will hopefully reject, but
this computation will underflow if end < start. Probably worth having this
method return 0.)

[Eran Messeri, 2015/03/25 18:27:28]

This is trickier than it seems, since the policy, as stated in month, does not
allow for consistent rounding up/rounding down of months - i.e., the code has to
know whether the validity period is exactly 15 months (or more) , so rounding up
is wrong in the case of 14 and a half months (as the issue pointed out). But the
code also has to know whether the validity period is exactly 27 months (or less)
have passed, so rounding down is wrong in the case of 27 and a half months.

I've resorted to returning, in addition to the number of rounded-down months, an
indicator of whether the last month counted is a full month.

 
-  // Add any remainder as a full month.
-  if (exploded_expiry.day_of_month > exploded_start.day_of_month)
-    ++month_diff;
-
   return month_diff;
 }
 
 bool HasRequiredNumberOfSCTs(const X509Certificate& cert,
                              const ct::CTVerifyResult& ct_result) {
   // TODO(eranm): Count the number of *independent* SCTs once the information
   // about log operators is available, crbug.com/425174
   size_t num_valid_scts = ct_result.verified_scts.size();
   size_t num_embedded_scts =
       std::count_if(ct_result.verified_scts.begin(),
@@ skipping 197 matching lines @@
 
   LogCTComplianceStatusToUMA(details.status, ev_whitelist);
 
   if (details.status == CT_IN_WHITELIST || details.status == CT_ENOUGH_SCTS)
     return true;
 
   return false;
 }
 
 }  // namespace net