Use network time for bad clock interstitial.

chrome/browser/ssl/ssl_error_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/ssl_error_handler.h"
 
 #include <stdint.h>
 #include <utility>
 
 #include "base/callback_helpers.h"
 #include "base/macros.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/stringprintf.h"
 #include "base/time/clock.h"
 #include "base/time/time.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/bad_clock_blocking_page.h"
 #include "chrome/browser/ssl/ssl_blocking_page.h"
 #include "chrome/browser/ssl/ssl_cert_reporter.h"
 #include "components/ssl_errors/error_classification.h"
 #include "components/ssl_errors/error_info.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "net/base/net_errors.h"
 
 #if defined(ENABLE_CAPTIVE_PORTAL_DETECTION)
 #include "chrome/browser/captive_portal/captive_portal_service.h"
 #include "chrome/browser/captive_portal/captive_portal_service_factory.h"
 #include "chrome/browser/captive_portal/captive_portal_tab_helper.h"
 #include "chrome/browser/ssl/captive_portal_blocking_page.h"
 #endif
 
+namespace network_time {
+class NetworkTimeTracker;
+}
+
 namespace {
 
 // The delay in milliseconds before displaying the SSL interstitial.
 // This can be changed in tests.
 // - If there is a name mismatch and a suggested URL available result arrives
 //   during this time, the user is redirected to the suggester URL.
 // - If a "captive portal detected" result arrives during this time,
 //   a captive portal interstitial is displayed.
 // - Otherwise, an SSL interstitial is displayed.
 int64_t g_interstitial_delay_in_milliseconds = 2000;
@@ skipping 88 matching lines @@
 bool IsSSLCommonNameMismatchHandlingEnabled() {
   return base::FieldTrialList::FindFullName("SSLCommonNameMismatchHandling") ==
          "Enabled";
 }
 
 bool IsErrorDueToBadClock(const base::Time& now, int error) {
   if (ssl_errors::ErrorInfo::NetErrorToErrorType(error) !=
       ssl_errors::ErrorInfo::CERT_DATE_INVALID) {
     return false;
   }
-  return ssl_errors::IsUserClockInThePast(now) ||
-         ssl_errors::IsUserClockInTheFuture(now);
+  switch (ssl_errors::GetClockState(
+      now, g_browser_process->network_time_tracker())) {
+    case ssl_errors::CLOCK_STATE_FUTURE:

[felt, 2016/03/11 23:23:45]

can you add a comment to say that this intentionally falls through? switch
statements that fall through give me a little bit of anxiety

[mab, 2016/03/11 23:34:20]

I'll just make it return.

+    case ssl_errors::CLOCK_STATE_PAST:
+      return true;
+    default:
+      return false;
+  }
 }
 
 }  // namespace
 
 DEFINE_WEB_CONTENTS_USER_DATA_KEY(SSLErrorHandler);
 DEFINE_WEB_CONTENTS_USER_DATA_KEY(CommonNameMismatchRedirectObserver);
 
 void SSLErrorHandler::HandleSSLError(
     content::WebContents* web_contents,
     int cert_error,
@@ skipping 247 matching lines @@
   if (!callback_.is_null()) {
     base::ResetAndReturn(&callback_).Run(false);
   }
   if (common_name_mismatch_handler_) {
     common_name_mismatch_handler_->Cancel();
     common_name_mismatch_handler_.reset();
   }
   // Deletes |this| and also destroys the timer.
   web_contents_->RemoveUserData(UserDataKey());
 }