Use network time for bad clock interstitial.

chrome/browser/ssl/ssl_error_handler.cc

Index: chrome/browser/ssl/ssl_error_handler.cc
diff --git a/chrome/browser/ssl/ssl_error_handler.cc b/chrome/browser/ssl/ssl_error_handler.cc
index 4e0a84bfa43deac3a4b5778737ba413f563e50ea..b0eff7643c969f078d25d2aee1346015ac0eeafd 100644
--- a/chrome/browser/ssl/ssl_error_handler.cc
+++ b/chrome/browser/ssl/ssl_error_handler.cc
@@ -14,6 +14,7 @@
 #include "base/strings/stringprintf.h"
 #include "base/time/clock.h"
 #include "base/time/time.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ssl/bad_clock_blocking_page.h"
 #include "chrome/browser/ssl/ssl_blocking_page.h"
@@ -33,6 +34,10 @@
 #include "chrome/browser/ssl/captive_portal_blocking_page.h"
 #endif
 
+namespace network_time {
+class NetworkTimeTracker;
+}
+
 namespace {
 
 // The delay in milliseconds before displaying the SSL interstitial.
@@ -141,8 +146,16 @@ bool IsErrorDueToBadClock(const base::Time& now, int error) {
       ssl_errors::ErrorInfo::CERT_DATE_INVALID) {
     return false;
   }
-  return ssl_errors::IsUserClockInThePast(now) ||
-         ssl_errors::IsUserClockInTheFuture(now);
+  switch (ssl_errors::GetClockState(

[estark, 2016/03/11 22:14:58]

mab: another question, unrelated to the metrics stuff. We had talked IRL about
the possibility of only showing the bad clock interstitial when the certificate
chain would be considered valid if validated with network time, right?

I seem to remember that the outcome of that discussion is that we thought it
might be nontrivial and/or error-prone to try to do that... is that right? (e.g.
we'd have to walk up the chain and validate every cert with the network time;
plus the underlying certificate validation code might not actually give us *all*
the errors, etc.) Does that match your memory?

[mab, 2016/03/11 23:12:49]

My memory matches yours.

+      now, g_browser_process->network_time_tracker())) {
+    case ssl_errors::CLOCK_STATE_NETWORK_FUTURE:
+    case ssl_errors::CLOCK_STATE_NETWORK_PAST:
+    case ssl_errors::CLOCK_STATE_BUILD_FUTURE:
+    case ssl_errors::CLOCK_STATE_BUILD_PAST:
+      return true;
+    default:
+      return false;
+  }
 }
 
 }  // namespace