Implement Expect-Staple

net/cert/internal/parse_ocsp.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PARSE_OCSP_H_
 #define NET_CERT_INTERNAL_PARSE_OCSP_H_
 
 #include <memory>
 #include <string>
 #include <vector>
 
+#include "base/time/time.h"
 #include "net/base/hash_value.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/der/input.h"
 #include "net/der/parse_values.h"
 #include "net/der/parser.h"
 #include "net/der/tag.h"
 
 namespace net {
 
@@ skipping 249 matching lines @@
 // 4.2.2.3), the strictest response is returned (REVOKED > UNKNOWN > GOOD).
 //
 // On failure |out| has an undefined state. Some of its fields may have been
 // updated during parsing, whereas others may not have been changed.
 NET_EXPORT_PRIVATE bool GetOCSPCertStatus(
     const OCSPResponseData& response_data,
     const der::Input& issuer_tbs_certificate_tlv,
     const der::Input& cert_tbs_certificate_tlv,
     OCSPCertStatus* out);
 
+// Checks that thisUpdate <= verify_time < nextUpdate, and that thisUpdate >=
+// verify_time - max_age.

[svaldez, 2016/06/23 14:03:15]

Might want to reword to "verify_time <= thisUpdate + max_age".

+NET_EXPORT_PRIVATE bool CheckOCSPDateValid(const OCSPSingleResponse& response,
+                                           const base::Time& verify_time,
+                                           const base::TimeDelta& max_age);
+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSE_OCSP_H_