Cast device revocation checking.

extensions/browser/api/cast_channel/cast_auth_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_auth_util.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "base/macros.h"
@@ skipping 133 matching lines @@
   std::vector<std::string> cert_chain;
   cert_chain.push_back(response.client_auth_certificate());
   cert_chain.insert(cert_chain.end(),
                     response.intermediate_certificate().begin(),
                     response.intermediate_certificate().end());
 
   // Use the current time when checking certificate validity.
   base::Time::Exploded now;
   base::Time::Now().UTCExplode(&now);
 
+  // CRL should not be enforced until it is served.
   cast_crypto::CastDeviceCertPolicy device_policy;
-  if (!cast_crypto::VerifyDeviceCert(cert_chain, now, &verification_context,
-                                     &device_policy)) {
+  if (!cast_crypto::VerifyDeviceCert(
+          cert_chain, now, &verification_context, &device_policy, nullptr,
+          cast_certificate::CRLPolicy::CRL_OPTIONAL)) {
     // TODO(eroman): The error information was lost; this error is ambiguous.
     return AuthResult("Failed verifying cast device certificate",
                       AuthResult::ERROR_CERT_NOT_SIGNED_BY_TRUSTED_CA);
   }
 
   if (!verification_context->VerifySignatureOverData(response.signature(),
                                                      signature_input)) {
     return AuthResult("Failed verifying signature over data",
                       AuthResult::ERROR_SIGNED_BLOBS_MISMATCH);
   }
 
   AuthResult success;
 
   // Set the policy into the result.
   switch (device_policy) {
     case cast_crypto::CastDeviceCertPolicy::AUDIO_ONLY:
       success.channel_policies = AuthResult::POLICY_AUDIO_ONLY;
       break;
     case cast_crypto::CastDeviceCertPolicy::NONE:
       success.channel_policies = AuthResult::POLICY_NONE;
       break;
   }
 
   return success;
 }
 
 }  // namespace cast_channel
 }  // namespace api
 }  // namespace extensions