Index: net/cert/cert_verify_proc.cc |
diff --git a/net/cert/cert_verify_proc.cc b/net/cert/cert_verify_proc.cc |
index 222ba47f51c98fcab412a52334146ee064d77696..14c87a4bf02fb7779773249bc24323909ee1d655 100644 |
--- a/net/cert/cert_verify_proc.cc |
+++ b/net/cert/cert_verify_proc.cc |
@@ -8,6 +8,7 @@ |
#include "base/metrics/histogram.h" |
#include "base/sha1.h" |
#include "base/strings/stringprintf.h" |
+#include "base/time/time.h" |
#include "build/build_config.h" |
#include "net/base/net_errors.h" |
#include "net/base/net_util.h" |
@@ -276,6 +277,13 @@ int CertVerifyProc::Verify(X509Certificate* cert, |
// now treat it as a warning and do not map it to an error return value. |
} |
+ // Flag certificates using too long validity periods. |
+ if (!verify_result->is_issued_by_known_root && HasTooLongValidity(*cert)) { |
Ryan Sleevi
2014/10/29 22:22:07
This is wrong.
if (verify_result->is_issued_by_kn
palmer
2014/10/30 01:23:16
Done.
|
+ verify_result->cert_status |= CERT_STATUS_TOO_LONG_VALIDITY; |
+ if (rv == OK) |
+ rv = MapCertStatusToNetError(verify_result->cert_status); |
+ } |
+ |
return rv; |
} |
@@ -614,4 +622,40 @@ bool CertVerifyProc::HasNameConstraintsViolation( |
return false; |
} |
+// static |
+bool CertVerifyProc::HasTooLongValidity(const X509Certificate& cert) { |
+ const base::Time& start = cert.valid_start(); |
+ const base::Time& expiry = cert.valid_expiry(); |
+ if (start.is_max() || start.is_null() || |
+ expiry.is_max() || expiry.is_null() || |
+ start > expiry) { |
+ return true; |
+ } |
+ |
+ base::Time::Exploded exploded_start; |
+ base::Time::Exploded exploded_expiry; |
+ cert.valid_start().UTCExplode(&exploded_start); |
+ cert.valid_expiry().UTCExplode(&exploded_expiry); |
+ |
+ int month_diff = |
+ exploded_expiry.year * 12 + exploded_expiry.month - |
+ exploded_start.year * 12 - exploded_start.month; |
Ryan Sleevi
2014/10/29 22:22:07
I still hate math and years, but also hate multipl
palmer
2014/10/30 01:23:16
Done.
|
+ // Add any remainder as a full month. |
+ if (exploded_expiry.day_of_month > exploded_start.day_of_month) |
+ ++month_diff; |
+ |
+ static const base::Time time_2015_04_01 = base::Time::FromInternalValue( |
+ GG_INT64_C(1427871600)); |
Ryan Sleevi
2014/10/29 22:22:07
GG_ is deprecated. Long live the <stdint.h> macros
palmer
2014/10/30 01:23:16
Done.
|
+ static const base::Time time_2012_07_01 = base::Time::FromInternalValue( |
+ GG_INT64_C(1341126000)); |
+ static const base::Time time_2019_07_01 = base::Time::FromInternalValue( |
+ GG_INT64_C(1561964400)); |
+ |
+ if (start >= time_2015_04_01) |
+ return month_diff > 39; |
+ if (start >= time_2012_07_01) |
+ return month_diff > 60; |
+ return month_diff > 120 || expiry > time_2019_07_01; |
+} |
+ |
} // namespace net |