Reject certificates that are valid for too long.

net/cert/cert_verify_proc.cc

Index: net/cert/cert_verify_proc.cc
diff --git a/net/cert/cert_verify_proc.cc b/net/cert/cert_verify_proc.cc
index 222ba47f51c98fcab412a52334146ee064d77696..14c87a4bf02fb7779773249bc24323909ee1d655 100644
--- a/net/cert/cert_verify_proc.cc
+++ b/net/cert/cert_verify_proc.cc
@@ -8,6 +8,7 @@
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "base/strings/stringprintf.h"
+#include "base/time/time.h"
 #include "build/build_config.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
@@ -276,6 +277,13 @@ int CertVerifyProc::Verify(X509Certificate* cert,
     // now treat it as a warning and do not map it to an error return value.
   }
 
+  // Flag certificates using too long validity periods.
+  if (!verify_result->is_issued_by_known_root && HasTooLongValidity(*cert)) {

[Ryan Sleevi, 2014/10/29 22:22:07]

This is wrong.

if (verify_result->is_issued_by_known_root ...)

[This will also make your test fail, which is right, because the test is wrong]

[palmer, 2014/10/30 01:23:16]

Done.

+    verify_result->cert_status |= CERT_STATUS_TOO_LONG_VALIDITY;
+    if (rv == OK)
+      rv = MapCertStatusToNetError(verify_result->cert_status);
+  }
+
   return rv;
 }
 
@@ -614,4 +622,40 @@ bool CertVerifyProc::HasNameConstraintsViolation(
   return false;
 }
 
+// static
+bool CertVerifyProc::HasTooLongValidity(const X509Certificate& cert) {
+  const base::Time& start = cert.valid_start();
+  const base::Time& expiry = cert.valid_expiry();
+  if (start.is_max() || start.is_null() ||
+      expiry.is_max() || expiry.is_null() ||
+      start > expiry) {
+    return true;
+  }
+
+  base::Time::Exploded exploded_start;
+  base::Time::Exploded exploded_expiry;
+  cert.valid_start().UTCExplode(&exploded_start);
+  cert.valid_expiry().UTCExplode(&exploded_expiry);
+
+  int month_diff =
+    exploded_expiry.year * 12 + exploded_expiry.month -
+      exploded_start.year * 12 - exploded_start.month;

[Ryan Sleevi, 2014/10/29 22:22:07]

I still hate math and years, but also hate multiplying ints by 12. Even if they
shouldn't exceed 9999.

if ((exploded_expiry.year - exploded_start.year) > 10)
  return true;
int month_diff =
    (exploded_expiry.year - exploded_start.year) * 12 +
    (exploded_expiry.month - exploded_start.month);

2014/01 - 2014/03 = 0 * 12 + (3 - 1) = 2
2014/01 - 2015/01 = 1 * 12 + (1 - 1) = 12
2014/12 - 2015/01 = 1 * 12 + (1 - 12) = 1
2014/01 - 2015/03 = 1 * 12 + (3 - 1) = 14

Pretty sure the math works...

(If you disagree, well, your indents are still wrong at least. git cl format
that)

[palmer, 2014/10/30 01:23:16]

Done.

+  // Add any remainder as a full month.
+  if (exploded_expiry.day_of_month > exploded_start.day_of_month)
+    ++month_diff;
+
+  static const base::Time time_2015_04_01 = base::Time::FromInternalValue(
+      GG_INT64_C(1427871600));

[Ryan Sleevi, 2014/10/29 22:22:07]

GG_ is deprecated. Long live the <stdint.h> macros of INT64_C

[palmer, 2014/10/30 01:23:16]

Done.

+  static const base::Time time_2012_07_01 = base::Time::FromInternalValue(
+      GG_INT64_C(1341126000));
+  static const base::Time time_2019_07_01 = base::Time::FromInternalValue(
+      GG_INT64_C(1561964400));
+
+  if (start >= time_2015_04_01)
+    return month_diff > 39;
+  if (start >= time_2012_07_01)
+    return month_diff > 60;
+  return month_diff > 120 || expiry > time_2019_07_01;
+}
+
 }  // namespace net