Add CheckOCSPDateValid() to net/cert/internal

net/cert/internal/parse_ocsp.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PARSE_OCSP_H_
 #define NET_CERT_INTERNAL_PARSE_OCSP_H_
 
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "net/base/hash_value.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/der/input.h"
 #include "net/der/parse_values.h"
 #include "net/der/parser.h"
 #include "net/der/tag.h"
 
+namespace base {
+class Time;
+}
+
 namespace net {
 
 // OCSPCertID contains a representation of a DER-encoded RFC 6960 "CertID".
 //
 // CertID ::= SEQUENCE {
 //    hashAlgorithm           AlgorithmIdentifier,
 //    issuerNameHash          OCTET STRING, -- Hash of issuer's DN
 //    issuerKeyHash           OCTET STRING, -- Hash of issuer's public key
 //    serialNumber            CertificateSerialNumber
 // }
@@ skipping 241 matching lines @@
 // 4.2.2.3), the strictest response is returned (REVOKED > UNKNOWN > GOOD).
 //
 // On failure |out| has an undefined state. Some of its fields may have been
 // updated during parsing, whereas others may not have been changed.
 NET_EXPORT_PRIVATE bool GetOCSPCertStatus(
     const OCSPResponseData& response_data,
     const der::Input& issuer_tbs_certificate_tlv,
     const der::Input& cert_tbs_certificate_tlv,
     OCSPCertStatus* out);
 
+// Checks that thisUpdate <= verify_time, and that verify_time <
+// thisUpdate + max_age. If |response| has a nextUpdate, then this also enforces
+// that |verify_time| < nextUpdate.

[Ryan Sleevi, 2016/06/28 17:33:30]

COMMENT: "Checks" doesn't really describe what the bool result would be

// Returns true if |response|, a valid OCSP response with a thisUpdate
// field and potentially a nextUpdate field, is valid at |verify_time|
// and not older than |max_age|.
// Expressed differently, returns true if
// response.thisUpdate <= verify_time < min(response.thisUpdate + max_age,
response.nextUpdate)

[dadrian, 2016/06/29 22:54:02]

Done.

+NET_EXPORT_PRIVATE bool CheckOCSPDateValid(const OCSPSingleResponse& response,
+                                           const base::Time& verify_time,
+                                           const base::TimeDelta& max_age);
+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSE_OCSP_H_