Add CheckOCSPDateValid() to net/cert/internal

net/der/parse_values.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <tuple>
 
 #include "base/logging.h"
 #include "base/numerics/safe_math.h"
+#include "base/time/time.h"
 #include "net/der/parse_values.h"
 
 namespace net {
 
 namespace der {
 
 namespace {
 
 bool ParseBoolInternal(const Input& in, bool* out, bool relaxed) {
   // According to ITU-T X.690 section 8.2, a bool is encoded as a single octet
@@ skipping 357 matching lines @@
   }
   uint8_t zulu;
   if (!reader.ReadByte(&zulu) || zulu != 'Z' || reader.HasMore())
     return false;
   if (!ValidateGeneralizedTime(time))
     return false;
   *value = time;
   return true;
 }
 
+der::GeneralizedTime ConvertBaseUTCTime(const base::Time& time) {
+  base::Time::Exploded exploded;
+  time.UTCExplode(&exploded);
+
+  der::GeneralizedTime result;
+  result.year = exploded.year;
+  result.month = exploded.month;
+  result.day = exploded.day_of_month;
+  result.hours = exploded.hour;
+  result.minutes = exploded.minute;
+  result.seconds = exploded.second;
+  DCHECK(ValidateGeneralizedTime(result));

[Ryan Sleevi, 2016/06/28 17:33:30]

Why DCHECK here? A DCHECK signals that there's a caller error here - so what is
the caller supposed to be checking?

If they have something that base::Time accepted, why are they at fault?
If it's something that time.UTCExplode(...) can't handle (e.g. Y2038), why are
they at fault?

The core of this should be explaining "How are you supposed to hold this API
correctly" - and I'm not sure what the caller is supposed to do, either for
'malicious' inputs or for benign one. If the user's clock is wonky, is that an
API misuse error? Or is that a condition we should be handling - gracefully?

[dadrian, 2016/06/28 19:15:27]

Presumably we should handle this the same way explode does, although perhaps a
better idea is to convert der::GeneralizedTime to base::Time, with an API that
can fail similar to Time::FromExploded(), and compare base::Time objects
instead.

[dadrian, 2016/06/29 22:54:02]

Nvm, just removed the DCHECK().

+  return result;
+}
+
 }  // namespace der
 
 }  // namespace net