Don't verify the policy timestamp when loading from cache.

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/values.h"
 #include "chrome/browser/policy/cloud/device_management_service.h"
@@ skipping 27 matching lines @@
   session_manager_client_->RetrieveDeviceLocalAccountPolicy(
       account_id_,
       base::Bind(&DeviceLocalAccountPolicyStore::ValidateLoadedPolicyBlob,
                  weak_factory_.GetWeakPtr()));
 }
 
 void DeviceLocalAccountPolicyStore::Store(
     const em::PolicyFetchResponse& policy) {
   weak_factory_.InvalidateWeakPtrs();
   CheckKeyAndValidate(
+      true,
       make_scoped_ptr(new em::PolicyFetchResponse(policy)),
       base::Bind(&DeviceLocalAccountPolicyStore::StoreValidatedPolicy,
                  weak_factory_.GetWeakPtr()));
 }
 
 void DeviceLocalAccountPolicyStore::ValidateLoadedPolicyBlob(
     const std::string& policy_blob) {
   if (policy_blob.empty()) {
     status_ = CloudPolicyStore::STATUS_LOAD_ERROR;
     NotifyStoreError();
   } else {
     scoped_ptr<em::PolicyFetchResponse> policy(new em::PolicyFetchResponse());
     if (policy->ParseFromString(policy_blob)) {
       CheckKeyAndValidate(
+          false,
           policy.Pass(),
           base::Bind(&DeviceLocalAccountPolicyStore::UpdatePolicy,
                      weak_factory_.GetWeakPtr()));
     } else {
       status_ = CloudPolicyStore::STATUS_PARSE_ERROR;
       NotifyStoreError();
     }
   }
 }
 
@@ skipping 68 matching lines @@
 void DeviceLocalAccountPolicyStore::HandleStoreResult(bool success) {
   if (!success) {
     status_ = CloudPolicyStore::STATUS_STORE_ERROR;
     NotifyStoreError();
   } else {
     Load();
   }
 }
 
 void DeviceLocalAccountPolicyStore::CheckKeyAndValidate(
+    bool valid_timestamp_required,
     scoped_ptr<em::PolicyFetchResponse> policy,
     const UserCloudPolicyValidator::CompletionCallback& callback) {
   device_settings_service_->GetOwnershipStatusAsync(
       base::Bind(&DeviceLocalAccountPolicyStore::Validate,
                  weak_factory_.GetWeakPtr(),
+                 valid_timestamp_required,
                  base::Passed(&policy),
                  callback));
 }
 
 void DeviceLocalAccountPolicyStore::Validate(
+    bool valid_timestamp_required,
     scoped_ptr<em::PolicyFetchResponse> policy_response,
     const UserCloudPolicyValidator::CompletionCallback& callback,
     chromeos::DeviceSettingsService::OwnershipStatus ownership_status) {
   DCHECK_NE(chromeos::DeviceSettingsService::OWNERSHIP_UNKNOWN,
             ownership_status);
   scoped_refptr<chromeos::OwnerKey> key =
       device_settings_service_->GetOwnerKey();
   if (!key.get() || !key->public_key()) {
     status_ = CloudPolicyStore::STATUS_BAD_STATE;
     NotifyStoreLoaded();
     return;
   }
 
   scoped_ptr<UserCloudPolicyValidator> validator(
       UserCloudPolicyValidator::Create(policy_response.Pass(),
                                        background_task_runner()));
   validator->ValidateUsername(account_id_);
   validator->ValidatePolicyType(dm_protocol::kChromePublicAccountPolicyType);
+  // The timestamp is verified when storing a new policy downloaded from the
+  // server but not when loading a cached policy from disk.
+  // See SessionManagerOperation::ValidateDeviceSettings for the rationale.
   validator->ValidateAgainstCurrentPolicy(
       policy(),
-      CloudPolicyValidatorBase::TIMESTAMP_REQUIRED,
+      valid_timestamp_required
+          ? CloudPolicyValidatorBase::TIMESTAMP_REQUIRED
+          : CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
       CloudPolicyValidatorBase::DM_TOKEN_REQUIRED);
   validator->ValidatePayload();
   validator->ValidateSignature(*key->public_key(), false);
   validator.release()->StartValidation(callback);
 }
 
 }  // namespace policy