Don't verify the policy timestamp when loading from cache.

chrome/browser/chromeos/settings/session_manager_operation.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/settings/session_manager_operation.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/files/file_path.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 144 matching lines @@
       content::BrowserThread::GetBlockingPool();
   scoped_refptr<base::SequencedTaskRunner> background_task_runner =
       pool->GetSequencedTaskRunnerWithShutdownBehavior(
           pool->GetSequenceToken(),
           base::SequencedWorkerPool::SKIP_ON_SHUTDOWN);
 
   policy::DeviceCloudPolicyValidator* validator =
       policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
                                                  background_task_runner);
 
-  // Policy auto-generated by session manager doesn't include a timestamp, so we
-  // need to allow missing timestamps.
-  const bool require_timestamp =
-      policy_data_.get() && policy_data_->has_request_token();
+
+  // Policy auto-generated by session manager doesn't include a timestamp, so
+  // the timestamp shouldn't be verified in that case.
+  //
+  // Additionally, offline devices can get their clock set backwards in time
+  // under some hardware conditions; checking the timestamp now could likely
+  // find a value in the future, and prevent the user from signing-in or
+  // starting guest mode. Tlsdate will eventually fix the clock when the device
+  // is back online, but the network configuration may come from device ONC.
+  //
+  // To prevent all of these issues the timestamp is just not verified when
+  // loading the device policy from the cache. Note that the timestamp is still
+  // verified during enrollment and when a new policy is fetched from the
+  // server.
   validator->ValidateAgainstCurrentPolicy(
       policy_data_.get(),
-      require_timestamp ?
-          policy::CloudPolicyValidatorBase::TIMESTAMP_REQUIRED :
-          policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
+      policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
   validator->ValidatePayload();
   validator->ValidateSignature(*owner_key_->public_key(), false);
   validator->StartValidation(
       base::Bind(&SessionManagerOperation::ReportValidatorStatus,
                  weak_factory_.GetWeakPtr()));
 }
 
 void SessionManagerOperation::ReportValidatorStatus(
@@ skipping 133 matching lines @@
 }
 
 void SignAndStoreSettingsOperation::HandleStoreResult(bool success) {
   if (!success)
     ReportResult(DeviceSettingsService::STORE_OPERATION_FAILED);
   else
     StartLoading();
 }
 
 }  // namespace chromeos