Don't verify the policy timestamp when loading from cache.

chrome/browser/policy/cloud/cloud_policy_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/cloud/cloud_policy_validator.h"
 
 #include "base/bind_helpers.h"
 #include "base/message_loop/message_loop.h"
 #include "base/sequenced_task_runner.h"
 #include "base/stl_util.h"
@@ skipping 258 matching lines @@
 CloudPolicyValidatorBase::Status CloudPolicyValidatorBase::CheckTimestamp() {
   if (!policy_data_->has_timestamp()) {
     if (timestamp_option_ == TIMESTAMP_NOT_REQUIRED) {
       return VALIDATION_OK;
     } else {
       LOG(ERROR) << "Policy timestamp missing";
       return VALIDATION_BAD_TIMESTAMP;
     }
   }
 
-  if (policy_data_->timestamp() < timestamp_not_before_) {
+  if (timestamp_option_ != TIMESTAMP_NOT_REQUIRED &&
+      policy_data_->timestamp() < timestamp_not_before_) {
+    // If |timestamp_option_| is TIMESTAMP_REQUIRED or TIMESTAMP_NOT_BEFORE
+    // then this is a failure.
     LOG(ERROR) << "Policy too old: " << policy_data_->timestamp();
     return VALIDATION_BAD_TIMESTAMP;
   }
-  if (timestamp_option_ != TIMESTAMP_NOT_BEFORE &&
+  if (timestamp_option_ == TIMESTAMP_REQUIRED &&
       policy_data_->timestamp() > timestamp_not_after_) {
     LOG(ERROR) << "Policy from the future: " << policy_data_->timestamp();
     return VALIDATION_BAD_TIMESTAMP;
   }
 
   return VALIDATION_OK;
 }
 
 CloudPolicyValidatorBase::Status CloudPolicyValidatorBase::CheckToken() {
   // Make sure the token matches the expected token (if any) and also
@@ skipping 76 matching lines @@
   }
   verifier.VerifyUpdate(reinterpret_cast<const uint8*>(data.c_str()),
                         data.size());
   return verifier.VerifyFinal();
 }
 
 template class CloudPolicyValidator<em::CloudPolicySettings>;
 template class CloudPolicyValidator<em::ExternalPolicyData>;
 
 }  // namespace policy