Limit lifetime of self-signed certificate used for TLS on Cast channel

extensions/browser/api/cast_channel/cast_socket.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_socket.h"
 
 #include <stdlib.h>
 #include <string.h>
 
 #include "base/bind.h"
@@ skipping 145 matching lines @@
 bool CastSocket::ExtractPeerCert(std::string* cert) {
   DCHECK(cert);
   DCHECK(peer_cert_.empty());
   net::SSLInfo ssl_info;
   if (!socket_->GetSSLInfo(&ssl_info) || !ssl_info.cert.get()) {
     return false;
   }
 
   logger_->LogSocketEvent(channel_id_, proto::SSL_INFO_OBTAINED);
 
+  // we need to ensure that the peer cert (which is self-signed) doesn't have an

[mark a. foltz, 2014/11/21 00:14:53]

Nit: Start sentence with "Ensure"

+  // excessive life-time (i.e. no more than 2 days).
+  base::Time expiry = ssl_info.cert->valid_expiry();
+  if (expiry.is_null() ||
+      expiry > base::Time::Now() + base::TimeDelta::FromDays(2)) {

[mark a. foltz, 2014/11/21 00:14:53]

Please declare a constant for "2" for the maximum lifetime in days.

+    LOG(ERROR) << "Peer cert has excessive lifetime. expiry=" << expiry;

[mark a. foltz, 2014/11/21 00:14:53]

We'll want to log a socket event for an expired cert.

- Add an enum value SSL_CERT_EXPIRED to the proto here:
https://code.google.com/p/chromium/codesearch#chromium/src/extensions/common/...

- Call logger_->LogSocketEventWithDetails(channel_id_, SSL_CERT_EXPIRED, ...)
with the expiry time as the detail message

[Kevin Marshall, 2014/11/21 00:41:13]

Also log the IP endpoint.

+    return false;
+  }
+
   bool result = net::X509Certificate::GetDEREncoded(
      ssl_info.cert->os_cert_handle(), cert);
   if (result) {
     VLOG_WITH_CONNECTION(1) << "Successfully extracted peer certificate: "
                             << *cert;

[mark a. foltz, 2014/11/21 00:14:53]

Can you please remove the << *cert line while you are here? This dumps binary
data into the text log which is not very helpful.

   }
 
   logger_->LogSocketEventWithRv(
       channel_id_, proto::DER_ENCODED_CERT_OBTAIN, result ? 1 : 0);
   return result;
 }
 
 bool CastSocket::VerifyChallengeReply() {
   AuthResult result = AuthenticateChallengeReply(*challenge_reply_, peer_cert_);
   logger_->LogSocketChallengeReplyEvent(channel_id_, result);
@@ skipping 696 matching lines @@
 }
 
 CastSocket::WriteRequest::~WriteRequest() {
 }
 
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions
 
 #undef VLOG_WITH_CONNECTION