net: fallback to online revocation checks for EV status when CRLSet has expired.

net/base/crl_set.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/base64.h"
 #include "base/format_macros.h"
 #include "base/json/json_reader.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/string_util.h"
@@ skipping 522 matching lines @@
       return REVOKED;
     }
   }
 
   return GOOD;
 }
 
 CRLSet::Result CRLSet::CheckSerial(
     const base::StringPiece& serial_number,
     const base::StringPiece& issuer_spki_hash) const {
-  Result result = CheckSerialIsRevoked(serial_number, issuer_spki_hash);
-  // If we get a revoked signal then we return that no matter how old the
-  // CRLSet is.
-  if (result == REVOKED)
-    return result;
-  if (not_after_ > 0) {
-    uint64 now = base::Time::Now().ToTimeT();
-    if (now > not_after_)
-      return CRL_SET_EXPIRED;
-  }
-  return result;
-}
-
-CRLSet::Result CRLSet::CheckSerialIsRevoked(
-    const base::StringPiece& serial_number,
-    const base::StringPiece& issuer_spki_hash) const {
   base::StringPiece serial(serial_number);
 
   if (!serial.empty() && (serial[0] & 0x80) != 0) {
     // This serial number is negative but the process which generates CRL sets
     // will reject any certificates with negative serial numbers as invalid.
     return UNKNOWN;
   }
 
   // Remove any leading zero bytes.
   while (serial.size() > 1 && serial[0] == 0x00)
     serial.remove_prefix(1);
 
   std::map<std::string, size_t>::const_iterator i =
       crls_index_by_issuer_.find(issuer_spki_hash.as_string());
   if (i == crls_index_by_issuer_.end())
     return UNKNOWN;
   const std::vector<std::string>& serials = crls_[i->second].second;
 
   for (std::vector<std::string>::const_iterator i = serials.begin();
        i != serials.end(); ++i) {
     if (base::StringPiece(*i) == serial)
       return REVOKED;
   }
 
   return GOOD;
 }
 
+bool CRLSet::IsExpired() const {
+  if (not_after_ == 0)

[Ryan Sleevi, 2012/03/16 00:50:52]

is 0 some magic value for "never expires" ? I notice it was in the original code
at line 548, but perhaps this is non-obvious, especially since not_after_ will
generally be zero-initialized when creating a new CRLSet.

[agl, 2012/03/20 20:02:19]

Yes, this is for backwards compatibility was CRLSets that were generated prior
to the addition of the NotAfter field.

+    return false;
+
+  uint64 now = base::Time::Now().ToTimeT();
+  return now > not_after_;
+}
+
 uint32 CRLSet::sequence() const {
   return sequence_;
 }
 
 const CRLSet::CRLList& CRLSet::crls() const {
   return crls_;
 }
 
+// static
+CRLSet* CRLSet::EmptyCRLSetForTesting() {
+  return new CRLSet;
+}
+
+CRLSet* CRLSet::ExpiredCRLSetForTesting() {
+  CRLSet* crl_set = new CRLSet;
+  crl_set->not_after_ = 1;
+  return crl_set;
+}
+
 }  // namespace net