Implement certificate lifetime parameter as required by WebRTC RFC.

webrtc/base/sslidentity.h

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 107 matching lines @@
 // TODO(hbos,torbjorng): Don't change KT_DEFAULT without first updating
 // PeerConnectionFactory_nativeCreatePeerConnection's certificate generation
 // code.
 enum KeyType { KT_RSA, KT_ECDSA, KT_LAST, KT_DEFAULT = KT_RSA };
 
 static const int kRsaDefaultModSize = 1024;
 static const int kRsaDefaultExponent = 0x10001;  // = 2^16+1 = 65537
 static const int kRsaMinModSize = 1024;
 static const int kRsaMaxModSize = 8192;
 
+// Certificate default validity lifetime.
+static const int CERTIFICATE_LIFETIME = 60*60*24*30;  // 30 days, arbitrarily

[tommi, 2016/02/11 16:59:30]

spaces around operators.
Also, this should be kCertificateLifetime

[torbjorng (webrtc), 2016/02/12 10:54:32]

Done.

+// Certificate validity window.
+// This is to compensate for slightly incorrect system clocks.
+static const int CERTIFICATE_WINDOW = -60*60*24;

[tommi, 2016/02/11 16:59:30]

same thing here

[torbjorng (webrtc), 2016/02/12 10:54:32]

Done.

+
 struct RSAParams {
   unsigned int mod_size;
   unsigned int pub_exp;
 };
 
 enum ECCurve { EC_NIST_P256, /* EC_FANCY, */ EC_LAST };
 
 class KeyParams {
  public:
   // Generate a KeyParams object from a simple KeyType, using default params.
@@ skipping 43 matching lines @@
 // Our identity in an SSL negotiation: a keypair and certificate (both
 // with the same public key).
 // This too is pretty much immutable once created.
 class SSLIdentity {
  public:
   // Generates an identity (keypair and self-signed certificate). If
   // common_name is non-empty, it will be used for the certificate's
   // subject and issuer name, otherwise a random string will be used.
   // Returns NULL on failure.
   // Caller is responsible for freeing the returned object.
   static SSLIdentity* Generate(const std::string& common_name,

[hbos, 2016/02/11 16:37:04]

Add a comment about |certificate_lifetime| and say that it should be >= 0.
(Technically it would still work if it was >= CERTIFICATE_WINDOW but that's an
implementation detail that I don't think should be documented in the API)

[tommi, 2016/02/11 16:59:30]

having dchecks for the expected valid values, helps

[torbjorng (webrtc), 2016/02/12 10:54:32]

Done.

-                               const KeyParams& key_param);
+                               const KeyParams& key_param,
+                               time_t certificate_lifetime);
+  static SSLIdentity* Generate(const std::string& common_name,
+                               const KeyParams& key_param) {
+    return Generate(common_name, key_param, CERTIFICATE_LIFETIME);
+  }
   static SSLIdentity* Generate(const std::string& common_name,
                                KeyType key_type) {
     return Generate(common_name, KeyParams(key_type));
   }
 
   // Generates an identity with the specified validity period.
+  // TODO(torbjorng): Now that Generate() accepts relevant params, make tests
+  // use that instead of this function.
   static SSLIdentity* GenerateForTest(const SSLIdentityParams& params);
 
   // Construct an identity from a private key and a certificate.
   static SSLIdentity* FromPEMStrings(const std::string& private_key,
                                      const std::string& certificate);
 
   virtual ~SSLIdentity() {}
 
   // Returns a new SSLIdentity object instance wrapping the same
   // identity information.
@@ skipping 18 matching lines @@
 // |s| is not 0-terminated; its char count is defined by |length|.
 int64_t ASN1TimeToSec(const unsigned char* s, size_t length, bool long_format);
 
 extern const char kPemTypeCertificate[];
 extern const char kPemTypeRsaPrivateKey[];
 extern const char kPemTypeEcPrivateKey[];
 
 }  // namespace rtc
 
 #endif  // WEBRTC_BASE_SSLIDENTITY_H_