| author |  Andrew Kelley <andrew@ziglang.org> 2023-01-02 13:18:56-07:00 |
| committer | Andrew Kelley <andrew@ziglang.org> 2023-01-02 16:57:16-07:00 |
| log | 9ca6d673457723548d8fe721b44499817ead1d2d |
| tree | 699b91e6953809a86ea6df6ae866f7d6832599ed |
| parent | 97acdeeca86af4111972aeb57dd9c792e7f1f419 |
std.crypto.tls.Certificate: make the current time a parameter
3 files changed, 8 insertions(+), 8 deletions(-)
lib
std
crypto
- Certificate.zig
Certificate
tls
lib/std/crypto/Certificate.zig+3-4
| ... | ... | @@ -198,14 +198,13 @@ pub const Parsed = struct { |
| 198 | 198 | /// * That the subject's issuer is indeed the provided issuer. |
| 199 | 199 | /// * The time validity of the subject. |
| 200 | 200 | /// * The signature. |
| 201 | pub fn verify(parsed_subject: Parsed, parsed_issuer: Parsed) VerifyError!void { | |
| 201 | pub fn verify(parsed_subject: Parsed, parsed_issuer: Parsed, now_sec: i64) VerifyError!void { | |
| 202 | 202 | // Check that the subject's issuer name matches the issuer's |
| 203 | 203 | // subject name. |
| 204 | 204 | if (!mem.eql(u8, parsed_subject.issuer(), parsed_issuer.subject())) { |
| 205 | 205 | return error.CertificateIssuerMismatch; |
| 206 | 206 | } |
| 207 | 207 | |
| 208 | const now_sec = std.time.timestamp(); | |
| 209 | 208 | if (now_sec < parsed_subject.validity.not_before) |
| 210 | 209 | return error.CertificateNotYetValid; |
| 211 | 210 | if (now_sec > parsed_subject.validity.not_after) |
| ... | ... | @@ -419,10 +418,10 @@ pub fn parse(cert: Certificate) !Parsed { |
| 419 | 418 | }; |
| 420 | 419 | } |
| 421 | 420 | |
| 422 | pub fn verify(subject: Certificate, issuer: Certificate) !void { | |
| 421 | pub fn verify(subject: Certificate, issuer: Certificate, now_sec: i64) !void { | |
| 423 | 422 | const parsed_subject = try subject.parse(); |
| 424 | 423 | const parsed_issuer = try issuer.parse(); |
| 425 | return parsed_subject.verify(parsed_issuer); | |
| 424 | return parsed_subject.verify(parsed_issuer, now_sec); | |
| 426 | 425 | } |
| 427 | 426 | |
| 428 | 427 | pub fn contents(cert: Certificate, elem: der.Element) []const u8 { |
lib/std/crypto/Certificate/Bundle.zig+2-2
| ... | ... | @@ -13,7 +13,7 @@ pub const VerifyError = Certificate.Parsed.VerifyError || error{ |
| 13 | 13 | CertificateIssuerNotFound, |
| 14 | 14 | }; |
| 15 | 15 | |
| 16 | pub fn verify(cb: Bundle, subject: Certificate.Parsed) VerifyError!void { | |
| 16 | pub fn verify(cb: Bundle, subject: Certificate.Parsed, now_sec: i64) VerifyError!void { | |
| 17 | 17 | const bytes_index = cb.find(subject.issuer()) orelse return error.CertificateIssuerNotFound; |
| 18 | 18 | const issuer_cert: Certificate = .{ |
| 19 | 19 | .buffer = cb.bytes.items, |
| ... | ... | @@ -22,7 +22,7 @@ pub fn verify(cb: Bundle, subject: Certificate.Parsed) VerifyError!void { |
| 22 | 22 | // Every certificate in the bundle is pre-parsed before adding it, ensuring |
| 23 | 23 | // that parsing will succeed here. |
| 24 | 24 | const issuer = issuer_cert.parse() catch unreachable; |
| 25 | try subject.verify(issuer); | |
| 25 | try subject.verify(issuer, now_sec); | |
| 26 | 26 | } |
| 27 | 27 | |
| 28 | 28 | /// The returned bytes become invalid after calling any of the rescan functions |
lib/std/crypto/tls/Client.zig+3-2
| ... | ... | @@ -351,6 +351,7 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) !C |
| 351 | 351 | var main_cert_pub_key_algo: Certificate.AlgorithmCategory = undefined; |
| 352 | 352 | var main_cert_pub_key_buf: [300]u8 = undefined; |
| 353 | 353 | var main_cert_pub_key_len: u16 = undefined; |
| 354 | const now_sec = std.time.timestamp(); | |
| 354 | 355 | |
| 355 | 356 | while (true) { |
| 356 | 357 | try d.readAtLeastOurAmt(stream, tls.record_header_len); |
| ... | ... | @@ -458,10 +459,10 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) !C |
| 458 | 459 | @memcpy(&main_cert_pub_key_buf, pub_key.ptr, pub_key.len); |
| 459 | 460 | main_cert_pub_key_len = @intCast(@TypeOf(main_cert_pub_key_len), pub_key.len); |
| 460 | 461 | } else { |
| 461 | try prev_cert.verify(subject); | |
| 462 | try prev_cert.verify(subject, now_sec); | |
| 462 | 463 | } |
| 463 | 464 | |
| 464 | if (ca_bundle.verify(subject)) |_| { | |
| 465 | if (ca_bundle.verify(subject, now_sec)) |_| { | |
| 465 | 466 | handshake_state = .trust_chain_established; |
| 466 | 467 | break :cert; |
| 467 | 468 | } else |err| switch (err) { |