mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Reword documentation for {SCT_CTX/CT_POLICY_EVAL_CTX}_set_time

Browse Source 
Do not call the time "current", as a different time can be provided.
For example, a time slightly in the future, to provide tolerance for
CT logs with a clock that is running fast.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1554)
This commit is contained in:
Rob Percival 2016-09-12 10:28:21 +01:00 committed by Rich Salz
parent 333c2e4372
commit 1871a5aa8a
3 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
crypto/ct/ct_locl.h
View File

@ -155,10 +155,11 @@ __owur int SCT_CTX_set1_issuer_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
__owur int SCT_CTX_set1_pubkey(SCT_CTX *sctx, X509_PUBKEY *pubkey);
/*
* Sets the current time, in milliseconds since the Unix epoch.
* The timestamp of the SCT will be compared to this, to check that it was not
* issued in the future. RFC6962 states that "TLS clients MUST reject SCTs whose
* timestamp is in the future", so SCT verification will fail in this case.
* Sets the time to evaluate the SCT against, in milliseconds since the Unix
* epoch. If the SCT's timestamp is after this time, it will be interpreted as
* having been issued in the future. RFC6962 states that "TLS clients MUST
* reject SCTs whose timestamp is in the future", so an SCT will not validate
* in this case.
*/
void SCT_CTX_set_time(SCT_CTX *sctx, uint64_t time_in_ms);

9
doc/man3/CT_POLICY_EVAL_CTX_new.pod
View File

@ -64,11 +64,14 @@ Increments the reference count of the certificate.
Holds a pointer to the CTLOG_STORE, so the CTLOG_STORE must outlive the
CT_POLICY_EVAL_CTX.
=item * CT_POLICY_EVAL_CTX_set_time() to provide the current time
=item * CT_POLICY_EVAL_CTX_set_time() to set the time SCTs should be compared with to determine if they are valid
The SCT timestamp will be compared to this time to check whether the SCT was
supposedly issued in the future. RFC6962 states that "TLS clients MUST reject
SCTs whose timestamp is in the future".
issued in the future. RFC6962 states that "TLS clients MUST reject SCTs whose
timestamp is in the future". Typically, the time provided to this function will
be the current time.
The time should be in milliseconds since the Unix epoch.
=back

6
include/openssl/ct.h
View File

@ -106,9 +106,9 @@ void CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx,
uint64_t CT_POLICY_EVAL_CTX_get_time(const CT_POLICY_EVAL_CTX *ctx);
/*
* Sets the current time, in milliseconds since the Unix epoch.
* The timestamps of the SCTs will be compared to this, to check that they were
* not issued in the future. RFC6962 states that "TLS clients MUST reject SCTs
* Sets the time to evaluate SCTs against, in milliseconds since the Unix epoch.
* If an SCT's timestamp is after this time, it will be interpreted as having
* been issued in the future. RFC6962 states that "TLS clients MUST reject SCTs
* whose timestamp is in the future", so an SCT will not validate in this case.
*/
void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms);