authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-02 13:18:56-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-02 16:57:16-07:00
log9ca6d673457723548d8fe721b44499817ead1d2d
tree699b91e6953809a86ea6df6ae866f7d6832599ed
parent97acdeeca86af4111972aeb57dd9c792e7f1f419

std.crypto.tls.Certificate: make the current time a parameter

3 files changed, 8 insertions(+), 8 deletions(-)

lib/std/crypto/Certificate.zig+3-4
...@@ -198,14 +198,13 @@ pub const Parsed = struct {...@@ -198,14 +198,13 @@ pub const Parsed = struct {
198 /// * That the subject's issuer is indeed the provided issuer.198 /// * That the subject's issuer is indeed the provided issuer.
199 /// * The time validity of the subject.199 /// * The time validity of the subject.
200 /// * The signature.200 /// * The signature.
201 pub fn verify(parsed_subject: Parsed, parsed_issuer: Parsed) VerifyError!void {201 pub fn verify(parsed_subject: Parsed, parsed_issuer: Parsed, now_sec: i64) VerifyError!void {
202 // Check that the subject's issuer name matches the issuer's202 // Check that the subject's issuer name matches the issuer's
203 // subject name.203 // subject name.
204 if (!mem.eql(u8, parsed_subject.issuer(), parsed_issuer.subject())) {204 if (!mem.eql(u8, parsed_subject.issuer(), parsed_issuer.subject())) {
205 return error.CertificateIssuerMismatch;205 return error.CertificateIssuerMismatch;
206 }206 }
207207
208 const now_sec = std.time.timestamp();
209 if (now_sec < parsed_subject.validity.not_before)208 if (now_sec < parsed_subject.validity.not_before)
210 return error.CertificateNotYetValid;209 return error.CertificateNotYetValid;
211 if (now_sec > parsed_subject.validity.not_after)210 if (now_sec > parsed_subject.validity.not_after)
...@@ -419,10 +418,10 @@ pub fn parse(cert: Certificate) !Parsed {...@@ -419,10 +418,10 @@ pub fn parse(cert: Certificate) !Parsed {
419 };418 };
420}419}
421420
422pub fn verify(subject: Certificate, issuer: Certificate) !void {421pub fn verify(subject: Certificate, issuer: Certificate, now_sec: i64) !void {
423 const parsed_subject = try subject.parse();422 const parsed_subject = try subject.parse();
424 const parsed_issuer = try issuer.parse();423 const parsed_issuer = try issuer.parse();
425 return parsed_subject.verify(parsed_issuer);424 return parsed_subject.verify(parsed_issuer, now_sec);
426}425}
427426
428pub fn contents(cert: Certificate, elem: der.Element) []const u8 {427pub fn contents(cert: Certificate, elem: der.Element) []const u8 {
lib/std/crypto/Certificate/Bundle.zig+2-2
...@@ -13,7 +13,7 @@ pub const VerifyError = Certificate.Parsed.VerifyError || error{...@@ -13,7 +13,7 @@ pub const VerifyError = Certificate.Parsed.VerifyError || error{
13 CertificateIssuerNotFound,13 CertificateIssuerNotFound,
14};14};
1515
16pub fn verify(cb: Bundle, subject: Certificate.Parsed) VerifyError!void {16pub fn verify(cb: Bundle, subject: Certificate.Parsed, now_sec: i64) VerifyError!void {
17 const bytes_index = cb.find(subject.issuer()) orelse return error.CertificateIssuerNotFound;17 const bytes_index = cb.find(subject.issuer()) orelse return error.CertificateIssuerNotFound;
18 const issuer_cert: Certificate = .{18 const issuer_cert: Certificate = .{
19 .buffer = cb.bytes.items,19 .buffer = cb.bytes.items,
...@@ -22,7 +22,7 @@ pub fn verify(cb: Bundle, subject: Certificate.Parsed) VerifyError!void {...@@ -22,7 +22,7 @@ pub fn verify(cb: Bundle, subject: Certificate.Parsed) VerifyError!void {
22 // Every certificate in the bundle is pre-parsed before adding it, ensuring22 // Every certificate in the bundle is pre-parsed before adding it, ensuring
23 // that parsing will succeed here.23 // that parsing will succeed here.
24 const issuer = issuer_cert.parse() catch unreachable;24 const issuer = issuer_cert.parse() catch unreachable;
25 try subject.verify(issuer);25 try subject.verify(issuer, now_sec);
26}26}
2727
28/// The returned bytes become invalid after calling any of the rescan functions28/// The returned bytes become invalid after calling any of the rescan functions
lib/std/crypto/tls/Client.zig+3-2
...@@ -351,6 +351,7 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) !C...@@ -351,6 +351,7 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) !C
351 var main_cert_pub_key_algo: Certificate.AlgorithmCategory = undefined;351 var main_cert_pub_key_algo: Certificate.AlgorithmCategory = undefined;
352 var main_cert_pub_key_buf: [300]u8 = undefined;352 var main_cert_pub_key_buf: [300]u8 = undefined;
353 var main_cert_pub_key_len: u16 = undefined;353 var main_cert_pub_key_len: u16 = undefined;
354 const now_sec = std.time.timestamp();
354355
355 while (true) {356 while (true) {
356 try d.readAtLeastOurAmt(stream, tls.record_header_len);357 try d.readAtLeastOurAmt(stream, tls.record_header_len);
...@@ -458,10 +459,10 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) !C...@@ -458,10 +459,10 @@ pub fn init(stream: anytype, ca_bundle: Certificate.Bundle, host: []const u8) !C
458 @memcpy(&main_cert_pub_key_buf, pub_key.ptr, pub_key.len);459 @memcpy(&main_cert_pub_key_buf, pub_key.ptr, pub_key.len);
459 main_cert_pub_key_len = @intCast(@TypeOf(main_cert_pub_key_len), pub_key.len);460 main_cert_pub_key_len = @intCast(@TypeOf(main_cert_pub_key_len), pub_key.len);
460 } else {461 } else {
461 try prev_cert.verify(subject);462 try prev_cert.verify(subject, now_sec);
462 }463 }
463464
464 if (ca_bundle.verify(subject)) |_| {465 if (ca_bundle.verify(subject, now_sec)) |_| {
465 handshake_state = .trust_chain_established;466 handshake_state = .trust_chain_established;
466 break :cert;467 break :cert;
467 } else |err| switch (err) {468 } else |err| switch (err) {