1e71b7053SJung-uk Kim /*
2*b077aed3SPierre Pronchery * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
3e71b7053SJung-uk Kim *
4*b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5e71b7053SJung-uk Kim * this file except in compliance with the License. You can obtain a copy
6e71b7053SJung-uk Kim * in the file LICENSE in the source distribution or at
7e71b7053SJung-uk Kim * https://www.openssl.org/source/license.html
8e71b7053SJung-uk Kim */
9e71b7053SJung-uk Kim
10e71b7053SJung-uk Kim #ifdef OPENSSL_NO_CT
11e71b7053SJung-uk Kim # error "CT is disabled"
12e71b7053SJung-uk Kim #endif
13e71b7053SJung-uk Kim
14e71b7053SJung-uk Kim #include <openssl/ct.h>
15e71b7053SJung-uk Kim #include <openssl/err.h>
16e71b7053SJung-uk Kim #include <time.h>
17e71b7053SJung-uk Kim
1817f01e99SJung-uk Kim #include "ct_local.h"
19e71b7053SJung-uk Kim
20e71b7053SJung-uk Kim /*
21e71b7053SJung-uk Kim * Number of seconds in the future that an SCT timestamp can be, by default,
22e71b7053SJung-uk Kim * without being considered invalid. This is added to time() when setting a
23e71b7053SJung-uk Kim * default value for CT_POLICY_EVAL_CTX.epoch_time_in_ms.
24e71b7053SJung-uk Kim * It can be overridden by calling CT_POLICY_EVAL_CTX_set_time().
25e71b7053SJung-uk Kim */
26e71b7053SJung-uk Kim static const time_t SCT_CLOCK_DRIFT_TOLERANCE = 300;
27e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_new_ex(OSSL_LIB_CTX * libctx,const char * propq)28*b077aed3SPierre Pronchery CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new_ex(OSSL_LIB_CTX *libctx,
29*b077aed3SPierre Pronchery const char *propq)
30e71b7053SJung-uk Kim {
31e71b7053SJung-uk Kim CT_POLICY_EVAL_CTX *ctx = OPENSSL_zalloc(sizeof(CT_POLICY_EVAL_CTX));
32e71b7053SJung-uk Kim
33e71b7053SJung-uk Kim if (ctx == NULL) {
34*b077aed3SPierre Pronchery ERR_raise(ERR_LIB_CT, ERR_R_MALLOC_FAILURE);
35e71b7053SJung-uk Kim return NULL;
36e71b7053SJung-uk Kim }
37e71b7053SJung-uk Kim
38*b077aed3SPierre Pronchery ctx->libctx = libctx;
39*b077aed3SPierre Pronchery if (propq != NULL) {
40*b077aed3SPierre Pronchery ctx->propq = OPENSSL_strdup(propq);
41*b077aed3SPierre Pronchery if (ctx->propq == NULL) {
42*b077aed3SPierre Pronchery ERR_raise(ERR_LIB_CT, ERR_R_MALLOC_FAILURE);
43*b077aed3SPierre Pronchery OPENSSL_free(ctx);
44*b077aed3SPierre Pronchery return NULL;
45*b077aed3SPierre Pronchery }
46*b077aed3SPierre Pronchery }
47*b077aed3SPierre Pronchery
48e71b7053SJung-uk Kim /* time(NULL) shouldn't ever fail, so don't bother checking for -1. */
49e71b7053SJung-uk Kim ctx->epoch_time_in_ms = (uint64_t)(time(NULL) + SCT_CLOCK_DRIFT_TOLERANCE) *
50e71b7053SJung-uk Kim 1000;
51e71b7053SJung-uk Kim
52e71b7053SJung-uk Kim return ctx;
53e71b7053SJung-uk Kim }
54e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_new(void)55*b077aed3SPierre Pronchery CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new(void)
56*b077aed3SPierre Pronchery {
57*b077aed3SPierre Pronchery return CT_POLICY_EVAL_CTX_new_ex(NULL, NULL);
58*b077aed3SPierre Pronchery }
59*b077aed3SPierre Pronchery
CT_POLICY_EVAL_CTX_free(CT_POLICY_EVAL_CTX * ctx)60e71b7053SJung-uk Kim void CT_POLICY_EVAL_CTX_free(CT_POLICY_EVAL_CTX *ctx)
61e71b7053SJung-uk Kim {
62e71b7053SJung-uk Kim if (ctx == NULL)
63e71b7053SJung-uk Kim return;
64e71b7053SJung-uk Kim X509_free(ctx->cert);
65e71b7053SJung-uk Kim X509_free(ctx->issuer);
66*b077aed3SPierre Pronchery OPENSSL_free(ctx->propq);
67e71b7053SJung-uk Kim OPENSSL_free(ctx);
68e71b7053SJung-uk Kim }
69e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_set1_cert(CT_POLICY_EVAL_CTX * ctx,X509 * cert)70e71b7053SJung-uk Kim int CT_POLICY_EVAL_CTX_set1_cert(CT_POLICY_EVAL_CTX *ctx, X509 *cert)
71e71b7053SJung-uk Kim {
72e71b7053SJung-uk Kim if (!X509_up_ref(cert))
73e71b7053SJung-uk Kim return 0;
74e71b7053SJung-uk Kim ctx->cert = cert;
75e71b7053SJung-uk Kim return 1;
76e71b7053SJung-uk Kim }
77e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_set1_issuer(CT_POLICY_EVAL_CTX * ctx,X509 * issuer)78e71b7053SJung-uk Kim int CT_POLICY_EVAL_CTX_set1_issuer(CT_POLICY_EVAL_CTX *ctx, X509 *issuer)
79e71b7053SJung-uk Kim {
80e71b7053SJung-uk Kim if (!X509_up_ref(issuer))
81e71b7053SJung-uk Kim return 0;
82e71b7053SJung-uk Kim ctx->issuer = issuer;
83e71b7053SJung-uk Kim return 1;
84e71b7053SJung-uk Kim }
85e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX * ctx,CTLOG_STORE * log_store)86e71b7053SJung-uk Kim void CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(CT_POLICY_EVAL_CTX *ctx,
87e71b7053SJung-uk Kim CTLOG_STORE *log_store)
88e71b7053SJung-uk Kim {
89e71b7053SJung-uk Kim ctx->log_store = log_store;
90e71b7053SJung-uk Kim }
91e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX * ctx,uint64_t time_in_ms)92e71b7053SJung-uk Kim void CT_POLICY_EVAL_CTX_set_time(CT_POLICY_EVAL_CTX *ctx, uint64_t time_in_ms)
93e71b7053SJung-uk Kim {
94e71b7053SJung-uk Kim ctx->epoch_time_in_ms = time_in_ms;
95e71b7053SJung-uk Kim }
96e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_get0_cert(const CT_POLICY_EVAL_CTX * ctx)97e71b7053SJung-uk Kim X509* CT_POLICY_EVAL_CTX_get0_cert(const CT_POLICY_EVAL_CTX *ctx)
98e71b7053SJung-uk Kim {
99e71b7053SJung-uk Kim return ctx->cert;
100e71b7053SJung-uk Kim }
101e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_get0_issuer(const CT_POLICY_EVAL_CTX * ctx)102e71b7053SJung-uk Kim X509* CT_POLICY_EVAL_CTX_get0_issuer(const CT_POLICY_EVAL_CTX *ctx)
103e71b7053SJung-uk Kim {
104e71b7053SJung-uk Kim return ctx->issuer;
105e71b7053SJung-uk Kim }
106e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_get0_log_store(const CT_POLICY_EVAL_CTX * ctx)107e71b7053SJung-uk Kim const CTLOG_STORE *CT_POLICY_EVAL_CTX_get0_log_store(const CT_POLICY_EVAL_CTX *ctx)
108e71b7053SJung-uk Kim {
109e71b7053SJung-uk Kim return ctx->log_store;
110e71b7053SJung-uk Kim }
111e71b7053SJung-uk Kim
CT_POLICY_EVAL_CTX_get_time(const CT_POLICY_EVAL_CTX * ctx)112e71b7053SJung-uk Kim uint64_t CT_POLICY_EVAL_CTX_get_time(const CT_POLICY_EVAL_CTX *ctx)
113e71b7053SJung-uk Kim {
114e71b7053SJung-uk Kim return ctx->epoch_time_in_ms;
115e71b7053SJung-uk Kim }
116