diff options
| author | Rob Percival <robpercival@google.com> | 2016-09-12 17:02:58 +0100 |
|---|---|---|
| committer | Rich Salz <rsalz@openssl.org> | 2016-11-15 16:31:30 -0500 |
| commit | 81d5808064949e6f23c1eaac4b24f09c8b1255db (patch) | |
| tree | f9a439e8e9a5a28ec1f8318319ea760ecfc0ab79 /crypto/ct | |
| parent | 6d1584aebae9e6f34b80fef4fb147c298cc723d2 (diff) | |
By default, allow SCT timestamps to be up to 5 minutes in the future
As requested in
https://github.com/openssl/openssl/pull/1554#issuecomment-246371575.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1554)
(cherry picked from commit c22aa33e29ce162c672c9b2f0df591db977d4e9b)
Diffstat (limited to 'crypto/ct')
| -rw-r--r-- | crypto/ct/ct_policy.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/crypto/ct/ct_policy.c b/crypto/ct/ct_policy.c index 1bc22749d3..adee331366 100644 --- a/crypto/ct/ct_policy.c +++ b/crypto/ct/ct_policy.c @@ -17,6 +17,12 @@ #include "ct_locl.h" +// Number of seconds in the future that an SCT timestamp can be, by default, +// without being considered invalid. This is added to time() when setting a +// default value for CT_POLICY_EVAL_CTX.epoch_time_in_ms. +// It can be overridden by calling CT_POLICY_EVAL_CTX_set_time(). +static const time_t SCT_CLOCK_DRIFT_TOLERANCE = 300; + CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new(void) { CT_POLICY_EVAL_CTX *ctx = OPENSSL_zalloc(sizeof(CT_POLICY_EVAL_CTX)); @@ -27,7 +33,7 @@ CT_POLICY_EVAL_CTX *CT_POLICY_EVAL_CTX_new(void) } // time(NULL) shouldn't ever fail, so don't bother checking for -1. - ctx->epoch_time_in_ms = time(NULL) * 1000; + ctx->epoch_time_in_ms = (time(NULL) + SCT_CLOCK_DRIFT_TOLERANCE) * 1000; return ctx; } |