commit 59c1b34b72ec6c55ca4de0c56a9be3da3d1c3e08 Author: Nick Mathewson nickm@torproject.org Date: Tue Sep 4 12:09:43 2018 -0400
Remove tor_tls_check_lifetime as unused.
Everything that might have used it, uses tor_tls_cert_is_valid() instead. --- src/lib/tls/tortls.c | 32 -------------------------------- src/lib/tls/tortls.h | 4 ---- src/test/test_tortls_openssl.c | 40 ---------------------------------------- 3 files changed, 76 deletions(-)
diff --git a/src/lib/tls/tortls.c b/src/lib/tls/tortls.c index edf421b4d..64c26f7e1 100644 --- a/src/lib/tls/tortls.c +++ b/src/lib/tls/tortls.c @@ -433,35 +433,3 @@ tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity)
return rv; } - -/** Check whether the certificate set on the connection <b>tls</b> is expired - * give or take <b>past_tolerance</b> seconds, or not-yet-valid give or take - * <b>future_tolerance</b> seconds. Return 0 for valid, -1 for failure. - * - * NOTE: you should call tor_tls_verify before tor_tls_check_lifetime. - */ -int -tor_tls_check_lifetime(int severity, tor_tls_t *tls, - time_t now, - int past_tolerance, int future_tolerance) -{ - tor_x509_cert_t *cert; - int r = -1; - - if (!(cert = tor_tls_get_peer_cert(tls))) - goto done; - - if (tor_x509_check_cert_lifetime_internal(severity, cert->cert, now, - past_tolerance, - future_tolerance) < 0) - goto done; - - r = 0; - done: - tor_x509_cert_free(cert); -#ifdef ENABLE_OPENSSL - tls_log_errors(tls, LOG_WARN, LD_NET, "checking certificate lifetime"); -#endif - - return r; -} diff --git a/src/lib/tls/tortls.h b/src/lib/tls/tortls.h index a8bc7370a..459192708 100644 --- a/src/lib/tls/tortls.h +++ b/src/lib/tls/tortls.h @@ -100,10 +100,6 @@ int tor_tls_peer_has_cert(tor_tls_t *tls); MOCK_DECL(struct tor_x509_cert_t *,tor_tls_get_peer_cert,(tor_tls_t *tls)); MOCK_DECL(struct tor_x509_cert_t *,tor_tls_get_own_cert,(tor_tls_t *tls)); int tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity); -int tor_tls_check_lifetime(int severity, - tor_tls_t *tls, time_t now, - int past_tolerance, - int future_tolerance); MOCK_DECL(int, tor_tls_read, (tor_tls_t *tls, char *cp, size_t len)); int tor_tls_write(tor_tls_t *tls, const char *cp, size_t n); int tor_tls_handshake(tor_tls_t *tls); diff --git a/src/test/test_tortls_openssl.c b/src/test/test_tortls_openssl.c index b7e28f376..3ae0f04b7 100644 --- a/src/test/test_tortls_openssl.c +++ b/src/test/test_tortls_openssl.c @@ -961,45 +961,6 @@ test_tortls_verify(void *ignored) #endif /* !defined(OPENSSL_OPAQUE) */
#ifndef OPENSSL_OPAQUE -static void -test_tortls_check_lifetime(void *ignored) -{ - (void)ignored; - int ret; - tor_tls_t *tls; - X509 *validCert = read_cert_from(validCertString); - time_t now = time(NULL); - - tls = tor_malloc_zero(sizeof(tor_tls_t)); - ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), 0, 0); - tt_int_op(ret, OP_EQ, -1); - - tls->ssl = tor_malloc_zero(sizeof(SSL)); - tls->ssl->session = tor_malloc_zero(sizeof(SSL_SESSION)); - tls->ssl->session->peer = validCert; - ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), 0, 0); - tt_int_op(ret, OP_EQ, 0); - - ASN1_STRING_free(validCert->cert_info->validity->notBefore); - validCert->cert_info->validity->notBefore = ASN1_TIME_set(NULL, now-10); - ASN1_STRING_free(validCert->cert_info->validity->notAfter); - validCert->cert_info->validity->notAfter = ASN1_TIME_set(NULL, now+60); - - ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), 0, -1000); - tt_int_op(ret, OP_EQ, -1); - - ret = tor_tls_check_lifetime(LOG_WARN, tls, time(NULL), -1000, 0); - tt_int_op(ret, OP_EQ, -1); - - done: - tor_free(tls->ssl->session); - tor_free(tls->ssl); - tor_free(tls); - X509_free(validCert); -} -#endif /* !defined(OPENSSL_OPAQUE) */ - -#ifndef OPENSSL_OPAQUE static int fixed_ssl_pending_result = 0;
static int @@ -2469,7 +2430,6 @@ struct testcase_t tortls_openssl_tests[] = { INTRUSIVE_TEST_CASE(classify_client_ciphers, 0), LOCAL_TEST_CASE(client_is_using_v2_ciphers, 0), INTRUSIVE_TEST_CASE(verify, 0), - INTRUSIVE_TEST_CASE(check_lifetime, 0), INTRUSIVE_TEST_CASE(get_pending_bytes, 0), INTRUSIVE_TEST_CASE(SSL_SESSION_get_master_key, 0), INTRUSIVE_TEST_CASE(get_tlssecrets, 0),