Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 66.187.237.31 as permitted sender)
Date: Mon, 27 Apr 2009 17:08:36 +0100
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: svn commit: r760866 - in /httpd/httpd/trunk: CHANGES
	docs/manual/mod/mod_ssl.xml modules/proxy/mod_proxy_http.c
	modules/ssl/mod_ssl.c modules/ssl/ssl_engine_config.c
	modules/ssl/ssl_engine_io.c modules/ssl/ssl_private.h
Message-ID: <20090427160836.GA12166@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <20090401120754.4D96E23889FD@eris.apache.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <20090401120754.4D96E23889FD@eris.apache.org>
User-Agent: Mutt/1.5.18 (2008-05-17)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Wed, Apr 01, 2009 at 12:07:49PM -0000, rpluem@apache.org wrote:
> Author: rpluem
> Date: Wed Apr  1 12:07:47 2009
> New Revision: 760866
> 
> URL: http://svn.apache.org/viewvc?rev=760866&view=rev
> Log:
...
> +        if (sc->proxy_ssl_check_peer_expire == SSL_ENABLED_TRUE) {
> +            apr_time_t start_time;
> +            apr_time_t end_time;
> +            apr_time_t now;
> +
> +            start_time = parseASN1time(c->pool,
> +                                       ssl_var_lookup(NULL, c->base_server,
> +                                                      c, NULL,
> +                                                      "SSL_CLIENT_V_START"));
> +            end_time = parseASN1time(c->pool,
> +                                     ssl_var_lookup(NULL, c->base_server,
> +                                                    c, NULL,
> +                                                    "SSL_CLIENT_V_END"));

You can (and should) use X509_get_notBefore(), X509_get_notAfter() to 
get the end/start times form sslconn->client_cert; can check for expiry 
using X509_cmp_current_time() on the returned values.  Should require 1 
less ASN.1 date parser!

Also maybe default these to "on" for the trunk?

Sorry, I'm about a month behind on reading svn commits now :( Joe