Set time directly on the x509 store

Instead of an ivar, so other ossl functions that take a store will use the correct time when verifying
ruby · Jun 25, 2024 · b4ae6c4 · b4ae6c4
1 parent c737234
commit b4ae6c4
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/ext/openssl/ossl_x509store.c b/ext/openssl/ossl_x509store.c
@@ -223,7 +223,6 @@ ossl_x509store_initialize(int argc, VALUE *argv, VALUE self)
     rb_iv_set(self, "@error", Qnil);
     rb_iv_set(self, "@error_string", Qnil);
     rb_iv_set(self, "@chain", Qnil);
-    rb_iv_set(self, "@time", Qnil);
 
     return self;
 }
@@ -329,7 +328,17 @@ ossl_x509store_set_trust(VALUE self, VALUE trust)
 static VALUE
 ossl_x509store_set_time(VALUE self, VALUE time)
 {
-    rb_iv_set(self, "@time", time);
+    X509_STORE *store;
+    X509_VERIFY_PARAM *param;
+
+    GetX509Store(self, store);
+    param = X509_VERIFY_PARAM_new();
+    X509_VERIFY_PARAM_set_time(param, NUM2LONG(rb_Integer(time)));
+    if (!X509_STORE_set1_param(store, param))
+    {
+        X509_VERIFY_PARAM_free(param);
+        ossl_raise(eX509StoreError, "X509_STORE_set1_param");
+    }
     return time;
 }
 
@@ -599,8 +608,6 @@ ossl_x509stctx_initialize(int argc, VALUE *argv, VALUE self)
         sk_X509_pop_free(x509s, X509_free);
         ossl_raise(eX509StoreError, "X509_STORE_CTX_init");
     }
-    if (!NIL_P(t = rb_iv_get(store, "@time")))
-	ossl_x509stctx_set_time(self, t);
     rb_iv_set(self, "@verify_callback", rb_iv_get(store, "@verify_callback"));
     rb_iv_set(self, "@cert", cert);