)]}'
{
  "commit": "c339766a51d2db711171cb704e30b7ae916a987f",
  "tree": "a943be297395d2202aa7ad29d2824078354bb9b1",
  "parents": [
    "58e367fd6501efc2f11adb0b44f1c7cde9b39c2a"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sun Feb 05 16:24:49 2017 -0500"
  },
  "committer": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sun Feb 05 16:41:08 2017 -0500"
  },
  "message": "Do not depend on internals of the SSL state machine.\n\ntlsdate has a \"time_is_an_illusion\" parameter which uses the server\u0027s\nreported time (within some bounds) to check the certificate against. It\ndoes this by configuring the time on the SSL\u0027s X509_VERIFY_PARAM when\none of the SSL3_ST_CR_SRVR_HELLO_A and SSL3_ST_CR_SRVR_HELLO_B states\npasses.\n\nIn addition to depending on quirks of the OpenSSL state machine which\nBoringSSL would otherwise need to emulate, this code is wrong. It needs\nto run at a point after the server_random is filled in.  In the original\nOpenSSL code, SSL3_ST_CR_SRVR_HELLO_A is when the message header is\nread, so this is too early. The _B also wouldn\u0027t work in a non-blocking\nsocket because state mcahine might pause halfway through reading the\nbody. This probably only worked because it only uses blocking BIOs.\n\nThis also depends on OpenSSL\u0027s info_callback hacking the state\ntransitions so SSL_state returned the previous state during the\ncallback.\n\nRather than ossify all these bugs, use SSL_CTX_set_cert_verify_callback.\nThis overrides OpenSSL\u0027s call to X509_verify_cert. By looking up the\nserver random immediately before verification, we are guaranteed\nserver_random is filled in. At this point we also have an X509_STORE_CTX\navailable, so we may set the time on it directly.\n\nChange-Id: I0a830984539d7e9e53c78891dea07f27f71edcbf\nTest: mma\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "319497f35f3b7f444e81f5db115ff2e6908e2492",
      "old_mode": 33188,
      "old_path": "src/tlsdate-helper.c",
      "new_id": "396045845b06a296105195778796718e76db00b7",
      "new_mode": 33188,
      "new_path": "src/tlsdate-helper.c"
    },
    {
      "type": "modify",
      "old_id": "64e4092b74f95e4add7a44d9eeb9d7b9934dee42",
      "old_mode": 33188,
      "old_path": "src/tlsdate-helper.h",
      "new_id": "fa9861a079643607a949432c1a75733dcdaba2a4",
      "new_mode": 33188,
      "new_path": "src/tlsdate-helper.h"
    }
  ]
}