Add tls_peer_cert_notbefore and tls_peer_cert_notafter to expose peer certificate

validity times for tls connections.
ok jsing@

1 files changed, 21 insertions, 1 deletions

diff --git a/src/lib/libtls/tls_peer.c b/src/lib/libtls/tls_peer.c
index 3145e500c4..8a74613ef8 100644
--- a/src/lib/libtls/tls_peer.c
+++ b/src/lib/libtls/tls_peer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_peer.c,v 1.4 2015/09/12 21:00:38 beck Exp $ */
+/* $OpenBSD: tls_peer.c,v 1.5 2015/10/07 23:33:38 beck Exp $ */
 /*
  * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
@@ -61,3 +61,23 @@ tls_peer_cert_contains_name(struct tls *ctx, const char *name)
         return (tls_check_name(ctx, ctx->ssl_peer_cert, name) == 0);
 }
 
+time_t
+tls_peer_cert_notbefore(struct tls *ctx)
+{
+        if (ctx->ssl_peer_cert == NULL)
+                return (-1);
+        if (ctx->conninfo == NULL)
+                return (-1);
+        return (ctx->conninfo->notbefore);
+}
+
+time_t
+tls_peer_cert_notafter(struct tls *ctx)
+{
+        if (ctx->ssl_peer_cert == NULL)
+                return (-1);
+        if (ctx->conninfo == NULL)
+                return (-1);
+        return (ctx->conninfo->notafter);
+}
+