verify

pub fn verify(chain: *const Chain, now: std.Io.Timestamp) VerifyError!void

File

Code

pub fn verify(chain: *const Chain, now: std.Io.Timestamp) VerifyError!void {
    const now_win = @divFloor(now.nanoseconds - std.time.epoch.windows * std.time.ns_per_s, 100);
    var cert_chain: *const crypt32.CERT_CHAIN.CONTEXT = undefined;
    if (!crypt32.CertGetCertificateChain(
        .CURRENT_USER,
        chain.primary orelse return error.TlsCertificateNotVerified,
        &.{
            .dwLowDateTime = @bitCast(@as(i32, @truncate(now_win >> 0))),
            .dwHighDateTime = @bitCast(@as(i32, @intCast(now_win >> 32))),
        },
        null,
        &.{ .RequestedUsage = .{ .dwType = .AND, .Usage = .{
            .cUsageIdentifier = ALLOWED_EKUS.len,
            .rgpszUsageIdentifier = &ALLOWED_EKUS,
        } } },
        .{ .REVOCATION_CHECK_END_CERT = true, .REVOCATION_ACCUMULATIVE_TIMEOUT = true },
        null,
        &cert_chain,
    ).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
    defer crypt32.CertFreeCertificateChain(cert_chain);
    var status: crypt32.CERT_CHAIN.POLICY.STATUS = .{
        .dwError = undefined,
        .lChainIndex = undefined,
        .lElementIndex = undefined,
        .pvExtraPolicyStatus = undefined,
    };
    if (!crypt32.CertVerifyCertificateChainPolicy(
        .SSL,
        cert_chain,
        &.{
            .dwFlags = .{
                .IGNORE_END_REV_UNKNOWN = true,
                .IGNORE_CTL_SIGNER_REV_UNKNOWN = true,
                .IGNORE_CA_REV_UNKNOWN = true,
                .IGNORE_ROOT_REV_UNKNOWN = true,
            },
            .pvExtraPolicyPara = @constCast(&crypt32.HTTPSPolicyCallbackData{ .dwAuthType = .SERVER }),
        },
        &status,
    ).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
    switch (status.dwError) {
        .SUCCESS => return,
        .CERT_E_UNTRUSTEDROOT => return error.TlsCertificateNotVerified,
        else => |err| return std.os.windows.unexpectedError(err),
    }
}