CVSROOT: /cvs
Module name: src
Changes by: js...@cvs.openbsd.org 2019/01/21 01:38:22
Modified files:
usr.sbin/ntpd : constraint.c
Log message:
Perform manual validity checking of the X.509 certificate for constraints.
Given that we're getting a constraint so that we can validate time, if our
own time is out we can fail the automatic validity checking since it is
based on the wallclock. Instead, disable the automatic validity checking
and perform manual checks based on the time reported from the server via
the HTTP header.
Discussed at length with and ok deraadt@
