Remove notBefore and notAfter cacheing.

This cache was added because our time conversion used timegm()
and gmtime() which aren't very cheap. These calls were noticably
expensive when profiling things like rpki-client which do many
X.509 validations.

Now that we convert times using julien seconds from the unix
epoch, BoringSSL style, instead of a julien days from a
Byzantine date, we no longer use timegm() and gmtime().

Since the julien seconds calculaitons are cheap for conversion,
we don't need to bother caching this, it doesn't have a noticable
performance impact.

While we are at this correct a bug where
x509_verify_asn1_time_to_time_t was not NULL safe.

Tested for performance regressions by tb@ and job@

ok tb@ job@

1 files changed, 3 insertions, 21 deletions

diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 5399658639..501f5e5710 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.142 2024/03/02 10:40:05 tb Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.143 2024/04/08 23:46:21 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1744,18 +1744,6 @@ verify_cb_cert(X509_STORE_CTX *ctx, X509 *x, int depth, int err)
         return ctx->verify_cb(0, ctx);
 }
 
-
-/* Mimic OpenSSL '0 for failure' ick */
-static int
-time_t_bogocmp(time_t a, time_t b)
-{
-        if (a == -1 || b == -1)
-                return 0;
-        if (a <= b)
-                return -1;
-        return 1;
-}
-
 /*
  * Check certificate validity times.
  *
@@ -1777,10 +1765,7 @@ x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth)
         else
                 ptime = time(NULL);
 
-        if (x->ex_flags & EXFLAG_SET)
-                i = time_t_bogocmp(x->not_before, ptime);
-        else
-                i = X509_cmp_time(X509_get_notBefore(x), &ptime);
+        i = X509_cmp_time(X509_get_notBefore(x), &ptime);
 
         if (i >= 0 && depth < 0)
                 return 0;
@@ -1791,10 +1776,7 @@ x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth)
             X509_V_ERR_CERT_NOT_YET_VALID))
                 return 0;
 
-        if (x->ex_flags & EXFLAG_SET)
-                i = time_t_bogocmp(x->not_after, ptime);
-        else
-                i = X509_cmp_time_internal(X509_get_notAfter(x), &ptime, 1);
+        i = X509_cmp_time_internal(X509_get_notAfter(x), &ptime, 1);
 
         if (i <= 0 && depth < 0)
                 return 0;