Stop supporing "legcay" time formats that OpenSSL supports. Rewrite the

utctime and gentime wrappers accordingly. Along with some other cleanup.
this also removes the need for timegm.
ok bcook@ sthen@ jsing@

2 files changed, 24 insertions, 22 deletions

diff --git a/src/lib/libcrypto/x509/x509_lcl.h b/src/lib/libcrypto/x509/x509_lcl.h
index 0c1c130d5c..9ffdd01e61 100644
--- a/src/lib/libcrypto/x509/x509_lcl.h
+++ b/src/lib/libcrypto/x509/x509_lcl.h
@@ -58,3 +58,4 @@
 
 int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet);
 int asn1_time_parse(const char *, size_t, struct tm *, int);
+int asn1_tm_cmp(struct tm *tm1, struct tm *tm2);
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index c48143f351..159d60b034 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.46 2015/10/02 15:04:45 beck Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.47 2015/10/19 16:32:37 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1648,8 +1648,9 @@ int
 X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
 {
         time_t time1, time2;
-        struct tm tm1;
+        struct tm tm1, tm2;
         int ret = 0;
+        int type;
 
         if (cmp_time == NULL)
                 time2 = time(NULL);
@@ -1658,9 +1659,15 @@ X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
 
         memset(&tm1, 0, sizeof(tm1));
 
-        if (asn1_time_parse(ctm->data, ctm->length, &tm1, 0) == -1)
+        if ((type = asn1_time_parse(ctm->data, ctm->length, &tm1, 0)) == -1)
                 goto out; /* invalid time */
 
+        /* RFC 5280 section 4.1.2.5 */
+        if (tm1.tm_year < 150 && type != V_ASN1_UTCTIME)
+                goto out;
+        if (tm1.tm_year >= 150 && type != V_ASN1_GENERALIZEDTIME)
+                goto out;
+
         /*
          * Defensively fail if the time string is not representable as
          * a time_t. A time_t must be sane if you care about times after
@@ -1669,10 +1676,12 @@ X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
         if ((time1 = timegm(&tm1)) == -1)
                 goto out;
 
-        if (time1 <= time2)
-                ret = -1;
-        else
-                ret = 1;
+        if (gmtime_r(&time2, &tm2) == NULL)
+                goto out;
+
+        ret = asn1_tm_cmp(&tm1, &tm2);
+        if (ret == 0)
+                ret = -1; /* 0 is used for error, so map same to less than */
  out:
         return (ret);
 }
@@ -1684,28 +1693,20 @@ X509_gmtime_adj(ASN1_TIME *s, long adj)
 }
 
 ASN1_TIME *
-X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm)
+X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_time)
 {
-        return X509_time_adj_ex(s, 0, offset_sec, in_tm);
+        return X509_time_adj_ex(s, 0, offset_sec, in_time);
 }
 
 ASN1_TIME *
-X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec, time_t *in_tm)
+X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec, time_t *in_time)
 {
         time_t t;
-
-        if (in_tm)
-                t = *in_tm;
+        if (in_time == NULL)
+                t = time(NULL);
         else
-                time(&t);
-
-        if (s && !(s->flags & ASN1_STRING_FLAG_MSTRING)) {
-                if (s->type == V_ASN1_UTCTIME)
-                        return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec);
-                if (s->type == V_ASN1_GENERALIZEDTIME)
-                        return ASN1_GENERALIZEDTIME_adj(s, t, offset_day,
-                            offset_sec);
-        }
+                t = *in_time;
+
         return ASN1_TIME_adj(s, t, offset_day, offset_sec);
 }