From 5176ab31ca58949fc78b5b06b23adf63a83b9c44 Mon Sep 17 00:00:00 2001 From: beck <> Date: Sun, 24 Mar 2024 11:30:12 +0000 Subject: Convert libressl to use the BoringSSL style time conversions This gets rid of our last uses of timegm and gmtime in the library and things that ship with it. It includes a bit of refactoring in ocsp_cl.c to remove some obvious ugly. ok tb@ --- src/lib/libcrypto/ocsp/ocsp_cl.c | 75 +++++++++++++++++--------------------- src/lib/libcrypto/ts/ts_rsp_sign.c | 4 +- 2 files changed, 36 insertions(+), 43 deletions(-) (limited to 'src/lib/libcrypto') diff --git a/src/lib/libcrypto/ocsp/ocsp_cl.c b/src/lib/libcrypto/ocsp/ocsp_cl.c index 5ef2226785..d8ee33c391 100644 --- a/src/lib/libcrypto/ocsp/ocsp_cl.c +++ b/src/lib/libcrypto/ocsp/ocsp_cl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ocsp_cl.c,v 1.24 2024/03/02 09:08:41 tb Exp $ */ +/* $OpenBSD: ocsp_cl.c,v 1.25 2024/03/24 11:30:12 beck Exp $ */ /* Written by Tom Titchener for the OpenSSL * project. */ @@ -68,6 +68,7 @@ #include #include #include +#include #include #include @@ -394,69 +395,61 @@ int OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, ASN1_GENERALIZEDTIME *nextupd, long nsec, long maxsec) { - time_t t_now, t_tmp; - struct tm tm_this, tm_next, tm_tmp; + int64_t posix_next, posix_this, posix_now; + struct tm tm_this, tm_next; - time(&t_now); + /* Negative values of nsec make no sense */ + if (nsec < 0) + return 0; + + posix_now = time(NULL); /* * Times must explicitly be a GENERALIZEDTIME as per section * 4.2.2.1 of RFC 6960 - It is invalid to accept other times * (such as UTCTIME permitted/required by RFC 5280 for certificates) */ - - /* Check thisUpdate is valid and not more than nsec in the future */ + /* Check that thisUpdate is valid. */ if (ASN1_time_parse(thisupd->data, thisupd->length, &tm_this, V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) { OCSPerror(OCSP_R_ERROR_IN_THISUPDATE_FIELD); return 0; - } else { - t_tmp = t_now + nsec; - if (gmtime_r(&t_tmp, &tm_tmp) == NULL) - return 0; - if (ASN1_time_tm_cmp(&tm_this, &tm_tmp) > 0) { - OCSPerror(OCSP_R_STATUS_NOT_YET_VALID); - return 0; - } - - /* - * If maxsec specified check thisUpdate is not more than maxsec - * in the past - */ - if (maxsec >= 0) { - t_tmp = t_now - maxsec; - if (gmtime_r(&t_tmp, &tm_tmp) == NULL) - return 0; - if (ASN1_time_tm_cmp(&tm_this, &tm_tmp) < 0) { - OCSPerror(OCSP_R_STATUS_TOO_OLD); - return 0; - } - } + } + if (!OPENSSL_tm_to_posix(&tm_this, &posix_this)) + return 0; + /* thisUpdate must not be more than nsec in the future. */ + if (posix_this - nsec > posix_now) { + OCSPerror(OCSP_R_STATUS_NOT_YET_VALID); + return 0; + } + /* thisUpdate must not be more than maxsec seconds in the past. */ + if (maxsec >= 0 && posix_this < posix_now - maxsec) { + OCSPerror(OCSP_R_STATUS_TOO_OLD); + return 0; } - if (!nextupd) + /* RFC 6960 section 4.2.2.1 allows for servers to not set nextUpdate */ + if (nextupd == NULL) return 1; - /* Check nextUpdate is valid and not more than nsec in the past */ + /* Check that nextUpdate is valid. */ if (ASN1_time_parse(nextupd->data, nextupd->length, &tm_next, V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) { OCSPerror(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD); return 0; - } else { - t_tmp = t_now - nsec; - if (gmtime_r(&t_tmp, &tm_tmp) == NULL) - return 0; - if (ASN1_time_tm_cmp(&tm_next, &tm_tmp) < 0) { - OCSPerror(OCSP_R_STATUS_EXPIRED); - return 0; - } } - - /* Also don't allow nextUpdate to precede thisUpdate */ - if (ASN1_time_tm_cmp(&tm_next, &tm_this) < 0) { + if (!OPENSSL_tm_to_posix(&tm_next, &posix_next)) + return 0; + /* Don't allow nextUpdate to precede thisUpdate. */ + if (posix_next < posix_this) { OCSPerror(OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE); return 0; } + /* nextUpdate must not be more than nsec seconds in the past. */ + if (posix_next + nsec < posix_now) { + OCSPerror(OCSP_R_STATUS_EXPIRED); + return 0; + } return 1; } diff --git a/src/lib/libcrypto/ts/ts_rsp_sign.c b/src/lib/libcrypto/ts/ts_rsp_sign.c index 3013cffbc5..8eb687aab1 100644 --- a/src/lib/libcrypto/ts/ts_rsp_sign.c +++ b/src/lib/libcrypto/ts/ts_rsp_sign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ts_rsp_sign.c,v 1.32 2023/08/22 08:09:36 tb Exp $ */ +/* $OpenBSD: ts_rsp_sign.c,v 1.33 2024/03/24 11:30:12 beck Exp $ */ /* Written by Zoltan Glozik (zglozik@stones.com) for the OpenSSL * project 2002. */ @@ -999,7 +999,7 @@ TS_RESP_set_genTime_with_precision(ASN1_GENERALIZEDTIME *asn1_time, if (precision > TS_MAX_CLOCK_PRECISION_DIGITS) goto err; - if (!(tm = gmtime(&sec))) + if (OPENSSL_gmtime(&sec, tm) == NULL) goto err; /* -- cgit v1.2.3-55-g6feb