From 72c7c57a68e32c57ac752161b5a93464ad11e7e1 Mon Sep 17 00:00:00 2001 From: beck Date: Mon, 8 Apr 2024 19:57:40 +0000 Subject: [PATCH] Make ASN1_TIME_set_string_X509 and ASN1_TIME_set_string match the man page This makes it where people can't put dumb values in certs without trying harder, and changes the regress to test this. GENERALIZED times outside of the RFC5280 spec are required for OCSP but these should be constructed with the GENERALIZED time string setters. ok tb@ --- lib/libcrypto/asn1/a_time_tm.c | 40 +++++++------------ regress/lib/libcrypto/asn1/asn1time.c | 50 +++++++++++++++++++++--- regress/lib/libcrypto/asn1/rfc5280time.c | 9 +---- 3 files changed, 60 insertions(+), 39 deletions(-) diff --git a/lib/libcrypto/asn1/a_time_tm.c b/lib/libcrypto/asn1/a_time_tm.c index 986c1e735d0..c8eabec08f1 100644 --- a/lib/libcrypto/asn1/a_time_tm.c +++ b/lib/libcrypto/asn1/a_time_tm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: a_time_tm.c,v 1.33 2024/03/02 09:10:42 tb Exp $ */ +/* $OpenBSD: a_time_tm.c,v 1.34 2024/04/08 19:57:40 beck Exp $ */ /* * Copyright (c) 2015 Bob Beck * @@ -160,15 +160,7 @@ tm_to_utctime(struct tm *tm, ASN1_TIME *atime) ASN1_TIME * tm_to_rfc5280_time(struct tm *tm, ASN1_TIME *atime) { - int year; - - year = tm->tm_year + 1900; - if (year < 1950 || year > 9999) { - ASN1error(ASN1_R_ILLEGAL_TIME_VALUE); - return (NULL); - } - - if (year < 2050) + if (tm->tm_year >= 50 && tm->tm_year < 150) return (tm_to_utctime(tm, atime)); return (tm_to_gentime(tm, atime)); @@ -352,25 +344,21 @@ ASN1_time_parse(const char *bytes, size_t len, struct tm *tm, int mode) static int ASN1_TIME_set_string_internal(ASN1_TIME *s, const char *str, int mode) { + struct tm tm; int type; - char *tmp; - if ((type = ASN1_time_parse(str, strlen(str), NULL, mode)) == -1) - return (0); - if (mode != 0 && mode != type) + if ((type = ASN1_time_parse(str, strlen(str), &tm, mode)) == -1) return (0); - - if (s == NULL) - return (1); - - if ((tmp = strdup(str)) == NULL) + switch(mode) { + case V_ASN1_UTCTIME: + return (type == mode && tm_to_utctime(&tm, s) != NULL); + case V_ASN1_GENERALIZEDTIME: + return (type == mode && tm_to_gentime(&tm, s) != NULL); + case RFC5280: + return (tm_to_rfc5280_time(&tm, s) != NULL); + default: return (0); - free(s->data); - s->data = tmp; - s->length = strlen(tmp); - s->type = type; - - return (1); + } } static ASN1_TIME * @@ -448,7 +436,7 @@ LCRYPTO_ALIAS(ASN1_TIME_to_generalizedtime); int ASN1_TIME_set_string(ASN1_TIME *s, const char *str) { - return (ASN1_TIME_set_string_internal(s, str, 0)); + return (ASN1_TIME_set_string_internal(s, str, RFC5280)); } LCRYPTO_ALIAS(ASN1_TIME_set_string); diff --git a/regress/lib/libcrypto/asn1/asn1time.c b/regress/lib/libcrypto/asn1/asn1time.c index 8208fcd1c02..7cc6df8a1af 100644 --- a/regress/lib/libcrypto/asn1/asn1time.c +++ b/regress/lib/libcrypto/asn1/asn1time.c @@ -1,4 +1,4 @@ -/* $OpenBSD: asn1time.c,v 1.25 2024/02/18 22:17:01 tb Exp $ */ +/* $OpenBSD: asn1time.c,v 1.26 2024/04/08 19:57:40 beck Exp $ */ /* * Copyright (c) 2015 Joel Sing * Copyright (c) 2024 Google Inc. @@ -420,6 +420,7 @@ static int asn1_time_test(int test_no, const struct asn1_time_test *att, int type) { ASN1_TIME *t = NULL, *tx509 = NULL; + char *parsed_time = NULL; int failure = 1; if (ASN1_TIME_set_string(NULL, att->str) != 1) { @@ -434,9 +435,27 @@ asn1_time_test(int test_no, const struct asn1_time_test *att, int type) if ((tx509 = ASN1_TIME_new()) == NULL) goto done; - if (ASN1_TIME_set_string(t, att->str) != 1) { - fprintf(stderr, "FAIL: test %d - failed to set string '%s'\n", - test_no, att->str); + switch (strlen(att->str)) { + case 13: + t->type = V_ASN1_UTCTIME; + if (ASN1_UTCTIME_set_string(t, att->str) != 1) { + fprintf(stderr, "FAIL: test %d - failed to set utc " + "string '%s'\n", + test_no, att->str); + goto done; + } + break; + case 15: + t->type = V_ASN1_GENERALIZEDTIME; + if (ASN1_GENERALIZEDTIME_set_string(t, att->str) != 1) { + fprintf(stderr, "FAIL: test %d - failed to set gen " + "string '%s'\n", + test_no, att->str); + goto done; + } + break; + default: + fprintf(stderr, "FAIL: unknown type\n"); goto done; } @@ -446,13 +465,33 @@ asn1_time_test(int test_no, const struct asn1_time_test *att, int type) goto done; } + if ((parsed_time = strdup(t->data)) == NULL) + goto done; + if (ASN1_TIME_normalize(t) != 1) { fprintf(stderr, "FAIL: test %d - failed to set normalize '%s'\n", test_no, att->str); goto done; } - if (ASN1_TIME_set_string_X509(tx509, t->data) != 1) { + if (ASN1_TIME_set_string_X509(tx509, parsed_time) != 1) { + fprintf(stderr, "FAIL: test %d - failed to set string X509 '%s'\n", + test_no, t->data); + goto done; + } + + if (t->type != tx509->type) { + fprintf(stderr, "FAIL: test %d - type %d, different from %d\n", + test_no, t->type, tx509->type); + goto done; + } + + if (ASN1_TIME_compare(t, tx509) != 0) { + fprintf(stderr, "FAIL: ASN1_TIME values differ!\n"); + goto done; + } + + if (ASN1_TIME_set_string(tx509, parsed_time) != 1) { fprintf(stderr, "FAIL: test %d - failed to set string X509 '%s'\n", test_no, t->data); goto done; @@ -476,6 +515,7 @@ asn1_time_test(int test_no, const struct asn1_time_test *att, int type) ASN1_TIME_free(t); ASN1_TIME_free(tx509); + free(parsed_time); return (failure); } diff --git a/regress/lib/libcrypto/asn1/rfc5280time.c b/regress/lib/libcrypto/asn1/rfc5280time.c index 7a44a30e886..c57cac14630 100644 --- a/regress/lib/libcrypto/asn1/rfc5280time.c +++ b/regress/lib/libcrypto/asn1/rfc5280time.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rfc5280time.c,v 1.7 2022/09/05 21:12:08 tb Exp $ */ +/* $OpenBSD: rfc5280time.c,v 1.8 2024/04/08 19:57:40 beck Exp $ */ /* * Copyright (c) 2015 Joel Sing * Copyright (c) 2015 Bob Beck @@ -234,13 +234,6 @@ rfc5280_invtime_test(int test_no, struct rfc5280_time_test *att) goto done; } } - if (ASN1_TIME_set_string(t, att->str) != 0) { - if (X509_cmp_time(t, &now) != 0) { - fprintf(stderr, "FAIL: test %d - successfully parsed as UTCTIME " - "string '%s'\n", test_no, att->str); - goto done; - } - } failure = 0; -- 2.20.1