Skip to content

Encode default cert validity as UTCTime through 2049 #11228

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidangarske wants to merge 1 commit into
base: master
Choose a base branch
from
+226 −57
Open

Encode default cert validity as UTCTime through 2049 #11228

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions tests/api/test_ossl_x509_crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,25 +520,25 @@ int test_wolfSSL_X509_sign(void)
* with the MSB set. See GenerateInteger in asn.c */
#ifndef USE_CERT_BUFFERS_1024
#ifndef WOLFSSL_ALT_NAMES
/* Valid case - size should be 781-786 with 16 byte serial number */
ExpectTrue((781 + snSz <= ret) && (ret <= 781 + 5 + snSz));
/* Valid case - size should be 777-782 with 16 byte serial number */
ExpectTrue((777 + snSz <= ret) && (ret <= 777 + 5 + snSz));
#elif defined(WOLFSSL_IP_ALT_NAME)
/* Valid case - size should be 955-960 with 16 byte serial number */
ExpectTrue((939 + snSz <= ret) && (ret <= 939 + 5 + snSz));
/* Valid case - size should be 951-956 with 16 byte serial number */
ExpectTrue((935 + snSz <= ret) && (ret <= 935 + 5 + snSz));
#else
/* Valid case - size should be 926-931 with 16 byte serial number */
ExpectTrue((910 + snSz <= ret) && (ret <= 910 + 5 + snSz));
/* Valid case - size should be 922-927 with 16 byte serial number */
ExpectTrue((906 + snSz <= ret) && (ret <= 906 + 5 + snSz));
#endif
#else
#ifndef WOLFSSL_ALT_NAMES
/* Valid case - size should be 537-542 with 16 byte serial number */
ExpectTrue((521 + snSz <= ret) && (ret <= 521 + 5 + snSz));
/* Valid case - size should be 533-538 with 16 byte serial number */
ExpectTrue((517 + snSz <= ret) && (ret <= 517 + 5 + snSz));
#elif defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME)
/* Valid case - size should be 695-670 with 16 byte serial number */
ExpectTrue((679 + snSz <= ret) && (ret <= 679 + 5 + snSz));
/* Valid case - size should be 691-696 with 16 byte serial number */
ExpectTrue((675 + snSz <= ret) && (ret <= 675 + 5 + snSz));
#else
/* Valid case - size should be 666-671 with 16 byte serial number */
ExpectTrue((650 + snSz <= ret) && (ret <= 650 + 5 + snSz));
/* Valid case - size should be 662-667 with 16 byte serial number */
ExpectTrue((646 + snSz <= ret) && (ret <= 646 + 5 + snSz));
#endif
#endif
/* check that issuer name is as expected after signature */
Expand Down
102 changes: 71 additions & 31 deletions wolfcrypt/src/asn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28292,15 +28292,32 @@ static WC_INLINE byte itob(int number)
}


/* write time to output, format */
static void SetTime(struct tm* date, byte* output)
/* RFC 5280: validity dates through 2049 encode as UTCTime, 2050 and later as
* GeneralizedTime. date->tm_year holds the full year here. */
static byte ValidityTimeFormat(const struct tm* date)
{
if (date->tm_year >= 1950 && date->tm_year < 2050)
return ASN_UTC_TIME;
return ASN_GENERALIZED_TIME;
}

/* write time value to output in the given ASN.1 format */
static void SetTime(struct tm* date, byte* output, byte format)
{
int i = 0;
int year = date->tm_year;

output[i++] = itob((date->tm_year % 10000) / 1000);
output[i++] = itob((date->tm_year % 1000) / 100);
output[i++] = itob((date->tm_year % 100) / 10);
output[i++] = itob( date->tm_year % 10);
if (format == ASN_UTC_TIME) {
year %= 100;
output[i++] = itob((year / 10) % 10);
output[i++] = itob( year % 10);
}
else {
output[i++] = itob((year % 10000) / 1000);
output[i++] = itob((year % 1000) / 100);
output[i++] = itob((year % 100) / 10);
output[i++] = itob( year % 10);
}

output[i++] = itob(date->tm_mon / 10);
output[i++] = itob(date->tm_mon % 10);
Expand Down Expand Up @@ -30063,6 +30080,8 @@ static int SetValidity(byte* before, byte* after, int daysValid)
{
#ifndef NO_ASN_TIME
int ret = 0;
byte format;
word32 timeSz;
time_t now;
time_t then;
struct tm* tmpTime;
Expand Down Expand Up @@ -30093,7 +30112,12 @@ static int SetValidity(byte* before, byte* after, int daysValid)
localTime.tm_year += 1900;
localTime.tm_mon += 1;

SetTime(&localTime, before);
format = ValidityTimeFormat(&localTime);
timeSz = (format == ASN_UTC_TIME) ? ASN_UTC_TIME_SIZE - 1
: ASN_GEN_TIME_SZ;
before[0] = format;
SetLength(timeSz, before + 1);
SetTime(&localTime, before + 2, format);

/* add daysValid of seconds */
then = now + (daysValid * (time_t)86400);
Expand All @@ -30110,7 +30134,12 @@ static int SetValidity(byte* before, byte* after, int daysValid)
localTime.tm_year += 1900;
localTime.tm_mon += 1;

SetTime(&localTime, after);
format = ValidityTimeFormat(&localTime);
timeSz = (format == ASN_UTC_TIME) ? ASN_UTC_TIME_SIZE - 1
: ASN_GEN_TIME_SZ;
after[0] = format;
SetLength(timeSz, after + 1);
SetTime(&localTime, after + 2, format);
}

return ret;
Expand Down Expand Up @@ -30803,6 +30832,8 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
int ret = 0;
word32 issRawLen = 0;
word32 sbjRawLen = 0;
byte localBefore[MAX_DATE_SIZE];
byte localAfter[MAX_DATE_SIZE];

/* Unused without PQC */
(void)falconKey;
Expand Down Expand Up @@ -31028,16 +31059,35 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
}
else
{
/* Don't put out UTC before data. */
dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_UTC].noOut = 1;
/* Make space for before date data. */
SetASN_Buffer(&dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_GT],
NULL, ASN_GEN_TIME_SZ);
/* Don't put out UTC after data. */
dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_UTC].noOut = 1;
/* Make space for after date data. */
SetASN_Buffer(&dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_GT],
NULL, ASN_GEN_TIME_SZ);
/* Compute default validity dates; SetValidity picks UTCTime or
* Generalized Time per RFC 5280 based on the year. */
ret = SetValidity(localBefore, localAfter, cert->daysValid);
if (ret == 0) {
if (localBefore[0] == ASN_UTC_TIME) {
SetASN_Buffer(
&dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_UTC],
localBefore + 2, ASN_UTC_TIME_SIZE - 1);
dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_GT].noOut = 1;
}
else {
dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_UTC].noOut = 1;
SetASN_Buffer(
&dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_GT],
localBefore + 2, ASN_GEN_TIME_SZ);
}
if (localAfter[0] == ASN_UTC_TIME) {
SetASN_Buffer(
&dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_UTC],
localAfter + 2, ASN_UTC_TIME_SIZE - 1);
dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_GT].noOut = 1;
}
else {
dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_UTC].noOut = 1;
SetASN_Buffer(
&dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_GT],
localAfter + 2, ASN_GEN_TIME_SZ);
}
}
}
if (sbjRawLen > 0) {
/* Put in encoded subject name. */
Expand Down Expand Up @@ -31075,7 +31125,9 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
X509CERTASN_IDX_SIGNATURE);

/* Calculate encoded certificate body size. */
ret = SizeASN_Items(x509CertASN, dataASN, x509CertASN_Length, &sz);
if (ret >= 0) {
ret = SizeASN_Items(x509CertASN, dataASN, x509CertASN_Length, &sz);
}
}
/* Check buffer is big enough for encoded data. */
if ((ret == 0) && (sz > derSz)) {
Expand Down Expand Up @@ -31106,18 +31158,6 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
dataASN[X509CERTASN_IDX_TBS_SUBJECT_SEQ].data.buffer.length,
&cert->subject, cert->heap);
}
if (ret >= 0) {
if (cert->beforeDateSz == 0 || cert->afterDateSz == 0)
{
/* Encode validity into buffer. */
/* safe casts -- the pointers are actually inside derBuffer. */
ret = SetValidity(
(byte*)(wc_ptr_t)dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTB_GT]
.data.buffer.data,
(byte*)(wc_ptr_t)dataASN[X509CERTASN_IDX_TBS_VALIDITY_NOTA_GT]
.data.buffer.data, cert->daysValid);
}
}
if (ret >= 0) {
/* Encode public key into buffer. */
/* safe cast -- the pointer is actually inside derBuffer. */
Expand Down
30 changes: 16 additions & 14 deletions wolfcrypt/src/asn_orig.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5911,17 +5911,15 @@ int SetNameEx(byte* output, word32 outputSz, CertName* name, void* heap)

/* Set Date validity from now until now + daysValid
* return size in bytes written to output, 0 on error */
/* TODO https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5
* "MUST always encode certificate validity dates through the year 2049 as
* UTCTime; certificate validity dates in 2050 or later MUST be encoded as
* GeneralizedTime." */
static int SetValidity(byte* output, int daysValid)
{
#ifndef NO_ASN_TIME
byte before[MAX_DATE_SIZE];
byte after[MAX_DATE_SIZE];

word32 beforeSz, afterSz, seqSz;
word32 timeSz;
byte format;

time_t now;
time_t then;
Expand All @@ -5941,9 +5939,6 @@ static int SetValidity(byte* output, int daysValid)
now = wc_Time(0);

/* before now */
before[0] = ASN_GENERALIZED_TIME;
beforeSz = SetLength(ASN_GEN_TIME_SZ, before + 1) + 1; /* gen tag */

/* subtract 1 day of seconds for more compliance */
then = now - 86400;
expandedTime = XGMTIME(&then, tmpTime);
Expand All @@ -5957,11 +5952,13 @@ static int SetValidity(byte* output, int daysValid)
localTime.tm_year += 1900;
localTime.tm_mon += 1;

SetTime(&localTime, before + beforeSz);
beforeSz += ASN_GEN_TIME_SZ;

after[0] = ASN_GENERALIZED_TIME;
afterSz = SetLength(ASN_GEN_TIME_SZ, after + 1) + 1; /* gen tag */
format = ValidityTimeFormat(&localTime);
timeSz = (format == ASN_UTC_TIME) ? ASN_UTC_TIME_SIZE - 1
: ASN_GEN_TIME_SZ;
before[0] = format;
beforeSz = SetLength(timeSz, before + 1) + 1;
SetTime(&localTime, before + beforeSz, format);
beforeSz += timeSz;

/* add daysValid of seconds */
then = now + (daysValid * (time_t)86400);
Expand All @@ -5976,8 +5973,13 @@ static int SetValidity(byte* output, int daysValid)
localTime.tm_year += 1900;
localTime.tm_mon += 1;

SetTime(&localTime, after + afterSz);
afterSz += ASN_GEN_TIME_SZ;
format = ValidityTimeFormat(&localTime);
timeSz = (format == ASN_UTC_TIME) ? ASN_UTC_TIME_SIZE - 1
: ASN_GEN_TIME_SZ;
after[0] = format;
afterSz = SetLength(timeSz, after + 1) + 1;
SetTime(&localTime, after + afterSz, format);
afterSz += timeSz;

/* headers and output */
seqSz = SetSequence(beforeSz + afterSz, output);
Expand Down
Loading
Loading