op public repos

Blame

Date:: Wed Aug 23 17:38:49 2023 UTC
Message:: bundle libtls gmid (like all other daemons that want to do privsep crypto) has a very close relationship with libtls and need to stay in sync with it. OpenBSD' libtls was recently changed to use OpenSSL' EC_KEY_METHOD instead of the older ECDSA_METHOD, on the gmid side we have to do the same otherwise failures happens at runtime. In a similar manner, privsep crypto is silently broken in the current libretls (next version should fix it.) The proper solution would be to complete the signer APIs so that applications don't need to dive into the library' internals, but that's a mid-term goal, for the immediate bundling the 'little' libtls is the lesser evil. The configure script has gained a new (undocumented for the time being) flag `--with-libtls=bundled|system' to control which libtls to use. It defaults to `bundled' except for OpenBSD where it uses the `system' one. Note that OpenBSD versions before 7.3 (inclusive) ought to use --with-libtls=bundled too since they still do ECDSA_METHOD.
Actions:: History | Blob | Raw File

  1 f9ab77a8 2023-08-23 op /* $OpenBSD: a_time_tm.c,v 1.15 2018/04/25 11:48:21 tb Exp $ */
  2 f9ab77a8 2023-08-23 op /*
  3 f9ab77a8 2023-08-23 op  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
  4 f9ab77a8 2023-08-23 op  *
  5 f9ab77a8 2023-08-23 op  * Permission to use, copy, modify, and distribute this software for any
  6 f9ab77a8 2023-08-23 op  * purpose with or without fee is hereby granted, provided that the above
  7 f9ab77a8 2023-08-23 op  * copyright notice and this permission notice appear in all copies.
  8 f9ab77a8 2023-08-23 op  *
  9 f9ab77a8 2023-08-23 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 10 f9ab77a8 2023-08-23 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 11 f9ab77a8 2023-08-23 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 12 f9ab77a8 2023-08-23 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 13 f9ab77a8 2023-08-23 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 14 f9ab77a8 2023-08-23 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 15 f9ab77a8 2023-08-23 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 16 f9ab77a8 2023-08-23 op  */
 17 f9ab77a8 2023-08-23 op 
 18 f9ab77a8 2023-08-23 op #include "config.h"
 19 f9ab77a8 2023-08-23 op 
 20 f9ab77a8 2023-08-23 op #include <ctype.h>
 21 f9ab77a8 2023-08-23 op #include <limits.h>
 22 f9ab77a8 2023-08-23 op #include <stdio.h>
 23 f9ab77a8 2023-08-23 op #include <string.h>
 24 f9ab77a8 2023-08-23 op #include <time.h>
 25 f9ab77a8 2023-08-23 op 
 26 f9ab77a8 2023-08-23 op #define GENTIME_LENGTH 15
 27 f9ab77a8 2023-08-23 op #define UTCTIME_LENGTH 13
 28 f9ab77a8 2023-08-23 op 
 29 f9ab77a8 2023-08-23 op #define V_ASN1_UTCTIME          23
 30 f9ab77a8 2023-08-23 op #define V_ASN1_GENERALIZEDTIME  24
 31 f9ab77a8 2023-08-23 op 
 32 f9ab77a8 2023-08-23 op #ifndef HAVE_ASN1_TIME_TM_CMP
 33 f9ab77a8 2023-08-23 op int
 34 f9ab77a8 2023-08-23 op ASN1_time_tm_cmp(struct tm *tm1, struct tm *tm2)
 35 f9ab77a8 2023-08-23 op {
 36 f9ab77a8 2023-08-23 op         if (tm1->tm_year < tm2->tm_year)
 37 f9ab77a8 2023-08-23 op                 return (-1);
 38 f9ab77a8 2023-08-23 op         if (tm1->tm_year > tm2->tm_year)
 39 f9ab77a8 2023-08-23 op                 return (1);
 40 f9ab77a8 2023-08-23 op         if (tm1->tm_mon < tm2->tm_mon)
 41 f9ab77a8 2023-08-23 op                 return (-1);
 42 f9ab77a8 2023-08-23 op         if (tm1->tm_mon > tm2->tm_mon)
 43 f9ab77a8 2023-08-23 op                 return (1);
 44 f9ab77a8 2023-08-23 op         if (tm1->tm_mday < tm2->tm_mday)
 45 f9ab77a8 2023-08-23 op                 return (-1);
 46 f9ab77a8 2023-08-23 op         if (tm1->tm_mday > tm2->tm_mday)
 47 f9ab77a8 2023-08-23 op                 return (1);
 48 f9ab77a8 2023-08-23 op         if (tm1->tm_hour < tm2->tm_hour)
 49 f9ab77a8 2023-08-23 op                 return (-1);
 50 f9ab77a8 2023-08-23 op         if (tm1->tm_hour > tm2->tm_hour)
 51 f9ab77a8 2023-08-23 op                 return (1);
 52 f9ab77a8 2023-08-23 op         if (tm1->tm_min < tm2->tm_min)
 53 f9ab77a8 2023-08-23 op                 return (-1);
 54 f9ab77a8 2023-08-23 op         if (tm1->tm_min > tm2->tm_min)
 55 f9ab77a8 2023-08-23 op                 return (1);
 56 f9ab77a8 2023-08-23 op         if (tm1->tm_sec < tm2->tm_sec)
 57 f9ab77a8 2023-08-23 op                 return (-1);
 58 f9ab77a8 2023-08-23 op         if (tm1->tm_sec > tm2->tm_sec)
 59 f9ab77a8 2023-08-23 op                 return (1);
 60 f9ab77a8 2023-08-23 op         return 0;
 61 f9ab77a8 2023-08-23 op }
 62 f9ab77a8 2023-08-23 op #endif
 63 f9ab77a8 2023-08-23 op 
 64 f9ab77a8 2023-08-23 op #ifndef HAVE_ASN1_TIME_TM_CLAMP_NOTAFTER
 65 f9ab77a8 2023-08-23 op int
 66 f9ab77a8 2023-08-23 op ASN1_time_tm_clamp_notafter(struct tm *tm)
 67 f9ab77a8 2023-08-23 op {
 68 f9ab77a8 2023-08-23 op #ifdef SMALL_TIME_T
 69 f9ab77a8 2023-08-23 op         struct tm broken_os_epoch_tm;
 70 f9ab77a8 2023-08-23 op         time_t broken_os_epoch_time = INT_MAX;
 71 f9ab77a8 2023-08-23 op 
 72 f9ab77a8 2023-08-23 op         if (gmtime_r(&broken_os_epoch_time, &broken_os_epoch_tm) == NULL)
 73 f9ab77a8 2023-08-23 op                 return 0;
 74 f9ab77a8 2023-08-23 op 
 75 f9ab77a8 2023-08-23 op         if (ASN1_time_tm_cmp(tm, &broken_os_epoch_tm) == 1)
 76 f9ab77a8 2023-08-23 op                 memcpy(tm, &broken_os_epoch_tm, sizeof(*tm));
 77 f9ab77a8 2023-08-23 op #endif
 78 f9ab77a8 2023-08-23 op         return 1;
 79 f9ab77a8 2023-08-23 op }
 80 f9ab77a8 2023-08-23 op #endif
 81 f9ab77a8 2023-08-23 op 
 82 f9ab77a8 2023-08-23 op /*
 83 f9ab77a8 2023-08-23 op  * Parse an RFC 5280 format ASN.1 time string.
 84 f9ab77a8 2023-08-23 op  *
 85 f9ab77a8 2023-08-23 op  * mode must be:
 86 f9ab77a8 2023-08-23 op  * 0 if we expect to parse a time as specified in RFC 5280 for an X509 object.
 87 f9ab77a8 2023-08-23 op  * V_ASN1_UTCTIME if we wish to parse an RFC5280 format UTC time.
 88 f9ab77a8 2023-08-23 op  * V_ASN1_GENERALIZEDTIME if we wish to parse an RFC5280 format Generalized time.
 89 f9ab77a8 2023-08-23 op  *
 90 f9ab77a8 2023-08-23 op  * Returns:
 91 f9ab77a8 2023-08-23 op  * -1 if the string was invalid.
 92 f9ab77a8 2023-08-23 op  * V_ASN1_UTCTIME if the string validated as a UTC time string.
 93 f9ab77a8 2023-08-23 op  * V_ASN1_GENERALIZEDTIME if the string validated as a Generalized time string.
 94 f9ab77a8 2023-08-23 op  *
 95 f9ab77a8 2023-08-23 op  * Fills in *tm with the corresponding time if tm is non NULL.
 96 f9ab77a8 2023-08-23 op  */
 97 f9ab77a8 2023-08-23 op #ifndef HAVE_ASN1_TIME_PARSE
 98 f9ab77a8 2023-08-23 op #define	ATOI2(ar)	((ar) += 2, ((ar)[-2] - '0') * 10 + ((ar)[-1] - '0'))
 99 f9ab77a8 2023-08-23 op int
100 f9ab77a8 2023-08-23 op ASN1_time_parse(const char *bytes, size_t len, struct tm *tm, int mode)
101 f9ab77a8 2023-08-23 op {
102 f9ab77a8 2023-08-23 op 	size_t i;
103 f9ab77a8 2023-08-23 op 	int type = 0;
104 f9ab77a8 2023-08-23 op 	struct tm ltm;
105 f9ab77a8 2023-08-23 op 	struct tm *lt;
106 f9ab77a8 2023-08-23 op 	const char *p;
107 f9ab77a8 2023-08-23 op 
108 f9ab77a8 2023-08-23 op 	if (bytes == NULL)
109 f9ab77a8 2023-08-23 op 		return (-1);
110 f9ab77a8 2023-08-23 op 
111 f9ab77a8 2023-08-23 op 	/* Constrain to valid lengths. */
112 f9ab77a8 2023-08-23 op 	if (len != UTCTIME_LENGTH && len != GENTIME_LENGTH)
113 f9ab77a8 2023-08-23 op 		return (-1);
114 f9ab77a8 2023-08-23 op 
115 f9ab77a8 2023-08-23 op 	lt = tm;
116 f9ab77a8 2023-08-23 op 	if (lt == NULL) {
117 f9ab77a8 2023-08-23 op 		memset(&ltm, 0, sizeof(ltm));
118 f9ab77a8 2023-08-23 op 		lt = &ltm;
119 f9ab77a8 2023-08-23 op 	}
120 f9ab77a8 2023-08-23 op 
121 f9ab77a8 2023-08-23 op 	/* Timezone is required and must be GMT (Zulu). */
122 f9ab77a8 2023-08-23 op 	if (bytes[len - 1] != 'Z')
123 f9ab77a8 2023-08-23 op 		return (-1);
124 f9ab77a8 2023-08-23 op 
125 f9ab77a8 2023-08-23 op 	/* Make sure everything else is digits. */
126 f9ab77a8 2023-08-23 op 	for (i = 0; i < len - 1; i++) {
127 f9ab77a8 2023-08-23 op 		if (isdigit((unsigned char)bytes[i]))
128 f9ab77a8 2023-08-23 op 			continue;
129 f9ab77a8 2023-08-23 op 		return (-1);
130 f9ab77a8 2023-08-23 op 	}
131 f9ab77a8 2023-08-23 op 
132 f9ab77a8 2023-08-23 op 	/*
133 f9ab77a8 2023-08-23 op 	 * Validate and convert the time
134 f9ab77a8 2023-08-23 op 	 */
135 f9ab77a8 2023-08-23 op 	p = bytes;
136 f9ab77a8 2023-08-23 op 	switch (len) {
137 f9ab77a8 2023-08-23 op 	case GENTIME_LENGTH:
138 f9ab77a8 2023-08-23 op 		if (mode == V_ASN1_UTCTIME)
139 f9ab77a8 2023-08-23 op 			return (-1);
140 f9ab77a8 2023-08-23 op 		lt->tm_year = (ATOI2(p) * 100) - 1900;	/* cc */
141 f9ab77a8 2023-08-23 op 		type = V_ASN1_GENERALIZEDTIME;
142 f9ab77a8 2023-08-23 op 		/* FALLTHROUGH */
143 f9ab77a8 2023-08-23 op 	case UTCTIME_LENGTH:
144 f9ab77a8 2023-08-23 op 		if (type == 0) {
145 f9ab77a8 2023-08-23 op 			if (mode == V_ASN1_GENERALIZEDTIME)
146 f9ab77a8 2023-08-23 op 				return (-1);
147 f9ab77a8 2023-08-23 op 			type = V_ASN1_UTCTIME;
148 f9ab77a8 2023-08-23 op 		}
149 f9ab77a8 2023-08-23 op 		lt->tm_year += ATOI2(p);		/* yy */
150 f9ab77a8 2023-08-23 op 		if (type == V_ASN1_UTCTIME) {
151 f9ab77a8 2023-08-23 op 			if (lt->tm_year < 50)
152 f9ab77a8 2023-08-23 op 				lt->tm_year += 100;
153 f9ab77a8 2023-08-23 op 		}
154 f9ab77a8 2023-08-23 op 		lt->tm_mon = ATOI2(p) - 1;		/* mm */
155 f9ab77a8 2023-08-23 op 		if (lt->tm_mon < 0 || lt->tm_mon > 11)
156 f9ab77a8 2023-08-23 op 			return (-1);
157 f9ab77a8 2023-08-23 op 		lt->tm_mday = ATOI2(p);			/* dd */
158 f9ab77a8 2023-08-23 op 		if (lt->tm_mday < 1 || lt->tm_mday > 31)
159 f9ab77a8 2023-08-23 op 			return (-1);
160 f9ab77a8 2023-08-23 op 		lt->tm_hour = ATOI2(p);			/* HH */
161 f9ab77a8 2023-08-23 op 		if (lt->tm_hour < 0 || lt->tm_hour > 23)
162 f9ab77a8 2023-08-23 op 			return (-1);
163 f9ab77a8 2023-08-23 op 		lt->tm_min = ATOI2(p);			/* MM */
164 f9ab77a8 2023-08-23 op 		if (lt->tm_min < 0 || lt->tm_min > 59)
165 f9ab77a8 2023-08-23 op 			return (-1);
166 f9ab77a8 2023-08-23 op 		lt->tm_sec = ATOI2(p);			/* SS */
167 f9ab77a8 2023-08-23 op 		/* Leap second 60 is not accepted. Reconsider later? */
168 f9ab77a8 2023-08-23 op 		if (lt->tm_sec < 0 || lt->tm_sec > 59)
169 f9ab77a8 2023-08-23 op 			return (-1);
170 f9ab77a8 2023-08-23 op 		break;
171 f9ab77a8 2023-08-23 op 	default:
172 f9ab77a8 2023-08-23 op 		return (-1);
173 f9ab77a8 2023-08-23 op 	}
174 f9ab77a8 2023-08-23 op 
175 f9ab77a8 2023-08-23 op 	return (type);
176 f9ab77a8 2023-08-23 op }
177 f9ab77a8 2023-08-23 op #endif