1 // Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include <openssl/asn1.h>
16 #include <openssl/posix_time.h>
17
18 #include <string.h>
19 #include <time.h>
20
21 #include <openssl/asn1t.h>
22 #include <openssl/bytestring.h>
23 #include <openssl/err.h>
24 #include <openssl/mem.h>
25
26 #include "internal.h"
27
28 // This is an implementation of the ASN1 Time structure which is: Time ::=
29 // CHOICE { utcTime UTCTime, generalTime GeneralizedTime } written by Steve
30 // Henson.
31
IMPLEMENT_ASN1_MSTRING(ASN1_TIME,B_ASN1_TIME)32 IMPLEMENT_ASN1_MSTRING(ASN1_TIME, B_ASN1_TIME)
33
34 IMPLEMENT_ASN1_FUNCTIONS_const(ASN1_TIME)
35
36 ASN1_TIME *ASN1_TIME_set_posix(ASN1_TIME *s, int64_t posix_time) {
37 return ASN1_TIME_adj(s, posix_time, 0, 0);
38 }
39
ASN1_TIME_set(ASN1_TIME * s,time_t time)40 ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t time) {
41 return ASN1_TIME_adj(s, time, 0, 0);
42 }
43
fits_in_utc_time(const struct tm * tm)44 static int fits_in_utc_time(const struct tm *tm) {
45 return 50 <= tm->tm_year && tm->tm_year < 150;
46 }
47
ASN1_TIME_adj(ASN1_TIME * s,int64_t posix_time,int offset_day,long offset_sec)48 ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, int64_t posix_time, int offset_day,
49 long offset_sec) {
50 struct tm tm;
51
52 if (!OPENSSL_posix_to_tm(posix_time, &tm)) {
53 OPENSSL_PUT_ERROR(ASN1, ASN1_R_ERROR_GETTING_TIME);
54 return NULL;
55 }
56 if (offset_day || offset_sec) {
57 if (!OPENSSL_gmtime_adj(&tm, offset_day, offset_sec)) {
58 return NULL;
59 }
60 }
61 if (fits_in_utc_time(&tm)) {
62 return ASN1_UTCTIME_adj(s, posix_time, offset_day, offset_sec);
63 }
64 return ASN1_GENERALIZEDTIME_adj(s, posix_time, offset_day, offset_sec);
65 }
66
ASN1_TIME_check(const ASN1_TIME * t)67 int ASN1_TIME_check(const ASN1_TIME *t) {
68 if (t->type == V_ASN1_GENERALIZEDTIME) {
69 return ASN1_GENERALIZEDTIME_check(t);
70 } else if (t->type == V_ASN1_UTCTIME) {
71 return ASN1_UTCTIME_check(t);
72 }
73 return 0;
74 }
75
76 // Convert an ASN1_TIME structure to GeneralizedTime
ASN1_TIME_to_generalizedtime(const ASN1_TIME * in,ASN1_GENERALIZEDTIME ** out)77 ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *in,
78 ASN1_GENERALIZEDTIME **out) {
79 if (!ASN1_TIME_check(in)) {
80 return NULL;
81 }
82
83 ASN1_GENERALIZEDTIME *ret = NULL;
84 if (!out || !*out) {
85 if (!(ret = ASN1_GENERALIZEDTIME_new())) {
86 goto err;
87 }
88 } else {
89 ret = *out;
90 }
91
92 // If already GeneralizedTime just copy across
93 if (in->type == V_ASN1_GENERALIZEDTIME) {
94 if (!ASN1_STRING_set(ret, in->data, in->length)) {
95 goto err;
96 }
97 goto done;
98 }
99
100 // Grow the string to accomodate the two-digit century.
101 if (!ASN1_STRING_set(ret, NULL, in->length + 2)) {
102 goto err;
103 }
104
105 {
106 char *const out_str = (char *)ret->data;
107 // |ASN1_STRING_set| also allocates an additional byte for a trailing NUL.
108 const size_t out_str_capacity = in->length + 2 + 1;
109 // Work out the century and prepend
110 if (in->data[0] >= '5') {
111 OPENSSL_strlcpy(out_str, "19", out_str_capacity);
112 } else {
113 OPENSSL_strlcpy(out_str, "20", out_str_capacity);
114 }
115 OPENSSL_strlcat(out_str, (const char *)in->data, out_str_capacity);
116 }
117
118 done:
119 if (out != NULL && *out == NULL) {
120 *out = ret;
121 }
122 return ret;
123
124 err:
125 if (out == NULL || *out != ret) {
126 ASN1_GENERALIZEDTIME_free(ret);
127 }
128 return NULL;
129 }
130
ASN1_TIME_set_string(ASN1_TIME * s,const char * str)131 int ASN1_TIME_set_string(ASN1_TIME *s, const char *str) {
132 return ASN1_UTCTIME_set_string(s, str) ||
133 ASN1_GENERALIZEDTIME_set_string(s, str);
134 }
135
ASN1_TIME_set_string_X509(ASN1_TIME * s,const char * str)136 int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str) {
137 CBS cbs;
138 CBS_init(&cbs, (const uint8_t *)str, strlen(str));
139 int type;
140 struct tm tm;
141 if (CBS_parse_utc_time(&cbs, /*out_tm=*/NULL,
142 /*allow_timezone_offset=*/0)) {
143 type = V_ASN1_UTCTIME;
144 } else if (CBS_parse_generalized_time(&cbs, &tm,
145 /*allow_timezone_offset=*/0)) {
146 type = V_ASN1_GENERALIZEDTIME;
147 if (fits_in_utc_time(&tm)) {
148 type = V_ASN1_UTCTIME;
149 CBS_skip(&cbs, 2);
150 }
151 } else {
152 return 0;
153 }
154
155 if (s != NULL) {
156 if (!ASN1_STRING_set(s, CBS_data(&cbs), CBS_len(&cbs))) {
157 return 0;
158 }
159 s->type = type;
160 }
161 return 1;
162 }
163
asn1_time_to_tm(struct tm * tm,const ASN1_TIME * t,int allow_timezone_offset)164 static int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *t,
165 int allow_timezone_offset) {
166 if (t == NULL) {
167 if (OPENSSL_posix_to_tm(time(NULL), tm)) {
168 return 1;
169 }
170 return 0;
171 }
172
173 if (t->type == V_ASN1_UTCTIME) {
174 return asn1_utctime_to_tm(tm, t, allow_timezone_offset);
175 } else if (t->type == V_ASN1_GENERALIZEDTIME) {
176 return asn1_generalizedtime_to_tm(tm, t);
177 }
178
179 return 0;
180 }
181
ASN1_TIME_diff(int * out_days,int * out_seconds,const ASN1_TIME * from,const ASN1_TIME * to)182 int ASN1_TIME_diff(int *out_days, int *out_seconds, const ASN1_TIME *from,
183 const ASN1_TIME *to) {
184 struct tm tm_from, tm_to;
185 if (!asn1_time_to_tm(&tm_from, from, /*allow_timezone_offset=*/1)) {
186 return 0;
187 }
188 if (!asn1_time_to_tm(&tm_to, to, /*allow_timezone_offset=*/1)) {
189 return 0;
190 }
191 return OPENSSL_gmtime_diff(out_days, out_seconds, &tm_from, &tm_to);
192 }
193
ASN1_TIME_to_posix_nonstandard(const ASN1_TIME * t,int64_t * out_time)194 int ASN1_TIME_to_posix_nonstandard(const ASN1_TIME *t, int64_t *out_time) {
195 struct tm tm;
196 if (!asn1_time_to_tm(&tm, t, /*allow_timezone_offset=*/1)) {
197 return 0;
198 }
199 return OPENSSL_tm_to_posix(&tm, out_time);
200 }
201
202 // The functions below do *not* permissively allow the use of four digit
203 // timezone offsets in UTC times, as is done elsewhere in the code. They are
204 // both new API, and used internally to X509_cmp_time. This is to discourage the
205 // use of nonstandard times in new code, and to ensure that this code behaves
206 // correctly in X509_cmp_time which historically did its own time validations
207 // slightly different than the many other copies of X.509 time validation
208 // sprinkled through the codebase. The custom checks in X509_cmp_time meant that
209 // it did not allow four digit timezone offsets in UTC times.
ASN1_TIME_to_time_t(const ASN1_TIME * t,time_t * out_time)210 int ASN1_TIME_to_time_t(const ASN1_TIME *t, time_t *out_time) {
211 struct tm tm;
212 if (!asn1_time_to_tm(&tm, t, /*allow_timezone_offset=*/0)) {
213 return 0;
214 }
215 return OPENSSL_timegm(&tm, out_time);
216 }
217
ASN1_TIME_to_posix(const ASN1_TIME * t,int64_t * out_time)218 int ASN1_TIME_to_posix(const ASN1_TIME *t, int64_t *out_time) {
219 struct tm tm;
220 if (!asn1_time_to_tm(&tm, t, /*allow_timezone_offset=*/0)) {
221 return 0;
222 }
223 return OPENSSL_tm_to_posix(&tm, out_time);
224 }
225