mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Backed out changeset 5ea9b7bd2db5 (bug 1019770)
This commit is contained in:
Wes Kocher
parent
3d70d4912f
commit
ea96ce4eb0
@ -33,33 +33,12 @@
|
||||
namespace mozilla { namespace pkix {
|
||||
|
||||
Result
|
||||
CheckTimes(const CERTValidity& validity, PRTime time)
|
||||
CheckTimes(const CERTCertificate* cert, PRTime time)
|
||||
{
|
||||
der::Input notBeforeInput;
|
||||
if (notBeforeInput.Init(validity.notBefore.data, validity.notBefore.len)
|
||||
!= der::Success) {
|
||||
return Fail(RecoverableError, SEC_ERROR_EXPIRED_CERTIFICATE);
|
||||
}
|
||||
PRTime notBefore;
|
||||
if (der::TimeChoice(validity.notBefore.type, notBeforeInput, notBefore)
|
||||
!= der::Success) {
|
||||
return Fail(RecoverableError, SEC_ERROR_EXPIRED_CERTIFICATE);
|
||||
}
|
||||
if (time < notBefore) {
|
||||
return Fail(RecoverableError, SEC_ERROR_EXPIRED_CERTIFICATE);
|
||||
}
|
||||
PR_ASSERT(cert);
|
||||
|
||||
der::Input notAfterInput;
|
||||
if (notAfterInput.Init(validity.notAfter.data, validity.notAfter.len)
|
||||
!= der::Success) {
|
||||
return Fail(RecoverableError, SEC_ERROR_EXPIRED_CERTIFICATE);
|
||||
}
|
||||
PRTime notAfter;
|
||||
if (der::TimeChoice(validity.notAfter.type, notAfterInput, notAfter)
|
||||
!= der::Success) {
|
||||
return Fail(RecoverableError, SEC_ERROR_EXPIRED_CERTIFICATE);
|
||||
}
|
||||
if (time > notAfter) {
|
||||
SECCertTimeValidity validity = CERT_CheckCertValidTimes(cert, time, false);
|
||||
if (validity != secCertTimeValid) {
|
||||
return Fail(RecoverableError, SEC_ERROR_EXPIRED_CERTIFICATE);
|
||||
}
|
||||
|
||||
@ -714,7 +693,7 @@ CheckIssuerIndependentProperties(TrustDomain& trustDomain,
|
||||
|
||||
// IMPORTANT: This check must come after the other checks in order for error
|
||||
// ranking to work correctly.
|
||||
rv = CheckTimes(cert.GetNSSCert()->validity, time);
|
||||
rv = CheckTimes(cert.GetNSSCert(), time);
|
||||
if (rv != Success) {
|
||||
return rv;
|
||||
}
|
||||
|
||||
@ -133,176 +133,4 @@ SignedData(Input& input, /*out*/ Input& tbs, /*out*/ CERTSignedData& signedData)
|
||||
return Success;
|
||||
}
|
||||
|
||||
static inline Result
|
||||
ReadDigit(Input& input, /*out*/ int& value)
|
||||
{
|
||||
uint8_t b;
|
||||
if (input.Read(b) != Success) {
|
||||
return Fail(SEC_ERROR_INVALID_TIME);
|
||||
}
|
||||
if (b < '0' || b > '9') {
|
||||
return Fail(SEC_ERROR_INVALID_TIME);
|
||||
}
|
||||
value = b - '0';
|
||||
return Success;
|
||||
}
|
||||
|
||||
static inline Result
|
||||
ReadTwoDigits(Input& input, int minValue, int maxValue, /*out*/ int& value)
|
||||
{
|
||||
int hi;
|
||||
if (ReadDigit(input, hi) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
int lo;
|
||||
if (ReadDigit(input, lo) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
value = (hi * 10) + lo;
|
||||
if (value < minValue || value > maxValue) {
|
||||
return Fail(SEC_ERROR_INVALID_TIME);
|
||||
}
|
||||
return Success;
|
||||
}
|
||||
|
||||
inline int
|
||||
daysBeforeYear(int year)
|
||||
{
|
||||
return (365 * (year - 1))
|
||||
+ ((year - 1) / 4) // leap years are every 4 years,
|
||||
- ((year - 1) / 100) // except years divisible by 100,
|
||||
+ ((year - 1) / 400); // except years divisible by 400.
|
||||
}
|
||||
|
||||
// We parse GeneralizedTime and UTCTime according to RFC 5280 and we do not
|
||||
// accept all time formats allowed in the ASN.1 spec. That is,
|
||||
// GeneralizedTime must always be in the format YYYYMMDDHHMMSSZ and UTCTime
|
||||
// must always be in the format YYMMDDHHMMSSZ. Timezone formats of the form
|
||||
// +HH:MM or -HH:MM or NOT accepted.
|
||||
Result
|
||||
TimeChoice(SECItemType type, Input& input, /*out*/ PRTime& time)
|
||||
{
|
||||
int days;
|
||||
|
||||
int yearHi;
|
||||
int yearLo;
|
||||
if (type == siGeneralizedTime) {
|
||||
if (ReadTwoDigits(input, 0, 99, yearHi) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
if (ReadTwoDigits(input, 0, 99, yearLo) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
} else if (type == siUTCTime) {
|
||||
if (ReadTwoDigits(input, 0, 99, yearLo) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
yearHi = yearLo >= 50 ? 19 : 20;
|
||||
} else {
|
||||
PR_NOT_REACHED("invalid tag given to TimeChoice");
|
||||
return Fail(SEC_ERROR_INVALID_TIME);
|
||||
}
|
||||
int year = (yearHi * 100) + yearLo;
|
||||
if (year < 1970) {
|
||||
// We don't support dates before January 1, 1970 because that is the epoch.
|
||||
return Fail(SEC_ERROR_INVALID_TIME); // TODO: better error code
|
||||
}
|
||||
if (year > 1970) {
|
||||
// This is NOT equivalent to daysBeforeYear(year - 1970) because the
|
||||
// leap year calculations in daysBeforeYear only works on absolute years.
|
||||
days = daysBeforeYear(year) - daysBeforeYear(1970);
|
||||
// We subtract 1 because we're interested in knowing how many days there
|
||||
// were *before* the given year, relative to 1970.
|
||||
} else {
|
||||
days = 0;
|
||||
}
|
||||
|
||||
int month;
|
||||
if (ReadTwoDigits(input, 1, 12, month) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
int daysInMonth;
|
||||
static const int jan = 31;
|
||||
const int feb = ((year % 4 == 0) &&
|
||||
((year % 100 != 0) || (year % 400 == 0)))
|
||||
? 29
|
||||
: 28;
|
||||
static const int mar = 31;
|
||||
static const int apr = 30;
|
||||
static const int may = 31;
|
||||
static const int jun = 30;
|
||||
static const int jul = 31;
|
||||
static const int aug = 31;
|
||||
static const int sep = 30;
|
||||
static const int oct = 31;
|
||||
static const int nov = 30;
|
||||
static const int dec = 31;
|
||||
switch (month) {
|
||||
case 1: daysInMonth = jan; break;
|
||||
case 2: daysInMonth = feb; days += jan; break;
|
||||
case 3: daysInMonth = mar; days += jan + feb; break;
|
||||
case 4: daysInMonth = apr; days += jan + feb + mar; break;
|
||||
case 5: daysInMonth = may; days += jan + feb + mar + apr; break;
|
||||
case 6: daysInMonth = jun; days += jan + feb + mar + apr + may; break;
|
||||
case 7: daysInMonth = jul; days += jan + feb + mar + apr + may + jun;
|
||||
break;
|
||||
case 8: daysInMonth = aug; days += jan + feb + mar + apr + may + jun +
|
||||
jul;
|
||||
break;
|
||||
case 9: daysInMonth = sep; days += jan + feb + mar + apr + may + jun +
|
||||
jul + aug;
|
||||
break;
|
||||
case 10: daysInMonth = oct; days += jan + feb + mar + apr + may + jun +
|
||||
jul + aug + sep;
|
||||
break;
|
||||
case 11: daysInMonth = nov; days += jan + feb + mar + apr + may + jun +
|
||||
jul + aug + sep + oct;
|
||||
break;
|
||||
case 12: daysInMonth = dec; days += jan + feb + mar + apr + may + jun +
|
||||
jul + aug + sep + oct + nov;
|
||||
break;
|
||||
default:
|
||||
PR_NOT_REACHED("month already bounds-checked by ReadTwoDigits");
|
||||
return Fail(PR_INVALID_STATE_ERROR);
|
||||
}
|
||||
|
||||
int dayOfMonth;
|
||||
if (ReadTwoDigits(input, 1, daysInMonth, dayOfMonth) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
days += dayOfMonth - 1;
|
||||
|
||||
int hours;
|
||||
if (ReadTwoDigits(input, 0, 23, hours) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
int minutes;
|
||||
if (ReadTwoDigits(input, 0, 59, minutes) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
int seconds;
|
||||
if (ReadTwoDigits(input, 0, 59, seconds) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
|
||||
uint8_t b;
|
||||
if (input.Read(b) != Success) {
|
||||
return Fail(SEC_ERROR_INVALID_TIME);
|
||||
}
|
||||
if (b != 'Z') {
|
||||
return Fail(SEC_ERROR_INVALID_TIME); // TODO: better error code?
|
||||
}
|
||||
if (End(input) != Success) {
|
||||
return Fail(SEC_ERROR_INVALID_TIME);
|
||||
}
|
||||
|
||||
int64_t totalSeconds = (static_cast<int64_t>(days) * 24 * 60 * 60) +
|
||||
(static_cast<int64_t>(hours) * 60 * 60) +
|
||||
(static_cast<int64_t>(minutes) * 60) +
|
||||
seconds;
|
||||
|
||||
time = totalSeconds * PR_USEC_PER_SEC;
|
||||
return Success;
|
||||
}
|
||||
|
||||
} } } // namespace mozilla::pkix::der
|
||||
|
||||
@ -41,7 +41,8 @@
|
||||
#include "pkix/nullptr.h"
|
||||
|
||||
#include "prerror.h"
|
||||
#include "prtime.h"
|
||||
#include "prlog.h"
|
||||
#include "secder.h"
|
||||
#include "secerr.h"
|
||||
#include "secoidt.h"
|
||||
#include "stdint.h"
|
||||
@ -72,7 +73,6 @@ enum Tag
|
||||
NULLTag = UNIVERSAL | 0x05,
|
||||
OIDTag = UNIVERSAL | 0x06,
|
||||
ENUMERATED = UNIVERSAL | 0x0a,
|
||||
UTCTime = UNIVERSAL | 0x17,
|
||||
GENERALIZED_TIME = UNIVERSAL | 0x18,
|
||||
SEQUENCE = UNIVERSAL | CONSTRUCTED | 0x30,
|
||||
};
|
||||
@ -497,33 +497,17 @@ Enumerated(Input& input, uint8_t& value)
|
||||
return internal::IntegralValue(input, ENUMERATED | 0, value);
|
||||
}
|
||||
|
||||
// XXX: This function should have the signature:
|
||||
//
|
||||
// Result TimeChoice(Input& input, /*out*/ PRTime& time);
|
||||
//
|
||||
// and parse the tag (and length and value) from the input like the other
|
||||
// functions here. However, currently we get TimeChoices already partially
|
||||
// decoded by NSS, so for now we'll have this signature, where the input
|
||||
// parameter contains the value of the time choice.
|
||||
//
|
||||
// type must be either siGeneralizedTime or siUTCTime.
|
||||
//
|
||||
// Only times from 1970-01-01-00:00:00 onward are accepted, in order to
|
||||
// eliminate the chance for complications in converting times to traditional
|
||||
// time formats that start at 1970.
|
||||
Result TimeChoice(SECItemType type, Input& input, /*out*/ PRTime& time);
|
||||
|
||||
// Only times from 1970-01-01-00:00:00 onward are accepted, in order to
|
||||
// eliminate the chance for complications in converting times to traditional
|
||||
// time formats that start at 1970.
|
||||
inline Result
|
||||
GeneralizedTime(Input& input, PRTime& time)
|
||||
{
|
||||
Input value;
|
||||
if (ExpectTagAndGetValue(input, GENERALIZED_TIME, value) != Success) {
|
||||
SECItem encoded;
|
||||
if (ExpectTagAndGetValue(input, GENERALIZED_TIME, encoded) != Success) {
|
||||
return Failure;
|
||||
}
|
||||
return TimeChoice(siGeneralizedTime, value, time);
|
||||
if (DER_GeneralizedTimeToTime(&time, &encoded) != SECSuccess) {
|
||||
return Failure;
|
||||
}
|
||||
return Success;
|
||||
}
|
||||
|
||||
// This parser will only parse values between 0..127. If this range is
|
||||
|
||||
Loading…
Reference in New Issue
Block a user