|
 |
0ac9f2 |
From 713e61448a6ffa3e6029a7c89fad61b8cb08c9ff Mon Sep 17 00:00:00 2001
|
|
|
0ac9f2 |
From: Peter Jones <pjones@redhat.com>
|
|
|
0ac9f2 |
Date: Tue, 25 Apr 2017 17:00:46 -0400
|
|
|
0ac9f2 |
Subject: [PATCH 19/29] more about the time
|
|
|
0ac9f2 |
|
|
|
0ac9f2 |
---
|
|
|
0ac9f2 |
src/certdb.c | 59 +++++++++++++++++++++++++++++++++--------------------------
|
|
|
0ac9f2 |
1 file changed, 33 insertions(+), 26 deletions(-)
|
|
|
0ac9f2 |
|
|
|
0ac9f2 |
diff --git a/src/certdb.c b/src/certdb.c
|
|
|
0ac9f2 |
index 673e074..1078a8a 100644
|
|
|
0ac9f2 |
--- a/src/certdb.c
|
|
|
0ac9f2 |
+++ b/src/certdb.c
|
|
|
0ac9f2 |
@@ -345,8 +345,10 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype,
|
|
|
0ac9f2 |
PRBool result;
|
|
|
0ac9f2 |
SECStatus rv;
|
|
|
0ac9f2 |
db_status status = NOT_FOUND;
|
|
|
0ac9f2 |
+ PRTime atTime = PR_Now();
|
|
|
0ac9f2 |
+ SECItem *eTime;
|
|
|
0ac9f2 |
PRTime earlyNow = 0, lateNow = 0x7fffffffffffffff;
|
|
|
0ac9f2 |
- PRTime notBefore = 0, notAfter = 0x7fffffffffffffff;
|
|
|
0ac9f2 |
+ PRTime notBefore, notAfter;
|
|
|
0ac9f2 |
|
|
|
0ac9f2 |
efi_guid_t efi_x509 = efi_guid_x509_cert;
|
|
|
0ac9f2 |
|
|
|
0ac9f2 |
@@ -358,6 +360,36 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype,
|
|
|
0ac9f2 |
if (!cinfo)
|
|
|
0ac9f2 |
goto out;
|
|
|
0ac9f2 |
|
|
|
0ac9f2 |
+ notBefore = earlyNow;
|
|
|
0ac9f2 |
+ notAfter = lateNow;
|
|
|
0ac9f2 |
+ find_cert_times(cinfo, ¬Before, ¬After);
|
|
|
0ac9f2 |
+ if (earlyNow < notBefore)
|
|
|
0ac9f2 |
+ earlyNow = notBefore;
|
|
|
0ac9f2 |
+ if (lateNow > notAfter)
|
|
|
0ac9f2 |
+ lateNow = notAfter;
|
|
|
0ac9f2 |
+
|
|
|
0ac9f2 |
+ // atTime = determine_reasonable_time(cert);
|
|
|
0ac9f2 |
+ eTime = SEC_PKCS7GetSigningTime(cinfo);
|
|
|
0ac9f2 |
+ if (eTime != NULL) {
|
|
|
0ac9f2 |
+ if (DER_DecodeTimeChoice (&atTime, eTime) == SECSuccess) {
|
|
|
0ac9f2 |
+ if (earlyNow < atTime)
|
|
|
0ac9f2 |
+ earlyNow = atTime;
|
|
|
0ac9f2 |
+ if (lateNow > atTime)
|
|
|
0ac9f2 |
+ lateNow = atTime;
|
|
|
0ac9f2 |
+ }
|
|
|
0ac9f2 |
+ }
|
|
|
0ac9f2 |
+
|
|
|
0ac9f2 |
+ if (lateNow < earlyNow)
|
|
|
0ac9f2 |
+ printf("Signature has impossible time constraint: %ld <= %ld\n",
|
|
|
0ac9f2 |
+ earlyNow / 1000000, lateNow / 1000000);
|
|
|
0ac9f2 |
+ atTime = earlyNow / 2 + lateNow / 2;
|
|
|
0ac9f2 |
+
|
|
|
0ac9f2 |
+
|
|
|
0ac9f2 |
+ cinfo = SEC_PKCS7DecodeItem(pkcs7sig, NULL, NULL, NULL, NULL, NULL,
|
|
|
0ac9f2 |
+ NULL, NULL);
|
|
|
0ac9f2 |
+ if (!cinfo)
|
|
|
0ac9f2 |
+ goto out;
|
|
|
0ac9f2 |
+
|
|
|
0ac9f2 |
/* Generate the digest of contentInfo */
|
|
|
0ac9f2 |
/* XXX support only sha256 for now */
|
|
|
0ac9f2 |
digest = SECITEM_AllocItem(NULL, NULL, 32);
|
|
|
0ac9f2 |
@@ -401,31 +433,6 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype,
|
|
|
0ac9f2 |
PORT_ErrorToString(PORT_GetError()));
|
|
|
0ac9f2 |
goto out;
|
|
|
0ac9f2 |
}
|
|
|
0ac9f2 |
- cert->timeOK = PR_TRUE;
|
|
|
0ac9f2 |
-
|
|
|
0ac9f2 |
- find_cert_times(cinfo, ¬Before, ¬After);
|
|
|
0ac9f2 |
- if (earlyNow < notBefore)
|
|
|
0ac9f2 |
- earlyNow = notBefore;
|
|
|
0ac9f2 |
- if (lateNow > notAfter)
|
|
|
0ac9f2 |
- lateNow = notAfter;
|
|
|
0ac9f2 |
-
|
|
|
0ac9f2 |
- SECItem *eTime;
|
|
|
0ac9f2 |
- PRTime atTime;
|
|
|
0ac9f2 |
- // atTime = determine_reasonable_time(cert);
|
|
|
0ac9f2 |
- eTime = SEC_PKCS7GetSigningTime(cinfo);
|
|
|
0ac9f2 |
- if (eTime != NULL) {
|
|
|
0ac9f2 |
- if (DER_DecodeTimeChoice (&atTime, eTime) == SECSuccess) {
|
|
|
0ac9f2 |
- if (earlyNow < atTime)
|
|
|
0ac9f2 |
- earlyNow = atTime;
|
|
|
0ac9f2 |
- if (lateNow > atTime)
|
|
|
0ac9f2 |
- lateNow = atTime;
|
|
|
0ac9f2 |
- }
|
|
|
0ac9f2 |
- }
|
|
|
0ac9f2 |
-
|
|
|
0ac9f2 |
- if (lateNow < earlyNow)
|
|
|
0ac9f2 |
- printf("Impossible time constraints: %ld <= %ld\n",
|
|
|
0ac9f2 |
- earlyNow / 1000000, lateNow / 1000000);
|
|
|
0ac9f2 |
- atTime = earlyNow / 2 + lateNow / 2;
|
|
|
0ac9f2 |
|
|
|
0ac9f2 |
/* Verify the signature */
|
|
|
0ac9f2 |
result = SEC_PKCS7VerifyDetachedSignatureAtTime(cinfo,
|
|
|
0ac9f2 |
--
|
|
|
0ac9f2 |
2.13.4
|
|
|
0ac9f2 |
|