Skip to content

Commit 91321fc

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #8992 from douzzer/20250710-WC_ASN_RUNTIME_DATE_CHECK_CONTROL
20250710-WC_ASN_RUNTIME_DATE_CHECK_CONTROL
2 parents 1f71e6d + d90394e commit 91321fc

File tree

4 files changed

+57
-12
lines changed

4 files changed

+57
-12
lines changed

‎.wolfssl_known_macro_extras‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -558,6 +558,7 @@ WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING
558558
WC_AES_BS_WORD_SIZE
559559
WC_AES_GCM_DEC_AUTH_EARLY
560560
WC_ASN_HASH_SHA256
561+
WC_ASN_RUNTIME_DATE_CHECK_CONTROL
561562
WC_ASYNC_ENABLE_3DES
562563
WC_ASYNC_ENABLE_AES
563564
WC_ASYNC_ENABLE_ARC4

‎tests/api.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4261,7 +4261,8 @@ static int test_wolfSSL_CRL_duplicate_extensions(void)
42614261
{
42624262
EXPECT_DECLS;
42634263
#if defined(WOLFSSL_ASN_TEMPLATE) && !defined(NO_CERTS) && \
4264-
defined(HAVE_CRL) && !defined(NO_RSA) && !defined(WOLFSSL_NO_ASN_STRICT)
4264+
defined(HAVE_CRL) && !defined(NO_RSA) && !defined(WOLFSSL_NO_ASN_STRICT) && \
4265+
(defined(WC_ASN_RUNTIME_DATE_CHECK_CONTROL) || defined(NO_ASN_TIME_CHECK))
42654266
const unsigned char crl_duplicate_akd[] =
42664267
"-----BEGIN X509 CRL-----\n"
42674268
"MIICCDCB8QIBATANBgkqhkiG9w0BAQsFADB5MQswCQYDVQQGEwJVUzETMBEGA1UE\n"
@@ -4280,6 +4281,8 @@ static int test_wolfSSL_CRL_duplicate_extensions(void)
42804281
WOLFSSL_CERT_MANAGER* cm = NULL;
42814282
int ret;
42824283

4284+
(void)wc_AsnSetSkipDateCheck(1);
4285+
42834286
cm = wolfSSL_CertManagerNew();
42844287
ExpectNotNull(cm);
42854288

@@ -4291,6 +4294,8 @@ static int test_wolfSSL_CRL_duplicate_extensions(void)
42914294
ExpectIntEQ(ret, ASN_PARSE_E);
42924295

42934296
wolfSSL_CertManagerFree(cm);
4297+
4298+
(void)wc_AsnSetSkipDateCheck(0);
42944299
#endif
42954300
return EXPECT_RESULT();
42964301
}

‎wolfcrypt/src/asn.c‎

Lines changed: 48 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,30 @@ WOLFSSL_LOCAL word32 SetASNLength(word32 length, byte* output)
359359
return i;
360360
}
361361

362+
#ifdef WC_ASN_RUNTIME_DATE_CHECK_CONTROL
363+
static int AsnSkipDateCheck = 0;
364+
int wc_AsnSetSkipDateCheck(int skip_p)
365+
{
366+
AsnSkipDateCheck = (skip_p != 0);
367+
return 0;
368+
}
369+
int wc_AsnGetSkipDateCheck(void)
370+
{
371+
return AsnSkipDateCheck;
372+
}
373+
#else
374+
#define AsnSkipDateCheck 0
375+
int wc_AsnSetSkipDateCheck(int skip_p)
376+
{
377+
(void)skip_p;
378+
return NOT_COMPILED_IN;
379+
}
380+
int wc_AsnGetSkipDateCheck(void)
381+
{
382+
return 0;
383+
}
384+
#endif
385+
362386
#ifdef WOLFSSL_ASN_TEMPLATE
363387
/* Calculate the size of a DER encoded length value.
364388
*
@@ -16848,6 +16872,7 @@ static int GetDate(DecodedCert* cert, int dateType, int verify, int maxIdx)
1684816872

1684916873
#ifndef NO_ASN_TIME_CHECK
1685016874
if (verify != NO_VERIFY && verify != VERIFY_SKIP_DATE &&
16875+
(! AsnSkipDateCheck) &&
1685116876
!XVALIDATE_DATE(date, format, dateType)) {
1685216877
if (dateType == ASN_BEFORE) {
1685316878
WOLFSSL_ERROR_VERBOSE(ASN_BEFORE_DATE_E);
@@ -23301,7 +23326,7 @@ static int CheckDate(ASNGetData *dataASN, int dateType)
2330123326

2330223327
#ifndef NO_ASN_TIME_CHECK
2330323328
/* Check date is a valid string and ASN_BEFORE or ASN_AFTER now. */
23304-
if (ret == 0) {
23329+
if ((ret == 0) && (! AsnSkipDateCheck)) {
2330523330
if (!XVALIDATE_DATE(dataASN->data.ref.data, dataASN->tag, dateType)) {
2330623331
if (dateType == ASN_BEFORE) {
2330723332
ret = ASN_BEFORE_DATE_E;
@@ -23480,7 +23505,7 @@ static int DecodeCertInternal(DecodedCert* cert, int verify, int* criticalExt,
2348023505
? X509CERTASN_IDX_TBS_VALIDITY_NOTB_UTC
2348123506
: X509CERTASN_IDX_TBS_VALIDITY_NOTB_GT;
2348223507
if ((CheckDate(&dataASN[i], ASN_BEFORE) < 0) && (verify != NO_VERIFY) &&
23483-
(verify != VERIFY_SKIP_DATE)) {
23508+
(verify != VERIFY_SKIP_DATE) && (! AsnSkipDateCheck)) {
2348423509
badDate = ASN_BEFORE_DATE_E;
2348523510
}
2348623511
/* Store reference to ASN_BEFORE date. */
@@ -23492,7 +23517,7 @@ static int DecodeCertInternal(DecodedCert* cert, int verify, int* criticalExt,
2349223517
? X509CERTASN_IDX_TBS_VALIDITY_NOTA_UTC
2349323518
: X509CERTASN_IDX_TBS_VALIDITY_NOTA_GT;
2349423519
if ((CheckDate(&dataASN[i], ASN_AFTER) < 0) && (verify != NO_VERIFY) &&
23495-
(verify != VERIFY_SKIP_DATE)) {
23520+
(verify != VERIFY_SKIP_DATE) && (! AsnSkipDateCheck)) {
2349623521
badDate = ASN_AFTER_DATE_E;
2349723522
}
2349823523
/* Store reference to ASN_AFTER date. */
@@ -25117,7 +25142,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
2511725142
if (ret == WC_NO_ERR_TRACE(ASN_BEFORE_DATE_E) ||
2511825143
ret == WC_NO_ERR_TRACE(ASN_AFTER_DATE_E)) {
2511925144
cert->badDate = ret;
25120-
if (verify == VERIFY_SKIP_DATE)
25145+
if ((verify == VERIFY_SKIP_DATE) || AsnSkipDateCheck)
2512125146
ret = 0;
2512225147
}
2512325148
else
@@ -25368,7 +25393,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm,
2536825393
if (ret == WC_NO_ERR_TRACE(ASN_BEFORE_DATE_E) ||
2536925394
ret == WC_NO_ERR_TRACE(ASN_AFTER_DATE_E)) {
2537025395
cert->badDate = ret;
25371-
if (verify == VERIFY_SKIP_DATE)
25396+
if ((verify == VERIFY_SKIP_DATE) || AsnSkipDateCheck)
2537225397
ret = 0;
2537325398
}
2537425399
else if (ret < 0) {
@@ -38154,7 +38179,7 @@ static int DecodeSingleResponse(byte* source, word32* ioIndex, word32 size,
3815438179

3815538180
#ifndef NO_ASN_TIME_CHECK
3815638181
#ifndef WOLFSSL_NO_OCSP_DATE_CHECK
38157-
if (!XVALIDATE_DATE(single->status->thisDate,
38182+
if ((! AsnSkipDateCheck) && !XVALIDATE_DATE(single->status->thisDate,
3815838183
single->status->thisDateFormat, ASN_BEFORE))
3815938184
return ASN_BEFORE_DATE_E;
3816038185
#endif
@@ -38191,7 +38216,9 @@ static int DecodeSingleResponse(byte* source, word32* ioIndex, word32 size,
3819138216

3819238217
#ifndef NO_ASN_TIME_CHECK
3819338218
#ifndef WOLFSSL_NO_OCSP_DATE_CHECK
38194-
if (!XVALIDATE_DATE(single->status->nextDate, single->status->nextDateFormat, ASN_AFTER))
38219+
if ((! AsnSkipDateCheck) &&
38220+
!XVALIDATE_DATE(single->status->nextDate,
38221+
single->status->nextDateFormat, ASN_AFTER))
3819538222
return ASN_AFTER_DATE_E;
3819638223
#endif
3819738224
#endif
@@ -38264,7 +38291,9 @@ static int DecodeSingleResponse(byte* source, word32* ioIndex, word32 size,
3826438291
cs->thisDateFormat = ASN_GENERALIZED_TIME;
3826538292
#if !defined(NO_ASN_TIME_CHECK) && !defined(WOLFSSL_NO_OCSP_DATE_CHECK)
3826638293
/* Check date is a valid string and ASN_BEFORE now. */
38267-
if (!XVALIDATE_DATE(cs->thisDate, ASN_GENERALIZED_TIME, ASN_BEFORE)) {
38294+
if ((! AsnSkipDateCheck) &&
38295+
!XVALIDATE_DATE(cs->thisDate, ASN_GENERALIZED_TIME, ASN_BEFORE))
38296+
{
3826838297
ret = ASN_BEFORE_DATE_E;
3826938298
}
3827038299
#endif /* !NO_ASN_TIME_CHECK && !WOLFSSL_NO_OCSP_DATE_CHECK */
@@ -38287,7 +38316,9 @@ static int DecodeSingleResponse(byte* source, word32* ioIndex, word32 size,
3828738316
cs->nextDateFormat = ASN_GENERALIZED_TIME;
3828838317
#if !defined(NO_ASN_TIME_CHECK) && !defined(WOLFSSL_NO_OCSP_DATE_CHECK)
3828938318
/* Check date is a valid string and ASN_AFTER now. */
38290-
if (!XVALIDATE_DATE(cs->nextDate, ASN_GENERALIZED_TIME, ASN_AFTER)) {
38319+
if ((! AsnSkipDateCheck) &&
38320+
!XVALIDATE_DATE(cs->nextDate, ASN_GENERALIZED_TIME, ASN_AFTER))
38321+
{
3829138322
ret = ASN_AFTER_DATE_E;
3829238323
}
3829338324
#endif /* !NO_ASN_TIME_CHECK && !WOLFSSL_NO_OCSP_DATE_CHECK */
@@ -40373,6 +40404,7 @@ static int ParseCRL_CertList(RevokedCert* rcert, DecodedCRL* dcrl,
4037340404
{
4037440405
#if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK)
4037540406
if (verify != NO_VERIFY &&
40407+
(! AsnSkipDateCheck) &&
4037640408
!XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, ASN_AFTER)) {
4037740409
WOLFSSL_MSG("CRL after date is no longer valid");
4037840410
WOLFSSL_ERROR_VERBOSE(CRL_CERT_DATE_ERR);
@@ -41034,6 +41066,7 @@ int ParseCRL(RevokedCert* rcert, DecodedCRL* dcrl, const byte* buff, word32 sz,
4103441066
if (dcrl->nextDateFormat != 0) {
4103541067
/* Next date was set, so validate it. */
4103641068
if (verify != NO_VERIFY &&
41069+
(! AsnSkipDateCheck) &&
4103741070
!XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, ASN_AFTER)) {
4103841071
WOLFSSL_MSG("CRL after date is no longer valid");
4103941072
ret = CRL_CERT_DATE_ERR;
@@ -43247,7 +43280,9 @@ int ParseX509Acert(DecodedAcert* acert, int verify)
4324743280
/* check BEFORE date. */
4324843281
idx = ACERT_IDX_ACINFO_VALIDITY_NOTB_GT;
4324943282
if (CheckDate(&dataASN[idx], BEFORE) < 0) {
43250-
if ((verify != NO_VERIFY) && (verify != VERIFY_SKIP_DATE)) {
43283+
if ((verify != NO_VERIFY) && (verify != VERIFY_SKIP_DATE) &&
43284+
(! AsnSkipDateCheck))
43285+
{
4325143286
badDate = ASN_BEFORE_DATE_E;
4325243287
}
4325343288
}
@@ -43259,7 +43294,9 @@ int ParseX509Acert(DecodedAcert* acert, int verify)
4325943294
/* check AFTER date. */
4326043295
idx = ACERT_IDX_ACINFO_VALIDITY_NOTA_GT;
4326143296
if (CheckDate(&dataASN[idx], AFTER) < 0) {
43262-
if ((verify != NO_VERIFY) && (verify != VERIFY_SKIP_DATE)) {
43297+
if ((verify != NO_VERIFY) && (verify != VERIFY_SKIP_DATE) &&
43298+
(! AsnSkipDateCheck))
43299+
{
4326343300
badDate = ASN_BEFORE_DATE_E;
4326443301
}
4326543302
}

‎wolfssl/wolfcrypt/asn.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2193,6 +2193,8 @@ WOLFSSL_LOCAL int ExtractDate(const unsigned char* date, unsigned char format,
21932193
wolfssl_tm* certTime, int* idx);
21942194
WOLFSSL_LOCAL int DateGreaterThan(const struct tm* a, const struct tm* b);
21952195
WOLFSSL_LOCAL int wc_ValidateDate(const byte* date, byte format, int dateType);
2196+
WOLFSSL_TEST_VIS int wc_AsnSetSkipDateCheck(int skip_p);
2197+
WOLFSSL_LOCAL int wc_AsnGetSkipDateCheck(void);
21962198

21972199
/* ASN.1 helper functions */
21982200
#ifdef WOLFSSL_CERT_GEN

0 commit comments

Comments
 (0)