crypto/asn1/a_time.c

   1 /*
   2  * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*-
  11  * This is an implementation of the ASN1 Time structure which is:
  12  *    Time ::= CHOICE {
  13  *      utcTime        UTCTime,
  14  *      generalTime    GeneralizedTime }
  15  */
  16
  17 #include <stdio.h>
  18 #include <time.h>
  19 #include "crypto/asn1.h"
  20 #include "crypto/ctype.h"
  21 #include "internal/cryptlib.h"
  22 #include <openssl/asn1t.h>
  23 #include "asn1_local.h"
  24
  25 IMPLEMENT_ASN1_MSTRING(ASN1_TIME, B_ASN1_TIME)
  26
  27 IMPLEMENT_ASN1_FUNCTIONS(ASN1_TIME)
  28 IMPLEMENT_ASN1_DUP_FUNCTION(ASN1_TIME)
  29
  30 static int is_utc(const int year)
  31 {
  32     if (50 <= year && year <= 149)
  33         return 1;
  34     return 0;
  35 }
  36
  37 static int leap_year(const int year)
  38 {
  39     if (year % 400 == 0 || (year % 100 != 0 && year % 4 == 0))
  40         return 1;
  41     return 0;
  42 }
  43
  44 /*
  45  * Compute the day of the week and the day of the year from the year, month
  46  * and day.  The day of the year is straightforward, the day of the week uses
  47  * a form of Zeller's congruence.  For this months start with March and are
  48  * numbered 4 through 15.
  49  */
  50 static void determine_days(struct tm *tm)
  51 {
  52     static const int ydays[12] = {
  53         0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334
  54     };
  55     int y = tm->tm_year + 1900;
  56     int m = tm->tm_mon;
  57     int d = tm->tm_mday;
  58     int c;
  59
  60     tm->tm_yday = ydays[m] + d - 1;
  61     if (m >= 2) {
  62         /* March and onwards can be one day further into the year */
  63         tm->tm_yday += leap_year(y);
  64         m += 2;
  65     } else {
  66         /* Treat January and February as part of the previous year */
  67         m += 14;
  68         y--;
  69     }
  70     c = y / 100;
  71     y %= 100;
  72     /* Zeller's congruence */
  73     tm->tm_wday = (d + (13 * m) / 5 + y + y / 4 + c / 4 + 5 * c + 6) % 7;
  74 }
  75
  76 int ossl_asn1_time_to_tm(struct tm *tm, const ASN1_TIME *d)
  77 {
  78     static const int min[9] = { 0, 0, 1, 1, 0, 0, 0, 0, 0 };
  79     static const int max[9] = { 99, 99, 12, 31, 23, 59, 59, 12, 59 };
  80     static const int mdays[12] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
  81     char *a;
  82     int n, i, i2, l, o, min_l, strict = 0, end = 6, btz = 5, md;
  83     struct tm tmp;
  84 #if defined(CHARSET_EBCDIC)
  85     const char upper_z = 0x5A, num_zero = 0x30, period = 0x2E, minus = 0x2D, plus = 0x2B;
  86 #else
  87     const char upper_z = 'Z', num_zero = '0', period = '.', minus = '-', plus = '+';
  88 #endif
  89     /*
  90      * ASN1_STRING_FLAG_X509_TIME is used to enforce RFC 5280
  91      * time string format, in which:
  92      *
  93      * 1. "seconds" is a 'MUST'
  94      * 2. "Zulu" timezone is a 'MUST'
  95      * 3. "+|-" is not allowed to indicate a timezone
  96      */
  97     if (d->type == V_ASN1_UTCTIME) {
  98         min_l = 13;
  99         if (d->flags & ASN1_STRING_FLAG_X509_TIME) {
 100             strict = 1;
 101         }
 102     } else if (d->type == V_ASN1_GENERALIZEDTIME) {
 103         end = 7;
 104         btz = 6;
 105         min_l = 15;
 106         if (d->flags & ASN1_STRING_FLAG_X509_TIME) {
 107             strict = 1;
 108         }
 109     } else {
 110         return 0;
 111     }
 112
 113     l = d->length;
 114     a = (char *)d->data;
 115     o = 0;
 116     memset(&tmp, 0, sizeof(tmp));
 117
 118     /*
 119      * GENERALIZEDTIME is similar to UTCTIME except the year is represented
 120      * as YYYY. This stuff treats everything as a two digit field so make
 121      * first two fields 00 to 99
 122      */
 123
 124     if (l < min_l)
 125         goto err;
 126     for (i = 0; i < end; i++) {
 127         if (!strict && (i == btz) && ((a[o] == upper_z) || (a[o] == plus) || (a[o] == minus))) {
 128             i++;
 129             break;
 130         }
 131         if (!ossl_ascii_isdigit(a[o]))
 132             goto err;
 133         n = a[o] - num_zero;
 134         /* incomplete 2-digital number */
 135         if (++o == l)
 136             goto err;
 137
 138         if (!ossl_ascii_isdigit(a[o]))
 139             goto err;
 140         n = (n * 10) + a[o] - num_zero;
 141         /* no more bytes to read, but we haven't seen time-zone yet */
 142         if (++o == l)
 143             goto err;
 144
 145         i2 = (d->type == V_ASN1_UTCTIME) ? i + 1 : i;
 146
 147         if ((n < min[i2]) || (n > max[i2]))
 148             goto err;
 149         switch (i2) {
 150         case 0:
 151             /* UTC will never be here */
 152             tmp.tm_year = n * 100 - 1900;
 153             break;
 154         case 1:
 155             if (d->type == V_ASN1_UTCTIME)
 156                 tmp.tm_year = n < 50 ? n + 100 : n;
 157             else
 158                 tmp.tm_year += n;
 159             break;
 160         case 2:
 161             tmp.tm_mon = n - 1;
 162             break;
 163         case 3:
 164             /* check if tm_mday is valid in tm_mon */
 165             if (tmp.tm_mon == 1) {
 166                 /* it's February */
 167                 md = mdays[1] + leap_year(tmp.tm_year + 1900);
 168             } else {
 169                 md = mdays[tmp.tm_mon];
 170             }
 171             if (n > md)
 172                 goto err;
 173             tmp.tm_mday = n;
 174             determine_days(&tmp);
 175             break;
 176         case 4:
 177             tmp.tm_hour = n;
 178             break;
 179         case 5:
 180             tmp.tm_min = n;
 181             break;
 182         case 6:
 183             tmp.tm_sec = n;
 184             break;
 185         }
 186     }
 187
 188     /*
 189      * Optional fractional seconds: decimal point followed by one or more
 190      * digits.
 191      */
 192     if (d->type == V_ASN1_GENERALIZEDTIME && a[o] == period) {
 193         if (strict)
 194             /* RFC 5280 forbids fractional seconds */
 195             goto err;
 196         if (++o == l)
 197             goto err;
 198         i = o;
 199         while ((o < l) && ossl_ascii_isdigit(a[o]))
 200             o++;
 201         /* Must have at least one digit after decimal point */
 202         if (i == o)
 203             goto err;
 204         /* no more bytes to read, but we haven't seen time-zone yet */
 205         if (o == l)
 206             goto err;
 207     }
 208
 209     /*
 210      * 'o' will never point to '\0' at this point, the only chance
 211      * 'o' can point to '\0' is either the subsequent if or the first
 212      * else if is true.
 213      */
 214     if (a[o] == upper_z) {
 215         o++;
 216     } else if (!strict && ((a[o] == plus) || (a[o] == minus))) {
 217         int offsign = a[o] == minus ? 1 : -1;
 218         int offset = 0;
 219
 220         o++;
 221         /*
 222          * if not equal, no need to do subsequent checks
 223          * since the following for-loop will add 'o' by 4
 224          * and the final return statement will check if 'l'
 225          * and 'o' are equal.
 226          */
 227         if (o + 4 != l)
 228             goto err;
 229         for (i = end; i < end + 2; i++) {
 230             if (!ossl_ascii_isdigit(a[o]))
 231                 goto err;
 232             n = a[o] - num_zero;
 233             o++;
 234             if (!ossl_ascii_isdigit(a[o]))
 235                 goto err;
 236             n = (n * 10) + a[o] - num_zero;
 237             i2 = (d->type == V_ASN1_UTCTIME) ? i + 1 : i;
 238             if ((n < min[i2]) || (n > max[i2]))
 239                 goto err;
 240             /* if tm is NULL, no need to adjust */
 241             if (tm != NULL) {
 242                 if (i == end)
 243                     offset = n * 3600;
 244                 else if (i == end + 1)
 245                     offset += n * 60;
 246             }
 247             o++;
 248         }
 249         if (offset && !OPENSSL_gmtime_adj(&tmp, 0, offset * offsign))
 250             goto err;
 251     } else {
 252         /* not Z, or not +/- in non-strict mode */
 253         goto err;
 254     }
 255     if (o == l) {
 256         /* success, check if tm should be filled */
 257         if (tm != NULL)
 258             *tm = tmp;
 259         return 1;
 260     }
 261  err:
 262     return 0;
 263 }
 264
 265 ASN1_TIME *ossl_asn1_time_from_tm(ASN1_TIME *s, struct tm *ts, int type)
 266 {
 267     char* p;
 268     ASN1_TIME *tmps = NULL;
 269     const size_t len = 20;
 270
 271     if (type == V_ASN1_UNDEF) {
 272         if (is_utc(ts->tm_year))
 273             type = V_ASN1_UTCTIME;
 274         else
 275             type = V_ASN1_GENERALIZEDTIME;
 276     } else if (type == V_ASN1_UTCTIME) {
 277         if (!is_utc(ts->tm_year))
 278             goto err;
 279     } else if (type != V_ASN1_GENERALIZEDTIME) {
 280         goto err;
 281     }
 282
 283     if (s == NULL)
 284         tmps = ASN1_STRING_new();
 285     else
 286         tmps = s;
 287     if (tmps == NULL)
 288         return NULL;
 289
 290     if (!ASN1_STRING_set(tmps, NULL, len))
 291         goto err;
 292
 293     tmps->type = type;
 294     p = (char*)tmps->data;
 295
 296     if (ts->tm_mon > INT_MAX - 1)
 297         goto err;
 298
 299     if (type == V_ASN1_GENERALIZEDTIME) {
 300         if (ts->tm_year > INT_MAX - 1900)
 301             goto err;
 302         tmps->length = BIO_snprintf(p, len, "%04d%02d%02d%02d%02d%02dZ",
 303                                     ts->tm_year + 1900, ts->tm_mon + 1,
 304                                     ts->tm_mday, ts->tm_hour, ts->tm_min,
 305                                     ts->tm_sec);
 306     } else {
 307         tmps->length = BIO_snprintf(p, len, "%02d%02d%02d%02d%02d%02dZ",
 308                                     ts->tm_year % 100, ts->tm_mon + 1,
 309                                     ts->tm_mday, ts->tm_hour, ts->tm_min,
 310                                     ts->tm_sec);
 311     }
 312
 313 #ifdef CHARSET_EBCDIC
 314     ebcdic2ascii(tmps->data, tmps->data, tmps->length);
 315 #endif
 316     return tmps;
 317  err:
 318     if (tmps != s)
 319         ASN1_STRING_free(tmps);
 320     return NULL;
 321 }
 322
 323 ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t)
 324 {
 325     return ASN1_TIME_adj(s, t, 0, 0);
 326 }
 327
 328 ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t,
 329                          int offset_day, long offset_sec)
 330 {
 331     struct tm *ts;
 332     struct tm data;
 333
 334     ts = OPENSSL_gmtime(&t, &data);
 335     if (ts == NULL) {
 336         ERR_raise(ERR_LIB_ASN1, ASN1_R_ERROR_GETTING_TIME);
 337         return NULL;
 338     }
 339     if (offset_day || offset_sec) {
 340         if (!OPENSSL_gmtime_adj(ts, offset_day, offset_sec))
 341             return NULL;
 342     }
 343     return ossl_asn1_time_from_tm(s, ts, V_ASN1_UNDEF);
 344 }
 345
 346 int ASN1_TIME_check(const ASN1_TIME *t)
 347 {
 348     if (t->type == V_ASN1_GENERALIZEDTIME)
 349         return ASN1_GENERALIZEDTIME_check(t);
 350     else if (t->type == V_ASN1_UTCTIME)
 351         return ASN1_UTCTIME_check(t);
 352     return 0;
 353 }
 354
 355 /* Convert an ASN1_TIME structure to GeneralizedTime */
 356 ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
 357                                                    ASN1_GENERALIZEDTIME **out)
 358 {
 359     ASN1_GENERALIZEDTIME *ret = NULL;
 360     struct tm tm;
 361
 362     if (!ASN1_TIME_to_tm(t, &tm))
 363         return NULL;
 364
 365     if (out != NULL)
 366         ret = *out;
 367
 368     ret = ossl_asn1_time_from_tm(ret, &tm, V_ASN1_GENERALIZEDTIME);
 369
 370     if (out != NULL && ret != NULL)
 371         *out = ret;
 372
 373     return ret;
 374 }
 375
 376 int ASN1_TIME_set_string(ASN1_TIME *s, const char *str)
 377 {
 378     /* Try UTC, if that fails, try GENERALIZED */
 379     if (ASN1_UTCTIME_set_string(s, str))
 380         return 1;
 381     return ASN1_GENERALIZEDTIME_set_string(s, str);
 382 }
 383
 384 int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str)
 385 {
 386     ASN1_TIME t;
 387     struct tm tm;
 388     int rv = 0;
 389
 390     t.length = strlen(str);
 391     t.data = (unsigned char *)str;
 392     t.flags = ASN1_STRING_FLAG_X509_TIME;
 393
 394     t.type = V_ASN1_UTCTIME;
 395
 396     if (!ASN1_TIME_check(&t)) {
 397         t.type = V_ASN1_GENERALIZEDTIME;
 398         if (!ASN1_TIME_check(&t))
 399             goto out;
 400     }
 401
 402     /*
 403      * Per RFC 5280 (section 4.1.2.5.), the valid input time
 404      * strings should be encoded with the following rules:
 405      *
 406      * 1. UTC: YYMMDDHHMMSSZ, if YY < 50 (20YY) --> UTC: YYMMDDHHMMSSZ
 407      * 2. UTC: YYMMDDHHMMSSZ, if YY >= 50 (19YY) --> UTC: YYMMDDHHMMSSZ
 408      * 3. G'd: YYYYMMDDHHMMSSZ, if YYYY >= 2050 --> G'd: YYYYMMDDHHMMSSZ
 409      * 4. G'd: YYYYMMDDHHMMSSZ, if YYYY < 2050 --> UTC: YYMMDDHHMMSSZ
 410      *
 411      * Only strings of the 4th rule should be reformatted, but since a
 412      * UTC can only present [1950, 2050), so if the given time string
 413      * is less than 1950 (e.g. 19230419000000Z), we do nothing...
 414      */
 415
 416     if (s != NULL && t.type == V_ASN1_GENERALIZEDTIME) {
 417         if (!ossl_asn1_time_to_tm(&tm, &t))
 418             goto out;
 419         if (is_utc(tm.tm_year)) {
 420             t.length -= 2;
 421             /*
 422              * it's OK to let original t.data go since that's assigned
 423              * to a piece of memory allocated outside of this function.
 424              * new t.data would be freed after ASN1_STRING_copy is done.
 425              */
 426             t.data = OPENSSL_zalloc(t.length + 1);
 427             if (t.data == NULL)
 428                 goto out;
 429             memcpy(t.data, str + 2, t.length);
 430             t.type = V_ASN1_UTCTIME;
 431         }
 432     }
 433
 434     if (s == NULL || ASN1_STRING_copy((ASN1_STRING *)s, (ASN1_STRING *)&t))
 435         rv = 1;
 436
 437     if (t.data != (unsigned char *)str)
 438         OPENSSL_free(t.data);
 439 out:
 440     return rv;
 441 }
 442
 443 int ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm)
 444 {
 445     if (s == NULL) {
 446         time_t now_t;
 447
 448         time(&now_t);
 449         memset(tm, 0, sizeof(*tm));
 450         if (OPENSSL_gmtime(&now_t, tm) != NULL)
 451             return 1;
 452         return 0;
 453     }
 454
 455     return ossl_asn1_time_to_tm(tm, s);
 456 }
 457
 458 int ASN1_TIME_diff(int *pday, int *psec,
 459                    const ASN1_TIME *from, const ASN1_TIME *to)
 460 {
 461     struct tm tm_from, tm_to;
 462
 463     if (!ASN1_TIME_to_tm(from, &tm_from))
 464         return 0;
 465     if (!ASN1_TIME_to_tm(to, &tm_to))
 466         return 0;
 467     return OPENSSL_gmtime_diff(pday, psec, &tm_from, &tm_to);
 468 }
 469
 470 static const char _asn1_mon[12][4] = {
 471     "Jan", "Feb", "Mar", "Apr", "May", "Jun",
 472     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
 473 };
 474
 475 /* prints the time with the default date format (RFC 822) */
 476 int ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
 477 {
 478     return ASN1_TIME_print_ex(bp, tm, ASN1_DTFLGS_RFC822);
 479 }
 480
 481 /* returns 1 on success, 0 on BIO write error or parse failure */
 482 int ASN1_TIME_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
 483 {
 484     return ossl_asn1_time_print_ex(bp, tm, flags) > 0;
 485 }
 486
 487
 488 /* prints the time with the date format of ISO 8601 */
 489 /* returns 0 on BIO write error, else -1 in case of parse failure, else 1 */
 490 int ossl_asn1_time_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
 491 {
 492     char *v;
 493     int gmt = 0, l;
 494     struct tm stm;
 495     const char upper_z = 0x5A, period = 0x2E;
 496
 497     /* ossl_asn1_time_to_tm will check the time type */
 498     if (!ossl_asn1_time_to_tm(&stm, tm))
 499         return BIO_write(bp, "Bad time value", 14) ? -1 : 0;
 500
 501     l = tm->length;
 502     v = (char *)tm->data;
 503     if (v[l - 1] == upper_z)
 504         gmt = 1;
 505
 506     if (tm->type == V_ASN1_GENERALIZEDTIME) {
 507         char *f = NULL;
 508         int f_len = 0;
 509
 510         /*
 511          * Try to parse fractional seconds. '14' is the place of
 512          * 'fraction point' in a GeneralizedTime string.
 513          */
 514         if (tm->length > 15 && v[14] == period) {
 515             f = &v[14];
 516             f_len = 1;
 517             while (14 + f_len < l && ossl_ascii_isdigit(f[f_len]))
 518                 ++f_len;
 519         }
 520
 521         if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
 522             return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02d%.*s%s",
 523                           stm.tm_year + 1900, stm.tm_mon + 1,
 524                           stm.tm_mday, stm.tm_hour,
 525                           stm.tm_min, stm.tm_sec, f_len, f,
 526                           (gmt ? "Z" : "")) > 0;
 527         }
 528         else {
 529             return BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
 530                           _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
 531                           stm.tm_min, stm.tm_sec, f_len, f, stm.tm_year + 1900,
 532                           (gmt ? " GMT" : "")) > 0;
 533         }
 534     } else {
 535         if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
 536             return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02d%s",
 537                           stm.tm_year + 1900, stm.tm_mon + 1,
 538                           stm.tm_mday, stm.tm_hour,
 539                           stm.tm_min, stm.tm_sec,
 540                           (gmt ? "Z" : "")) > 0;
 541         }
 542         else {
 543             return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d%s",
 544                           _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
 545                           stm.tm_min, stm.tm_sec, stm.tm_year + 1900,
 546                           (gmt ? " GMT" : "")) > 0;
 547         }
 548     }
 549 }
 550
 551 int ASN1_TIME_cmp_time_t(const ASN1_TIME *s, time_t t)
 552 {
 553     struct tm stm, ttm;
 554     int day, sec;
 555
 556     if (!ASN1_TIME_to_tm(s, &stm))
 557         return -2;
 558
 559     if (!OPENSSL_gmtime(&t, &ttm))
 560         return -2;
 561
 562     if (!OPENSSL_gmtime_diff(&day, &sec, &ttm, &stm))
 563         return -2;
 564
 565     if (day > 0 || sec > 0)
 566         return 1;
 567     if (day < 0 || sec < 0)
 568         return -1;
 569     return 0;
 570 }
 571
 572 int ASN1_TIME_normalize(ASN1_TIME *t)
 573 {
 574     struct tm tm;
 575
 576     if (t == NULL || !ASN1_TIME_to_tm(t, &tm))
 577         return 0;
 578
 579     return ossl_asn1_time_from_tm(t, &tm, V_ASN1_UNDEF) != NULL;
 580 }
 581
 582 int ASN1_TIME_compare(const ASN1_TIME *a, const ASN1_TIME *b)
 583 {
 584     int day, sec;
 585
 586     if (!ASN1_TIME_diff(&day, &sec, b, a))
 587         return -2;
 588     if (day > 0 || sec > 0)
 589         return 1;
 590     if (day < 0 || sec < 0)
 591         return -1;
 592     return 0;
 593 }