ocsptool: add --attime option

This adds a --attime option to ocsptool, so the tests don't need
faketime or datefudge to adjust system time.

Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
Modified-by: Daiki Ueno <ueno@gnu.org>

diff --git a/src/benchmark.h b/src/benchmark.h
index cb5ddaafcc52c38015ef232f6b50870de8f8c483..7b66751496be60a5fc15afab404a9bc2560855eb 100644 (file)
--- a/src/benchmark.h
+++ b/src/benchmark.h
@@ -29,6 +29,7 @@
 
 /* for uint64_t */
 #include <stdint.h>
+#include "timespec.h"
 
 #if defined(HAVE_CLOCK_GETTIME) && defined(CLOCK_PROCESS_CPUTIME_ID)
 #undef gettime

diff --git a/src/common.c b/src/common.c
index 6f8a2d732533e9f029045346025f84e9b49f78a6..739eede02fe16b10e3646e8939bf8dec8f6f5b5b 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -1354,6 +1354,34 @@ void log_set(FILE *file)
        logfile = file;
 }
 
+static struct timespec time_at;
+static bool time_at_set;
+
+void get_system_time(struct timespec *ts)
+{
+       if (time_at_set) {
+               *ts = time_at;
+       } else {
+               gettime(ts);
+       }
+}
+
+static time_t mytime(time_t *t)
+{
+       if (t) {
+               *t = time_at.tv_sec;
+       }
+       return time_at.tv_sec;
+}
+
+void set_system_time(struct timespec *ts)
+{
+       time_at = *ts;
+       time_at_set = true;
+
+       gnutls_global_set_time_function(mytime);
+}
+
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wformat-y2k"
 /* This is very similar to ctime() but it does not force a newline.

diff --git a/src/common.h b/src/common.h
index ba25470af14943abcd6fba34d507c577cc1881a9..f0557a0f473a61064cfebba0673f637adcd2f7f4 100644 (file)
--- a/src/common.h
+++ b/src/common.h
@@ -44,6 +44,7 @@
 #include "socket.h"
 #undef OCSP_RESPONSE
 #endif
+#include "timespec.h"
 
 #ifndef __attribute__
 #if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 5)
@@ -153,4 +154,7 @@ static void set_read_funcs(gnutls_session_t session)
 #define SIMPLE_CTIME_BUF_SIZE 64
 char *simple_ctime(const time_t *t, char buf[SIMPLE_CTIME_BUF_SIZE]);
 
+void get_system_time(struct timespec *ts);
+void set_system_time(struct timespec *ts);
+
 #endif /* GNUTLS_SRC_COMMON_H */

diff --git a/src/ocsptool-common.c b/src/ocsptool-common.c
index 17e10253d7eb01f8eb52864ae7aef51b0ef0b2d0..8c8c7463ab051ee77443cfd8b3e1073a53b2e0f5 100644 (file)
--- a/src/ocsptool-common.c
+++ b/src/ocsptool-common.c
@@ -330,11 +330,13 @@ int check_ocsp_response(gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
        gnutls_ocsp_resp_t resp;
        int ret;
        unsigned int status, cert_status;
+       struct timespec r;
        time_t rtime, vtime, ntime, now;
        char timebuf1[SIMPLE_CTIME_BUF_SIZE];
        char timebuf2[SIMPLE_CTIME_BUF_SIZE];
 
-       now = time(0);
+       get_system_time(&r);
+       now = r.tv_sec;
 
        ret = gnutls_ocsp_resp_init(&resp);
        if (ret < 0) {

diff --git a/src/ocsptool-options.json b/src/ocsptool-options.json
index 0a45a148524a3e9654e85fbb3f036935bb5cc8a4..5895fba2704dd292b90d8f29f8f1094be4a46eab 100644 (file)
--- a/src/ocsptool-options.json
+++ b/src/ocsptool-options.json
@@ -147,6 +147,13 @@
           "long-option": "verify-allow-broken",
           "description": "Allow broken algorithms, such as MD5 for verification",
           "detail": "This can be combined with --verify-response."
+        },
+        {
+          "long-option": "attime",
+          "description": "Perform validation at the timestamp instead of the system time",
+          "detail": "timestamp is an instance in time encoded as Unix time or in a human\n readable timestring such as \"29 Feb 2004\", \"2004-02-29\".\nFull documentation available at \n<https://www.gnu.org/software/coreutils/manual/html_node/Date-input-formats.html>\nor locally via info '(coreutils) date invocation'.",
+          "argument-name": "timestamp",
+          "argument-type": "string"
         }
       ]
     }

diff --git a/src/ocsptool.c b/src/ocsptool.c
index 7ce8a5391d51867cf660e6ad8b3b30067d466e9f..5ad24a6395180f3e32020f494ef73fd2aa8863d4 100644 (file)
--- a/src/ocsptool.c
+++ b/src/ocsptool.c
@@ -37,10 +37,12 @@
 #include <read-file.h>
 #include <socket.h>
 #include <minmax.h>
+#include "parse-datetime.h"
 
 #include <ocsptool-common.h>
 #include "ocsptool-options.h"
 #include "certtool-common.h"
+#include "common.h"
 
 FILE *outfile;
 static unsigned int incert_format, outcert_format;
@@ -648,6 +650,18 @@ int main(int argc, char **argv)
        gnutls_global_set_log_function(tls_log_func);
        gnutls_global_set_log_level(OPT_VALUE_DEBUG);
 
+       if (ENABLED_OPT(ATTIME)) {
+               struct timespec r;
+
+               if (!parse_datetime(&r, OPT_ARG(ATTIME), NULL)) {
+                       fprintf(stderr,
+                               "%s option value %s is not a valid time\n",
+                               "attime", OPT_ARG(ATTIME));
+                       app_exit(1);
+               }
+               set_system_time(&r);
+       }
+
        if (ENABLED_OPT(INDER))
                incert_format = GNUTLS_X509_FMT_DER;
        else

diff --git a/tests/ocsp-tests/ocsp-load-chain.sh b/tests/ocsp-tests/ocsp-load-chain.sh
index c1c26c29cb517788752210bef83526ecfbaee970..8b35a0e1a93cf046641be48b25e6d4968c7e47c8 100755 (executable)
--- a/tests/ocsp-tests/ocsp-load-chain.sh
+++ b/tests/ocsp-tests/ocsp-load-chain.sh
@@ -31,10 +31,7 @@ export TZ="UTC"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
-"$FAKETIME" "$FAKETIME_F_OPT" "2017-06-19 00:00:00" \
-       "${OCSPTOOL}" -e --load-chain "${srcdir}/ocsp-tests/certs/chain-amazon.com.pem" --infile "${srcdir}/ocsp-tests/certs/ocsp-amazon.com.der" --verify-allow-broken
+"${OCSPTOOL}" --attime "2017-06-19" -e --load-chain "${srcdir}/ocsp-tests/certs/chain-amazon.com.pem" --infile "${srcdir}/ocsp-tests/certs/ocsp-amazon.com.der" --verify-allow-broken
 rc=$?
 
 # We're done.
@@ -43,8 +40,7 @@ if test "${rc}" != "0"; then
        exit ${rc}
 fi
 
-"$FAKETIME" "$FAKETIME_F_OPT" "2017-06-19 00:00:00" \
-       "${OCSPTOOL}" -e --load-chain "${srcdir}/ocsp-tests/certs/chain-amazon.com-unsorted.pem" --infile "${srcdir}/ocsp-tests/certs/ocsp-amazon.com.der" --verify-allow-broken
+"${OCSPTOOL}" --attime "2017-06-19" -e --load-chain "${srcdir}/ocsp-tests/certs/chain-amazon.com-unsorted.pem" --infile "${srcdir}/ocsp-tests/certs/ocsp-amazon.com.der" --verify-allow-broken
 rc=$?
 
 # We're done.
@@ -53,9 +49,9 @@ if test "${rc}" != "0"; then
        exit ${rc}
 fi
 
+
 # verify an OCSP response using ECDSA
-"$FAKETIME" "$FAKETIME_F_OPT" "2017-06-29 00:00:00" \
-       "${OCSPTOOL}" -d 6 -e --load-chain "${srcdir}/ocsp-tests/certs/chain-akamai.com.pem" --infile "${srcdir}/ocsp-tests/certs/ocsp-akamai.com.der"
+"${OCSPTOOL}" --attime "2017-06-29" -d 6 -e --load-chain "${srcdir}/ocsp-tests/certs/chain-akamai.com.pem" --infile "${srcdir}/ocsp-tests/certs/ocsp-akamai.com.der"
 rc=$?
 
 # We're done.

diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
index 79f181337cf5b05f735d172b6ddb48c5343f44a3..a2576d7e811fcfa1f37b853e47415b6b4bd8a259 100755 (executable)
--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
+++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
@@ -145,11 +145,10 @@ echo "=== Verifying OCSP server is up ==="
 t=0
 while test "${t}" -lt "${SERVER_START_TIMEOUT}"; do
     # Run a test request to make sure the server works
-    "$FAKETIME" "${TESTDATE}" \
-             ${VALGRIND} "${OCSPTOOL}" --ask \
-             --load-cert "${SERVER_CERT_FILE}" \
-             --load-issuer "${srcdir}/ocsp-tests/certs/ca.pem" \
-             --outfile "${OCSP_RESPONSE_FILE}"
+    ${VALGRIND} "${OCSPTOOL}" --ask --attime "${TESTDATE}" \
+               --load-cert "${SERVER_CERT_FILE}" \
+               --load-issuer "${srcdir}/ocsp-tests/certs/ca.pem" \
+               --outfile "${OCSP_RESPONSE_FILE}"
     rc=$?
     if test "${rc}" = "0"; then
        break

diff --git a/tests/ocsp-tests/ocsp-signer-verify.sh b/tests/ocsp-tests/ocsp-signer-verify.sh
index ded2ca35c9498194868ef2b3a65bfb07906721dd..d12420d77cc5270c952048700c08432ace40ac79 100755 (executable)
--- a/tests/ocsp-tests/ocsp-signer-verify.sh
+++ b/tests/ocsp-tests/ocsp-signer-verify.sh
@@ -29,8 +29,6 @@ export TZ="UTC"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 date="2021-07-14 00:00:00"
 sample_dir="${srcdir}/ocsp-tests/signer-verify"
 trusted="${sample_dir}/trust.pem"
@@ -38,8 +36,7 @@ trusted="${sample_dir}/trust.pem"
 verify_response ()
 {
     echo "verifying ${sample_dir}/${1} using ${trusted}"
-    "$FAKETIME" "$FAKETIME_F_OPT" "${date}" \
-              "${OCSPTOOL}" --infile="${sample_dir}/${1}" \
+    "${OCSPTOOL}" --attime "${date}" --infile="${sample_dir}/${1}" \
               --verify-response --load-trust="${trusted}"
     return $?
 }

diff --git a/tests/ocsp-tests/ocsp-test.sh b/tests/ocsp-tests/ocsp-test.sh
index 67388ebe8774df1bcf717201fed5746d6e3d9f2f..34274d9883f352317cedc0efe517dac61b2706d2 100755 (executable)
--- a/tests/ocsp-tests/ocsp-test.sh
+++ b/tests/ocsp-tests/ocsp-test.sh
@@ -31,14 +31,11 @@ export TZ="UTC"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 # Note that in rare cases this test may fail because the
 # time set using faketime/datefudge could have changed since the generation
 # (if example the system was busy)
 
-"$FAKETIME" "$FAKETIME_F_OPT" "2016-04-22 00:00:00" \
-       "${OCSPTOOL}" -e --load-signer "${srcdir}/ocsp-tests/certs/ca.pem" --infile "${srcdir}/ocsp-tests/response1.der"
+"${OCSPTOOL}" --attime "2016-04-22" -e --load-signer "${srcdir}/ocsp-tests/certs/ca.pem" --infile "${srcdir}/ocsp-tests/response1.der"
 rc=$?
 
 # We're done.
@@ -47,8 +44,7 @@ if test "${rc}" != "0"; then
        exit ${rc}
 fi
 
-"$FAKETIME" "$FAKETIME_F_OPT" "2016-04-22 00:00:00" \
-       "${OCSPTOOL}" -e --load-signer "${srcdir}/ocsp-tests/certs/ocsp-server.pem" --infile "${srcdir}/ocsp-tests/response2.der"
+"${OCSPTOOL}" --attime "2016-04-22" -e --load-signer "${srcdir}/ocsp-tests/certs/ocsp-server.pem" --infile "${srcdir}/ocsp-tests/response2.der"
 rc=$?
 
 # We're done.
@@ -57,8 +53,7 @@ if test "${rc}" != "0"; then
        exit ${rc}
 fi
 
-"$FAKETIME" "$FAKETIME_F_OPT" "2016-04-22 00:00:00" \
-       "${OCSPTOOL}" -e --load-signer "${srcdir}/ocsp-tests/certs/ca.pem" --infile "${srcdir}/ocsp-tests/response2.der" -d 4
+"${OCSPTOOL}" --attime "2016-04-22" -e --load-signer "${srcdir}/ocsp-tests/certs/ca.pem" --infile "${srcdir}/ocsp-tests/response2.der" -d 4
 rc=$?
 
 # We're done.

diff --git a/tests/ocsp-tests/ocsp-tls-connection.sh b/tests/ocsp-tests/ocsp-tls-connection.sh
index 0fefabcd966312d2c8ff2f8b6e927272c96409f6..96fc36f451c53ec7f76844c537663adab18f2deb 100755 (executable)
--- a/tests/ocsp-tests/ocsp-tls-connection.sh
+++ b/tests/ocsp-tests/ocsp-tls-connection.sh
@@ -127,10 +127,9 @@ echo "=== Verifying OCSP server is up ==="
 t=0
 while test "${t}" -lt "${SERVER_START_TIMEOUT}"; do
     # Run a test request to make sure the server works
-    "$FAKETIME" "${TESTDATE}" \
-             ${VALGRIND} "${OCSPTOOL}" --ask \
-             --load-cert "${SERVER_CERT_FILE}" \
-             --load-issuer "${srcdir}/ocsp-tests/certs/ca.pem"
+    ${VALGRIND} "${OCSPTOOL}" --attime "${TESTDATE}" --ask \
+               --load-cert "${SERVER_CERT_FILE}" \
+               --load-issuer "${srcdir}/ocsp-tests/certs/ca.pem"
     rc=$?
     if test "${rc}" = "0"; then
        break