Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1313281 > unrolled thread

Re: [RFC PATCH 4/4] X.509: Handle midnight alternative notation in GeneralizedTime

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [RFC PATCH 4/4] X.509: Handle midnight alternative notation in GeneralizedTime Rudolf Polzer <rpolzer@google.com> - 2016-01-20 16:10 +0100
    Re: [RFC PATCH 4/4] X.509: Handle midnight alternative notation in GeneralizedTime David Howells <dhowells@redhat.com> - 2016-01-20 16:30 +0100
      Re: [RFC PATCH 4/4] X.509: Handle midnight alternative notation in  GeneralizedTime One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-01-20 16:40 +0100

#1313281 — Re: [RFC PATCH 4/4] X.509: Handle midnight alternative notation in GeneralizedTime

On Mon, Jan 4, 2016 at 5:17 PM, David Howells <dhowells@redhat.com> wrote:
> The ASN.1 GeneralizedTime object carries an ISO 8601 format date and time.
> The time is permitted to show midnight as 00:00 or 24:00 (the latter being
> equivalent of 00:00 of the following day).
>
> The permitted value is checked in x509_decode_time() but the actual
> handling is left to mktime64().
>
> Without this patch, certain X.509 certificates will be rejected and could
> lead to an unbootable kernel.
>
> Note that with this patch we also permit any 24:mm:ss time and extend this
> to UTCTime, which whilst not strictly correct don't permit much leeway in
> fiddling date strings.
>
> Reported-by: Rudolf Polzer <rpolzer@google.com>
> Signed-off-by: David Howells <dhowells@redhat.com>
> cc: David Woodhouse <David.Woodhouse@intel.com>
> cc: John Stultz <john.stultz@linaro.org>
> cc: Arnd Bergmann <arnd@arndb.de>
> ---
>
>  crypto/asymmetric_keys/x509_cert_parser.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
> index 3379c0ba3988..70ed0852fdb2 100644
> --- a/crypto/asymmetric_keys/x509_cert_parser.c
> +++ b/crypto/asymmetric_keys/x509_cert_parser.c
> @@ -548,7 +548,7 @@ int x509_decode_time(time64_t *_t,  size_t hdrlen,
>         }
>
>         if (day < 1 || day > mon_len ||
> -           hour > 23 ||
> +           hour > 24 || /* ISO 8601 permits 24:00:00 as midnight tomorrow */
>             min > 59 ||
>             sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
>                 goto invalid_time;
>

Looks good.

As for 24:xx:yy times - I'm split about this. This code doesn't
require a bijective decoding anyway (and if it did, 24:00:00 and
00:00:00 mapping to the same time64_t would be problem enough) so this
is sure safe. On the other hand, a cert with a 24:xx:yy time that's
not 24:00:00 probably should be regarded as invalid and not trusted
for that reason alone.

Best regards,

Rudolf Polzer

[toc] | [next] | [standalone]

#1313301

Rudolf Polzer <rpolzer@google.com> wrote:

> As for 24:xx:yy times - I'm split about this. This code doesn't
> require a bijective decoding anyway (and if it did, 24:00:00 and
> 00:00:00 mapping to the same time64_t would be problem enough) so this
> is sure safe. On the other hand, a cert with a 24:xx:yy time that's
> not 24:00:00 probably should be regarded as invalid and not trusted
> for that reason alone.

Feel free to argue that one with Linus:-/

David

[toc] | [prev] | [next] | [standalone]

#1313305 — Re: [RFC PATCH 4/4] X.509: Handle midnight alternative notation in GeneralizedTime

On Wed, 20 Jan 2016 15:20:00 +0000
David Howells <dhowells@redhat.com> wrote:

> Rudolf Polzer <rpolzer@google.com> wrote:
> 
> > As for 24:xx:yy times - I'm split about this. This code doesn't
> > require a bijective decoding anyway (and if it did, 24:00:00 and
> > 00:00:00 mapping to the same time64_t would be problem enough) so this
> > is sure safe. On the other hand, a cert with a 24:xx:yy time that's
> > not 24:00:00 probably should be regarded as invalid and not trusted
> > for that reason alone.
> 
> Feel free to argue that one with Linus:-/

Pedantic hat on 24:00:01 is also potentially valid. The ANSI and ISO
standards allow for double leap seconds even though CCIR-460 doesn't
allow it to actually happen.

Alan

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web