diff options
| author | Rob Austein <sra@hactrn.net> | 2013-11-07 01:55:17 +0000 |
|---|---|---|
| committer | Rob Austein <sra@hactrn.net> | 2013-11-07 01:55:17 +0000 |
| commit | 38492fe646c10dcfba5f8ce6356438cfcbb8699e (patch) | |
| tree | f999c37e787a6395abac887b7498371cc07a1ad0 /rcynic/rcynic.c | |
| parent | 53c89bbe26005845b25e65bcda96136ffb116650 (diff) | |
Check manifest validity dates against its EE certificate. Fixes #651.
svn path=/trunk/; revision=5587
Diffstat (limited to 'rcynic/rcynic.c')
| -rw-r--r-- | rcynic/rcynic.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/rcynic/rcynic.c b/rcynic/rcynic.c index ba0b7352..f1838a80 100644 --- a/rcynic/rcynic.c +++ b/rcynic/rcynic.c @@ -253,6 +253,7 @@ static const struct { QB(malformed_roa_addressfamily, "Malformed ROA addressFamily") \ QB(malformed_tal_uri, "Malformed TAL URI") \ QB(manifest_carepository_mismatch, "Manifest caRepository mismatch") \ + QB(manifest_interval_overruns_cert, "Manifest interval overruns certificate") \ QB(manifest_lists_missing_object, "Manifest lists missing object") \ QB(manifest_not_yet_valid, "Manifest not yet valid") \ QB(missing_resources, "Missing resources") \ @@ -3262,6 +3263,22 @@ static int check_allowed_time_encoding(ASN1_TIME *t) return 0; } +/** + * Compare ASN1_TIME values. + */ +static int asn1_time_cmp(ASN1_TIME *t1, ASN1_TIME *t2) +{ + ASN1_GENERALIZEDTIME *g1 = ASN1_TIME_to_generalizedtime(t1, NULL); + ASN1_GENERALIZEDTIME *g2 = ASN1_TIME_to_generalizedtime(t2, NULL); + + int cmp = ASN1_STRING_cmp(g1, g2); + + ASN1_GENERALIZEDTIME_free(g1); + ASN1_GENERALIZEDTIME_free(g2); + + return cmp; +} + /** @@ -4313,6 +4330,12 @@ static Manifest *check_manifest_1(rcynic_ctx_t *rc, goto done; } + if (asn1_time_cmp(manifest->thisUpdate, X509_get_notBefore(x)) < 0 || + asn1_time_cmp(manifest->nextUpdate, X509_get_notAfter(x)) > 0) { + log_validation_status(rc, uri, manifest_interval_overruns_cert, generation); + goto done; + } + if (ASN1_INTEGER_cmp(manifest->manifestNumber, asn1_zero) < 0 || ASN1_INTEGER_cmp(manifest->manifestNumber, asn1_twenty_octets) > 0) { log_validation_status(rc, uri, bad_manifest_number, generation); |