Support GeneralizeTime in the CRMF library. Bug 219080. r=julien.

Patch by nelson and julien.

4 files changed, 10 insertions, 22 deletions

diff --git a/security/nss/cmd/crmftest/testcrmf.c b/security/nss/cmd/crmftest/testcrmf.c
index 9801b17e9..42cae81e5 100644
--- a/security/nss/cmd/crmftest/testcrmf.c
+++ b/security/nss/cmd/crmftest/testcrmf.c
@@ -674,6 +674,10 @@ Decode(void)
 	if (rv) {
 	    SECU_PrintError("crmftest", "CRMF_CertRequestGetCertTemplateValidity");
 	}
+	if (!validity.notBefore) {
+	    /* We encoded a notBefore, so somthing's wrong if it's not here. */
+	    printf("ERROR: Validity period notBefore date missing.\n");
+	}
 	/* XXX It's all parsed now.  We probably should DO SOMETHING with it.
 	** But nope.  We just throw it all away.
 	** Maybe this was intended to be no more than a decoder test.
diff --git a/security/nss/lib/crmf/crmfreq.c b/security/nss/lib/crmf/crmfreq.c
index 04d375726..b4e06bc32 100644
--- a/security/nss/lib/crmf/crmfreq.c
+++ b/security/nss/lib/crmf/crmfreq.c
@@ -236,22 +236,6 @@ crmf_template_add_issuer (PRArenaPool *poolp, CERTName **dest,
 
 
 static SECStatus
-crmf_encode_utctime(PRArenaPool *poolp, SECItem *destTime, PRTime time)
-{
-    SECItem   tmpItem;
-    SECStatus rv;
-
-
-    rv = DER_TimeToUTCTime (&tmpItem, time);
-    if (rv != SECSuccess) {
-        return rv;
-    }
-    rv = SECITEM_CopyItem(poolp, destTime, &tmpItem);
-    PORT_Free(tmpItem.data);
-    return rv;
-}
-
-static SECStatus
 crmf_template_add_validity (PRArenaPool *poolp, CRMFOptionalValidity **dest,
 			    CRMFValidityCreationInfo *info)
 {
@@ -270,14 +254,14 @@ crmf_template_add_validity (PRArenaPool *poolp, CRMFOptionalValidity **dest,
     }
 
     if (info->notBefore) {
-        rv = crmf_encode_utctime (poolp, &myValidity->notBefore, 
+        rv = DER_EncodeTimeChoice (poolp, &myValidity->notBefore, 
 				  *info->notBefore);
 	if (rv != SECSuccess) {
 	    goto loser;
 	}
     }
     if (info->notAfter) {
-        rv = crmf_encode_utctime (poolp, &myValidity->notAfter,
+        rv = DER_EncodeTimeChoice (poolp, &myValidity->notAfter,
 				  *info->notAfter);
 	if (rv != SECSuccess) {
 	    goto loser;
diff --git a/security/nss/lib/crmf/crmftmpl.c b/security/nss/lib/crmf/crmftmpl.c
index 04da708f3..594feea3e 100644
--- a/security/nss/lib/crmf/crmftmpl.c
+++ b/security/nss/lib/crmf/crmftmpl.c
@@ -46,7 +46,7 @@ SEC_ASN1_MKSUB(SEC_NullTemplate)
 SEC_ASN1_MKSUB(SEC_BitStringTemplate)
 SEC_ASN1_MKSUB(SEC_IntegerTemplate)
 SEC_ASN1_MKSUB(SEC_OctetStringTemplate)
-SEC_ASN1_MKSUB(SEC_UTCTimeTemplate)
+SEC_ASN1_MKSUB(CERT_TimeChoiceTemplate)
 SEC_ASN1_MKSUB(CERT_SubjectPublicKeyInfoTemplate)
 SEC_ASN1_MKSUB(CERT_NameTemplate)
 
@@ -82,11 +82,11 @@ static const SEC_ASN1Template CRMFOptionalValidityTemplate[] = {
     { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_NO_STREAM |
       SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN | 0, 
       offsetof (CRMFOptionalValidity, notBefore),
-      SEC_ASN1_SUB(SEC_UTCTimeTemplate) },
+      SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
     { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_NO_STREAM |
       SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN | 1, 
       offsetof (CRMFOptionalValidity, notAfter),
-      SEC_ASN1_SUB(SEC_UTCTimeTemplate) },
+      SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
     { 0 }
 };
 
diff --git a/security/nss/lib/crmf/respcmn.c b/security/nss/lib/crmf/respcmn.c
index 11f7e0154..153ecee51 100644
--- a/security/nss/lib/crmf/respcmn.c
+++ b/security/nss/lib/crmf/respcmn.c
@@ -125,7 +125,7 @@ SECStatus
 crmf_create_prtime(SECItem *src, PRTime **dest)
 {
    *dest = PORT_ZNew(PRTime);
-    return DER_UTCTimeToTime(*dest, src);
+    return DER_DecodeTimeChoice(*dest, src);
 }
 
 CRMFCertExtension*