Fix for bug 143334 : add support for GeneralizedTime in certificates and CRLs. r=wtc,nelsonb

4 files changed, 150 insertions, 23 deletions

diff --git a/security/nss/lib/util/dertime.c b/security/nss/lib/util/dertime.c
index 75e1761a2..2651a4f00 100644
--- a/security/nss/lib/util/dertime.c
+++ b/security/nss/lib/util/dertime.c
@@ -73,14 +73,18 @@ static long monthToDayInYear[12] = {
 
 /* gmttime must contains UTC time in micro-seconds unit */
 SECStatus
-DER_TimeToUTCTime(SECItem *dst, int64 gmttime)
+DER_TimeToUTCTimeArena(PRArenaPool* arenaOpt, SECItem *dst, int64 gmttime)
 {
     PRExplodedTime printableTime;
     unsigned char *d;
 
     dst->len = 13;
-    dst->data = d = (unsigned char*) PORT_Alloc(13);
-    dst->type = siBuffer;
+    if (arenaOpt) {
+        dst->data = d = (unsigned char*) PORT_ArenaAlloc(arenaOpt, dst->len);
+    } else {
+        dst->data = d = (unsigned char*) PORT_Alloc(dst->len);
+    }
+    dst->type = siUTCTime;
     if (!d) {
 	return SECFailure;
     }
@@ -116,6 +120,13 @@ DER_TimeToUTCTime(SECItem *dst, int64 gmttime)
 }
 
 SECStatus
+DER_TimeToUTCTime(SECItem *dst, int64 gmttime)
+{
+    return DER_TimeToUTCTimeArena(NULL, dst, gmttime);
+}
+
+
+SECStatus
 DER_AsciiToTime(int64 *dst, char *string)
 {
     long year, month, mday, hour, minute, second, hourOff, minOff, days;
@@ -222,14 +233,18 @@ DER_UTCTimeToTime(int64 *dst, SECItem *time)
    certificate extension, which does not have this restriction. 
  */
 SECStatus
-DER_TimeToGeneralizedTime(SECItem *dst, int64 gmttime)
+DER_TimeToGeneralizedTimeArena(PRArenaPool* arenaOpt, SECItem *dst, int64 gmttime)
 {
     PRExplodedTime printableTime;
     unsigned char *d;
 
     dst->len = 15;
-    dst->data = d = (unsigned char*) PORT_Alloc(15);
-    dst->type = siBuffer;
+    if (arenaOpt) {
+        dst->data = d = (unsigned char*) PORT_ArenaAlloc(arenaOpt, dst->len);
+    } else {
+        dst->data = d = (unsigned char*) PORT_Alloc(dst->len);
+    }
+    dst->type = siGeneralizedTime;
     if (!d) {
 	return SECFailure;
     }
@@ -260,6 +275,13 @@ DER_TimeToGeneralizedTime(SECItem *dst, int64 gmttime)
     return SECSuccess;
 }
 
+SECStatus
+DER_TimeToGeneralizedTime(SECItem *dst, int64 gmttime)
+{
+    return DER_TimeToGeneralizedTimeArena(NULL, dst, gmttime);
+}
+
+
 /*
     The caller should make sure that the generalized time should only
     be used for the certificate validity after the year 2051; otherwise,
diff --git a/security/nss/lib/util/seccomon.h b/security/nss/lib/util/seccomon.h
index f55f1311d..96d41af07 100644
--- a/security/nss/lib/util/seccomon.h
+++ b/security/nss/lib/util/seccomon.h
@@ -68,7 +68,9 @@ typedef enum {
     siAsciiNameString = 7,
     siAsciiString = 8,
     siDEROID = 9,
-    siUnsignedInteger = 10
+    siUnsignedInteger = 10,
+    siUTCTime = 11,
+    siGeneralizedTime = 12
 } SECItemType;
 
 typedef struct SECItemStr SECItem;
diff --git a/security/nss/lib/util/secder.h b/security/nss/lib/util/secder.h
index fdd43b1de..a54967f61 100644
--- a/security/nss/lib/util/secder.h
+++ b/security/nss/lib/util/secder.h
@@ -51,6 +51,7 @@
 
 #include "seccomon.h"
 #include "secdert.h"
+#include "prtime.h"
 
 SEC_BEGIN_PROTOS
 
@@ -137,6 +138,9 @@ extern unsigned long DER_GetUInteger(SECItem *src);
 ** result->data points to upon a successfull operation.
 */
 extern SECStatus DER_TimeToUTCTime(SECItem *result, int64 time);
+extern SECStatus DER_TimeToUTCTimeArena(PRArenaPool* arenaOpt,
+                                        SECItem *dst, int64 gmttime);
+
 
 /*
 ** Convert an ascii encoded time value (according to DER rules) into
@@ -165,11 +169,17 @@ extern char *DER_UTCTimeToAscii(SECItem *utcTime);
 ** The caller is responsible for deallocating the returned buffer.
 */
 extern char *DER_UTCDayToAscii(SECItem *utctime);
+/* same thing for DER encoded GeneralizedTime */
+extern char *DER_GeneralizedDayToAscii(SECItem *gentime);
+/* same thing for either DER UTCTime or GeneralizedTime */
+extern char *DER_TimeChoiceDayToAscii(SECItem *timechoice);
 
 /*
 ** Convert a int64 time to a DER encoded Generalized time
 */
 extern SECStatus DER_TimeToGeneralizedTime(SECItem *dst, int64 gmttime);
+extern SECStatus DER_TimeToGeneralizedTimeArena(PRArenaPool* arenaOpt,
+                                                SECItem *dst, int64 gmttime);
 
 /*
 ** Convert a DER encoded Generalized time value into a UNIX time value.
@@ -183,7 +193,7 @@ extern SECStatus DER_GeneralizedTimeToTime(int64 *dst, SECItem *time);
 ** caller is responsible for deallocating the returned buffer.
 */
 extern char *CERT_UTCTime2FormattedAscii (int64 utcTime, char *format);
-
+#define CERT_GeneralizedTime2FormattedAscii CERT_UTCTime2FormattedAscii
 
 /*
 ** Convert from a int64 Generalized time value to a formatted ascii value. The
@@ -191,6 +201,19 @@ extern char *CERT_UTCTime2FormattedAscii (int64 utcTime, char *format);
 */
 extern char *CERT_GenTime2FormattedAscii (int64 genTime, char *format);
 
+/*
+** decode a SECItem containing either a SEC_ASN1_GENERALIZED_TIME 
+** or a SEC_ASN1_UTC_TIME
+*/
+
+extern SECStatus CERT_DecodeTimeChoice(PRTime* output, SECItem* input);
+
+/* encode a PRTime to an ASN.1 DER SECItem containing either a
+   SEC_ASN1_GENERALIZED_TIME or a SEC_ASN1_UTC_TIME */
+
+extern SECStatus CERT_EncodeTimeChoice(PRArenaPool* arena, SECItem* output,
+                                       PRTime input);
+
 SEC_END_PROTOS
 
 #endif /* _SECDER_H_ */
diff --git a/security/nss/lib/util/sectime.c b/security/nss/lib/util/sectime.c
index d3cca6f87..678021853 100644
--- a/security/nss/lib/util/sectime.c
+++ b/security/nss/lib/util/sectime.c
@@ -36,28 +36,31 @@
 #include "secder.h"
 #include "cert.h"
 #include "secitem.h"
+#include "secerr.h"
+
+const SEC_ASN1Template CERT_TimeChoiceTemplate[] = {
+  { SEC_ASN1_CHOICE, offsetof(SECItem, type), 0, sizeof(SECItem) },
+  { SEC_ASN1_UTC_TIME, 0, 0, siUTCTime },
+  { SEC_ASN1_GENERALIZED_TIME, 0, 0, siGeneralizedTime },
+  { 0 }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(CERT_TimeChoiceTemplate);
 
 const SEC_ASN1Template CERT_ValidityTemplate[] = {
     { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTValidity) },
-    { SEC_ASN1_UTC_TIME,
-	  offsetof(CERTValidity,notBefore) },
-    { SEC_ASN1_UTC_TIME,
-	  offsetof(CERTValidity,notAfter) },
+    { SEC_ASN1_INLINE,
+	  offsetof(CERTValidity,notBefore), CERT_TimeChoiceTemplate, 0 },
+    { SEC_ASN1_INLINE,
+	  offsetof(CERTValidity,notAfter), CERT_TimeChoiceTemplate, 0 },
     { 0 }
 };
 
-DERTemplate CERTValidityTemplate[] = {
-    { DER_SEQUENCE,
-	  0, NULL, sizeof(CERTValidity) },
-    { DER_UTC_TIME,
-	  offsetof(CERTValidity,notBefore), },
-    { DER_UTC_TIME,
-	  offsetof(CERTValidity,notAfter), },
-    { 0, }
-};
+PRTime January1st2050 = LL_INIT(0x0008f81e,0x1b098000);
 
 static char *DecodeUTCTime2FormattedAscii (SECItem *utcTimeDER, char *format);
+static char *DecodeGeneralizedTime2FormattedAscii (SECItem *generalizedTimeDER, char *format);
 
 /* convert DER utc time to ascii time string */
 char *
@@ -73,6 +76,36 @@ DER_UTCDayToAscii(SECItem *utctime)
     return (DecodeUTCTime2FormattedAscii (utctime, "%a %b %d, %Y"));
 }
 
+/* convert DER generalized time to ascii time string, only include day,
+   not time */
+char *
+DER_GeneralizedDayToAscii(SECItem *gentime)
+{
+    return (DecodeGeneralizedTime2FormattedAscii (gentime, "%a %b %d, %Y"));
+}
+
+/* convert DER generalized or UTC time to ascii time string, only include
+   day, not time */
+char *
+DER_TimeChoiceDayToAscii(SECItem *timechoice)
+{
+    switch (timechoice->type) {
+
+    case siUTCTime:
+        return DER_UTCDayToAscii(timechoice);
+
+    case siGeneralizedTime:
+        return DER_GeneralizedDayToAscii(timechoice);
+
+    default:
+        PORT_Assert(0);
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return NULL;
+    }
+}
+
+
+
 CERTValidity *
 CERT_CreateValidity(int64 notBefore, int64 notAfter)
 {
@@ -89,9 +122,9 @@ CERT_CreateValidity(int64 notBefore, int64 notAfter)
     v = (CERTValidity*) PORT_ArenaZAlloc(arena, sizeof(CERTValidity));
     if (v) {
 	v->arena = arena;
-	rv = DER_TimeToUTCTime(&v->notBefore, notBefore);
+	rv = CERT_EncodeTimeChoice(arena, &v->notBefore, notBefore);
 	if (rv) goto loser;
-	rv = DER_TimeToUTCTime(&v->notAfter, notAfter);
+	rv = CERT_EncodeTimeChoice(arena, &v->notAfter, notAfter);
 	if (rv) goto loser;
     }
     return v;
@@ -175,3 +208,50 @@ DecodeUTCTime2FormattedAscii (SECItem *utcTimeDER,  char *format)
     }
     return (CERT_UTCTime2FormattedAscii (utcTime, format));
 }
+
+/* convert DER utc time to ascii time string, The format of the time string
+   depends on the input "format"
+ */
+static char *
+DecodeGeneralizedTime2FormattedAscii (SECItem *generalizedTimeDER,  char *format)
+{
+    PRTime generalizedTime;
+    int rv;
+   
+    rv = DER_GeneralizedTimeToTime(&generalizedTime, generalizedTimeDER);
+    if (rv) {
+        return(NULL);
+    }
+    return (CERT_GeneralizedTime2FormattedAscii (generalizedTime, format));
+}
+
+/* decode a SECItem containing either a SEC_ASN1_GENERALIZED_TIME 
+   or a SEC_ASN1_UTC_TIME */
+
+SECStatus CERT_DecodeTimeChoice(PRTime* output, SECItem* input)
+{
+    switch (input->type) {
+        case siGeneralizedTime:
+            return DER_GeneralizedTimeToTime(output, input);
+
+        case siUTCTime:
+            return DER_UTCTimeToTime(output, input);
+
+        default:
+            PORT_SetError(SEC_ERROR_INVALID_ARGS);
+            PORT_Assert(0);
+            return SECFailure;
+    }
+}
+
+/* encode a PRTime to an ASN.1 DER SECItem containing either a
+   SEC_ASN1_GENERALIZED_TIME or a SEC_ASN1_UTC_TIME */
+
+SECStatus CERT_EncodeTimeChoice(PRArenaPool* arena, SECItem* output, PRTime input)
+{
+    if (LL_CMP(input, >, January1st2050)) {
+        return DER_TimeToGeneralizedTimeArena(arena, output, input);
+    } else {
+        return DER_TimeToUTCTimeArena(arena, output, input);
+    }
+}