X.509: Handle midnight alternative notation in GeneralizedTime
authorDavid Howells <dhowells@redhat.com>
Wed, 24 Feb 2016 14:37:54 +0000 (14:37 +0000)
committerDavid Howells <dhowells@redhat.com>
Mon, 29 Feb 2016 14:29:40 +0000 (14:29 +0000)
commit7650cb80e4e90b0fae7854b6008a46d24360515f
treed4f390d6ef2224bddfc9172b890daea4d2b110c6
parentda02559c9f864c8d62f524c1e0b64173711a16ab
X.509: Handle midnight alternative notation in GeneralizedTime

The ASN.1 GeneralizedTime object carries an ISO 8601 format date and time.
The time is permitted to show midnight as 00:00 or 24:00 (the latter being
equivalent of 00:00 of the following day).

The permitted value is checked in x509_decode_time() but the actual
handling is left to mktime64().

Without this patch, certain X.509 certificates will be rejected and could
lead to an unbootable kernel.

Note that with this patch we also permit any 24:mm:ss time and extend this
to UTCTime, which whilst not strictly correct don't permit much leeway in
fiddling date strings.

Reported-by: Rudolf Polzer <rpolzer@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
cc: David Woodhouse <David.Woodhouse@intel.com>
cc: John Stultz <john.stultz@linaro.org>
crypto/asymmetric_keys/x509_cert_parser.c