From: David Woodhouse <[email protected]> OpenSSL HEAD is in the process of adding this flag to disable the validity time checking. Backport it to 1.0.2 and use it too, for consistency.
https://rt.openssl.org/Ticket/Display.html?id=3951&user=guest&pass=guest Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: David Woodhouse <[email protected]> --- .../Library/BaseCryptLib/Pk/CryptPkcs7Verify.c | 5 +- CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c | 5 +- CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c | 5 +- .../Library/OpensslLib/EDKII_openssl-1.0.2d.patch | 53 ++++++++++++++-------- 4 files changed, 42 insertions(+), 26 deletions(-) diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c index 4d23cbf..b7f14d5 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c @@ -569,9 +569,10 @@ Pkcs7Verify ( // // Allow partial certificate chains, terminated by a non-self-signed but - // still trusted intermediate certificate. + // still trusted intermediate certificate. Also disable time checks. // - X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN); + X509_STORE_set_flags (CertStore, + X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME); // // OpenSSL PKCS7 Verification by default checks for SMIME (email signing) and diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c index 449a08d..7ce5087 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c @@ -426,9 +426,10 @@ TimestampTokenVerify ( // // Allow partial certificate chains, terminated by a non-self-signed but - // still trusted intermediate certificate. + // still trusted intermediate certificate. Also disable time checks. // - X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN); + X509_STORE_set_flags (CertStore, + X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME); X509_STORE_set_purpose (CertStore, X509_PURPOSE_ANY); diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c index 742586c..7df5d68 100644 --- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c +++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c @@ -466,9 +466,10 @@ X509VerifyCert ( // // Allow partial certificate chains, terminated by a non-self-signed but - // still trusted intermediate certificate. + // still trusted intermediate certificate. Also disable time checks. // - X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN); + X509_STORE_set_flags (CertStore, + X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME); // // Set up X509_STORE_CTX for the subsequent verification operation. diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch index 72e5f3d..a89565c 100644 --- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch +++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch @@ -207,28 +207,41 @@ diff U3 crypto/rsa/rsa_ameth.c crypto/rsa/rsa_ameth.c const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[] = { { -diff U3 crypto/x509/x509_vfy.c crypto/x509/x509_vfy.c +diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c +index df012dd..29b3297 100644 --- crypto/x509/x509_vfy.c Thu Jun 11 21:52:58 2015 +++ crypto/x509/x509_vfy.c Fri Jun 12 11:29:37 2015 -@@ -1653,6 +1653,10 @@ - - static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) - { -+#ifdef OPENSSL_SYS_UEFI -+ /* Bypass Certificate Time Checking for UEFI version. */ -+ return 1; -+#else - time_t *ptime; - int i; - -@@ -1692,6 +1696,7 @@ - } - - return 1; -+#endif - } - - static int internal_verify(X509_STORE_CTX *ctx) +@@ -950,6 +950,8 @@ static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify) + ctx->current_crl = crl; + if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) + ptime = &ctx->param->check_time; ++ else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) ++ return 1; + else + ptime = NULL; + +@@ -1670,6 +1672,8 @@ int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet) + + if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) + ptime = &ctx->param->check_time; ++ else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME) ++ return 1; + else + ptime = NULL; + +diff --git a/include/openssl/x509_vfy.h b/include/openssl/x509_vfy.h +index 8e0a225..c78ba98 100644 +--- crypto/x509/x509_vfy.h ++++ crypto/x509/x509_vfy.h +@@ -407,6 +407,8 @@ void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth); + * will force the behaviour to match that of previous versions. + */ + # define X509_V_FLAG_NO_ALT_CHAINS 0x100000 ++/* Do not check certificate/CRL validity against current time */ ++# define X509_V_FLAG_NO_CHECK_TIME 0x200000 + + # define X509_VP_FLAG_DEFAULT 0x1 + # define X509_VP_FLAG_OVERWRITE 0x2 diff U3 crypto/x509v3/ext_dat.h crypto/x509v3/ext_dat.h --- crypto/x509v3/ext_dat.h Thu Jun 11 21:50:12 2015 +++ crypto/x509v3/ext_dat.h Fri Jun 12 11:11:03 2015 -- 2.4.3 -- David Woodhouse Open Source Technology Centre [email protected] Intel Corporation
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
