CryptoPkg/BaseCryptLib: Use X509_V_FLAG_NO_CHECK_TIME

OpenSSL HEAD is in the process of adding this flag to disable the validity
time checking. Backport it to 1.0.2 and use it too, for consistency.

https://rt.openssl.org/Ticket/Display.html?id=3951&user=guest&pass=guest

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Reviewed-by: Qin Long <qin.long@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@18704 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
index 4d23cbfb945164ba4824e79b5b512f6479ae0e67..fafcf1ba85361c98592e7e304a581a77b9ecee0e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7Verify.c
@@ -569,9 +569,10 @@ Pkcs7Verify (
 \r
   //\r
   // Allow partial certificate chains, terminated by a non-self-signed but\r
-  // still trusted intermediate certificate.\r
+  // still trusted intermediate certificate. Also disable time checks.\r
   //\r
-  X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN);\r
+  X509_STORE_set_flags (CertStore,\r
+                        X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);\r
 \r
   //\r
   // OpenSSL PKCS7 Verification by default checks for SMIME (email signing) and\r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
index 449a08db2c6391599e5d42ffbd2961adec4cc496..d49581221c4a9982397c0d15d75868677895d84b 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptTs.c
@@ -426,9 +426,10 @@ TimestampTokenVerify (
 \r
   //\r
   // Allow partial certificate chains, terminated by a non-self-signed but\r
-  // still trusted intermediate certificate.\r
+  // still trusted intermediate certificate. Also disable time checks.\r
   //\r
-  X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN);\r
+  X509_STORE_set_flags (CertStore,\r
+                        X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);\r
 \r
   X509_STORE_set_purpose (CertStore, X509_PURPOSE_ANY);\r
 \r

diff --git a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
index 669a7af3db0367d172bacf71d1e42b167ac2e5ac..7dc459675965e4d66b08cda67567b0d629fb047e 100644 (file)
--- a/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
+++ b/CryptoPkg/Library/BaseCryptLib/Pk/CryptX509.c
@@ -465,9 +465,10 @@ X509VerifyCert (
 \r
   //\r
   // Allow partial certificate chains, terminated by a non-self-signed but\r
-  // still trusted intermediate certificate.\r
+  // still trusted intermediate certificate. Also disable time checks.\r
   //\r
-  X509_STORE_set_flags (CertStore, X509_V_FLAG_PARTIAL_CHAIN);\r
+  X509_STORE_set_flags (CertStore,\r
+                        X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME);\r
 \r
   //\r
   // Set up X509_STORE_CTX for the subsequent verification operation.\r

diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch
index 72e5f3da54c47719d42533574ee7dfcddc2dda4b..220d44ef3b91b2074a8ff7248081802bf1569a05 100644 (file)
--- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch
+++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2d.patch
@@ -210,25 +210,36 @@ diff U3 crypto/rsa/rsa_ameth.c crypto/rsa/rsa_ameth.c
 diff U3 crypto/x509/x509_vfy.c crypto/x509/x509_vfy.c\r
 --- crypto/x509/x509_vfy.c     Thu Jun 11 21:52:58 2015\r
 +++ crypto/x509/x509_vfy.c     Fri Jun 12 11:29:37 2015\r
-@@ -1653,6 +1653,10 @@\r
- \r
- static int check_cert_time(X509_STORE_CTX *ctx, X509 *x)\r
- {\r
-+#ifdef OPENSSL_SYS_UEFI\r
-+    /* Bypass Certificate Time Checking for UEFI version. */\r
-+    return 1;\r
-+#else\r
-     time_t *ptime;\r
-     int i;\r
- \r
-@@ -1692,6 +1696,7 @@\r
-     }\r
- \r
-     return 1;\r
-+#endif\r
- }\r
- \r
- static int internal_verify(X509_STORE_CTX *ctx)\r
+@@ -935,6 +935,8 @@\r
+         ctx->current_crl = crl;\r
+     if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)\r
+         ptime = &ctx->param->check_time;\r
++    else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)\r
++        return 1;\r
+     else\r
+         ptime = NULL;\r
+ \r
+@@ -1658,6 +1660,8 @@\r
+ \r
+     if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)\r
+         ptime = &ctx->param->check_time;\r
++    else if (ctx->param->flags & X509_V_FLAG_NO_CHECK_TIME)\r
++        return 1;\r
+     else\r
+         ptime = NULL;\r
+ \r
+diff U3 crypto/x509/x509_vfy.h crypto/x509/x509_vfy.h\r
+--- crypto/x509/x509_vfy.h     Thu Jul 09 19:57:16 2015\r
++++ crypto/x509/x509_vfy.h     Thu Oct 29 14:05:57 2015\r
+@@ -438,6 +438,8 @@\r
+  * will force the behaviour to match that of previous versions.\r
+  */\r
+ # define X509_V_FLAG_NO_ALT_CHAINS               0x100000\r
++/* Do not check certificate/CRL validity against current time */\r
++# define X509_V_FLAG_NO_CHECK_TIME               0x200000\r
+ \r
+ # define X509_VP_FLAG_DEFAULT                    0x1\r
+ # define X509_VP_FLAG_OVERWRITE                  0x2\r
 diff U3 crypto/x509v3/ext_dat.h crypto/x509v3/ext_dat.h\r
 --- crypto/x509v3/ext_dat.h    Thu Jun 11 21:50:12 2015\r
 +++ crypto/x509v3/ext_dat.h    Fri Jun 12 11:11:03 2015\r