CryptoPkg/OpensslLib: Switch to upstream fix for OpenSSL RT#3951

A more complete implementation of the X509_V_FLAG_NO_CHECK_TIME flag was
added to OpenSSL 1.1 as commit d35ff2c0a. Drop our own version and use a
backport of what was committed upstream.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Qin Long <qin.long@intel.com>
Tested-by: Qin Long <qin.long@intel.com>

diff --git a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch
index 04ee8af1df3ec71a575f638d0d3ac915db795e88..82fa8dddf0594887fc2861a099a27ff828224375 100644 (file)
--- a/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch
+++ b/CryptoPkg/Library/OpensslLib/EDKII_openssl-1.0.2f.patch
@@ -11,6 +11,19 @@ index 4a715dc..eb61eda 100755
        {\r
        $disabled{"gost"} = "forced";\r
        }\r
        {\r
        $disabled{"gost"} = "forced";\r
        }\r

+diff --git a/apps/apps.c b/apps/apps.c\r
+index 2e77805..e21e759 100644\r
+--- a/apps/apps.c\r
++++ b/apps/apps.c\r
+@@ -2374,6 +2374,8 @@ int args_verify(char ***pargs, int *pargc,\r
+         flags |= X509_V_FLAG_PARTIAL_CHAIN;\r
+     else if (!strcmp(arg, "-no_alt_chains"))\r
+         flags |= X509_V_FLAG_NO_ALT_CHAINS;\r
++    else if (!strcmp(arg, "-no_check_time"))\r
++        flags |= X509_V_FLAG_NO_CHECK_TIME;\r
+     else\r
+         return 0;\r
+ \r

 diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c\r
 index 35fd44c..9f39bff 100644\r
 --- a/crypto/asn1/a_strex.c\r
 diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c\r
 index 35fd44c..9f39bff 100644\r
 --- a/crypto/asn1/a_strex.c\r


@@ -1608,6 +1621,21 @@ index f4a8358..94d3293 100644
  \r
  /* Error codes for the ZENCOD functions. */\r
  \r
  \r
  /* Error codes for the ZENCOD functions. */\r
  \r

+diff --git a/doc/crypto/X509_VERIFY_PARAM_set_flags.pod b/doc/crypto/X509_VERIFY_PARAM_set_flags.pod\r
+index 44792f9..7f95d58 100644\r
+--- a/doc/crypto/X509_VERIFY_PARAM_set_flags.pod\r
++++ b/doc/crypto/X509_VERIFY_PARAM_set_flags.pod\r
+@@ -203,6 +203,10 @@ chain found is not trusted, then OpenSSL will continue to check to see if an\r
+ alternative chain can be found that is trusted. With this flag set the behaviour\r
+ will match that of OpenSSL versions prior to 1.0.2b.\r
+ \r
++The B<X509_V_FLAG_NO_CHECK_TIME> flag suppresses checking the validity period\r
++of certificates and CRLs against the current time. If X509_VERIFY_PARAM_set_time()\r
++is used to specify a verification time, the check is not suppressed.\r
++\r
+ =head1 NOTES\r
+ \r
+ The above functions should be used to manipulate verification parameters\r

 diff --git a/doc/crypto/threads.pod b/doc/crypto/threads.pod\r
 index dc0e939..fe123bb 100644\r
 --- a/doc/crypto/threads.pod\r
 diff --git a/doc/crypto/threads.pod b/doc/crypto/threads.pod\r
 index dc0e939..fe123bb 100644\r
 --- a/doc/crypto/threads.pod\r