summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2016-02-24 14:37:53 +0000
committerDavid Howells <dhowells@redhat.com>2016-02-29 14:29:40 +0000
commitda02559c9f864c8d62f524c1e0b64173711a16ab (patch)
tree342f1be223e4aec80aa82b29400f7d59a29e05e0
parentede5147d515694e012cd958ec874b9daf8a65fec (diff)
X.509: Support leap seconds
The format of ASN.1 GeneralizedTime seems to be specified by ISO 8601 [X.680 46.3] and this apparently supports leap seconds (ie. the seconds field is 60). It's not entirely clear that ASN.1 expects it, but we can relax the seconds check slightly for GeneralizedTime. This results in us passing a time with sec as 60 to mktime64(), which handles it as being a duplicate of the 0th second of the next minute. We can't really do otherwise without giving the kernel much greater knowledge of where all the leap seconds are. Unfortunately, this would require change the mapping of the kernel's current-time-in-seconds. UTCTime, however, only supports a seconds value in the range 00-59, but for the sake of simplicity allow this with UTCTime also. Without this patch, certain X.509 certificates will be rejected, potentially making a kernel unbootable. Reported-by: Rudolf Polzer <rpolzer@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Arnd Bergmann <arnd@arndb.de> cc: David Woodhouse <David.Woodhouse@intel.com> cc: John Stultz <john.stultz@linaro.org>
-rw-r--r--crypto/asymmetric_keys/x509_cert_parser.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 794cf0eac2c9..99ff5382b627 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -527,7 +527,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
if (day < 1 || day > mon_len ||
hour > 23 ||
min > 59 ||
- sec > 59)
+ sec > 60) /* ISO 8601 permits leap seconds [X.680 46.3] */
goto invalid_time;
*_t = mktime64(year, mon, day, hour, min, sec);