Add set1 versions of X509 timestamp setters. OpenSSL renamed the preferred spelling of X509_set_notBefore to X509_set1_notBefore, etc., in 568ce3a583a17c33feacbf5028ece9f7f0680478. Add the set1 names and update uses within the library. Change-Id: Ib211e356da9de963990ad2b330249383ccfef7e5 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/42524 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/x509/t_crl.c b/crypto/x509/t_crl.c index dc9b87f..14f98c5 100644 --- a/crypto/x509/t_crl.c +++ b/crypto/x509/t_crl.c
@@ -91,10 +91,10 @@ BIO_printf(out, "%8sIssuer: %s\n", "", p); OPENSSL_free(p); BIO_printf(out, "%8sLast Update: ", ""); - ASN1_TIME_print(out, X509_CRL_get_lastUpdate(x)); + ASN1_TIME_print(out, X509_CRL_get0_lastUpdate(x)); BIO_printf(out, "\n%8sNext Update: ", ""); - if (X509_CRL_get_nextUpdate(x)) - ASN1_TIME_print(out, X509_CRL_get_nextUpdate(x)); + if (X509_CRL_get0_nextUpdate(x)) + ASN1_TIME_print(out, X509_CRL_get0_nextUpdate(x)); else BIO_printf(out, "NONE"); BIO_printf(out, "\n");
diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c index e7bfbe3..0fcdc5a 100644 --- a/crypto/x509/x509_set.c +++ b/crypto/x509/x509_set.c
@@ -117,7 +117,7 @@ return (X509_NAME_set(&x->cert_info->subject, name)); } -int X509_set_notBefore(X509 *x, const ASN1_TIME *tm) +int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm) { ASN1_TIME *in; @@ -155,7 +155,7 @@ return x509->cert_info->validity->notBefore; } -int X509_set_notAfter(X509 *x, const ASN1_TIME *tm) +int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm) { ASN1_TIME *in;
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 308ebbc..9839b95 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c
@@ -1037,7 +1037,7 @@ else ptime = NULL; - i = X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime); + i = X509_cmp_time(X509_CRL_get0_lastUpdate(crl), ptime); if (i == 0) { if (!notify) return 0; @@ -1054,8 +1054,8 @@ return 0; } - if (X509_CRL_get_nextUpdate(crl)) { - i = X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime); + if (X509_CRL_get0_nextUpdate(crl)) { + i = X509_cmp_time(X509_CRL_get0_nextUpdate(crl), ptime); if (i == 0) { if (!notify) @@ -1100,8 +1100,8 @@ /* If current CRL is equivalent use it if it is newer */ if (crl_score == best_score && best_crl != NULL) { int day, sec; - if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl), - X509_CRL_get_lastUpdate(crl)) == 0) + if (ASN1_TIME_diff(&day, &sec, X509_CRL_get0_lastUpdate(best_crl), + X509_CRL_get0_lastUpdate(crl)) == 0) continue; /* * ASN1_TIME_diff never returns inconsistent signs for |day| @@ -2058,9 +2058,9 @@ if (!X509_CRL_set_issuer_name(crl, X509_CRL_get_issuer(newer))) goto memerr; - if (!X509_CRL_set_lastUpdate(crl, X509_CRL_get_lastUpdate(newer))) + if (!X509_CRL_set1_lastUpdate(crl, X509_CRL_get0_lastUpdate(newer))) goto memerr; - if (!X509_CRL_set_nextUpdate(crl, X509_CRL_get_nextUpdate(newer))) + if (!X509_CRL_set1_nextUpdate(crl, X509_CRL_get0_nextUpdate(newer))) goto memerr; /* Set base CRL number: must be critical */
diff --git a/crypto/x509/x509cset.c b/crypto/x509/x509cset.c index d2f2b8f..ba868b3 100644 --- a/crypto/x509/x509cset.c +++ b/crypto/x509/x509cset.c
@@ -79,7 +79,7 @@ return (X509_NAME_set(&x->crl->issuer, name)); } -int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm) +int X509_CRL_set1_lastUpdate(X509_CRL *x, const ASN1_TIME *tm) { ASN1_TIME *in; @@ -96,7 +96,7 @@ return (in != NULL); } -int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm) +int X509_CRL_set1_nextUpdate(X509_CRL *x, const ASN1_TIME *tm) { ASN1_TIME *in;
diff --git a/include/openssl/x509.h b/include/openssl/x509.h index d3b32a8..4127377 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h
@@ -146,7 +146,7 @@ STACK_OF(X509_NAME_ENTRY) * entries; int modified; // true if 'bytes' needs to be built BUF_MEM *bytes; - // unsigned long hash; Keep the hash around for lookups + // unsigned long hash; Keep the hash around for lookups unsigned char *canon_enc; int canon_enclen; } /* X509_NAME */; @@ -470,6 +470,11 @@ extern "C" { #endif +// TODO(davidben): Document remaining functions, reorganize them, and define +// supported patterns for using |X509| objects in general. In particular, when +// it is safe to call mutating functions is a little tricky due to various +// internal caches. + // X509_get_version returns the numerical value of |x509|'s version. That is, // it returns zero for X.509v1, one for X.509v2, and two for X.509v3. Unknown // versions are rejected by the parser, but a manually-created |X509| object may @@ -477,16 +482,40 @@ // version, or -1 on overflow. OPENSSL_EXPORT long X509_get_version(const X509 *x509); -// X509_get_notBefore returns |x509|'s notBefore value. Note this function is -// not const-correct for legacy reasons. Use |X509_get0_notBefore| or +// X509_get0_notBefore returns |x509|'s notBefore time. +OPENSSL_EXPORT const ASN1_TIME *X509_get0_notBefore(const X509 *x509); + +// X509_get0_notAfter returns |x509|'s notAfter time. +OPENSSL_EXPORT const ASN1_TIME *X509_get0_notAfter(const X509 *x509); + +// X509_set1_notBefore sets |x509|'s notBefore time to |tm|. It returns one on +// success and zero on error. +OPENSSL_EXPORT int X509_set1_notBefore(X509 *x509, const ASN1_TIME *tm); + +// X509_set1_notAfter sets |x509|'s notAfter time to |tm|. it returns one on +// success and zero on error. +OPENSSL_EXPORT int X509_set1_notAfter(X509 *x509, const ASN1_TIME *tm); + +// X509_getm_notBefore returns a mutable pointer to |x509|'s notBefore time. +OPENSSL_EXPORT ASN1_TIME *X509_getm_notBefore(X509 *x509); + +// X509_getm_notAfter returns a mutable pointer to |x509|'s notAfter time. +OPENSSL_EXPORT ASN1_TIME *X509_getm_notAfter(X509 *x); + +// X509_get_notBefore returns |x509|'s notBefore time. Note this function is not +// const-correct for legacy reasons. Use |X509_get0_notBefore| or // |X509_getm_notBefore| instead. OPENSSL_EXPORT ASN1_TIME *X509_get_notBefore(const X509 *x509); -// X509_get_notAfter returns |x509|'s notAfter value. Note this function is not +// X509_get_notAfter returns |x509|'s notAfter time. Note this function is not // const-correct for legacy reasons. Use |X509_get0_notAfter| or // |X509_getm_notAfter| instead. OPENSSL_EXPORT ASN1_TIME *X509_get_notAfter(const X509 *x509); +// The following symbols are deprecated aliases to |X509_set1_*|. +#define X509_set_notBefore X509_set1_notBefore +#define X509_set_notAfter X509_set1_notAfter + // X509_get_cert_info returns |x509|'s TBSCertificate structure. Note this // function is not const-correct for legacy reasons. // @@ -521,15 +550,29 @@ // X509_CRL_get0_lastUpdate returns |crl|'s lastUpdate time. OPENSSL_EXPORT const ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *crl); -// X509_CRL_get0_lastUpdate returns |crl|'s nextUpdate time. +// X509_CRL_get0_nextUpdate returns |crl|'s nextUpdate time, or NULL if |crl| +// has none. OPENSSL_EXPORT const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl); +// X509_CRL_set1_lastUpdate sets |crl|'s lastUpdate time to |tm|. It returns one +// on success and zero on error. +OPENSSL_EXPORT int X509_CRL_set1_lastUpdate(X509_CRL *crl, const ASN1_TIME *tm); + +// X509_CRL_set1_nextUpdate sets |crl|'s nextUpdate time to |tm|. It returns one +// on success and zero on error. +OPENSSL_EXPORT int X509_CRL_set1_nextUpdate(X509_CRL *crl, const ASN1_TIME *tm); + +// The following symbols are deprecated aliases to |X509_CRL_set1_*|. +#define X509_CRL_set_lastUpdate X509_CRL_set1_lastUpdate +#define X509_CRL_set_nextUpdate X509_CRL_set1_nextUpdate + // X509_CRL_get_lastUpdate returns a mutable pointer to |crl|'s lastUpdate time. -// Use |X509_CRL_get0_lastUpdate| or |X509_CRL_set_lastUpdate| instead. +// Use |X509_CRL_get0_lastUpdate| or |X509_CRL_set1_lastUpdate| instead. OPENSSL_EXPORT ASN1_TIME *X509_CRL_get_lastUpdate(X509_CRL *crl); -// X509_CRL_get_nextUpdate returns a mutable pointer to |crl|'s nextUpdate time. -// Use |X509_CRL_get0_nextUpdate| or |X509_CRL_set_nextUpdate| instead. +// X509_CRL_get_nextUpdate returns a mutable pointer to |crl|'s nextUpdate time, +// or NULL if |crl| has none. Use |X509_CRL_get0_nextUpdate| or +// |X509_CRL_set1_nextUpdate| instead. OPENSSL_EXPORT ASN1_TIME *X509_CRL_get_nextUpdate(X509_CRL *crl); // X509_CRL_get_issuer returns |crl|'s issuer name. Note this function is not @@ -858,12 +901,6 @@ OPENSSL_EXPORT X509_NAME *X509_get_issuer_name(X509 *a); OPENSSL_EXPORT int X509_set_subject_name(X509 *x, X509_NAME *name); OPENSSL_EXPORT X509_NAME *X509_get_subject_name(X509 *a); -OPENSSL_EXPORT int X509_set_notBefore(X509 *x, const ASN1_TIME *tm); -OPENSSL_EXPORT const ASN1_TIME *X509_get0_notBefore(const X509 *x); -OPENSSL_EXPORT ASN1_TIME *X509_getm_notBefore(X509 *x); -OPENSSL_EXPORT int X509_set_notAfter(X509 *x, const ASN1_TIME *tm); -OPENSSL_EXPORT const ASN1_TIME *X509_get0_notAfter(const X509 *x); -OPENSSL_EXPORT ASN1_TIME *X509_getm_notAfter(X509 *x); OPENSSL_EXPORT int X509_set_pubkey(X509 *x, EVP_PKEY *pkey); OPENSSL_EXPORT EVP_PKEY *X509_get_pubkey(X509 *x); OPENSSL_EXPORT ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x); @@ -911,8 +948,6 @@ OPENSSL_EXPORT int X509_CRL_set_version(X509_CRL *x, long version); OPENSSL_EXPORT int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name); -OPENSSL_EXPORT int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm); -OPENSSL_EXPORT int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm); OPENSSL_EXPORT int X509_CRL_sort(X509_CRL *crl); OPENSSL_EXPORT int X509_CRL_up_ref(X509_CRL *crl);