From 5c435383742197bd7879800b2bcb88a20bbceac1 Mon Sep 17 00:00:00 2001
From: chris2511 <chris2511>
Date: Wed, 6 Aug 2003 08:15:37 +0000
Subject: [PATCH] uses UTC time for certificate dates >1950 and < 2049 solves
 Bug: [ 783830 ] GeneralizedTime-format breaks browsers

---
 lib/asn1time.cpp | 37 ++++++++++++++++++++++++++++++++++++-
 lib/asn1time.h   |  4 +++-
 lib/pki_x509.cpp |  8 ++++++--
 3 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/lib/asn1time.cpp b/lib/asn1time.cpp
index 12e7e051..5ee847a9 100644
--- a/lib/asn1time.cpp
+++ b/lib/asn1time.cpp
@@ -81,6 +81,11 @@ ASN1_TIME *a1time::get() const
 	return M_ASN1_TIME_dup(time);
 }
 
+ASN1_TIME *a1time::get_utc() const
+{
+	return toUTCtime();
+}
+
 a1time &a1time::set(const ASN1_TIME *a)
 {
 	if (a == NULL) {
@@ -260,10 +265,40 @@ int a1time::derSize() const
 }
 
 
+ASN1_UTCTIME *a1time::toUTCtime() const
+        {
+        ASN1_UTCTIME *ret;
+		int year=0,i ;
+        // if (!ASN1_TIME_check(t)) return NULL;
+		for (i=0; i<4; i++){
+			year *= 10;
+			year += time->data[i] - '0';
+		}
+		if (year > 2049 || year <1950)
+			return NULL;
+
+        if (!(ret = ASN1_UTCTIME_new ()))
+        	return NULL;
+
+        /* If already UTC Time just copy across */
+        if (time->type == V_ASN1_UTCTIME)
+                {
+                if(!ASN1_STRING_set(ret, time->data, time->length))
+                        return NULL;
+                return ret;
+                }
+		
+		/* copy w/o 19 or 20 */
+        if (!ASN1_STRING_set(ret, time->data+2, time->length - 2))
+                return NULL;
+
+        return ret;
+        }
+ 
 /* this was happily copied from OpenSSL 0.9.7 
  * and is used if linking against 0.9.6
  */
- 
+
 #if OPENSSL_VERSION_NUMBER < 0x00907000L
 /* Convert an ASN1_TIME structure to GeneralizedTime */
 ASN1_GENERALIZEDTIME *a1time::ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
diff --git a/lib/asn1time.h b/lib/asn1time.h
index 5eb19ecb..7a707d99 100644
--- a/lib/asn1time.h
+++ b/lib/asn1time.h
@@ -57,10 +57,11 @@
 class a1time
 {
    private:	
-	ASN1_GENERALIZEDTIME *time;
+	ASN1_TIME *time;
 #if OPENSSL_VERSION_NUMBER < 0x00907000L
 	ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out);
 #endif
+	ASN1_UTCTIME *toUTCtime() const;
    public:
 	a1time();
 	a1time(const ASN1_TIME *a);
@@ -76,6 +77,7 @@ class a1time
 	int ymdg(int *y, int *m, int *d, int *g) const;
 	int a1time::ymdg(int *y, int *m, int *d, int *h, int *M, int *s, int *g) const;
 	ASN1_TIME *get() const;
+	ASN1_TIME *get_utc() const;
 	a1time &now(int delta = 0);
 	unsigned char *i2d(unsigned char *p);
 	unsigned char *d2i(unsigned char *p, int size);
diff --git a/lib/pki_x509.cpp b/lib/pki_x509.cpp
index e2db1ee8..bef438e6 100644
--- a/lib/pki_x509.cpp
+++ b/lib/pki_x509.cpp
@@ -154,7 +154,9 @@ void pki_x509::setNotBefore(const a1time &a1)
 	if (X509_get_notBefore(cert) != NULL ) {
 		ASN1_TIME_free(X509_get_notBefore(cert));
 	}
-	X509_get_notBefore(cert) = a1.get();
+	X509_get_notBefore(cert) = a1.get_utc();
+	if (X509_get_notBefore(cert) == NULL)
+		X509_get_notBefore(cert) = a1.get();
 	openssl_error();
 }
 
@@ -163,7 +165,9 @@ void pki_x509::setNotAfter(const a1time &a1)
 	if (X509_get_notAfter(cert) != NULL ) {
 		ASN1_TIME_free(X509_get_notAfter(cert));
 	}
-	X509_get_notAfter(cert) = a1.get();
+	X509_get_notAfter(cert) = a1.get_utc();
+	if (X509_get_notAfter(cert) == NULL)
+		X509_get_notAfter(cert) = a1.get();
 	openssl_error();
 }