change time_t to ASN_1 type to vaildate cert chain.

Change-Id: I104ff9a3354133b1b4a7aab02de1088a8d4d21bb
Signed-off-by: jc815.lee <jc815.lee@samsung.com>

diff --git a/vcore/src/vcore/Certificate.cpp b/vcore/src/vcore/Certificate.cpp
index 45c751d..8270946 100644 (file)
--- a/vcore/src/vcore/Certificate.cpp
+++ b/vcore/src/vcore/Certificate.cpp
@@ -367,6 +367,27 @@ time_t Certificate::getNotBefore() const
     return output;
 }
 
+ASN1_TIME* Certificate::getNotAfterTime() const
+{
+       ASN1_TIME *timeafter = X509_get_notAfter(m_x509);
+       if (!timeafter) {
+               LogError("Reading Not After error.");
+               ThrowMsg(Exception::OpensslInternalError, "Reading Not After error.");
+       }
+
+       return timeafter;
+}
+
+ASN1_TIME* Certificate::getNotBeforeTime() const
+{
+       ASN1_TIME *timebefore = X509_get_notBefore(m_x509);
+       if (!timebefore) {
+               LogError("Reading Not Before error.");
+               ThrowMsg(Exception::OpensslInternalError, "Reading Not Before error.");
+       }
+       return timebefore;
+}
+
 bool Certificate::isRootCert()
 {
     // based on that root certificate has the same subject as issuer name

diff --git a/vcore/src/vcore/Certificate.h b/vcore/src/vcore/Certificate.h
index 5e94d7c..d084dda 100644 (file)
--- a/vcore/src/vcore/Certificate.h
+++ b/vcore/src/vcore/Certificate.h
@@ -36,6 +36,8 @@
 #include <dpl/optional_typedefs.h>
 #include <dpl/string.h>
 
+#include <openssl/x509.h>
+
 #include <cert-service.h>
 
 extern "C" {
@@ -130,6 +132,10 @@ class Certificate : public DPL::EnableSharedFromThis<Certificate>
 
     time_t getNotBefore() const;
 
+    ASN1_TIME* getNotAfterTime() const;
+
+    ASN1_TIME* getNotBeforeTime() const;
+
     /**
      * @brief This is convenient function.
      *

diff --git a/vcore/src/vcore/SignatureValidator.cpp b/vcore/src/vcore/SignatureValidator.cpp
old mode 100755 (executable)
new mode 100644 (file)
index dafd53e..fabd0ff
--- a/vcore/src/vcore/SignatureValidator.cpp
+++ b/vcore/src/vcore/SignatureValidator.cpp
@@ -262,26 +262,40 @@ SignatureValidator::Result ImplTizenSignatureValidator::check(
       }
      }
 
-    // We add only Root CA certificate because WAC ensure that the rest
-    // of certificates are present in signature files ;-)
     XmlSec::XmlSecContext context;
     context.signatureFile = data.getSignatureFileName();
     context.certificatePtr = root;
 
-    // Now we should have full certificate chain.
-    // If the end certificate is not ROOT CA we should disregard signature
-    // but still signature must be valid... Aaaaaa it's so stupid...
     if (!(root->isSignedBy(root))) {
         LogWarning("Root CA certificate not found. Chain is incomplete.");
     //  context.allowBrokenChain = true;
     }
 
+    time_t nowTime = time(NULL);
+
+    ASN1_TIME* notAfterTime = data.getEndEntityCertificatePtr()->getNotAfterTime();
+    ASN1_TIME* notBeforeTime = data.getEndEntityCertificatePtr()->getNotBeforeTime();
+
+       if (data.isAuthorSignature())
+       {
+               if (X509_cmp_time(notBeforeTime, &nowTime) > 0)
+               {
+                       LogDebug("notBeforeTime is greater then current time");
+                       return SignatureValidator::SIGNATURE_INVALID;
+               }
+
+               if (X509_cmp_time(notAfterTime, &nowTime) < 0)
+               {
+                       LogDebug("notAfterTime is less then current time");
+                       return SignatureValidator::SIGNATURE_INVALID;
+               }
+       }
     // WAC 2.0 SP-2066 The wrt must not block widget installation
     // due to expiration of the author certificate.
+#if 0
     time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
     time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
 
-    time_t nowTime = time(NULL);
     struct tm *t;
 
     if (data.isAuthorSignature())
@@ -317,7 +331,7 @@ SignatureValidator::Result ImplTizenSignatureValidator::check(
           LogDebug("Modified current notBefore day : " << t->tm_mday);
       }
     }
-
+#endif
     // WAC 2.0 SP-2066 The wrt must not block widget installation
     //context.allowBrokenChain = true;
 
@@ -491,10 +505,34 @@ SignatureValidator::Result ImplTizenSignatureValidator::checkList(SignatureData
 
     // WAC 2.0 SP-2066 The wrt must not block widget installation
     // due to expiration of the author certificate.
+    time_t nowTime = time(NULL);
+
+#define CHECK_TIME
+#ifdef CHECK_TIME
+
+    ASN1_TIME* notAfterTime = data.getEndEntityCertificatePtr()->getNotAfterTime();
+    ASN1_TIME* notBeforeTime = data.getEndEntityCertificatePtr()->getNotBeforeTime();
+
+       if (data.isAuthorSignature())
+       {
+               if (X509_cmp_time(notBeforeTime, &nowTime) > 0)
+               {
+                       LogDebug("notBeforeTime is greater then current time");
+                       return SignatureValidator::SIGNATURE_INVALID;
+               }
+
+               if (X509_cmp_time(notAfterTime, &nowTime) < 0)
+               {
+                       LogDebug("notAfterTime is less then current time");
+                       return SignatureValidator::SIGNATURE_INVALID;
+               }
+       }
+#endif
+
+#if 0
     time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
     time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
 
-    time_t nowTime = time(NULL);
     struct tm *t;
 
     if (data.isAuthorSignature())
@@ -530,7 +568,7 @@ SignatureValidator::Result ImplTizenSignatureValidator::checkList(SignatureData
           LogDebug("Modified current notBefore day : " << t->tm_mday);
       }
     }
-
+#endif
     // WAC 2.0 SP-2066 The wrt must not block widget installation
     //context.allowBrokenChain = true;
 
@@ -740,12 +778,35 @@ SignatureValidator::Result ImplWacSignatureValidator::check(
 //        context.allowBrokenChain = true;
     }
 
+    time_t nowTime = time(NULL);
     // WAC 2.0 SP-2066 The wrt must not block widget installation
     // due to expiration of the author certificate.
+#define CHECK_TIME
+#ifdef CHECK_TIME
+
+    ASN1_TIME* notAfterTime = data.getEndEntityCertificatePtr()->getNotAfterTime();
+    ASN1_TIME* notBeforeTime = data.getEndEntityCertificatePtr()->getNotBeforeTime();
+
+       if (data.isAuthorSignature())
+       {
+               if (X509_cmp_time(notBeforeTime, &nowTime) > 0)
+               {
+                       LogDebug("notBeforeTime is greater then current time");
+                       return SignatureValidator::SIGNATURE_INVALID;
+               }
+
+               if (X509_cmp_time(notAfterTime, &nowTime) < 0)
+               {
+                       LogDebug("notAfterTime is less then current time");
+                       return SignatureValidator::SIGNATURE_INVALID;
+               }
+       }
+#endif
+
+#if 0
     time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
     time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
 
-    time_t nowTime = time(NULL);
     struct tm *t;
 
     if (data.isAuthorSignature())
@@ -781,7 +842,7 @@ SignatureValidator::Result ImplWacSignatureValidator::check(
        LogDebug("Modified current notBefore day : " << t->tm_mday);
     }
    }
-
+#endif
     if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validate(&context)) {
         LogWarning("Installation break - invalid package!");
         return SignatureValidator::SIGNATURE_INVALID;

diff --git a/vcore/src/vcore/SignatureValidator.h b/vcore/src/vcore/SignatureValidator.h
old mode 100755 (executable)
new mode 100644 (file)

diff --git a/vcore/src/vcore/WrtSignatureValidator.cpp b/vcore/src/vcore/WrtSignatureValidator.cpp
index 9de5f5c..57a3618 100644 (file)
--- a/vcore/src/vcore/WrtSignatureValidator.cpp
+++ b/vcore/src/vcore/WrtSignatureValidator.cpp
@@ -232,10 +232,33 @@ WrtSignatureValidator::Result ImplTizen::check(
 
     // WAC 2.0 SP-2066 The wrt must not block widget installation
     // due to expiration of the author certificate.
+    time_t nowTime = time(NULL);
+#define CHECK_TIME
+#ifdef CHECK_TIME
+
+    ASN1_TIME* notAfterTime = data.getEndEntityCertificatePtr()->getNotAfterTime();
+    ASN1_TIME* notBeforeTime = data.getEndEntityCertificatePtr()->getNotBeforeTime();
+
+       if (data.isAuthorSignature())
+       {
+               if (X509_cmp_time(notBeforeTime, &nowTime) > 0)
+               {
+                       LogDebug("notBeforeTime is greater then current time");
+                       return WrtSignatureValidator::SIGNATURE_INVALID;
+               }
+
+               if (X509_cmp_time(notAfterTime, &nowTime) < 0)
+               {
+                       LogDebug("notAfterTime is less then current time");
+                       return WrtSignatureValidator::SIGNATURE_INVALID;
+               }
+       }
+#endif
+
+#if 0
     time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
     time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
 
-       time_t nowTime = time(NULL);
        struct tm *t;
 
        if (data.isAuthorSignature())
@@ -271,7 +294,7 @@ WrtSignatureValidator::Result ImplTizen::check(
                        LogDebug("Modified current notBefore day : " << t->tm_mday);
                }
        }
-       
+#endif
     // WAC 2.0 SP-2066 The wrt must not block widget installation
        //context.allowBrokenChain = true;
 
@@ -448,12 +471,35 @@ WrtSignatureValidator::Result ImplWac::check(
         context.allowBrokenChain = true;
     }
 
+    time_t nowTime = time(NULL);
     // WAC 2.0 SP-2066 The wrt must not block widget installation
        // due to expiration of the author certificate.
+#define CHECK_TIME
+#ifdef CHECK_TIME
+
+    ASN1_TIME* notAfterTime = data.getEndEntityCertificatePtr()->getNotAfterTime();
+    ASN1_TIME* notBeforeTime = data.getEndEntityCertificatePtr()->getNotBeforeTime();
+
+       if (data.isAuthorSignature())
+       {
+               if (X509_cmp_time(notBeforeTime, &nowTime) > 0)
+               {
+                       LogDebug("notBeforeTime is greater then current time");
+                       return WrtSignatureValidator::SIGNATURE_INVALID;
+               }
+
+               if (X509_cmp_time(notAfterTime, &nowTime) < 0)
+               {
+                       LogDebug("notAfterTime is less then current time");
+                       return WrtSignatureValidator::SIGNATURE_INVALID;
+               }
+       }
+#endif
+
+#if 0
        time_t notAfter = data.getEndEntityCertificatePtr()->getNotAfter();
        time_t notBefore = data.getEndEntityCertificatePtr()->getNotBefore();
 
-       time_t nowTime = time(NULL);
        struct tm *t;
 
        if (data.isAuthorSignature())
@@ -489,7 +535,7 @@ WrtSignatureValidator::Result ImplWac::check(
                        LogDebug("Modified current notBefore day : " << t->tm_mday);
                }
        }
-
+#endif
     if (XmlSec::NO_ERROR != XmlSecSingleton::Instance().validate(&context)) {
         LogWarning("Installation break - invalid package!");
         return WrtSignatureValidator::SIGNATURE_INVALID;