Skip to content

Commit aa0a441

Browse files
aamcommit-bot@chromium.org
aam
authored and
[email protected]
committed
[vm/certs/win] When adding root certificates consider not_before and not_after properties, only add valid ones.
boringssl seems to be confused when expired certificates are present in trusted root, only picks up the first matching one which could be expired and ignores still-valid-ones. TEST=secure_socket_utils_test Fixes #46370 Change-Id: I5bbc0a1a3331ce4dcda46eee41b02b5b6e835b2a Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/211160 Reviewed-by: Siva Annamalai <[email protected]> Commit-Queue: Alexander Aprelev <[email protected]>
1 parent 574061d commit aa0a441

7 files changed

+185
-3
lines changed

‎runtime/bin/BUILD.gn

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,7 @@ executable("run_vm_tests") {
909909
":dart_snapshot_cc",
910910
":standalone_dart_io",
911911
"..:libdart_precompiler",
912+
"//third_party/boringssl", # for secure_socket_utils_test
912913
"//third_party/zlib",
913914
]
914915
include_dirs = [

‎runtime/bin/builtin_impl_sources.gni

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
# This file contains all C++ sources for the dart:_builtin library and
66
# some of the C++ sources for the dart:io library. The rest are in
7-
# io_impl_sources.gypi.
7+
# io_impl_sources.gni.
88

99
builtin_impl_sources = [
1010
"crypto.cc",

‎runtime/bin/io_impl_sources.gni

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# BSD-style license that can be found in the LICENSE file.
44

55
# This file contains some C++ sources for the dart:io library. The other
6-
# implementation files are in builtin_impl_sources.gypi.
6+
# implementation files are in builtin_impl_sources.gni.
77
io_impl_sources = [
88
"console.h",
99
"console_posix.cc",
@@ -109,4 +109,7 @@ io_impl_sources = [
109109
"typed_data_utils.h",
110110
]
111111

112-
io_impl_tests = [ "platform_macos_test.cc" ]
112+
io_impl_tests = [
113+
"platform_macos_test.cc",
114+
"secure_socket_utils_test.cc",
115+
]

‎runtime/bin/secure_socket_utils.cc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,22 @@ void SecureSocketUtils::CheckStatus(int status,
8989
SecureSocketUtils::CheckStatusSSL(status, type, message, NULL);
9090
}
9191

92+
bool SecureSocketUtils::IsCurrentTimeInsideCertValidDateRange(X509* root_cert) {
93+
ASN1_TIME* not_before = X509_get_notBefore(root_cert);
94+
ASN1_TIME* not_after = X509_get_notAfter(root_cert);
95+
int days_since_valid = 0;
96+
int secs_since_valid = 0;
97+
int days_before_invalid = 0;
98+
int secs_before_invalid = 0;
99+
// nullptr indicates current date/time
100+
ASN1_TIME_diff(&days_since_valid, &secs_since_valid, not_before,
101+
/*to=*/nullptr);
102+
ASN1_TIME_diff(&days_before_invalid, &secs_before_invalid,
103+
/*from=*/nullptr, not_after);
104+
return days_since_valid >= 0 && secs_since_valid >= 0 &&
105+
days_before_invalid >= 0 && secs_before_invalid >= 0;
106+
}
107+
92108
} // namespace bin
93109
} // namespace dart
94110

‎runtime/bin/secure_socket_utils.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ class SecureSocketUtils : public AllStatic {
3939

4040
static void CheckStatus(int status, const char* type, const char* message);
4141

42+
static bool IsCurrentTimeInsideCertValidDateRange(X509* root_cert);
43+
4244
static bool NoPEMStartLine() {
4345
uint32_t last_error = ERR_peek_last_error();
4446
return (ERR_GET_LIB(last_error) == ERR_LIB_PEM) &&

‎runtime/bin/secure_socket_utils_test.cc

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
// Copyright (c) 2021, the Dart project authors. Please see the AUTHORS file
2+
// for details. All rights reserved. Use of this source code is governed by a
3+
// BSD-style license that can be found in the LICENSE file.
4+
5+
#if !defined(DART_IO_SECURE_SOCKET_DISABLED)
6+
7+
#include <openssl/bio.h>
8+
#include <openssl/ssl.h>
9+
#include <openssl/x509.h>
10+
11+
#include "bin/secure_socket_utils.h"
12+
#include "platform/globals.h"
13+
#include "vm/unit_test.h"
14+
15+
namespace dart {
16+
namespace bin {
17+
18+
TEST_CASE(SecureSocketUtils_CertNotYetValid) {
19+
const char* valid_after_2121 =
20+
"-----BEGIN CERTIFICATE-----\n"
21+
"MIIFbzCCA1egAwIBAgIUO6PLWc8zatZF5Cc07uYdjDy4UGowDQYJKoZIhvcNAQEL\n"
22+
"BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\n"
23+
"GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAiGA8yMTIxMDgwMTE3MDUwNFoYDzIx\n"
24+
"MzEwNzMwMTcwNTA0WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0\n"
25+
"ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIICIjANBgkqhkiG\n"
26+
"9w0BAQEFAAOCAg8AMIICCgKCAgEAvgmd8v2K4ngOI/dOa/sn63uetG9sUhzTdViO\n"
27+
"87q7s4XeFmziS3BMQyMqTmrIHJAKuZp66ZH6ZOno54UX2KedI4hf0He3NbAitGgI\n"
28+
"o6z/WBglH+ByORUEU1Yzh03akja5C8Hp9IUpC6PGJEolPsZeoBMZs1bCxwD9miHy\n"
29+
"bs/NYsUGsDJwUZFEW2UTjYuyeTPSdkIgoZIPCp8tp9E6jy7fb2H2XE0Z+rJ4rU/e\n"
30+
"0aQ1Q7gNBnBWrJAGgYfQj9XbFx6nNEW6XUBqIV/uUmz9y64pMQ21I9e64Qn5KHDo\n"
31+
"08CzQ651dGY1GJkziUuQITkPN4EqS6D5R74ruTJW0lp/cg7RNPoTAXBXI+Nqz7WE\n"
32+
"bscerDKFGgaAZ8WXqvwpHqwGeiilZT/OwSwjrN8zaW6eLljAStGhLgn6j/Te8rfW\n"
33+
"9+AGSjesJ8dJ+dppFG8A+1Auvtii12Jk8hj/IM/udt5ZLs6meSOYPeNF3UqHrA7s\n"
34+
"O39KsMy7ppFQPwBBXgKZMXQlt6uMmi/2s/OHXZRpf7c09n6+3NKYutMsYHO6SrlD\n"
35+
"hYcWdpjlv632O5WAdjehohDLfYLugsPPt/hJC3UAA8QfNrEXVHx3D2qgowLB9Brx\n"
36+
"zC7aT/0rmVQu2wXvekc8tIRUnDgr8tLjSuEyj9nBb7cWUOWi/1YiEb5T1x7/zyhP\n"
37+
"5p8g8l8CAwEAAaNTMFEwHQYDVR0OBBYEFN1Mf9EDYiYYds9IB9qvOYEmDhs5MB8G\n"
38+
"A1UdIwQYMBaAFN1Mf9EDYiYYds9IB9qvOYEmDhs5MA8GA1UdEwEB/wQFMAMBAf8w\n"
39+
"DQYJKoZIhvcNAQELBQADggIBAA8DjwXFECGFKPNc//kTSUUcMxRLORBH/oSe2hml\n"
40+
"dNRtjkVHWcPDsn5Md0cM6e0kOXw2AEqRK9keYN/27JGHBvzu1MbzSHd1czeGx46d\n"
41+
"5QI5MyI0U8iiYoW8IJURrnAuD+9yS6O4b7c9qnTwwdsAy98gzfWZbrb++mgoWDrt\n"
42+
"Ma4V1zKMUZYezV95zlBmB9sKxbJlLP6pMGPENsbNuqB1KK8uAYnd4YYdEx97lt7o\n"
43+
"SeUySohZQasheI73jJuYdDwqDcGCtRvwaOyDuOsDZVNqjNiqiI3aaGVII2lNbjOO\n"
44+
"g85pN4pWB+1b3wdEt+c5VETYX3SiJNOyhy3rp68liegeeNVTgNdp5vSxmogWxtCN\n"
45+
"uv6uim0Lw//Ezz6acc15CLdaS1msS2V/5Ogk7/cYEajtWp8l7/dy9Gf8ekzRBaET\n"
46+
"3vw7sla+YhsUI+NZQG79gfkDfYmRMpW6djaWgY9c5l/NJ8ev1ZQWj1i5t4w7lW5h\n"
47+
"3wB8qVV7BQ3zY36iEes4hvmXmykCOgQ2yXTOVZVhKYAxoaRMgkJSWL9rsPvmHEM8\n"
48+
"b3gjUC/5nwTzLZAw0iYLtPpSnFwhprZPPWF+k5FQAx/UQ+0qjqY8EbfWLzexm+7P\n"
49+
"Sm35NlpFHH6vyyj48RVYQcw8KvDvbuUwjiauydhYCCLoQVdywec8d3fUu6NdBusm\n"
50+
"q8uu\n"
51+
"-----END CERTIFICATE-----\n";
52+
size_t len = strlen(valid_after_2121);
53+
BIO* cert_bio = BIO_new(BIO_s_mem());
54+
BIO_write(cert_bio, valid_after_2121, len);
55+
X509* cert_X509 = PEM_read_bio_X509(cert_bio, NULL, NULL, NULL);
56+
EXPECT(cert_X509 != nullptr);
57+
EXPECT(!SecureSocketUtils::IsCurrentTimeInsideCertValidDateRange(cert_X509));
58+
BIO_free(cert_bio);
59+
X509_free(cert_X509);
60+
}
61+
62+
TEST_CASE(SecureSocketUtils_CertValid) {
63+
const char* valid_in_2021 =
64+
"-----BEGIN CERTIFICATE-----\n"
65+
"MIIFbTCCA1WgAwIBAgIUFmzKjF/PfpFX+5+pF1LXzbFzL/4wDQYJKoZIhvcNAQEL\n"
66+
"BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\n"
67+
"GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yMTA4MjUxNzA1NTNaGA8yMTIx\n"
68+
"MDgwMTE3MDU1M1owRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx\n"
69+
"ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCAiIwDQYJKoZIhvcN\n"
70+
"AQEBBQADggIPADCCAgoCggIBAMdupz2RQB1fHii6EACZq8MPbDk+xoxHb111Z85C\n"
71+
"VK47tC+Sn16DmWKwmcMp7mbPIO8jUSJOk8FrZWsSFZ9xBzXb/H2W6kFNb8XqKyhH\n"
72+
"vweeTekPuONrpJIqBJiIEXqyMoxiqwbtl38ZVo5DwFvc8mriFVYapMLb3DKQxOMR\n"
73+
"uM32R40VVf1S/LcYab/UTdxdtoI6MINv5SFsmp7Cd+8nUMXdetCTdlu5aoHSTUE0\n"
74+
"EzsYG4WTQqi3WpvnTuFlFq4LLd7NYmWUoiUJiB5u7vSEZM91u/eGtOm9Y7OzwJUp\n"
75+
"Obv3hEIrNS0c/qXuG89+7vlcW5AqJkyWhNgoMRXFXYlqPFKWwYOU0t/vjSlFlB3u\n"
76+
"8a0zNur6d95IC/9XSGFgW3FYnEzTPiorR8y/dbw8P5ioP2yMrm1b6v+TlyOyQ3Hu\n"
77+
"gCKJy7Ah1IpUG7wefZIpTN8CaumusUwJdCcGBPfwyOD1yvF8UyETJ5ZB7JC7jXgj\n"
78+
"KUpytSeN79m15s+ksn6tS9uLqTHr3Yr7J7ha3m2UO4gl2QOa20/fdmenVqEsq+Z7\n"
79+
"1PuDaitEVaCQE3/286rwNQPgoDgDbIckZOzOzYq0b3lZZBlSZRpcsrBEf3KJIz9Y\n"
80+
"X5R5bLvw/qtCVjHDankA2EqMYKf9LBCLkQ0GUMpu3aS7xZhn4A6tIcqtRpe1+ruZ\n"
81+
"k5GdAgMBAAGjUzBRMB0GA1UdDgQWBBRzt8cxhCiZoLnnKWgLDt5nPctfYTAfBgNV\n"
82+
"HSMEGDAWgBRzt8cxhCiZoLnnKWgLDt5nPctfYTAPBgNVHRMBAf8EBTADAQH/MA0G\n"
83+
"CSqGSIb3DQEBCwUAA4ICAQCUzlwgMiwnNo4VM2FCroJpGP/8gEsMcUUpfeQnKALm\n"
84+
"MudiNPWVQk7uHeAKXvzoSlq/7/ZYKqlXxqiNXhkawnBl0lyR4Bnj8GbQMkujZzUS\n"
85+
"EUI5UlPqlvy4WJw9ybgPPyl5D/0D7dkK0xAVxMktjaCGKtPQ/UCY2APxyoISmhSl\n"
86+
"0+ql1YpHM1XIty/mzlTAIZ7bnbKDPA3J3OjaCP0Skhf2g4Wkch3+6Wx5xfYnyRv1\n"
87+
"UbihStrvN1dH9d+D642C45qpRa2l3GJvDxdyr6xSa3l9IajUYbpMFe0yymuxqWhX\n"
88+
"bDLi0ouKmowKNiiqUmUEJhJBbt/XdTIeeyTcaz2ZHVmMU9E72OhsjzxAvajoDBv9\n"
89+
"FJ3THlLlh7iHBv24Hghx5V6FCliO6uLUdLB1d8WNUtEWdzf17ZlPqRIkjSY+6kSJ\n"
90+
"dNwQhl5kYL0caOKWvEEP9f2HondKxtVpYGHgtKvcvCj/hz8UCk9R3odcwweq48RK\n"
91+
"fKNRHy3nQfWttSSbBH8SwSmtX2VesMu6jMcqwU/8YSrWTJa/5UexlNR9qRrDnhya\n"
92+
"kqZCaETfx15LUkPPuyn+z76z2+hNW0VDpnUVRystHHkDz+q2cbH/bsfY47Et0Bsb\n"
93+
"TozWCPRzEkmzTTaAZLtqXa5MzWsZweBzK5owXlOPTD2eo1UphgtOqsKPE/RB/Qgq\n"
94+
"dw==\n"
95+
"-----END CERTIFICATE-----\n";
96+
size_t len = strlen(valid_in_2021);
97+
BIO* cert_bio = BIO_new(BIO_s_mem());
98+
BIO_write(cert_bio, valid_in_2021, len);
99+
X509* cert_X509 = PEM_read_bio_X509(cert_bio, NULL, NULL, NULL);
100+
EXPECT(cert_X509 != nullptr);
101+
EXPECT(SecureSocketUtils::IsCurrentTimeInsideCertValidDateRange(cert_X509));
102+
BIO_free(cert_bio);
103+
X509_free(cert_X509);
104+
}
105+
106+
TEST_CASE(SecureSocketUtils_CertAlreadyExpired) {
107+
const char* valid_before_2021 =
108+
"-----BEGIN CERTIFICATE-----\n"
109+
"MIIFazCCA1OgAwIBAgIUY+S+GbniK1WC9821VgAJusuF33UwDQYJKoZIhvcNAQEL\n"
110+
"BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\n"
111+
"GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDA4MjUxNzAyNDFaFw0yMDA5\n"
112+
"MjQxNzAyNDFaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\n"
113+
"HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggIiMA0GCSqGSIb3DQEB\n"
114+
"AQUAA4ICDwAwggIKAoICAQDNfCrlXNeGKpF0PHzjkG5UfsSYvwfNUTqnzC3AkTMY\n"
115+
"AZyyqDCA780TPZH48aZ/QFegFdIBUkEijFLuRKUqAv5jHxaVhMQcr5ujdCAJWT+e\n"
116+
"5jc0cvukdWnFFqZwJWur4/3RsUnaWXY+oDk0pGuZD7VeNm9PTi1pQogwAivhSynM\n"
117+
"YxCq0cO0JPM0Dr7ks99V1gDWrEOqjJGeEzvRlwdx+GPkvMvmrSHxWOphN/ji2MRx\n"
118+
"tZ0T5FrrrGEtfp8gtTe5q5V+di1GvbuE6Y+MVYGIJeu3yqHkoh/TTS9Ex+QRm9nh\n"
119+
"QM1Pm4hi2PofSSEdj15cUw6vfPJWewZiytcVJFTt2in1YuYufZMwPLP/ylnAQLkM\n"
120+
"dq3TIF1g4ym9xLgQ/ZgnMX6g6ReOqG/1Au5InPUXMo3n56N959gQD1K8J2C4xtQP\n"
121+
"MxrDAbGuYOmCterPAmW4aIVgbxIXwEK7lzTZyHUOvwjNaEfu0fuVOd9NC2B+g8So\n"
122+
"I188ty96/BVwQO5bAzGekJn9xHVcTUU067b5zNfCpo4XGKaKVNGGR+AXhtjRXbrX\n"
123+
"N9/BOHdABlV5W32HkhT4fr/BSSp/UyCnBZRPvLcI3Nvraok8snn/eGt6IW3y171O\n"
124+
"3tYx4Gz7+M2K/T1rMuujVXOx6srtZ8oQIqFgZTR0sKKsim1umHAmoTJrG3wEOlUs\n"
125+
"awIDAQABo1MwUTAdBgNVHQ4EFgQUzTOEhm+P6rWyBkKAkctA9FvheC8wHwYDVR0j\n"
126+
"BBgwFoAUzTOEhm+P6rWyBkKAkctA9FvheC8wDwYDVR0TAQH/BAUwAwEB/zANBgkq\n"
127+
"hkiG9w0BAQsFAAOCAgEABYYIBheuGRbmRhsS39zy0jDhqmDbsyIFd3/NoMZ+WvW4\n"
128+
"NFcVRATalIX6ScXl7RGs1p855OiqOHij1tCzBClZXZ1zWD2v0KfWMFjR/S79HJOI\n"
129+
"w3RGaMvALUJtOCz5in5Odryuo3GBkxKNonS+HAjnrWosqBCorerjn/TdIscTbA6h\n"
130+
"7Iwy5umyyY63E69ehD7aANc/mxk++BWdAs3kPSXMI7PDpWUW5WV0hPUpe3sf0eY8\n"
131+
"skfXa+UJ2qDmVkMmHUIOhi92zTRv6ROQXGY52JhHZOFSFxvqjWkk1M8q6Vm2ln2s\n"
132+
"2GUa2j4emp+zti2JuFAwDgEK8wyqlq14hA8hTHL27mxpht990QGAU+qmcfhUf/qd\n"
133+
"cIPkbz53Dpezzd96SuHQyjALaTbEw2vis9WpsejOKiaAp8264t0DgtLUndj4wVfC\n"
134+
"3xti1jubmouUEdbNh7bnDfXxdxuAECFzhEG9mrosnTemuUVQSXIyrNfHRKDEaGv1\n"
135+
"zh2Jij4HI+OKnJuao/9vsbNPib7k8tR0JKbXZD3HvOfQi5wMtlCUedu9eZ3Cq9Mu\n"
136+
"1NwIwFoSU5pwO4PopiYL2hAEJXd0SN6TnWZThU28qTulrCb8enNU6BfkokTlkmYs\n"
137+
"HUzvFarVyhKbQkyD/P3ckC/p2mg9aE7iLO5wTY1gegcSDF4R4479t/aDWMmevis=\n"
138+
"-----END CERTIFICATE-----\n";
139+
size_t len = strlen(valid_before_2021);
140+
BIO* cert_bio = BIO_new(BIO_s_mem());
141+
BIO_write(cert_bio, valid_before_2021, len);
142+
X509* cert_X509 = PEM_read_bio_X509(cert_bio, NULL, NULL, NULL);
143+
EXPECT(cert_X509 != nullptr);
144+
EXPECT(!SecureSocketUtils::IsCurrentTimeInsideCertValidDateRange(cert_X509));
145+
BIO_free(cert_bio);
146+
X509_free(cert_X509);
147+
}
148+
149+
} // namespace bin
150+
} // namespace dart
151+
152+
#endif // !defined(DART_IO_SECURE_SOCKET_DISABLED)

‎runtime/bin/security_context_win.cc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,14 @@ static bool AddCertificatesFromNamedSystemStore(const wchar_t* name,
111111
Syslog::Print("\n");
112112
}
113113

114+
if (!SecureSocketUtils::IsCurrentTimeInsideCertValidDateRange(root_cert)) {
115+
if (SSL_LOG_STATUS) {
116+
Syslog::Print("...certificate is outside of its valid date range\n");
117+
}
118+
X509_free(root_cert);
119+
continue;
120+
}
121+
114122
int status = X509_STORE_add_cert(store, root_cert);
115123
if (status == 0) {
116124
int error = ERR_get_error();

0 commit comments

Comments
 (0)