Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix validity times on certificates issued by the Darwin framework. #20637

Merged
merged 1 commit into from
Jul 13, 2022
Merged

Fix validity times on certificates issued by the Darwin framework. #20637

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/credentials/CHIPCert.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,11 +384,15 @@ CHIP_ERROR ChipCertificateSet::ValidateCert(const ChipCertificateData * cert, Va
{
if (context.mEffectiveTime.Get<CurrentChipEpochTime>().count() < cert->mNotBeforeTime)
{
ChipLogDetail(SecureChannel, "Certificate's mNotBeforeTime (%" PRIu32 ") is after current time (%" PRIu32 ")",
cert->mNotBeforeTime, context.mEffectiveTime.Get<CurrentChipEpochTime>().count());
validityResult = CertificateValidityResult::kNotYetValid;
}
else if (cert->mNotAfterTime != kNullCertTime &&
context.mEffectiveTime.Get<CurrentChipEpochTime>().count() > cert->mNotAfterTime)
{
ChipLogDetail(SecureChannel, "Certificate's mNotAfterTime (%" PRIu32 ") is before current time (%" PRIu32 ")",
cert->mNotAfterTime, context.mEffectiveTime.Get<CurrentChipEpochTime>().count());
validityResult = CertificateValidityResult::kExpired;
}
else
Expand All @@ -407,6 +411,8 @@ CHIP_ERROR ChipCertificateSet::ValidateCert(const ChipCertificateData * cert, Va
// certificate in question is expired. Check for this.
if (cert->mNotAfterTime != 0 && context.mEffectiveTime.Get<LastKnownGoodChipEpochTime>().count() > cert->mNotAfterTime)
{
ChipLogDetail(SecureChannel, "Certificate's mNotAfterTime (%" PRIu32 ") is before last known good time (%" PRIu32 ")",
cert->mNotAfterTime, context.mEffectiveTime.Get<LastKnownGoodChipEpochTime>().count());
validityResult = CertificateValidityResult::kExpiredAtLastKnownGoodTime;
}
else
Expand Down
4 changes: 1 addition & 3 deletions src/darwin/Framework/CHIP/MTROperationalCredentialsDelegate.mm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,10 +172,8 @@
bool MTROperationalCredentialsDelegate::ToChipEpochTime(uint32_t offset, uint32_t & epoch)
{
NSDate * date = [NSDate dateWithTimeIntervalSinceNow:offset];
unsigned units = NSCalendarUnitYear | NSCalendarUnitMonth | NSCalendarUnitDay | NSCalendarUnitHour | NSCalendarUnitMinute
| NSCalendarUnitSecond;
NSCalendar * calendar = [[NSCalendar alloc] initWithCalendarIdentifier:NSCalendarIdentifierGregorian];
NSDateComponents * components = [calendar components:units fromDate:date];
NSDateComponents * components = [calendar componentsInTimeZone:[NSTimeZone timeZoneForSecondsFromGMT:0] fromDate:date];

uint16_t year = static_cast<uint16_t>([components year]);
uint8_t month = static_cast<uint8_t>([components month]);
Expand Down