Add client cert activation/expiration times to the ssl_cert class.

3 files changed, 72 insertions, 10 deletions

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index 2c469c4b8..da2ef1400 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -878,11 +878,26 @@ class GnuTLSIOHook : public SSLIOHook
 			certinfo->fingerprint = BinToHex(buffer, buffer_size);
 		}
 
-		/* Beware here we do not check for errors.
-		 */
-		if ((gnutls_x509_crt_get_expiration_time(cert) < ServerInstance->Time()) || (gnutls_x509_crt_get_activation_time(cert) > ServerInstance->Time()))
+		certinfo->activation = gnutls_x509_crt_get_activation_time(cert);
+		if (certinfo->activation == -1)
+		{
+			certinfo->activation = 0;
+			certinfo->error = "Unable to check certificate activation time";
+		}
+		else if (certinfo->activation >= ServerInstance->Time())
+		{
+			certinfo->error = "Certificate not activated";
+		}
+
+		certinfo->expiration = gnutls_x509_crt_get_expiration_time(cert);
+		if (certinfo->expiration == -1)
+		{
+			certinfo->expiration = 0;
+			certinfo->error = "Unable to check certificate expiration time";
+		}
+		else if (certinfo->expiration <= ServerInstance->Time())
 		{
-			certinfo->error = "Not activated, or expired certificate";
+			certinfo->error = "Certificate has expired";
 		}
 
 info_done_dealloc:
diff --git a/src/modules/extra/m_ssl_mbedtls.cpp b/src/modules/extra/m_ssl_mbedtls.cpp
index a2529dcb3..35fd8926f 100644
--- a/src/modules/extra/m_ssl_mbedtls.cpp
+++ b/src/modules/extra/m_ssl_mbedtls.cpp
@@ -29,6 +29,10 @@
 #include "inspircd.h"
 #include "modules/ssl.h"
 
+#ifdef _WIN32
+# define timegm _mkgmtime
+#endif
+
 // Fix warnings about the use of commas at end of enumerator lists on C++03.
 #if defined __clang__
 # pragma clang diagnostic ignored "-Wc++11-extensions"
@@ -631,6 +635,8 @@ class mbedTLSIOHook : public SSLIOHook
 			return;
 		}
 
+		certificate->activation = GetTime(&cert->valid_from);
+		certificate->expiration = GetTime(&cert->valid_to);
 		if (flags == 0)
 		{
 			// Verification succeeded
@@ -640,8 +646,10 @@ class mbedTLSIOHook : public SSLIOHook
 		{
 			// Verification failed
 			certificate->trusted = false;
-			if ((flags & MBEDTLS_X509_BADCERT_EXPIRED) || (flags & MBEDTLS_X509_BADCERT_FUTURE))
-				certificate->error = "Not activated, or expired certificate";
+			if (flags & MBEDTLS_X509_BADCERT_FUTURE)
+				certificate->error = "Certificate not activated";
+			else if (flags & MBEDTLS_X509_BADCERT_EXPIRED)
+				certificate->error = "Certificate has expired";
 		}
 
 		certificate->unknownsigner = (flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED);
@@ -664,6 +672,21 @@ class mbedTLSIOHook : public SSLIOHook
 			out[pos] = ' ';
 	}
 
+	static time_t GetTime(const mbedtls_x509_time* x509time)
+	{
+		// HACK: this is terrible but there's no sensible way I can see to get
+		// a time_t from this.
+		tm ts;
+		ts.tm_year = x509time->year - 1900;
+		ts.tm_mon  = x509time->mon  - 1;
+		ts.tm_mday = x509time->day;
+		ts.tm_hour = x509time->hour;
+		ts.tm_min  = x509time->min;
+		ts.tm_sec  = x509time->sec;
+
+		return timegm(&ts);
+	}
+
 	static int Pull(void* userptr, unsigned char* buffer, size_t size)
 	{
 		StreamSocket* const sock = reinterpret_cast<StreamSocket*>(userptr);
diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index b3aed3896..f786c46d3 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -78,6 +78,7 @@
 #endif
 
 #ifdef _WIN32
+# define timegm _mkgmtime
 # pragma comment(lib, "libcrypto.lib")
 # pragma comment(lib, "libssl.lib")
 #endif
@@ -700,10 +701,16 @@ class OpenSSLIOHook : public SSLIOHook
 			certinfo->fingerprint = BinToHex(md, n);
 		}
 
-		if ((ASN1_UTCTIME_cmp_time_t(X509_getm_notAfter(cert), ServerInstance->Time()) == -1) || (ASN1_UTCTIME_cmp_time_t(X509_getm_notBefore(cert), ServerInstance->Time()) == 0))
-		{
-			certinfo->error = "Not activated, or expired certificate";
-		}
+		certinfo->activation = GetTime(X509_getm_notBefore(cert));
+		certinfo->expiration = GetTime(X509_getm_notAfter(cert));
+
+		int activated = ASN1_UTCTIME_cmp_time_t(X509_getm_notBefore(cert), ServerInstance->Time());
+		if (activated != -1 && activated != 0)
+			certinfo->error = "Certificate not activated";
+
+		int expired = ASN1_UTCTIME_cmp_time_t(X509_getm_notAfter(cert), ServerInstance->Time());
+		if (expired != 0 && expired != 1)
+			certinfo->error = "Certificate has expired";
 
 		X509_free(cert);
 	}
@@ -718,6 +725,23 @@ class OpenSSLIOHook : public SSLIOHook
 			out[pos] = ' ';
 	}
 
+	static time_t GetTime(ASN1_TIME* x509time)
+	{
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+		if (!x509time)
+			return 0;
+
+		struct tm ts;
+		if (!ASN1_TIME_to_tm(x509time, &ts))
+			return 0;
+
+		return timegm(&ts);
+#else
+		// OpenSSL 1.1 is required for ASN_TIME_to_tm.
+		return 0;
+#endif
+	}
+
 	void SSLInfoCallback(int where, int rc)
 	{
 		if ((where & SSL_CB_HANDSHAKE_START) && (status == STATUS_OPEN))