Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

compliance issue: Fort accepts GeneralizedTime with fractional seconds #152

Open
job opened this issue Oct 29, 2024 · 3 comments
Open

compliance issue: Fort accepts GeneralizedTime with fractional seconds #152

job opened this issue Oct 29, 2024 · 3 comments

Comments

@job
Copy link
Contributor

job commented Oct 29, 2024

https://github.com/NICMx/FORT-validator/blame/e6856e67ae7ced7e0945f35373a2ccf4e75dfe9b/src/asn1/asn1c/GeneralizedTime.c#L276

RPKI & RFC 5280 standards do not allow fractional seconds

@job
Copy link
Contributor Author

job commented Oct 29, 2024

feather$ /home/job/source/FORT-validator/src/fort --mode=print thisupdate_millis.mft
{
    "contentType": "pkcs7-signedData",
    "content": {
        "version": 3,
        "digestAlgorithms": [
            {
                "algorithm": "SHA256"
            }
        ],
        "encapContentInfo": {
            "eContentType": "id-ct-rpkiManifest",
            "eContent": {
                "manifestNumber": 31,
                "thisUpdate": "2024-10-29 15:50:02Z",              <----- SHOULD THROW DECODING ERROR 
                "nextUpdate": "2025-01-29 14:50:02Z",
                "fileHashAlg": "SHA256",
                "fileList": [

thisupdate_millis.mft.gz

@job
Copy link
Contributor Author

job commented Oct 29, 2024

object actually contains fractional seconds, as can be seen here:

$ openssl asn1parse -in thisupdate_millis.mft -inform der  -i -strparse 62
    0:d=0  hl=4 l= 280 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :1F
    7:d=1  hl=2 l=  19 prim:  GENERALIZEDTIME   :20241029155002.666Z
   28:d=1  hl=2 l=  15 prim:  GENERALIZEDTIME   :20250129145002Z
   45:d=1  hl=2 l=   9 prim:  OBJECT            :sha256
...

@ydahhrk
Copy link
Member

ydahhrk commented Oct 29, 2024

Dang. I missed the DER bug.

BRB

This goes hand-in-hand with #153.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants