Skip to content

Commit 5daf264

Browse files
prbprbprbprbprbprb
authored
Don't create Date or Calendar objects for ASN.1 dates unless needed. (#1176)
* Don't create Date or Calendar objects for ASN.1 dates unless needed. Continues to parse Cert/CRL dates on creation in order to detect errors, but stores them as longs since the epoch rather than Dates and lazily creates Dates directly from them rather than requiring a Calendar.
1 parent 23ca210 commit 5daf264

7 files changed

Lines changed: 38 additions & 107 deletions

File tree

‎common/src/jni/main/cpp/conscrypt/native_crypto.cc‎

Lines changed: 19 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -4861,6 +4861,20 @@ static jobjectArray NativeCrypto_get_X509_GENERAL_NAME_stack(JNIEnv* env, jclass
48614861
return joa.release();
48624862
}
48634863

4864+
/*
4865+
* Converts an ASN1_TIME to epoch time in milliseconds.
4866+
*/
4867+
static jlong ASN1_TIME_convert_to_posix(JNIEnv* env, const ASN1_TIME* time) {
4868+
int64_t retval;
4869+
if (!ASN1_TIME_to_posix(time, &retval)) {
4870+
JNI_TRACE("ASN1_TIME_convert_to_posix(%p) => Invalid date value", time);
4871+
conscrypt::jniutil::throwParsingException(env, "Invalid date value");
4872+
return 0;
4873+
}
4874+
// ASN1_TIME_to_posix can only return years from 0000 to 9999, so this won't overflow.
4875+
return static_cast<jlong>(retval * 1000);
4876+
}
4877+
48644878
static jlong NativeCrypto_X509_get_notBefore(JNIEnv* env, jclass, jlong x509Ref,
48654879
CONSCRYPT_UNUSED jobject holder) {
48664880
CHECK_ERROR_QUEUE_ON_RETURN;
@@ -4875,7 +4889,7 @@ static jlong NativeCrypto_X509_get_notBefore(JNIEnv* env, jclass, jlong x509Ref,
48754889

48764890
ASN1_TIME* notBefore = X509_get_notBefore(x509);
48774891
JNI_TRACE("X509_get_notBefore(%p) => %p", x509, notBefore);
4878-
return reinterpret_cast<uintptr_t>(notBefore);
4892+
return ASN1_TIME_convert_to_posix(env, notBefore);
48794893
}
48804894

48814895
static jlong NativeCrypto_X509_get_notAfter(JNIEnv* env, jclass, jlong x509Ref,
@@ -4892,7 +4906,7 @@ static jlong NativeCrypto_X509_get_notAfter(JNIEnv* env, jclass, jlong x509Ref,
48924906

48934907
ASN1_TIME* notAfter = X509_get_notAfter(x509);
48944908
JNI_TRACE("X509_get_notAfter(%p) => %p", x509, notAfter);
4895-
return reinterpret_cast<uintptr_t>(notAfter);
4909+
return ASN1_TIME_convert_to_posix(env, notAfter);
48964910
}
48974911

48984912
// NOLINTNEXTLINE(runtime/int)
@@ -5528,7 +5542,7 @@ static jlong NativeCrypto_get_X509_REVOKED_revocationDate(JNIEnv* env, jclass,
55285542

55295543
JNI_TRACE("get_X509_REVOKED_revocationDate(%p) => %p", revoked,
55305544
X509_REVOKED_get0_revocationDate(revoked));
5531-
return reinterpret_cast<uintptr_t>(X509_REVOKED_get0_revocationDate(revoked));
5545+
return ASN1_TIME_convert_to_posix(env, X509_REVOKED_get0_revocationDate(revoked));
55325546
}
55335547

55345548
#ifdef __GNUC__
@@ -5622,7 +5636,7 @@ static jlong NativeCrypto_X509_CRL_get_lastUpdate(JNIEnv* env, jclass, jlong x50
56225636

56235637
ASN1_TIME* lastUpdate = X509_CRL_get_lastUpdate(crl);
56245638
JNI_TRACE("X509_CRL_get_lastUpdate(%p) => %p", crl, lastUpdate);
5625-
return reinterpret_cast<uintptr_t>(lastUpdate);
5639+
return ASN1_TIME_convert_to_posix(env, lastUpdate);
56265640
}
56275641

56285642
static jlong NativeCrypto_X509_CRL_get_nextUpdate(JNIEnv* env, jclass, jlong x509CrlRef,
@@ -5639,7 +5653,7 @@ static jlong NativeCrypto_X509_CRL_get_nextUpdate(JNIEnv* env, jclass, jlong x50
56395653

56405654
ASN1_TIME* nextUpdate = X509_CRL_get_nextUpdate(crl);
56415655
JNI_TRACE("X509_CRL_get_nextUpdate(%p) => %p", crl, nextUpdate);
5642-
return reinterpret_cast<uintptr_t>(nextUpdate);
5656+
return ASN1_TIME_convert_to_posix(env, nextUpdate);
56435657
}
56445658

56455659
static jbyteArray NativeCrypto_i2d_X509_REVOKED(JNIEnv* env, jclass, jlong x509RevokedRef) {
@@ -5663,63 +5677,6 @@ static jint NativeCrypto_X509_supported_extension(JNIEnv* env, jclass, jlong x50
56635677
return X509_supported_extension(ext);
56645678
}
56655679

5666-
static inline bool decimal_to_integer(const char* data, size_t len, int* out) {
5667-
int ret = 0;
5668-
for (size_t i = 0; i < len; i++) {
5669-
ret *= 10;
5670-
if (data[i] < '0' || data[i] > '9') {
5671-
return false;
5672-
}
5673-
ret += data[i] - '0';
5674-
}
5675-
*out = ret;
5676-
return true;
5677-
}
5678-
5679-
static void NativeCrypto_ASN1_TIME_to_Calendar(JNIEnv* env, jclass, jlong asn1TimeRef,
5680-
jobject calendar) {
5681-
CHECK_ERROR_QUEUE_ON_RETURN;
5682-
ASN1_TIME* asn1Time = reinterpret_cast<ASN1_TIME*>(static_cast<uintptr_t>(asn1TimeRef));
5683-
JNI_TRACE("ASN1_TIME_to_Calendar(%p, %p)", asn1Time, calendar);
5684-
5685-
if (asn1Time == nullptr) {
5686-
conscrypt::jniutil::throwNullPointerException(env, "asn1Time == null");
5687-
return;
5688-
}
5689-
5690-
if (!ASN1_TIME_check(asn1Time)) {
5691-
conscrypt::jniutil::throwParsingException(env, "Invalid date format");
5692-
return;
5693-
}
5694-
5695-
bssl::UniquePtr<ASN1_GENERALIZEDTIME> gen(ASN1_TIME_to_generalizedtime(asn1Time, nullptr));
5696-
if (gen.get() == nullptr) {
5697-
conscrypt::jniutil::throwParsingException(env,
5698-
"ASN1_TIME_to_generalizedtime returned null");
5699-
return;
5700-
}
5701-
5702-
if (ASN1_STRING_length(gen.get()) < 14 || ASN1_STRING_get0_data(gen.get()) == nullptr) {
5703-
conscrypt::jniutil::throwNullPointerException(env, "gen->length < 14 || gen->data == null");
5704-
return;
5705-
}
5706-
5707-
int year, mon, mday, hour, min, sec;
5708-
const char* data = reinterpret_cast<const char*>(ASN1_STRING_get0_data(gen.get()));
5709-
if (!decimal_to_integer(data, 4, &year) ||
5710-
!decimal_to_integer(data + 4, 2, &mon) ||
5711-
!decimal_to_integer(data + 6, 2, &mday) ||
5712-
!decimal_to_integer(data + 8, 2, &hour) ||
5713-
!decimal_to_integer(data + 10, 2, &min) ||
5714-
!decimal_to_integer(data + 12, 2, &sec)) {
5715-
conscrypt::jniutil::throwParsingException(env, "Invalid date format");
5716-
return;
5717-
}
5718-
5719-
env->CallVoidMethod(calendar, conscrypt::jniutil::calendar_setMethod, year, mon - 1, mday, hour,
5720-
min, sec);
5721-
}
5722-
57235680
// A CbsHandle is a structure used to manage resources allocated by asn1_read-*
57245681
// functions so that they can be freed properly when finished. This struct owns
57255682
// all objects pointed to by its members.
@@ -11218,7 +11175,6 @@ static JNINativeMethod sNativeCryptoMethods[] = {
1121811175
CONSCRYPT_NATIVE_METHOD(X509_REVOKED_dup, "(J)J"),
1121911176
CONSCRYPT_NATIVE_METHOD(i2d_X509_REVOKED, "(J)[B"),
1122011177
CONSCRYPT_NATIVE_METHOD(X509_supported_extension, "(J)I"),
11221-
CONSCRYPT_NATIVE_METHOD(ASN1_TIME_to_Calendar, "(JLjava/util/Calendar;)V"),
1122211178
CONSCRYPT_NATIVE_METHOD(asn1_read_init, "([B)J"),
1122311179
CONSCRYPT_NATIVE_METHOD(asn1_read_sequence, "(J)J"),
1122411180
CONSCRYPT_NATIVE_METHOD(asn1_read_next_tag_is, "(JI)Z"),

‎common/src/main/java/org/conscrypt/NativeCrypto.java‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -611,10 +611,6 @@ static native void X509_CRL_verify(long x509CrlCtx, OpenSSLX509CRL holder,
611611

612612
static native int X509_supported_extension(long x509ExtensionRef);
613613

614-
// --- ASN1_TIME -----------------------------------------------------------
615-
616-
static native void ASN1_TIME_to_Calendar(long asn1TimeCtx, Calendar cal) throws ParsingException;
617-
618614
// --- ASN1 Encoding -------------------------------------------------------
619615

620616
/**

‎common/src/main/java/org/conscrypt/OpenSSLX509CRL.java‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -50,23 +50,15 @@
5050
*/
5151
final class OpenSSLX509CRL extends X509CRL {
5252
private volatile long mContext;
53-
private final Date thisUpdate;
54-
private final Date nextUpdate;
53+
private final long thisUpdate;
54+
private final long nextUpdate;
5555

5656
private OpenSSLX509CRL(long ctx) throws ParsingException {
5757
mContext = ctx;
5858
// The legacy X509 OpenSSL APIs don't validate ASN1_TIME structures until access, so
5959
// parse them here because this is the only time we're allowed to throw ParsingException
60-
thisUpdate = toDate(NativeCrypto.X509_CRL_get_lastUpdate(mContext, this));
61-
nextUpdate = toDate(NativeCrypto.X509_CRL_get_nextUpdate(mContext, this));
62-
}
63-
64-
// Package-visible because it's also used by OpenSSLX509CRLEntry
65-
static Date toDate(long asn1time) throws ParsingException {
66-
Calendar calendar = Calendar.getInstance(TimeZone.getTimeZone("UTC"));
67-
calendar.set(Calendar.MILLISECOND, 0);
68-
NativeCrypto.ASN1_TIME_to_Calendar(asn1time, calendar);
69-
return calendar.getTime();
60+
thisUpdate = NativeCrypto.X509_CRL_get_lastUpdate(mContext, this);
61+
nextUpdate = NativeCrypto.X509_CRL_get_nextUpdate(mContext, this);
7062
}
7163

7264
static OpenSSLX509CRL fromX509DerInputStream(InputStream is) throws ParsingException {
@@ -278,12 +270,12 @@ public X500Principal getIssuerX500Principal() {
278270

279271
@Override
280272
public Date getThisUpdate() {
281-
return (Date) thisUpdate.clone();
273+
return new Date(thisUpdate);
282274
}
283275

284276
@Override
285277
public Date getNextUpdate() {
286-
return (Date) nextUpdate.clone();
278+
return new Date(nextUpdate);
287279
}
288280

289281
@Override

‎common/src/main/java/org/conscrypt/OpenSSLX509CRLEntry.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,13 @@
3131
*/
3232
final class OpenSSLX509CRLEntry extends X509CRLEntry {
3333
private final long mContext;
34-
private final Date revocationDate;
34+
private final long revocationDate;
3535

3636
OpenSSLX509CRLEntry(long ctx) throws ParsingException {
3737
mContext = ctx;
3838
// The legacy X509 OpenSSL APIs don't validate ASN1_TIME structures until access, so
3939
// parse them here because this is the only time we're allowed to throw ParsingException
40-
revocationDate = OpenSSLX509CRL.toDate(NativeCrypto.get_X509_REVOKED_revocationDate(mContext));
40+
revocationDate = NativeCrypto.get_X509_REVOKED_revocationDate(mContext);
4141
}
4242

4343
@Override
@@ -112,7 +112,7 @@ public BigInteger getSerialNumber() {
112112

113113
@Override
114114
public Date getRevocationDate() {
115-
return (Date) revocationDate.clone();
115+
return new Date(revocationDate);
116116
}
117117

118118
@Override

‎common/src/main/java/org/conscrypt/OpenSSLX509Certificate.java‎

Lines changed: 8 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -61,29 +61,15 @@ public final class OpenSSLX509Certificate extends X509Certificate {
6161
private transient volatile long mContext;
6262
private transient Integer mHashCode;
6363

64-
private final Date notBefore;
65-
private final Date notAfter;
64+
private final long notBefore;
65+
private final long notAfter;
6666

6767
OpenSSLX509Certificate(long ctx) throws ParsingException {
6868
mContext = ctx;
6969
// The legacy X509 OpenSSL APIs don't validate ASN1_TIME structures until access, so
7070
// parse them here because this is the only time we're allowed to throw ParsingException
71-
notBefore = toDate(NativeCrypto.X509_get_notBefore(mContext, this));
72-
notAfter = toDate(NativeCrypto.X509_get_notAfter(mContext, this));
73-
}
74-
75-
// A non-throwing constructor used when we have already parsed the dates
76-
private OpenSSLX509Certificate(long ctx, Date notBefore, Date notAfter) {
77-
mContext = ctx;
78-
this.notBefore = notBefore;
79-
this.notAfter = notAfter;
80-
}
81-
82-
private static Date toDate(long asn1time) throws ParsingException {
83-
Calendar calendar = Calendar.getInstance(TimeZone.getTimeZone("UTC"));
84-
calendar.set(Calendar.MILLISECOND, 0);
85-
NativeCrypto.ASN1_TIME_to_Calendar(asn1time, calendar);
86-
return calendar.getTime();
71+
notBefore = NativeCrypto.X509_get_notBefore(mContext, this);
72+
notAfter = NativeCrypto.X509_get_notAfter(mContext, this);
8773
}
8874

8975
public static OpenSSLX509Certificate fromX509DerInputStream(InputStream is)
@@ -260,12 +246,12 @@ public void checkValidity(Date date) throws CertificateExpiredException,
260246
CertificateNotYetValidException {
261247
if (getNotBefore().compareTo(date) > 0) {
262248
throw new CertificateNotYetValidException("Certificate not valid until "
263-
+ getNotBefore().toString() + " (compared to " + date.toString() + ")");
249+
+ getNotBefore() + " (compared to " + date + ")");
264250
}
265251

266252
if (getNotAfter().compareTo(date) < 0) {
267253
throw new CertificateExpiredException("Certificate expired at "
268-
+ getNotAfter().toString() + " (compared to " + date.toString() + ")");
254+
+ getNotAfter() + " (compared to " + date + ")");
269255
}
270256
}
271257

@@ -291,12 +277,12 @@ public Principal getSubjectDN() {
291277

292278
@Override
293279
public Date getNotBefore() {
294-
return (Date) notBefore.clone();
280+
return new Date(notBefore);
295281
}
296282

297283
@Override
298284
public Date getNotAfter() {
299-
return (Date) notAfter.clone();
285+
return new Date(notAfter);
300286
}
301287

302288
@Override

‎common/src/test/java/org/conscrypt/HostnameVerifierTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -598,7 +598,7 @@ public void subjectAltNameWithToplevelWildcard() throws Exception {
598598
//
599599
// Certificate generated using:-
600600
// openssl req -x509 -nodes -days 36500 -subj "/CN=Google Inc" \
601-
// -addext "subjectAltName=DNS:*.com" -newkey rsa:512
601+
// -addext "subjectAltName=DNS:*.com" -
602602
SSLSession session = session(""
603603
+ "-----BEGIN CERTIFICATE-----\n"
604604
+ "MIIBlTCCAT+gAwIBAgIUe1RB6C61ZW/SEQpKiywSEJOEOUMwDQYJKoZIhvcNAQEL\n"

‎openjdk/build.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,7 @@ model {
407407

408408
if (toolChain in Clang || toolChain in Gcc) {
409409
cppCompiler.args "-Wall",
410+
"-Werror",
410411
"-fPIC",
411412
"-O3",
412413
"-std=c++17",

0 commit comments

Comments
 (0)