tree e014d31f52853d3f564630586ed5b7e2906899e3
parent 97aa4363e1a119b09fc0c57771375f86f9a5d3ac
author Hanno Becker <hanno.becker@arm.com> 1560161664 +0100
committer Hanno Becker <hanno.becker@arm.com> 1561450271 +0100

Fix certificate validity checking logic to work with !TIME_DATE

If MBEDTLS_HAVE_TIME_DATE is undefined, the functions
`mbedtls_x509_time_is_past()` and `mbedtls_x509_time_is_future()`
are still defined but return `0` (that is, no time is seen to in
the past or future). To maintain functional correctness, this
means that these functions have to be called in a way where
the condition being checked for is the erroneous one: Concretely,
one shouldn't check that a CRT's `validFrom` is in the past,
or that its `validTo` is in the future, because that would
fail if !MBEDTLS_HAVE_TIME_DATE. Instead, one should check
that `validFrom` is NOT in the future, and `validTo` is NOT
in the past. That was the logic previously, but an uncautious
change during transition to X.509 on-demand parsing has
changed it. This commit fixes this.