tree 9bd865db82f6feefe14c965461550819eadbbdeb
parent 80eaddfc36444ccc8fff73b98e6a7f9a86dceafd
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1564495386 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1564498618 +0200

Fix bug in MBEDTLS_X509_CRT_REMOVE_TIME

When looking for a parent, all candidates were considered time-invalid due to
the #ifdef incorrectly including the `parent_valid = 1` line.

When MBEDTLS_HAVE_TIME_DATE is unset the time-validity of certificates is
never checked and always treated as valid. This is usually achieved by proper
usage of mbedtls_x509_time_is_past() and mbedtls_x509_time_is_future() (and
their definition when we don't HAVE_TIME_DATE).

Here the calls to these functions needs to be guarded by
MBEDTLS_X509_CRT_REMOVE_TIME as they access struct members whose presence is
controlled by this option. But the "valid" branch should still always be taken.

(Note: MBEDTLS_X509_CRT_REMOVE_TIME being set forces MBEDTLS_HAVE_TIME_DATE to
be unset, as enforce by check_config.h.)

This bug was found by `all.sh test_baremetal` - no need for a new test.