FORT-validator
FORT-validator copied to clipboard
compliance issue: Fort accepts GeneralizedTime with fractional seconds
https://github.com/NICMx/FORT-validator/blame/e6856e67ae7ced7e0945f35373a2ccf4e75dfe9b/src/asn1/asn1c/GeneralizedTime.c#L276
RPKI & RFC 5280 standards do not allow fractional seconds
feather$ /home/job/source/FORT-validator/src/fort --mode=print thisupdate_millis.mft
{
"contentType": "pkcs7-signedData",
"content": {
"version": 3,
"digestAlgorithms": [
{
"algorithm": "SHA256"
}
],
"encapContentInfo": {
"eContentType": "id-ct-rpkiManifest",
"eContent": {
"manifestNumber": 31,
"thisUpdate": "2024-10-29 15:50:02Z", <----- SHOULD THROW DECODING ERROR
"nextUpdate": "2025-01-29 14:50:02Z",
"fileHashAlg": "SHA256",
"fileList": [
object actually contains fractional seconds, as can be seen here:
$ openssl asn1parse -in thisupdate_millis.mft -inform der -i -strparse 62
0:d=0 hl=4 l= 280 cons: SEQUENCE
4:d=1 hl=2 l= 1 prim: INTEGER :1F
7:d=1 hl=2 l= 19 prim: GENERALIZEDTIME :20241029155002.666Z
28:d=1 hl=2 l= 15 prim: GENERALIZEDTIME :20250129145002Z
45:d=1 hl=2 l= 9 prim: OBJECT :sha256
...
~Dang. I missed the DER bug.~
~BRB~
This goes hand-in-hand with #153.