Hi
I just sent a pull request for your consideration
(https://github.com/libressl-portable/portable/pull/286). I'm attaching the
patch here for your convenience.
Btw, I'd also like to point out that the mild (warning) tone of the 32-bit
time_t message in configure.ac message is a bit contradictory with the firm
stance on enforcing security in the actual implementation in X509_cmp_time():
/*
* Defensively fail if the time string is not representable as
* a time_t. A time_t must be sane if you care about times after
* Jan 19 2038.
*/
if ((time1 = timegm(&tm1)) == -1)
goto out;
that is, if the warning against 32-bit time_t is ignored, one ends up building a
library that rejects all certificates with expiry date after Y2K38. I'm not sure how
common are these, but it turns out Spanish tax administration are using one such
certificate (check www7.aeat.es:443) and are going to make connections to this
service compulsory for all invoicing software
<http://www.agenciatributaria.es/AEAT.internet/en_gb/Inicio/La_Agencia_Tributaria/Campanas/Suministro_Inmediato_de_Informacion_en_el_IVA__SII_/Suministro_Inmediato_de_Informacion_en_el_IVA__SII_.shtml>
starting this year.
I appreciate you have a strong focus on security (which is one of the reasons we
choose to use LibreSSL in our inventory and invoicing application
<http://winomega.com/>), thus given all this I would humbly suggest to go all
the way and abort the build if 64-bit time_t is not available. This would prevent a
lot of confusion as otherwise valid certificates are rejected with no apparent reason.
Many thanks for your time and for a great product,
--
Paul Graham
Development Dept.
http://Omega-Software.com/
commit 8186f994b200dcbcd7e2cd30b635ced0496b5f32
Author: Paul Graham <developm...@winomega.com>
Date: Tue Feb 14 22:42:43 2017 +0100
Add -D__MINGW_USE_VC2005_COMPAT hint to avoid 32-bit time_t on mingw32
diff --git a/configure.ac b/configure.ac
index eecfb41..38864bb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -142,6 +142,16 @@ AM_CONDITIONAL([SMALL_TIME_T], [test "$ac_cv_sizeof_time_t" = "4"])
if test "$ac_cv_sizeof_time_t" = "4"; then
echo " ** Warning, this system is unable to represent times past 2038"
echo " ** It will behave incorrectly when handling valid RFC5280 dates"
+
+ if test "$host_os" = "mingw32" ; then
+ echo " **"
+ echo " ** On Mingw-w64, you can solve this problem by switching to"
+ echo " ** MSVC 2005 ABI which provides 64-bit time_t. If you want to"
+ echo " ** do that, rebuild $PACKAGE_NAME (and everything that links with it)"
+ echo " ** with CPPFLAGS=-D__MINGW_USE_VC2005_COMPAT"
+ fi
+
+ exit 1
fi
AC_REQUIRE_AUX_FILE([tap-driver.sh])
