Update to latest BearSSL (#8600)

Minor SSL bug fix included.

tools/sdk/include/bearssl/bearssl.h

@@ -137,6 +137,10 @@
 #include "bearssl_x509.h"
 #include "bearssl_pem.h"
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /** \brief Type for a configuration option.
  *
  * A "configuration option" is a value that is selected when the BearSSL
@@ -167,4 +171,13 @@ typedef struct {
  */
 const br_config_option *br_get_config(void);
 
+/* ======================================================================= */
+
+/** \brief Version feature: support for time callback. */
+#define BR_FEATURE_X509_TIME_CALLBACK   1
+
+#ifdef __cplusplus
+}
+#endif
+
 #endif

tools/sdk/include/bearssl/bearssl_git.h

@@ -1,2 +1,2 @@
 // Do not edit -- Automatically generated by tools/sdk/ssl/bearssl/Makefile
-#define BEARSSL_GIT 6105635
+#define BEARSSL_GIT 9fe3977

tools/sdk/include/bearssl/bearssl_x509.h

@@ -625,6 +625,52 @@ typedef struct {
 
 } br_name_element;
 
+/**
+ * \brief Callback for validity date checks.
+ *
+ * The function receives as parameter an arbitrary user-provided context,
+ * and the notBefore and notAfter dates specified in an X.509 certificate,
+ * both expressed as a number of days and a number of seconds:
+ *
+ *   - Days are counted in a proleptic Gregorian calendar since
+ *     January 1st, 0 AD. Year "0 AD" is the one that preceded "1 AD";
+ *     it is also traditionally known as "1 BC".
+ *
+ *   - Seconds are counted since midnight, from 0 to 86400 (a count of
+ *     86400 is possible only if a leap second happened).
+ *
+ * Each date and time is understood in the UTC time zone. The "Unix
+ * Epoch" (January 1st, 1970, 00:00 UTC) corresponds to days=719528 and
+ * seconds=0; the "Windows Epoch" (January 1st, 1601, 00:00 UTC) is
+ * days=584754, seconds=0.
+ *
+ * This function must return -1 if the current date is strictly before
+ * the "notBefore" time, or +1 if the current date is strictly after the
+ * "notAfter" time. If neither condition holds, then the function returns
+ * 0, which means that the current date falls within the validity range of
+ * the certificate. If the function returns a value distinct from -1, 0
+ * and +1, then this is interpreted as an unavailability of the current
+ * time, which normally ends the validation process with a
+ * `BR_ERR_X509_TIME_UNKNOWN` error.
+ *
+ * During path validation, this callback will be invoked for each
+ * considered X.509 certificate. Validation fails if any of the calls
+ * returns a non-zero value.
+ *
+ * The context value is an abritrary pointer set by the caller when
+ * configuring this callback.
+ *
+ * \param tctx                 context pointer.
+ * \param not_before_days      notBefore date (days since Jan 1st, 0 AD).
+ * \param not_before_seconds   notBefore time (seconds, at most 86400).
+ * \param not_after_days       notAfter date (days since Jan 1st, 0 AD).
+ * \param not_after_seconds    notAfter time (seconds, at most 86400).
+ * \return  -1, 0 or +1.
+ */
+typedef int (*br_x509_time_check)(void *tctx,
+	uint32_t not_before_days, uint32_t not_before_seconds,
+	uint32_t not_after_days, uint32_t not_after_seconds);
+
 /**
  * \brief The "minimal" X.509 engine structure.
  *
@@ -647,8 +693,8 @@ typedef struct {
 		uint32_t *rp;
 		const unsigned char *ip;
 	} cpu;
-	uint32_t dp_stack[32];
-	uint32_t rp_stack[32];
+	uint32_t dp_stack[31];
+	uint32_t rp_stack[31];
 	int err;
 
 	/* Server name to match with the SAN / CN of the EE certificate. */
@@ -730,6 +776,12 @@ typedef struct {
 	br_name_element *name_elts;
 	size_t num_name_elts;
 
+	/*
+	 * Callback function (and context) to get the current date.
+	 */
+	void *itime_ctx;
+	br_x509_time_check itime;
+
 	/*
 	 * Public key cryptography implementations (signature verification).
 	 */
@@ -890,7 +942,10 @@ void br_x509_minimal_init_full(br_x509_minimal_context *ctx,
  *   - Seconds are counted since midnight, from 0 to 86400 (a count of
  *     86400 is possible only if a leap second happened).
  *
- * The validation date and time is understood in the UTC time zone.
+ * The validation date and time is understood in the UTC time zone. The
+ * "Unix Epoch" (January 1st, 1970, 00:00 UTC) corresponds to days=719528
+ * and seconds=0; the "Windows Epoch" (January 1st, 1601, 00:00 UTC) is
+ * days=584754, seconds=0.
  *
  * If the validation date and time are not explicitly set, but BearSSL
  * was compiled with support for the system clock on the underlying
@@ -908,6 +963,28 @@ br_x509_minimal_set_time(br_x509_minimal_context *ctx,
 {
 	ctx->days = days;
 	ctx->seconds = seconds;
+	ctx->itime = 0;
+}
+
+/**
+ * \brief Set the validity range callback function for the X.509
+ * "minimal" engine.
+ *
+ * The provided function will be invoked to check whether the validation
+ * date is within the validity range for a given X.509 certificate; a
+ * call will be issued for each considered certificate. The provided
+ * context pointer (itime_ctx) will be passed as first parameter to the
+ * callback.
+ *
+ * \param tctx   context for callback invocation.
+ * \param cb     callback function.
+ */
+static inline void
+br_x509_minimal_set_time_callback(br_x509_minimal_context *ctx,
+	void *itime_ctx, br_x509_time_check itime)
+{
+	ctx->itime_ctx = itime_ctx;
+	ctx->itime = itime;
 }
 
 /**

tools/sdk/ssl/bearssl

@@ -1 +1 @@
-Subproject commit 6105635531027f5b298aa656d44be2289b2d434f
+Subproject commit 9fe3977fc33d2a0dc6d26fd4bdec054d5cb889d3