use 64 bit time stamps globally

This change now implies that 32 bit systems support the time in seconds
since Epoch beyond 2038.

Signed-off-by: Stephan Mueller <smueller@chronox.de>

Author: smuellerDD

TODO

@@ -22,5 +22,3 @@
 - RISCV64 ASM / ZBB / ML-KEM: add to Linux kernel
 
 - X.509/PKCS7 parser: add to the Linux kernel
-
-- replace use of time() with clock_gettime(CLOCK_REALTIME)

asn1/src/pkcs7_generator.c

@@ -583,14 +583,13 @@ static int pkcs7_set_time(uint8_t *data, size_t *avail_datalen, uint8_t *tag)
 	 */
 	char datestr[X509_GENTIM_SIZE + 2];
 	struct tm *time_detail;
-	time_t timeval = time(NULL);
+	time64_t timeval;
 	int ret;
 
-	if (timeval == (time_t)-1)
-		return -EFAULT;
+	CKINT(lc_get_time(&timeval));
 
 	/* UTC time */
-	time_detail = gmtime(&timeval);
+	time_detail = gmtime((const time_t *)&timeval);
 
 	/*
 	 * The value is the time since EPOCH for 2050-01-01

asn1/tests/meson.build

@@ -303,19 +303,14 @@ if get_option('x509_generator').enabled()
 		     '--serial', '0102030405060708' ],
 	     suite: regression)
 
-	# This tests the different times: valid-from is UCTTime, valid-to is
-	# General Time - only applicable on 64 bit systems as 32 bit systems
-	# cannot represent time beyond 2038
-	if not arm32_neon_asm
-		test('X.509 Generator 13', asn1_enc_tester,
-			args: [ '--eku', '50', '--ca', '--san-dns', 'leancrypto',
-				'--san-ip', '1.1.1.1', '--keyusage', '64',
-				'--skid', '0102030405', '--akid', '08090a0b',
-				'--valid-from', '1729527728', '--valid-to', '2524608000',
-				'--subject-cn', 'subject', '--issuer-cn', 'issuer',
-				'--serial', '0102030405060708' ],
-			suite: regression)
-	endif
+	test('X.509 Generator 13', asn1_enc_tester,
+		args: [ '--eku', '50', '--ca', '--san-dns', 'leancrypto',
+			'--san-ip', '1.1.1.1', '--keyusage', '64',
+			'--skid', '0102030405', '--akid', '08090a0b',
+			'--valid-from', '1729527728', '--valid-to', '2524608000',
+			'--subject-cn', 'subject', '--issuer-cn', 'issuer',
+			'--serial', '0102030405060708' ],
+		suite: regression)
 
 	asn1_extensions_enc_tester = executable('asn1_extensions_enc_tester',
 			 [ 'asn1_extensions_enc_tester.c',

drng/src/seeded_rng.c

@@ -101,7 +101,7 @@ struct lc_seeded_rng_ctx {
 #define LC_SEEDED_RNG_MAX_BYTES (1 << 20) /* Max bytes without reseed */
 	size_t bytes;
 #define LC_SEEDED_RNG_MAX_TIME 60 /* Max seconds without reseed */
-	unsigned long last_seeded;
+	time64_t last_seeded;
 	pid_t pid; /* Detect a fork */
 	mutex_w_t lock; /* Lock */
 };
@@ -121,9 +121,18 @@ static struct lc_seeded_rng_ctx seeded_rng = {
 
 #ifdef LINUX_KERNEL
 
-static unsigned long get_time(void)
+static int time64_after(time64_t curr, time64_t base)
 {
-	return jiffies / HZ;
+	if (curr < 0)
+		return 0;
+	if (base < 0)
+		return 1;
+	return (curr > base) ? 1 : 0;
+}
+
+static time64_t get_time(void)
+{
+	return (time64_t)(jiffies / HZ);
 }
 
 #elif defined(LC_EFI_ENVIRONMENT)
@@ -132,36 +141,37 @@ static unsigned long get_time(void)
  * Time-based reseeding is disabled in EFI environment, it only relies on
  * the number of generated bytes to determine the reseed trigger.
  */
-static int time_after(unsigned long curr, unsigned long base)
+static int time64_after(time64_t curr, time64_t base)
 {
 	(void)curr;
 	(void)base;
 	return 0;
 }
 
-static unsigned long get_time(void)
+static time64_t get_time(void)
 {
 	return 0;
 }
 
 #else /* LINUX_KERNEL */
 
-static int time_after(unsigned long curr, unsigned long base)
+static int time64_after(time64_t curr, time64_t base)
 {
-	if (curr == (unsigned long)-1)
+	if (curr < 0)
 		return 0;
-	if (base == (unsigned long)-1)
+	if (base < 0)
 		return 1;
 	return (curr > base) ? 1 : 0;
 }
 
-static unsigned long get_time(void)
+static time64_t get_time(void)
 {
-	time_t t = time(NULL);
+	time64_t t;
 
-	if (t == (time_t)-1)
+	if (lc_get_time(&t))
 		return 0;
-	return (unsigned long)t;
+
+	return t;
 }
 
 #endif /* LINUX_KERNEL */
@@ -233,11 +243,11 @@ void lc_seeded_rng_zero_state(void)
 	seeded_rng_noise_fini();
 }
 
-static unsigned long time_after_now(unsigned long base)
+static time64_t time_after_now(time64_t base)
 {
-	unsigned long curr = get_time();
+	time64_t curr = get_time();
 
-	return time_after(curr, base) ? (curr - base) : 0;
+	return time64_after(curr, base) ? (curr - base) : 0;
 }
 
 static int lc_seeded_rng_must_reseed(struct lc_seeded_rng_ctx *rng,

internal/api/ext_headers.h

@@ -81,8 +81,12 @@ typedef s64 time64_t;
 
 static inline int lc_get_time(time64_t *time_since_epoch)
 {
-	(void)time_since_epoch;
-	return -EOPNOTSUPP;
+	if (!time_since_epoch)
+		return -EINVAL;
+
+	*time_since_epoch = (time64_t)(jiffies / HZ);
+
+	return 0;
 }
 
 #elif (defined(LC_EFI_ENVIRONMENT))
@@ -303,15 +307,18 @@ typedef int64_t time64_t;
 
 static inline int lc_get_time(time64_t *time_since_epoch)
 {
+	struct timespec tp = { 0 };
+
 	if (!time_since_epoch)
 		return -EINVAL;
 
-	*time_since_epoch = time(NULL);
-
-	if (*time_since_epoch == (time_t)-1)
-		return -errno;
+	if (clock_gettime(CLOCK_REALTIME, &tp) == 0) {
+		*time_since_epoch = tp.tv_sec;
+		return 0;
+	}
 
-	return 0;
+	*time_since_epoch = (time64_t)-1;
+	return -errno;
 }
 
 #else /* LINUX_KERNEL */
@@ -377,15 +384,18 @@ typedef int64_t time64_t;
 
 static inline int lc_get_time(time64_t *time_since_epoch)
 {
+	struct timespec tp = { 0 };
+
 	if (!time_since_epoch)
 		return -EINVAL;
 
-	*time_since_epoch = time(NULL);
-
-	if (*time_since_epoch == (time_t)-1)
-		return -errno;
+	if (clock_gettime(CLOCK_REALTIME, &tp) == 0) {
+		*time_since_epoch = tp.tv_sec;
+		return 0;
+	}
 
-	return 0;
+	*time_since_epoch = (time64_t)-1;
+	return -errno;
 }
 
 #endif /* LINUX_KERNEL */

internal/tests/memcmp_secure_test.c

@@ -24,6 +24,7 @@
 #include "lc_hash_drbg.h"
 #include "lc_memcmp_secure.h"
 #include "small_stack_support.h"
+#include "ret_checkers.h"
 
 static int memcmp_secure_tester(void)
 {
@@ -32,12 +33,14 @@ static int memcmp_secure_tester(void)
 	};
 	LC_DRBG_HASH_CTX_ON_STACK(drbg);
 	uint8_t *ap, *bp;
-	time_t now = time(NULL);
+	time64_t now;
 	unsigned int i;
 	int ret = 1;
 	unsigned short rnd = 0, add = 0;
 	LC_DECLARE_MEM(ws, struct workspace, 32);
 
+	CKINT(lc_get_time(&now));
+
 	if (lc_rng_seed(drbg, (uint8_t *)&now, sizeof(now), NULL, 0))
 		return 1;
 

internal/tests/memcpy_secure_test.c

@@ -24,6 +24,7 @@
 #include "lc_hash_drbg.h"
 #include "lc_memcmp_secure.h"
 #include "lc_memcpy_secure.h"
+#include "ret_checkers.h"
 #include "small_stack_support.h"
 
 static int memcpy_secure_tester(void)
@@ -33,12 +34,14 @@ static int memcpy_secure_tester(void)
 	};
 	LC_DRBG_HASH_CTX_ON_STACK(drbg);
 	uint8_t *ap, *bp;
-	time_t now = time(NULL);
+	time64_t now;
 	unsigned int i;
 	int ret = 1;
 	unsigned short rnd = 0, add = 0;
 	LC_DECLARE_MEM(ws, struct workspace, 32);
 
+	CKINT(lc_get_time(&now));
+
 	if (lc_rng_seed(drbg, (uint8_t *)&now, sizeof(now), NULL, 0))
 		return 1;
 

meson.build

@@ -169,6 +169,9 @@ if (get_option('fips140').enabled())
 	add_global_arguments([ '-DLC_FIPS140' ], language: 'c')
 endif
 
+# 64 bit time to not suffer from Y2038 problem
+add_global_arguments([ '-D_TIME_BITS=64' ], language: 'c')
+
 # Header generation
 header_script = find_program('addon/generate_header.sh', required: true)
 
@@ -400,6 +403,12 @@ if get_option('pkcs7_parser').disabled() and get_option('pkcs7_generator').enabl
 	error('PKCS#7 / CMS generator support requires PKCS#7 / CMS parser support')
 endif
 
+if (get_option('efi').enabled() and
+    (get_option('pkcs7_generator').enabled() or
+     get_option('x509_generator').enabled()))
+	error('EFI compilation support for PKCS#7 message generator / X.509 certificate generator not provided')
+endif
+
 ################################################################################
 # Enable assembler support
 ################################################################################

otp/src/totp.c

@@ -31,16 +31,17 @@ LC_INTERFACE_FUNCTION(int, lc_totp, const uint8_t *hmac_key,
 		      size_t hmac_key_len, uint32_t step, uint32_t digits,
 		      uint32_t *totp_val)
 {
-	time_t now;
+	time64_t now;
 	uint64_t counter;
+	int ret;
 
 	if (!totp_val)
 		return -EINVAL;
 
 	/* Get time in seconds since Epoch */
-	now = time(NULL);
-	if (now == (time_t)-1)
-		return -errno;
+	ret = lc_get_time(&now);
+	if (ret)
+		return ret;
 
 	counter = (uint64_t)now;
 	counter /= step;