Fixed spurious warning about old-style prototype.

diff --git a/T0Comp.exe b/T0Comp.exe
index 67eba10..de2364d 100755 (executable)
Binary files a/T0Comp.exe and b/T0Comp.exe differ

diff --git a/inc/bearssl.h b/inc/bearssl.h
index 4f4797c..310edb2 100644 (file)
--- a/inc/bearssl.h
+++ b/inc/bearssl.h
@@ -137,6 +137,10 @@
 #include "bearssl_x509.h"
 #include "bearssl_pem.h"
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /** \brief Type for a configuration option.
  *
  * A "configuration option" is a value that is selected when the BearSSL
@@ -167,4 +171,13 @@ typedef struct {
  */
 const br_config_option *br_get_config(void);
 
+/* ======================================================================= */
+
+/** \brief Version feature: support for time callback. */
+#define BR_FEATURE_X509_TIME_CALLBACK   1
+
+#ifdef __cplusplus
+}
+#endif
+
 #endif

diff --git a/inc/bearssl_x509.h b/inc/bearssl_x509.h
index 49d2fba..7668e1d 100644 (file)
--- a/inc/bearssl_x509.h
+++ b/inc/bearssl_x509.h
@@ -625,6 +625,52 @@ typedef struct {
 
 } br_name_element;
 
+/**
+ * \brief Callback for validity date checks.
+ *
+ * The function receives as parameter an arbitrary user-provided context,
+ * and the notBefore and notAfter dates specified in an X.509 certificate,
+ * both expressed as a number of days and a number of seconds:
+ *
+ *   - Days are counted in a proleptic Gregorian calendar since
+ *     January 1st, 0 AD. Year "0 AD" is the one that preceded "1 AD";
+ *     it is also traditionally known as "1 BC".
+ *
+ *   - Seconds are counted since midnight, from 0 to 86400 (a count of
+ *     86400 is possible only if a leap second happened).
+ *
+ * Each date and time is understood in the UTC time zone. The "Unix
+ * Epoch" (January 1st, 1970, 00:00 UTC) corresponds to days=719528 and
+ * seconds=0; the "Windows Epoch" (January 1st, 1601, 00:00 UTC) is
+ * days=584754, seconds=0.
+ *
+ * This function must return -1 if the current date is strictly before
+ * the "notBefore" time, or +1 if the current date is strictly after the
+ * "notAfter" time. If neither condition holds, then the function returns
+ * 0, which means that the current date falls within the validity range of
+ * the certificate. If the function returns a value distinct from -1, 0
+ * and +1, then this is interpreted as an unavailability of the current
+ * time, which normally ends the validation process with a
+ * `BR_ERR_X509_TIME_UNKNOWN` error.
+ *
+ * During path validation, this callback will be invoked for each
+ * considered X.509 certificate. Validation fails if any of the calls
+ * returns a non-zero value.
+ *
+ * The context value is an abritrary pointer set by the caller when
+ * configuring this callback.
+ *
+ * \param tctx                 context pointer.
+ * \param not_before_days      notBefore date (days since Jan 1st, 0 AD).
+ * \param not_before_seconds   notBefore time (seconds, at most 86400).
+ * \param not_after_days       notAfter date (days since Jan 1st, 0 AD).
+ * \param not_after_seconds    notAfter time (seconds, at most 86400).
+ * \return  -1, 0 or +1.
+ */
+typedef int (*br_x509_time_check)(void *tctx,
+       uint32_t not_before_days, uint32_t not_before_seconds,
+       uint32_t not_after_days, uint32_t not_after_seconds);
+
 /**
  * \brief The "minimal" X.509 engine structure.
  *
@@ -647,8 +693,8 @@ typedef struct {
                uint32_t *rp;
                const unsigned char *ip;
        } cpu;
-       uint32_t dp_stack[32];
-       uint32_t rp_stack[32];
+       uint32_t dp_stack[31];
+       uint32_t rp_stack[31];
        int err;
 
        /* Server name to match with the SAN / CN of the EE certificate. */
@@ -723,6 +769,12 @@ typedef struct {
        br_name_element *name_elts;
        size_t num_name_elts;
 
+       /*
+        * Callback function (and context) to get the current date.
+        */
+       void *itime_ctx;
+       br_x509_time_check itime;
+
        /*
         * Public key cryptography implementations (signature verification).
         */
@@ -853,7 +905,10 @@ void br_x509_minimal_init_full(br_x509_minimal_context *ctx,
  *   - Seconds are counted since midnight, from 0 to 86400 (a count of
  *     86400 is possible only if a leap second happened).
  *
- * The validation date and time is understood in the UTC time zone.
+ * The validation date and time is understood in the UTC time zone. The
+ * "Unix Epoch" (January 1st, 1970, 00:00 UTC) corresponds to days=719528
+ * and seconds=0; the "Windows Epoch" (January 1st, 1601, 00:00 UTC) is
+ * days=584754, seconds=0.
  *
  * If the validation date and time are not explicitly set, but BearSSL
  * was compiled with support for the system clock on the underlying
@@ -871,6 +926,28 @@ br_x509_minimal_set_time(br_x509_minimal_context *ctx,
 {
        ctx->days = days;
        ctx->seconds = seconds;
+       ctx->itime = 0;
+}
+
+/**
+ * \brief Set the validity range callback function for the X.509
+ * "minimal" engine.
+ *
+ * The provided function will be invoked to check whether the validation
+ * date is within the validity range for a given X.509 certificate; a
+ * call will be issued for each considered certificate. The provided
+ * context pointer (itime_ctx) will be passed as first parameter to the
+ * callback.
+ *
+ * \param tctx   context for callback invocation.
+ * \param cb     callback function.
+ */
+static inline void
+br_x509_minimal_set_time_callback(br_x509_minimal_context *ctx,
+       void *itime_ctx, br_x509_time_check itime)
+{
+       ctx->itime_ctx = itime_ctx;
+       ctx->itime = itime;
 }
 
 /**

diff --git a/src/ec/ec_p256_m64.c b/src/ec/ec_p256_m64.c
index 5a7ea17..71a527c 100644 (file)
--- a/src/ec/ec_p256_m64.c
+++ b/src/ec/ec_p256_m64.c
@@ -99,6 +99,9 @@ f256_add(uint64_t *d, const uint64_t *a, const uint64_t *b)
        unsigned __int128 w;
        uint64_t t;
 
+       /*
+        * Do the addition, with an extra carry in t.
+        */
        w = (unsigned __int128)a[0] + b[0];
        d[0] = (uint64_t)w;
        w = (unsigned __int128)a[1] + b[1] + (w >> 64);
@@ -110,7 +113,7 @@ f256_add(uint64_t *d, const uint64_t *a, const uint64_t *b)
        t = (uint64_t)(w >> 64);
 
        /*
-        * 2^256 = 2^224 - 2^192 - 2^96 + 1 in the field.
+        * Fold carry t, using: 2^256 = 2^224 - 2^192 - 2^96 + 1 mod p.
         */
        w = (unsigned __int128)d[0] + t;
        d[0] = (uint64_t)w;
@@ -119,8 +122,22 @@ f256_add(uint64_t *d, const uint64_t *a, const uint64_t *b)
        /* Here, carry "w >> 64" can only be 0 or -1 */
        w = (unsigned __int128)d[2] - ((w >> 64) & 1);
        d[2] = (uint64_t)w;
-       /* Again, carry is 0 or -1 */
-       d[3] += (uint64_t)(w >> 64) + (t << 32) - t;
+       /* Again, carry is 0 or -1. But there can be carry only if t = 1,
+          in which case the addition of (t << 32) - t is positive. */
+       w = (unsigned __int128)d[3] - ((w >> 64) & 1) + (t << 32) - t;
+       d[3] = (uint64_t)w;
+       t = (uint64_t)(w >> 64);
+
+       /*
+        * There can be an extra carry here, which we must fold again.
+        */
+       w = (unsigned __int128)d[0] + t;
+       d[0] = (uint64_t)w;
+       w = (unsigned __int128)d[1] + (w >> 64) - (t << 32);
+       d[1] = (uint64_t)w;
+       w = (unsigned __int128)d[2] - ((w >> 64) & 1);
+       d[2] = (uint64_t)w;
+       d[3] += (t << 32) - t - (uint64_t)((w >> 64) & 1);
 
 #elif BR_UMUL128
 
@@ -140,6 +157,15 @@ f256_add(uint64_t *d, const uint64_t *a, const uint64_t *b)
        cc = _addcarry_u64(cc, d[0], 0, &d[0]);
        cc = _addcarry_u64(cc, d[1], -(t << 32), &d[1]);
        cc = _addcarry_u64(cc, d[2], -t, &d[2]);
+       cc = _addcarry_u64(cc, d[3], (t << 32) - (t << 1), &d[3]);
+
+       /*
+        * We have to do it again if there still is a carry.
+        */
+       t = cc;
+       cc = _addcarry_u64(cc, d[0], 0, &d[0]);
+       cc = _addcarry_u64(cc, d[1], -(t << 32), &d[1]);
+       cc = _addcarry_u64(cc, d[2], -t, &d[2]);
        (void)_addcarry_u64(cc, d[3], (t << 32) - (t << 1), &d[3]);
 
 #endif
@@ -167,6 +193,7 @@ f256_sub(uint64_t *d, const uint64_t *a, const uint64_t *b)
        t = (uint64_t)(w >> 64) & 1;
 
        /*
+        * If there is a borrow (t = 1), then we must add the modulus
         * p = 2^256 - 2^224 + 2^192 + 2^96 - 1.
         */
        w = (unsigned __int128)d[0] - t;
@@ -177,6 +204,20 @@ f256_sub(uint64_t *d, const uint64_t *a, const uint64_t *b)
        w = (unsigned __int128)d[2] + (w >> 64);
        d[2] = (uint64_t)w;
        /* Again, carry is 0 or +1 */
+       w = (unsigned __int128)d[3] + (w >> 64) - (t << 32) + t;
+       d[3] = (uint64_t)w;
+       t = (uint64_t)(w >> 64) & 1;
+
+       /*
+        * There may be again a borrow, in which case we must add the
+        * modulus again.
+        */
+       w = (unsigned __int128)d[0] - t;
+       d[0] = (uint64_t)w;
+       w = (unsigned __int128)d[1] + (t << 32) - ((w >> 64) & 1);
+       d[1] = (uint64_t)w;
+       w = (unsigned __int128)d[2] + (w >> 64);
+       d[2] = (uint64_t)w;
        d[3] += (uint64_t)(w >> 64) - (t << 32) + t;
 
 #elif BR_UMUL128
@@ -190,13 +231,23 @@ f256_sub(uint64_t *d, const uint64_t *a, const uint64_t *b)
        cc = _subborrow_u64(cc, a[3], b[3], &d[3]);
 
        /*
-        * If there is a carry, then we need to add p.
+        * If there is a borrow, then we need to add p. We (virtually)
+        * add 2^256, then subtract 2^256 - p.
+        */
+       t = cc;
+       cc = _subborrow_u64(0, d[0], t, &d[0]);
+       cc = _subborrow_u64(cc, d[1], -(t << 32), &d[1]);
+       cc = _subborrow_u64(cc, d[2], -t, &d[2]);
+       cc = _subborrow_u64(cc, d[3], (t << 32) - (t << 1), &d[3]);
+
+       /*
+        * If there still is a borrow, then we need to add p again.
         */
        t = cc;
-       cc = _addcarry_u64(0, d[0], -t, &d[0]);
-       cc = _addcarry_u64(cc, d[1], (-t) >> 32, &d[1]);
-       cc = _addcarry_u64(cc, d[2], 0, &d[2]);
-       (void)_addcarry_u64(cc, d[3], t - (t << 32), &d[3]);
+       cc = _subborrow_u64(0, d[0], t, &d[0]);
+       cc = _subborrow_u64(cc, d[1], -(t << 32), &d[1]);
+       cc = _subborrow_u64(cc, d[2], -t, &d[2]);
+       (void)_subborrow_u64(cc, d[3], (t << 32) - (t << 1), &d[3]);
 
 #endif
 }

diff --git a/src/rsa/rsa_i62_keygen.c b/src/rsa/rsa_i62_keygen.c
index 8f55c37..992fe97 100644 (file)
--- a/src/rsa/rsa_i62_keygen.c
+++ b/src/rsa/rsa_i62_keygen.c
@@ -40,7 +40,7 @@ br_rsa_i62_keygen(const br_prng_class **rng,
 
 /* see bearssl_rsa.h */
 br_rsa_keygen
-br_rsa_i62_keygen_get()
+br_rsa_i62_keygen_get(void)
 {
        return &br_rsa_i62_keygen;
 }
@@ -49,7 +49,7 @@ br_rsa_i62_keygen_get()
 
 /* see bearssl_rsa.h */
 br_rsa_keygen
-br_rsa_i62_keygen_get()
+br_rsa_i62_keygen_get(void)
 {
        return 0;
 }

diff --git a/src/rsa/rsa_pss_sig_unpad.c b/src/rsa/rsa_pss_sig_unpad.c
index a9f8ca3..0c6ae99 100644 (file)
--- a/src/rsa/rsa_pss_sig_unpad.c
+++ b/src/rsa/rsa_pss_sig_unpad.c
@@ -114,7 +114,7 @@ br_rsa_pss_sig_unpad(const br_hash_class *hf_data,
         * in the string.
         */
        for (u = 0; u < hash_len; u ++) {
-               r |= tmp[u] ^ x[(xlen - salt_len - 1) + u];
+               r |= tmp[u] ^ x[(xlen - hash_len - 1) + u];
        }
 
        return EQ0(r);

diff --git a/src/ssl/ssl_rec_cbc.c b/src/ssl/ssl_rec_cbc.c
index c080604..c38cbfd 100644 (file)
--- a/src/ssl/ssl_rec_cbc.c
+++ b/src/ssl/ssl_rec_cbc.c
@@ -136,7 +136,7 @@ cbc_decrypt(br_sslrec_in_cbc_context *cc,
 
        /*
         * Use the last decrypted byte to compute the actual payload
-        * length. Take care not to underflow (we use unsigned types).
+        * length. Take care not to overflow (we use unsigned types).
         */
        pad_len = buf[max_len];
        good = LE(pad_len, (uint32_t)(max_len - min_len));

diff --git a/src/x509/x509_minimal.c b/src/x509/x509_minimal.c
index 6103c08..04f149b 100644 (file)
--- a/src/x509/x509_minimal.c
+++ b/src/x509/x509_minimal.c
@@ -157,7 +157,7 @@ void br_x509_minimal_run(void *t0ctx);
  *     -- Extensions: extension values are processed in due order.
  *
  *        -- Basic Constraints: for all certificates except EE, must be
- *        present, indicate a CA, and have a path legnth compatible with
+ *        present, indicate a CA, and have a path length compatible with
  *        the chain length so far.
  *
  *        -- Key Usage: for the EE, if present, must allow signatures
@@ -448,7 +448,7 @@ static const unsigned char t0_datablock[] = {
 static const unsigned char t0_codeblock[] = {
        0x00, 0x01, 0x00, 0x0D, 0x00, 0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x01,
        0x00, 0x11, 0x00, 0x00, 0x01, 0x01, 0x09, 0x00, 0x00, 0x01, 0x01, 0x0A,
-       0x00, 0x00, 0x24, 0x24, 0x00, 0x00, 0x01,
+       0x00, 0x00, 0x25, 0x25, 0x00, 0x00, 0x01,
        T0_INT1(BR_ERR_X509_BAD_BOOLEAN), 0x00, 0x00, 0x01,
        T0_INT1(BR_ERR_X509_BAD_DN), 0x00, 0x00, 0x01,
        T0_INT1(BR_ERR_X509_BAD_SERVER_NAME), 0x00, 0x00, 0x01,
@@ -486,227 +486,224 @@ static const unsigned char t0_codeblock[] = {
        T0_INT2(offsetof(CONTEXT_NAME, next_dn_hash)), 0x00, 0x00, 0x01,
        T0_INT2(offsetof(CONTEXT_NAME, num_certs)), 0x00, 0x00, 0x01,
        T0_INT2(offsetof(CONTEXT_NAME, pad)), 0x00, 0x00, 0x01,
-       T0_INT2(offsetof(CONTEXT_NAME, saved_dn_hash)), 0x00, 0x00, 0xC9, 0x71,
-       0x00, 0x00, 0x01, 0x80, 0x73, 0x00, 0x00, 0x01, 0x80, 0x7C, 0x00, 0x00,
-       0x01, 0x81, 0x02, 0x00, 0x00, 0x92, 0x05, 0x05, 0x34, 0x42, 0x01, 0x00,
-       0x00, 0x34, 0x01, 0x0A, 0x0E, 0x09, 0x01, 0x9A, 0xFF, 0xB8, 0x00, 0x0A,
-       0x00, 0x00, 0x01, 0x82, 0x19, 0x00, 0x00, 0x01, 0x82, 0x01, 0x00, 0x00,
-       0x01, 0x81, 0x68, 0x00, 0x04, 0x03, 0x00, 0x03, 0x01, 0x03, 0x02, 0x03,
-       0x03, 0x02, 0x03, 0x02, 0x01, 0x11, 0x06, 0x07, 0x02, 0x02, 0x02, 0x00,
-       0x0D, 0x04, 0x05, 0x02, 0x03, 0x02, 0x01, 0x0D, 0x00, 0x02, 0x03, 0x00,
-       0x03, 0x01, 0x25, 0x02, 0x01, 0x13, 0x3B, 0x02, 0x00, 0x0F, 0x15, 0x00,
-       0x00, 0x01, 0x81, 0x74, 0x00, 0x00, 0x05, 0x02, 0x52, 0x28, 0x00, 0x00,
-       0x06, 0x02, 0x53, 0x28, 0x00, 0x00, 0x01, 0x10, 0x77, 0x00, 0x00, 0x11,
-       0x05, 0x02, 0x56, 0x28, 0x74, 0x00, 0x00, 0x11, 0x05, 0x02, 0x56, 0x28,
-       0x75, 0x00, 0x00, 0x06, 0x02, 0x4C, 0x28, 0x00, 0x00, 0x01, 0x82, 0x11,
-       0x00, 0x00, 0x25, 0x20, 0x01, 0x08, 0x0E, 0x3B, 0x40, 0x20, 0x09, 0x00,
-       0x09, 0x03, 0x00, 0x5B, 0x2B, 0xAF, 0x39, 0xAF, 0xB3, 0x25, 0x01, 0x20,
-       0x11, 0x06, 0x11, 0x24, 0x74, 0xAD, 0xB3, 0x01, 0x02, 0x78, 0xB0, 0x01,
-       0x02, 0x12, 0x06, 0x02, 0x57, 0x28, 0x79, 0xB3, 0x01, 0x02, 0x78, 0xAE,
-       0xAF, 0xC2, 0x9C, 0x65, 0x61, 0x21, 0x16, 0xAF, 0xA7, 0x29, 0x69, 0x06,
-       0x02, 0x4B, 0x28, 0xA7, 0x29, 0x71, 0x06, 0x02, 0x4B, 0x28, 0x79, 0x02,
-       0x00, 0x06, 0x05, 0x9D, 0x03, 0x01, 0x04, 0x09, 0x9C, 0x61, 0x68, 0x21,
-       0x27, 0x05, 0x02, 0x4A, 0x28, 0x68, 0x65, 0x21, 0x16, 0xAF, 0xAF, 0x9E,
-       0x05, 0x02, 0x57, 0x28, 0xBC, 0x26, 0x06, 0x27, 0xC2, 0xA4, 0xAF, 0x63,
-       0xAA, 0x03, 0x03, 0x63, 0x3B, 0x02, 0x03, 0x09, 0x3B, 0x02, 0x03, 0x0A,
-       0xAA, 0x03, 0x04, 0x79, 0x64, 0x2A, 0x01, 0x81, 0x00, 0x09, 0x02, 0x03,
-       0x12, 0x06, 0x02, 0x58, 0x28, 0x79, 0x5A, 0x03, 0x02, 0x04, 0x3A, 0x88,
-       0x26, 0x06, 0x34, 0x9E, 0x05, 0x02, 0x57, 0x28, 0x6A, 0x26, 0x06, 0x04,
-       0x01, 0x17, 0x04, 0x12, 0x6B, 0x26, 0x06, 0x04, 0x01, 0x18, 0x04, 0x0A,
-       0x6C, 0x26, 0x06, 0x04, 0x01, 0x19, 0x04, 0x02, 0x57, 0x28, 0x03, 0x05,
-       0x79, 0xA4, 0x25, 0x03, 0x06, 0x25, 0x63, 0x34, 0x0D, 0x06, 0x02, 0x50,
-       0x28, 0xA5, 0x59, 0x03, 0x02, 0x04, 0x02, 0x57, 0x28, 0x79, 0x02, 0x00,
-       0x06, 0x21, 0x02, 0x02, 0x5A, 0x30, 0x11, 0x06, 0x08, 0x24, 0x02, 0x03,
-       0x02, 0x04, 0x1D, 0x04, 0x10, 0x59, 0x30, 0x11, 0x06, 0x08, 0x24, 0x02,
-       0x05, 0x02, 0x06, 0x1C, 0x04, 0x03, 0x57, 0x28, 0x24, 0x04, 0x24, 0x02,
-       0x02, 0x5A, 0x30, 0x11, 0x06, 0x08, 0x24, 0x02, 0x03, 0x02, 0x04, 0x23,
-       0x04, 0x10, 0x59, 0x30, 0x11, 0x06, 0x08, 0x24, 0x02, 0x05, 0x02, 0x06,
-       0x22, 0x04, 0x03, 0x57, 0x28, 0x24, 0x25, 0x06, 0x01, 0x28, 0x24, 0x01,
-       0x00, 0x03, 0x07, 0xB4, 0x01, 0x21, 0x8F, 0x01, 0x22, 0x8F, 0x25, 0x01,
-       0x23, 0x11, 0x06, 0x81, 0x26, 0x24, 0x74, 0xAD, 0xAF, 0x25, 0x06, 0x81,
-       0x1A, 0x01, 0x00, 0x03, 0x08, 0xAF, 0x9E, 0x24, 0xB3, 0x25, 0x01, 0x01,
-       0x11, 0x06, 0x04, 0xA6, 0x03, 0x08, 0xB3, 0x01, 0x04, 0x78, 0xAD, 0x70,
-       0x26, 0x06, 0x0F, 0x02, 0x00, 0x06, 0x03, 0xC3, 0x04, 0x05, 0x99, 0x01,
-       0x7F, 0x03, 0x07, 0x04, 0x80, 0x6C, 0x91, 0x26, 0x06, 0x06, 0x02, 0x00,
-       0x9B, 0x04, 0x80, 0x62, 0xC5, 0x26, 0x06, 0x11, 0x02, 0x00, 0x06, 0x09,
-       0x01, 0x00, 0x03, 0x01, 0x98, 0x03, 0x01, 0x04, 0x01, 0xC3, 0x04, 0x80,
-       0x4D, 0x73, 0x26, 0x06, 0x0A, 0x02, 0x08, 0x06, 0x03, 0x9A, 0x04, 0x01,
-       0xC3, 0x04, 0x3F, 0x6F, 0x26, 0x06, 0x03, 0xC3, 0x04, 0x38, 0xC8, 0x26,
-       0x06, 0x03, 0xC3, 0x04, 0x31, 0x90, 0x26, 0x06, 0x03, 0xC3, 0x04, 0x2A,
-       0xC6, 0x26, 0x06, 0x03, 0xC3, 0x04, 0x23, 0x7A, 0x26, 0x06, 0x03, 0xC3,
-       0x04, 0x1C, 0x85, 0x26, 0x06, 0x03, 0xC3, 0x04, 0x15, 0x6E, 0x26, 0x06,
-       0x03, 0xC3, 0x04, 0x0E, 0xC7, 0x26, 0x06, 0x03, 0xC3, 0x04, 0x07, 0x02,
-       0x08, 0x06, 0x02, 0x49, 0x28, 0xC3, 0x79, 0x79, 0x04, 0xFE, 0x62, 0x79,
-       0x79, 0x04, 0x08, 0x01, 0x7F, 0x11, 0x05, 0x02, 0x56, 0x28, 0x24, 0x79,
-       0x3A, 0x02, 0x00, 0x06, 0x08, 0x02, 0x01, 0x3C, 0x2F, 0x05, 0x02, 0x45,
-       0x28, 0x02, 0x00, 0x06, 0x01, 0x17, 0x02, 0x00, 0x02, 0x07, 0x2F, 0x05,
-       0x02, 0x51, 0x28, 0xB3, 0x76, 0xAD, 0x9E, 0x06, 0x80, 0x77, 0xBD, 0x26,
-       0x06, 0x07, 0x01, 0x02, 0x5A, 0x8A, 0x04, 0x80, 0x5E, 0xBE, 0x26, 0x06,
-       0x07, 0x01, 0x03, 0x5A, 0x8B, 0x04, 0x80, 0x53, 0xBF, 0x26, 0x06, 0x07,
-       0x01, 0x04, 0x5A, 0x8C, 0x04, 0x80, 0x48, 0xC0, 0x26, 0x06, 0x06, 0x01,
-       0x05, 0x5A, 0x8D, 0x04, 0x3E, 0xC1, 0x26, 0x06, 0x06, 0x01, 0x06, 0x5A,
-       0x8E, 0x04, 0x34, 0x7F, 0x26, 0x06, 0x06, 0x01, 0x02, 0x59, 0x8A, 0x04,
-       0x2A, 0x80, 0x26, 0x06, 0x06, 0x01, 0x03, 0x59, 0x8B, 0x04, 0x20, 0x81,
-       0x26, 0x06, 0x06, 0x01, 0x04, 0x59, 0x8C, 0x04, 0x16, 0x82, 0x26, 0x06,
-       0x06, 0x01, 0x05, 0x59, 0x8D, 0x04, 0x0C, 0x83, 0x26, 0x06, 0x06, 0x01,
-       0x06, 0x59, 0x8E, 0x04, 0x02, 0x57, 0x28, 0x5E, 0x35, 0x60, 0x37, 0x1B,
-       0x25, 0x05, 0x02, 0x57, 0x28, 0x5D, 0x37, 0x04, 0x02, 0x57, 0x28, 0xC2,
-       0xA4, 0x25, 0x01, T0_INT2(BR_X509_BUFSIZE_SIG), 0x12, 0x06, 0x02, 0x50,
-       0x28, 0x25, 0x5F, 0x35, 0x5C, 0xA5, 0x79, 0x79, 0x01, 0x00, 0x5B, 0x36,
-       0x18, 0x00, 0x00, 0x01, 0x30, 0x0A, 0x25, 0x01, 0x00, 0x01, 0x09, 0x72,
-       0x05, 0x02, 0x48, 0x28, 0x00, 0x00, 0x30, 0x30, 0x00, 0x00, 0x01, 0x81,
-       0x08, 0x00, 0x00, 0x01, 0x81, 0x10, 0x00, 0x00, 0x01, 0x81, 0x19, 0x00,
-       0x00, 0x01, 0x81, 0x22, 0x00, 0x00, 0x01, 0x81, 0x2B, 0x00, 0x01, 0x7E,
-       0x01, 0x01, 0x11, 0x3B, 0x01, 0x83, 0xFD, 0x7F, 0x11, 0x15, 0x06, 0x03,
-       0x3B, 0x24, 0x00, 0x3B, 0x25, 0x03, 0x00, 0x25, 0xCA, 0x05, 0x04, 0x42,
-       0x01, 0x00, 0x00, 0x25, 0x01, 0x81, 0x00, 0x0D, 0x06, 0x04, 0x96, 0x04,
-       0x80, 0x49, 0x25, 0x01, 0x90, 0x00, 0x0D, 0x06, 0x0F, 0x01, 0x06, 0x14,
-       0x01, 0x81, 0x40, 0x2F, 0x96, 0x02, 0x00, 0x01, 0x00, 0x97, 0x04, 0x33,
-       0x25, 0x01, 0x83, 0xFF, 0x7F, 0x0D, 0x06, 0x14, 0x01, 0x0C, 0x14, 0x01,
-       0x81, 0x60, 0x2F, 0x96, 0x02, 0x00, 0x01, 0x06, 0x97, 0x02, 0x00, 0x01,
-       0x00, 0x97, 0x04, 0x17, 0x01, 0x12, 0x14, 0x01, 0x81, 0x70, 0x2F, 0x96,
-       0x02, 0x00, 0x01, 0x0C, 0x97, 0x02, 0x00, 0x01, 0x06, 0x97, 0x02, 0x00,
-       0x01, 0x00, 0x97, 0x00, 0x00, 0x01, 0x82, 0x15, 0x00, 0x00, 0x25, 0x01,
-       0x83, 0xB0, 0x00, 0x01, 0x83, 0xB7, 0x7F, 0x72, 0x00, 0x00, 0x01, 0x81,
-       0x34, 0x00, 0x00, 0x01, 0x80, 0x6B, 0x00, 0x00, 0x01, 0x81, 0x78, 0x00,
-       0x00, 0x01, 0x3D, 0x00, 0x00, 0x01, 0x80, 0x43, 0x00, 0x00, 0x01, 0x80,
-       0x4D, 0x00, 0x00, 0x01, 0x80, 0x57, 0x00, 0x00, 0x01, 0x80, 0x61, 0x00,
-       0x00, 0x30, 0x11, 0x06, 0x04, 0x42, 0xAD, 0xC2, 0xB4, 0x00, 0x00, 0x01,
-       0x82, 0x09, 0x00, 0x00, 0x01, 0x81, 0x6C, 0x00, 0x00, 0x25, 0x01, 0x83,
-       0xB8, 0x00, 0x01, 0x83, 0xBF, 0x7F, 0x72, 0x00, 0x00, 0x01, 0x30, 0x62,
-       0x37, 0x01, 0x7F, 0x7C, 0x19, 0x01, 0x00, 0x7C, 0x19, 0x04, 0x7A, 0x00,
-       0x01, 0x81, 0x38, 0x00, 0x01, 0x7E, 0x0D, 0x06, 0x02, 0x4F, 0x28, 0x25,
-       0x03, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x30, 0x25, 0x3F, 0x3B, 0x01,
-       0x82, 0x00, 0x13, 0x2F, 0x06, 0x04, 0x42, 0x01, 0x00, 0x00, 0x30, 0x67,
-       0x09, 0x37, 0x40, 0x00, 0x00, 0x14, 0x01, 0x3F, 0x15, 0x01, 0x81, 0x00,
-       0x2F, 0x96, 0x00, 0x02, 0x01, 0x00, 0x03, 0x00, 0xAF, 0x25, 0x06, 0x80,
-       0x59, 0xB3, 0x01, 0x20, 0x30, 0x11, 0x06, 0x17, 0x24, 0x74, 0xAD, 0x9E,
-       0x24, 0x01, 0x7F, 0x2E, 0x03, 0x01, 0xB3, 0x01, 0x20, 0x77, 0xAD, 0xB2,
-       0x02, 0x01, 0x1F, 0x79, 0x79, 0x04, 0x38, 0x01, 0x21, 0x30, 0x11, 0x06,
-       0x08, 0x24, 0x75, 0xB6, 0x01, 0x01, 0x1E, 0x04, 0x2A, 0x01, 0x22, 0x30,
-       0x11, 0x06, 0x11, 0x24, 0x75, 0xB6, 0x25, 0x06, 0x06, 0x2C, 0x02, 0x00,
-       0x2F, 0x03, 0x00, 0x01, 0x02, 0x1E, 0x04, 0x13, 0x01, 0x26, 0x30, 0x11,
-       0x06, 0x08, 0x24, 0x75, 0xB6, 0x01, 0x06, 0x1E, 0x04, 0x05, 0x42, 0xAE,
-       0x01, 0x00, 0x24, 0x04, 0xFF, 0x23, 0x79, 0x02, 0x00, 0x00, 0x00, 0xAF,
-       0xB4, 0x25, 0x01, 0x01, 0x11, 0x06, 0x08, 0xA6, 0x05, 0x02, 0x51, 0x28,
-       0xB4, 0x04, 0x02, 0x51, 0x28, 0x25, 0x01, 0x02, 0x11, 0x06, 0x0C, 0x24,
-       0x75, 0xB0, 0x66, 0x2B, 0x41, 0x0D, 0x06, 0x02, 0x51, 0x28, 0xB4, 0x01,
-       0x7F, 0x10, 0x06, 0x02, 0x56, 0x28, 0x24, 0x79, 0x00, 0x00, 0xAF, 0x25,
-       0x06, 0x1A, 0xAF, 0x9E, 0x24, 0x25, 0x06, 0x11, 0xAF, 0x25, 0x06, 0x0C,
-       0xAF, 0x9E, 0x24, 0x89, 0x26, 0x05, 0x02, 0x49, 0x28, 0xC2, 0x04, 0x71,
-       0x79, 0x79, 0x04, 0x63, 0x79, 0x00, 0x02, 0x03, 0x00, 0xB3, 0x01, 0x03,
-       0x78, 0xAD, 0xBA, 0x03, 0x01, 0x02, 0x01, 0x01, 0x07, 0x12, 0x06, 0x02,
-       0x56, 0x28, 0x25, 0x01, 0x00, 0x30, 0x11, 0x06, 0x05, 0x24, 0x4D, 0x28,
-       0x04, 0x15, 0x01, 0x01, 0x30, 0x11, 0x06, 0x0A, 0x24, 0xBA, 0x02, 0x01,
-       0x14, 0x02, 0x01, 0x0E, 0x04, 0x05, 0x24, 0xBA, 0x01, 0x00, 0x24, 0x02,
-       0x00, 0x06, 0x19, 0x01, 0x00, 0x30, 0x01, 0x38, 0x15, 0x06, 0x03, 0x01,
-       0x10, 0x2F, 0x3B, 0x01, 0x81, 0x40, 0x15, 0x06, 0x03, 0x01, 0x20, 0x2F,
-       0x62, 0x37, 0x04, 0x07, 0x01, 0x04, 0x15, 0x05, 0x02, 0x4D, 0x28, 0xC2,
-       0x00, 0x00, 0x38, 0xAF, 0xC2, 0x1A, 0x00, 0x03, 0x01, 0x00, 0x03, 0x00,
-       0x38, 0xAF, 0x25, 0x06, 0x30, 0xB3, 0x01, 0x11, 0x77, 0xAD, 0x25, 0x05,
-       0x02, 0x44, 0x28, 0x25, 0x06, 0x20, 0xAF, 0x9E, 0x24, 0x87, 0x26, 0x03,
-       0x01, 0x01, 0x00, 0x2E, 0x03, 0x02, 0xB2, 0x25, 0x02, 0x01, 0x15, 0x06,
-       0x07, 0x2C, 0x06, 0x04, 0x01, 0x7F, 0x03, 0x00, 0x02, 0x02, 0x1F, 0x79,
-       0x04, 0x5D, 0x79, 0x04, 0x4D, 0x79, 0x1A, 0x02, 0x00, 0x00, 0x00, 0xB3,
-       0x01, 0x06, 0x78, 0xB1, 0x00, 0x00, 0xB8, 0x86, 0x06, 0x0E, 0x3B, 0x25,
-       0x05, 0x06, 0x42, 0x01, 0x00, 0x01, 0x00, 0x00, 0xB8, 0x6D, 0x04, 0x08,
-       0x92, 0x06, 0x05, 0x24, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0xB9, 0x86,
-       0x06, 0x0E, 0x3B, 0x25, 0x05, 0x06, 0x42, 0x01, 0x00, 0x01, 0x00, 0x00,
-       0xB9, 0x6D, 0x04, 0x08, 0x92, 0x06, 0x05, 0x24, 0x01, 0x00, 0x04, 0x00,
-       0x00, 0x00, 0xBA, 0x25, 0x01, 0x81, 0x00, 0x0D, 0x06, 0x04, 0x00, 0x04,
-       0x80, 0x55, 0x25, 0x01, 0x81, 0x40, 0x0D, 0x06, 0x07, 0x24, 0x01, 0x00,
-       0x00, 0x04, 0x80, 0x47, 0x25, 0x01, 0x81, 0x60, 0x0D, 0x06, 0x0E, 0x01,
-       0x1F, 0x15, 0x01, 0x01, 0xA3, 0x01, 0x81, 0x00, 0x01, 0x8F, 0x7F, 0x04,
-       0x32, 0x25, 0x01, 0x81, 0x70, 0x0D, 0x06, 0x0F, 0x01, 0x0F, 0x15, 0x01,
-       0x02, 0xA3, 0x01, 0x90, 0x00, 0x01, 0x83, 0xFF, 0x7F, 0x04, 0x1C, 0x25,
-       0x01, 0x81, 0x78, 0x0D, 0x06, 0x11, 0x01, 0x07, 0x15, 0x01, 0x03, 0xA3,
-       0x01, 0x84, 0x80, 0x00, 0x01, 0x80, 0xC3, 0xFF, 0x7F, 0x04, 0x04, 0x24,
-       0x01, 0x00, 0x00, 0x72, 0x05, 0x03, 0x24, 0x01, 0x00, 0x00, 0x00, 0x3B,
-       0x25, 0x05, 0x06, 0x42, 0x01, 0x00, 0x01, 0x7F, 0x00, 0xBA, 0x34, 0x25,
-       0x3D, 0x06, 0x03, 0x3B, 0x24, 0x00, 0x01, 0x06, 0x0E, 0x3B, 0x25, 0x01,
-       0x06, 0x14, 0x01, 0x02, 0x10, 0x06, 0x04, 0x42, 0x01, 0x7F, 0x00, 0x01,
-       0x3F, 0x15, 0x09, 0x00, 0x00, 0x25, 0x06, 0x06, 0x0B, 0xA2, 0x34, 0x41,
-       0x04, 0x77, 0x24, 0x25, 0x00, 0x00, 0xB3, 0x01, 0x03, 0x78, 0xAD, 0xBA,
-       0x06, 0x02, 0x55, 0x28, 0x00, 0x00, 0x3B, 0x25, 0x06, 0x07, 0x31, 0x25,
-       0x06, 0x01, 0x19, 0x04, 0x76, 0x42, 0x00, 0x00, 0x01, 0x01, 0x78, 0xAC,
-       0x01, 0x01, 0x10, 0x06, 0x02, 0x43, 0x28, 0xBA, 0x3E, 0x00, 0x04, 0xB3,
-       0x25, 0x01, 0x17, 0x01, 0x18, 0x72, 0x05, 0x02, 0x48, 0x28, 0x01, 0x18,
-       0x11, 0x03, 0x00, 0x75, 0xAD, 0xA8, 0x02, 0x00, 0x06, 0x0C, 0x01, 0x80,
-       0x64, 0x08, 0x03, 0x01, 0xA8, 0x02, 0x01, 0x09, 0x04, 0x0E, 0x25, 0x01,
-       0x32, 0x0D, 0x06, 0x04, 0x01, 0x80, 0x64, 0x09, 0x01, 0x8E, 0x6C, 0x09,
-       0x03, 0x01, 0x02, 0x01, 0x01, 0x82, 0x6D, 0x08, 0x02, 0x01, 0x01, 0x03,
-       0x09, 0x01, 0x04, 0x0C, 0x09, 0x02, 0x01, 0x01, 0x80, 0x63, 0x09, 0x01,
-       0x80, 0x64, 0x0C, 0x0A, 0x02, 0x01, 0x01, 0x83, 0x0F, 0x09, 0x01, 0x83,
-       0x10, 0x0C, 0x09, 0x03, 0x03, 0x01, 0x01, 0x01, 0x0C, 0xA9, 0x41, 0x01,
-       0x01, 0x0E, 0x02, 0x01, 0x01, 0x04, 0x07, 0x3F, 0x02, 0x01, 0x01, 0x80,
-       0x64, 0x07, 0x3E, 0x02, 0x01, 0x01, 0x83, 0x10, 0x07, 0x3F, 0x2F, 0x15,
-       0x06, 0x03, 0x01, 0x18, 0x09, 0x94, 0x09, 0x7B, 0x25, 0x01, 0x05, 0x14,
-       0x02, 0x03, 0x09, 0x03, 0x03, 0x01, 0x1F, 0x15, 0x01, 0x01, 0x3B, 0xA9,
-       0x02, 0x03, 0x09, 0x41, 0x03, 0x03, 0x01, 0x00, 0x01, 0x17, 0xA9, 0x01,
-       0x9C, 0x10, 0x08, 0x03, 0x02, 0x01, 0x00, 0x01, 0x3B, 0xA9, 0x01, 0x3C,
-       0x08, 0x02, 0x02, 0x09, 0x03, 0x02, 0x01, 0x00, 0x01, 0x3C, 0xA9, 0x02,
-       0x02, 0x09, 0x03, 0x02, 0xBA, 0x25, 0x01, 0x2E, 0x11, 0x06, 0x0D, 0x24,
-       0xBA, 0x25, 0x01, 0x30, 0x01, 0x39, 0x72, 0x06, 0x03, 0x24, 0x04, 0x74,
-       0x01, 0x80, 0x5A, 0x10, 0x06, 0x02, 0x48, 0x28, 0x79, 0x02, 0x03, 0x02,
-       0x02, 0x00, 0x01, 0xBA, 0x7D, 0x01, 0x0A, 0x08, 0x03, 0x00, 0xBA, 0x7D,
-       0x02, 0x00, 0x09, 0x00, 0x02, 0x03, 0x00, 0x03, 0x01, 0xA8, 0x25, 0x02,
-       0x01, 0x02, 0x00, 0x72, 0x05, 0x02, 0x48, 0x28, 0x00, 0x00, 0x34, 0xB3,
-       0x01, 0x02, 0x78, 0x0B, 0xAB, 0x00, 0x03, 0x25, 0x03, 0x00, 0x03, 0x01,
-       0x03, 0x02, 0xAD, 0xBA, 0x25, 0x01, 0x81, 0x00, 0x13, 0x06, 0x02, 0x54,
-       0x28, 0x25, 0x01, 0x00, 0x11, 0x06, 0x0B, 0x24, 0x25, 0x05, 0x04, 0x24,
-       0x01, 0x00, 0x00, 0xBA, 0x04, 0x6F, 0x02, 0x01, 0x25, 0x05, 0x02, 0x50,
-       0x28, 0x41, 0x03, 0x01, 0x02, 0x02, 0x37, 0x02, 0x02, 0x40, 0x03, 0x02,
-       0x25, 0x06, 0x03, 0xBA, 0x04, 0x68, 0x24, 0x02, 0x00, 0x02, 0x01, 0x0A,
-       0x00, 0x01, 0xBA, 0x25, 0x01, 0x81, 0x00, 0x0D, 0x06, 0x01, 0x00, 0x01,
-       0x81, 0x00, 0x0A, 0x25, 0x05, 0x02, 0x4E, 0x28, 0x03, 0x00, 0x01, 0x00,
-       0x02, 0x00, 0x01, 0x00, 0x12, 0x06, 0x19, 0x02, 0x00, 0x41, 0x03, 0x00,
-       0x25, 0x01, 0x83, 0xFF, 0xFF, 0x7F, 0x12, 0x06, 0x02, 0x4F, 0x28, 0x01,
-       0x08, 0x0E, 0x3B, 0xBA, 0x34, 0x09, 0x04, 0x60, 0x00, 0x00, 0xAC, 0x95,
-       0x00, 0x00, 0xAD, 0xC2, 0x00, 0x00, 0xB3, 0x76, 0xAD, 0x00, 0x01, 0xAD,
-       0x25, 0x05, 0x02, 0x54, 0x28, 0xBA, 0x25, 0x01, 0x81, 0x00, 0x13, 0x06,
-       0x02, 0x54, 0x28, 0x03, 0x00, 0x25, 0x06, 0x16, 0xBA, 0x02, 0x00, 0x25,
-       0x01, 0x87, 0xFF, 0xFF, 0x7F, 0x13, 0x06, 0x02, 0x54, 0x28, 0x01, 0x08,
-       0x0E, 0x09, 0x03, 0x00, 0x04, 0x67, 0x24, 0x02, 0x00, 0x00, 0x00, 0xAD,
-       0x25, 0x01, 0x81, 0x7F, 0x12, 0x06, 0x08, 0xC2, 0x01, 0x00, 0x67, 0x37,
-       0x01, 0x00, 0x00, 0x25, 0x67, 0x37, 0x67, 0x40, 0xA5, 0x01, 0x7F, 0x00,
-       0x00, 0xB3, 0x01, 0x0C, 0x30, 0x11, 0x06, 0x05, 0x24, 0x75, 0xB6, 0x04,
-       0x3E, 0x01, 0x12, 0x30, 0x11, 0x06, 0x05, 0x24, 0x75, 0xB7, 0x04, 0x33,
-       0x01, 0x13, 0x30, 0x11, 0x06, 0x05, 0x24, 0x75, 0xB7, 0x04, 0x28, 0x01,
-       0x14, 0x30, 0x11, 0x06, 0x05, 0x24, 0x75, 0xB7, 0x04, 0x1D, 0x01, 0x16,
-       0x30, 0x11, 0x06, 0x05, 0x24, 0x75, 0xB7, 0x04, 0x12, 0x01, 0x1E, 0x30,
-       0x11, 0x06, 0x05, 0x24, 0x75, 0xB5, 0x04, 0x07, 0x42, 0xAE, 0x01, 0x00,
-       0x01, 0x00, 0x24, 0x00, 0x01, 0xBA, 0x03, 0x00, 0x02, 0x00, 0x01, 0x05,
-       0x14, 0x01, 0x01, 0x15, 0x2D, 0x02, 0x00, 0x01, 0x06, 0x14, 0x25, 0x01,
-       0x01, 0x15, 0x06, 0x02, 0x46, 0x28, 0x01, 0x04, 0x0E, 0x02, 0x00, 0x01,
-       0x1F, 0x15, 0x25, 0x01, 0x1F, 0x11, 0x06, 0x02, 0x47, 0x28, 0x09, 0x00,
-       0x00, 0x25, 0x05, 0x05, 0x01, 0x00, 0x01, 0x7F, 0x00, 0xB3, 0x00, 0x01,
-       0xAD, 0x25, 0x05, 0x05, 0x67, 0x37, 0x01, 0x7F, 0x00, 0x01, 0x01, 0x03,
-       0x00, 0x9F, 0x25, 0x01, 0x83, 0xFF, 0x7E, 0x11, 0x06, 0x16, 0x24, 0x25,
-       0x06, 0x10, 0xA0, 0x25, 0x05, 0x05, 0x24, 0xC2, 0x01, 0x00, 0x00, 0x02,
-       0x00, 0x84, 0x03, 0x00, 0x04, 0x6D, 0x04, 0x1B, 0x25, 0x05, 0x05, 0x24,
-       0xC2, 0x01, 0x00, 0x00, 0x02, 0x00, 0x84, 0x03, 0x00, 0x25, 0x06, 0x0B,
-       0x9F, 0x25, 0x05, 0x05, 0x24, 0xC2, 0x01, 0x00, 0x00, 0x04, 0x6D, 0x24,
-       0x02, 0x00, 0x25, 0x05, 0x01, 0x00, 0x41, 0x67, 0x37, 0x01, 0x7F, 0x00,
-       0x01, 0xAD, 0x01, 0x01, 0x03, 0x00, 0x25, 0x06, 0x10, 0xA1, 0x25, 0x05,
-       0x05, 0x24, 0xC2, 0x01, 0x00, 0x00, 0x02, 0x00, 0x84, 0x03, 0x00, 0x04,
-       0x6D, 0x24, 0x02, 0x00, 0x25, 0x05, 0x01, 0x00, 0x41, 0x67, 0x37, 0x01,
-       0x7F, 0x00, 0x01, 0xAD, 0x01, 0x01, 0x03, 0x00, 0x25, 0x06, 0x10, 0xBA,
-       0x25, 0x05, 0x05, 0x24, 0xC2, 0x01, 0x00, 0x00, 0x02, 0x00, 0x84, 0x03,
-       0x00, 0x04, 0x6D, 0x24, 0x02, 0x00, 0x25, 0x05, 0x01, 0x00, 0x41, 0x67,
-       0x37, 0x01, 0x7F, 0x00, 0x00, 0xBA, 0x01, 0x08, 0x0E, 0x3B, 0xBA, 0x34,
-       0x09, 0x00, 0x00, 0xBA, 0x3B, 0xBA, 0x01, 0x08, 0x0E, 0x34, 0x09, 0x00,
-       0x00, 0x25, 0x05, 0x02, 0x4F, 0x28, 0x41, 0xBB, 0x00, 0x00, 0x32, 0x25,
-       0x01, 0x00, 0x13, 0x06, 0x01, 0x00, 0x24, 0x19, 0x04, 0x74, 0x00, 0x01,
-       0x01, 0x00, 0x00, 0x01, 0x0B, 0x00, 0x00, 0x01, 0x15, 0x00, 0x00, 0x01,
-       0x1F, 0x00, 0x00, 0x01, 0x29, 0x00, 0x00, 0x01, 0x33, 0x00, 0x00, 0xC3,
-       0x24, 0x00, 0x00, 0x25, 0x06, 0x07, 0xC4, 0x25, 0x06, 0x01, 0x19, 0x04,
-       0x76, 0x00, 0x00, 0x01, 0x00, 0x30, 0x31, 0x0B, 0x42, 0x00, 0x00, 0x01,
-       0x81, 0x70, 0x00, 0x00, 0x01, 0x82, 0x0D, 0x00, 0x00, 0x01, 0x82, 0x22,
-       0x00, 0x00, 0x01, 0x82, 0x05, 0x00, 0x00, 0x01, 0x03, 0x33, 0x01, 0x03,
-       0x33, 0x00, 0x00, 0x25, 0x01, 0x83, 0xFB, 0x50, 0x01, 0x83, 0xFB, 0x6F,
-       0x72, 0x06, 0x04, 0x24, 0x01, 0x00, 0x00, 0x25, 0x01, 0x83, 0xB0, 0x00,
-       0x01, 0x83, 0xBF, 0x7F, 0x72, 0x06, 0x04, 0x24, 0x01, 0x00, 0x00, 0x01,
-       0x83, 0xFF, 0x7F, 0x15, 0x01, 0x83, 0xFF, 0x7E, 0x0D, 0x00
+       T0_INT2(offsetof(CONTEXT_NAME, saved_dn_hash)), 0x00, 0x00, 0x01, 0x80,
+       0x73, 0x00, 0x00, 0x01, 0x80, 0x7C, 0x00, 0x00, 0x01, 0x81, 0x02, 0x00,
+       0x00, 0x8F, 0x05, 0x05, 0x33, 0x41, 0x01, 0x00, 0x00, 0x33, 0x01, 0x0A,
+       0x0E, 0x09, 0x01, 0x9A, 0xFF, 0xB8, 0x00, 0x0A, 0x00, 0x00, 0x01, 0x82,
+       0x19, 0x00, 0x00, 0x01, 0x82, 0x01, 0x00, 0x00, 0x01, 0x81, 0x68, 0x00,
+       0x02, 0x03, 0x00, 0x03, 0x01, 0x26, 0x02, 0x01, 0x13, 0x3A, 0x02, 0x00,
+       0x0F, 0x15, 0x00, 0x00, 0x01, 0x81, 0x74, 0x00, 0x00, 0x05, 0x02, 0x51,
+       0x29, 0x00, 0x00, 0x06, 0x02, 0x52, 0x29, 0x00, 0x00, 0x01, 0x10, 0x74,
+       0x00, 0x00, 0x11, 0x05, 0x02, 0x55, 0x29, 0x71, 0x00, 0x00, 0x11, 0x05,
+       0x02, 0x55, 0x29, 0x72, 0x00, 0x00, 0x06, 0x02, 0x4B, 0x29, 0x00, 0x00,
+       0x01, 0x82, 0x11, 0x00, 0x00, 0x26, 0x21, 0x01, 0x08, 0x0E, 0x3A, 0x3F,
+       0x21, 0x09, 0x00, 0x0B, 0x03, 0x00, 0x5A, 0x2B, 0xAC, 0x38, 0xAC, 0xB0,
+       0x26, 0x01, 0x20, 0x11, 0x06, 0x11, 0x25, 0x71, 0xAA, 0xB0, 0x01, 0x02,
+       0x75, 0xAD, 0x01, 0x02, 0x12, 0x06, 0x02, 0x56, 0x29, 0x76, 0xB0, 0x01,
+       0x02, 0x75, 0xAB, 0xAC, 0xBF, 0x99, 0x64, 0x60, 0x22, 0x16, 0xAC, 0xA4,
+       0x03, 0x01, 0x03, 0x02, 0xA4, 0x02, 0x02, 0x02, 0x01, 0x19, 0x06, 0x02,
+       0x4A, 0x29, 0x76, 0x02, 0x00, 0x06, 0x05, 0x9A, 0x03, 0x03, 0x04, 0x09,
+       0x99, 0x60, 0x67, 0x22, 0x28, 0x05, 0x02, 0x49, 0x29, 0x67, 0x64, 0x22,
+       0x16, 0xAC, 0xAC, 0x9B, 0x05, 0x02, 0x56, 0x29, 0xB9, 0x27, 0x06, 0x27,
+       0xBF, 0xA1, 0xAC, 0x62, 0xA7, 0x03, 0x05, 0x62, 0x3A, 0x02, 0x05, 0x09,
+       0x3A, 0x02, 0x05, 0x0A, 0xA7, 0x03, 0x06, 0x76, 0x63, 0x2A, 0x01, 0x81,
+       0x00, 0x09, 0x02, 0x05, 0x12, 0x06, 0x02, 0x57, 0x29, 0x76, 0x59, 0x03,
+       0x04, 0x04, 0x3A, 0x85, 0x27, 0x06, 0x34, 0x9B, 0x05, 0x02, 0x56, 0x29,
+       0x68, 0x27, 0x06, 0x04, 0x01, 0x17, 0x04, 0x12, 0x69, 0x27, 0x06, 0x04,
+       0x01, 0x18, 0x04, 0x0A, 0x6A, 0x27, 0x06, 0x04, 0x01, 0x19, 0x04, 0x02,
+       0x56, 0x29, 0x03, 0x07, 0x76, 0xA1, 0x26, 0x03, 0x08, 0x26, 0x62, 0x33,
+       0x0D, 0x06, 0x02, 0x4F, 0x29, 0xA2, 0x58, 0x03, 0x04, 0x04, 0x02, 0x56,
+       0x29, 0x76, 0x02, 0x00, 0x06, 0x21, 0x02, 0x04, 0x59, 0x30, 0x11, 0x06,
+       0x08, 0x25, 0x02, 0x05, 0x02, 0x06, 0x1E, 0x04, 0x10, 0x58, 0x30, 0x11,
+       0x06, 0x08, 0x25, 0x02, 0x07, 0x02, 0x08, 0x1D, 0x04, 0x03, 0x56, 0x29,
+       0x25, 0x04, 0x24, 0x02, 0x04, 0x59, 0x30, 0x11, 0x06, 0x08, 0x25, 0x02,
+       0x05, 0x02, 0x06, 0x24, 0x04, 0x10, 0x58, 0x30, 0x11, 0x06, 0x08, 0x25,
+       0x02, 0x07, 0x02, 0x08, 0x23, 0x04, 0x03, 0x56, 0x29, 0x25, 0x26, 0x06,
+       0x01, 0x29, 0x25, 0x01, 0x00, 0x03, 0x09, 0xB1, 0x01, 0x21, 0x8C, 0x01,
+       0x22, 0x8C, 0x26, 0x01, 0x23, 0x11, 0x06, 0x81, 0x26, 0x25, 0x71, 0xAA,
+       0xAC, 0x26, 0x06, 0x81, 0x1A, 0x01, 0x00, 0x03, 0x0A, 0xAC, 0x9B, 0x25,
+       0xB0, 0x26, 0x01, 0x01, 0x11, 0x06, 0x04, 0xA3, 0x03, 0x0A, 0xB0, 0x01,
+       0x04, 0x75, 0xAA, 0x6E, 0x27, 0x06, 0x0F, 0x02, 0x00, 0x06, 0x03, 0xC0,
+       0x04, 0x05, 0x96, 0x01, 0x7F, 0x03, 0x09, 0x04, 0x80, 0x6C, 0x8E, 0x27,
+       0x06, 0x06, 0x02, 0x00, 0x98, 0x04, 0x80, 0x62, 0xC2, 0x27, 0x06, 0x11,
+       0x02, 0x00, 0x06, 0x09, 0x01, 0x00, 0x03, 0x03, 0x95, 0x03, 0x03, 0x04,
+       0x01, 0xC0, 0x04, 0x80, 0x4D, 0x70, 0x27, 0x06, 0x0A, 0x02, 0x0A, 0x06,
+       0x03, 0x97, 0x04, 0x01, 0xC0, 0x04, 0x3F, 0x6D, 0x27, 0x06, 0x03, 0xC0,
+       0x04, 0x38, 0xC5, 0x27, 0x06, 0x03, 0xC0, 0x04, 0x31, 0x8D, 0x27, 0x06,
+       0x03, 0xC0, 0x04, 0x2A, 0xC3, 0x27, 0x06, 0x03, 0xC0, 0x04, 0x23, 0x77,
+       0x27, 0x06, 0x03, 0xC0, 0x04, 0x1C, 0x82, 0x27, 0x06, 0x03, 0xC0, 0x04,
+       0x15, 0x6C, 0x27, 0x06, 0x03, 0xC0, 0x04, 0x0E, 0xC4, 0x27, 0x06, 0x03,
+       0xC0, 0x04, 0x07, 0x02, 0x0A, 0x06, 0x02, 0x48, 0x29, 0xC0, 0x76, 0x76,
+       0x04, 0xFE, 0x62, 0x76, 0x76, 0x04, 0x08, 0x01, 0x7F, 0x11, 0x05, 0x02,
+       0x55, 0x29, 0x25, 0x76, 0x39, 0x02, 0x00, 0x06, 0x08, 0x02, 0x03, 0x3B,
+       0x2F, 0x05, 0x02, 0x44, 0x29, 0x02, 0x00, 0x06, 0x01, 0x17, 0x02, 0x00,
+       0x02, 0x09, 0x2F, 0x05, 0x02, 0x50, 0x29, 0xB0, 0x73, 0xAA, 0x9B, 0x06,
+       0x80, 0x77, 0xBA, 0x27, 0x06, 0x07, 0x01, 0x02, 0x59, 0x87, 0x04, 0x80,
+       0x5E, 0xBB, 0x27, 0x06, 0x07, 0x01, 0x03, 0x59, 0x88, 0x04, 0x80, 0x53,
+       0xBC, 0x27, 0x06, 0x07, 0x01, 0x04, 0x59, 0x89, 0x04, 0x80, 0x48, 0xBD,
+       0x27, 0x06, 0x06, 0x01, 0x05, 0x59, 0x8A, 0x04, 0x3E, 0xBE, 0x27, 0x06,
+       0x06, 0x01, 0x06, 0x59, 0x8B, 0x04, 0x34, 0x7C, 0x27, 0x06, 0x06, 0x01,
+       0x02, 0x58, 0x87, 0x04, 0x2A, 0x7D, 0x27, 0x06, 0x06, 0x01, 0x03, 0x58,
+       0x88, 0x04, 0x20, 0x7E, 0x27, 0x06, 0x06, 0x01, 0x04, 0x58, 0x89, 0x04,
+       0x16, 0x7F, 0x27, 0x06, 0x06, 0x01, 0x05, 0x58, 0x8A, 0x04, 0x0C, 0x80,
+       0x27, 0x06, 0x06, 0x01, 0x06, 0x58, 0x8B, 0x04, 0x02, 0x56, 0x29, 0x5D,
+       0x34, 0x5F, 0x36, 0x1C, 0x26, 0x05, 0x02, 0x56, 0x29, 0x5C, 0x36, 0x04,
+       0x02, 0x56, 0x29, 0xBF, 0xA1, 0x26, 0x01, T0_INT2(BR_X509_BUFSIZE_SIG),
+       0x12, 0x06, 0x02, 0x4F, 0x29, 0x26, 0x5E, 0x34, 0x5B, 0xA2, 0x76, 0x76,
+       0x01, 0x00, 0x5A, 0x35, 0x18, 0x00, 0x00, 0x01, 0x30, 0x0A, 0x26, 0x01,
+       0x00, 0x01, 0x09, 0x6F, 0x05, 0x02, 0x47, 0x29, 0x00, 0x00, 0x30, 0x30,
+       0x00, 0x00, 0x01, 0x81, 0x08, 0x00, 0x00, 0x01, 0x81, 0x10, 0x00, 0x00,
+       0x01, 0x81, 0x19, 0x00, 0x00, 0x01, 0x81, 0x22, 0x00, 0x00, 0x01, 0x81,
+       0x2B, 0x00, 0x01, 0x7B, 0x01, 0x01, 0x11, 0x3A, 0x01, 0x83, 0xFD, 0x7F,
+       0x11, 0x15, 0x06, 0x03, 0x3A, 0x25, 0x00, 0x3A, 0x26, 0x03, 0x00, 0x26,
+       0xC6, 0x05, 0x04, 0x41, 0x01, 0x00, 0x00, 0x26, 0x01, 0x81, 0x00, 0x0D,
+       0x06, 0x04, 0x93, 0x04, 0x80, 0x49, 0x26, 0x01, 0x90, 0x00, 0x0D, 0x06,
+       0x0F, 0x01, 0x06, 0x14, 0x01, 0x81, 0x40, 0x2F, 0x93, 0x02, 0x00, 0x01,
+       0x00, 0x94, 0x04, 0x33, 0x26, 0x01, 0x83, 0xFF, 0x7F, 0x0D, 0x06, 0x14,
+       0x01, 0x0C, 0x14, 0x01, 0x81, 0x60, 0x2F, 0x93, 0x02, 0x00, 0x01, 0x06,
+       0x94, 0x02, 0x00, 0x01, 0x00, 0x94, 0x04, 0x17, 0x01, 0x12, 0x14, 0x01,
+       0x81, 0x70, 0x2F, 0x93, 0x02, 0x00, 0x01, 0x0C, 0x94, 0x02, 0x00, 0x01,
+       0x06, 0x94, 0x02, 0x00, 0x01, 0x00, 0x94, 0x00, 0x00, 0x01, 0x82, 0x15,
+       0x00, 0x00, 0x26, 0x01, 0x83, 0xB0, 0x00, 0x01, 0x83, 0xB7, 0x7F, 0x6F,
+       0x00, 0x00, 0x01, 0x81, 0x34, 0x00, 0x00, 0x01, 0x80, 0x6B, 0x00, 0x00,
+       0x01, 0x81, 0x78, 0x00, 0x00, 0x01, 0x3D, 0x00, 0x00, 0x01, 0x80, 0x43,
+       0x00, 0x00, 0x01, 0x80, 0x4D, 0x00, 0x00, 0x01, 0x80, 0x57, 0x00, 0x00,
+       0x01, 0x80, 0x61, 0x00, 0x00, 0x30, 0x11, 0x06, 0x04, 0x41, 0xAA, 0xBF,
+       0xB1, 0x00, 0x00, 0x01, 0x82, 0x09, 0x00, 0x00, 0x01, 0x81, 0x6C, 0x00,
+       0x00, 0x26, 0x01, 0x83, 0xB8, 0x00, 0x01, 0x83, 0xBF, 0x7F, 0x6F, 0x00,
+       0x00, 0x01, 0x30, 0x61, 0x36, 0x01, 0x7F, 0x79, 0x1A, 0x01, 0x00, 0x79,
+       0x1A, 0x04, 0x7A, 0x00, 0x01, 0x81, 0x38, 0x00, 0x01, 0x7B, 0x0D, 0x06,
+       0x02, 0x4E, 0x29, 0x26, 0x03, 0x00, 0x0A, 0x02, 0x00, 0x00, 0x00, 0x30,
+       0x26, 0x3E, 0x3A, 0x01, 0x82, 0x00, 0x13, 0x2F, 0x06, 0x04, 0x41, 0x01,
+       0x00, 0x00, 0x30, 0x66, 0x09, 0x36, 0x3F, 0x00, 0x00, 0x14, 0x01, 0x3F,
+       0x15, 0x01, 0x81, 0x00, 0x2F, 0x93, 0x00, 0x02, 0x01, 0x00, 0x03, 0x00,
+       0xAC, 0x26, 0x06, 0x80, 0x59, 0xB0, 0x01, 0x20, 0x30, 0x11, 0x06, 0x17,
+       0x25, 0x71, 0xAA, 0x9B, 0x25, 0x01, 0x7F, 0x2E, 0x03, 0x01, 0xB0, 0x01,
+       0x20, 0x74, 0xAA, 0xAF, 0x02, 0x01, 0x20, 0x76, 0x76, 0x04, 0x38, 0x01,
+       0x21, 0x30, 0x11, 0x06, 0x08, 0x25, 0x72, 0xB3, 0x01, 0x01, 0x1F, 0x04,
+       0x2A, 0x01, 0x22, 0x30, 0x11, 0x06, 0x11, 0x25, 0x72, 0xB3, 0x26, 0x06,
+       0x06, 0x2C, 0x02, 0x00, 0x2F, 0x03, 0x00, 0x01, 0x02, 0x1F, 0x04, 0x13,
+       0x01, 0x26, 0x30, 0x11, 0x06, 0x08, 0x25, 0x72, 0xB3, 0x01, 0x06, 0x1F,
+       0x04, 0x05, 0x41, 0xAB, 0x01, 0x00, 0x25, 0x04, 0xFF, 0x23, 0x76, 0x02,
+       0x00, 0x00, 0x00, 0xAC, 0xB1, 0x26, 0x01, 0x01, 0x11, 0x06, 0x08, 0xA3,
+       0x05, 0x02, 0x50, 0x29, 0xB1, 0x04, 0x02, 0x50, 0x29, 0x26, 0x01, 0x02,
+       0x11, 0x06, 0x0C, 0x25, 0x72, 0xAD, 0x65, 0x2B, 0x40, 0x0D, 0x06, 0x02,
+       0x50, 0x29, 0xB1, 0x01, 0x7F, 0x10, 0x06, 0x02, 0x55, 0x29, 0x25, 0x76,
+       0x00, 0x00, 0xAC, 0x26, 0x06, 0x1A, 0xAC, 0x9B, 0x25, 0x26, 0x06, 0x11,
+       0xAC, 0x26, 0x06, 0x0C, 0xAC, 0x9B, 0x25, 0x86, 0x27, 0x05, 0x02, 0x48,
+       0x29, 0xBF, 0x04, 0x71, 0x76, 0x76, 0x04, 0x63, 0x76, 0x00, 0x02, 0x03,
+       0x00, 0xB0, 0x01, 0x03, 0x75, 0xAA, 0xB7, 0x03, 0x01, 0x02, 0x01, 0x01,
+       0x07, 0x12, 0x06, 0x02, 0x55, 0x29, 0x26, 0x01, 0x00, 0x30, 0x11, 0x06,
+       0x05, 0x25, 0x4C, 0x29, 0x04, 0x15, 0x01, 0x01, 0x30, 0x11, 0x06, 0x0A,
+       0x25, 0xB7, 0x02, 0x01, 0x14, 0x02, 0x01, 0x0E, 0x04, 0x05, 0x25, 0xB7,
+       0x01, 0x00, 0x25, 0x02, 0x00, 0x06, 0x19, 0x01, 0x00, 0x30, 0x01, 0x38,
+       0x15, 0x06, 0x03, 0x01, 0x10, 0x2F, 0x3A, 0x01, 0x81, 0x40, 0x15, 0x06,
+       0x03, 0x01, 0x20, 0x2F, 0x61, 0x36, 0x04, 0x07, 0x01, 0x04, 0x15, 0x05,
+       0x02, 0x4C, 0x29, 0xBF, 0x00, 0x00, 0x37, 0xAC, 0xBF, 0x1B, 0x00, 0x03,
+       0x01, 0x00, 0x03, 0x00, 0x37, 0xAC, 0x26, 0x06, 0x30, 0xB0, 0x01, 0x11,
+       0x74, 0xAA, 0x26, 0x05, 0x02, 0x43, 0x29, 0x26, 0x06, 0x20, 0xAC, 0x9B,
+       0x25, 0x84, 0x27, 0x03, 0x01, 0x01, 0x00, 0x2E, 0x03, 0x02, 0xAF, 0x26,
+       0x02, 0x01, 0x15, 0x06, 0x07, 0x2C, 0x06, 0x04, 0x01, 0x7F, 0x03, 0x00,
+       0x02, 0x02, 0x20, 0x76, 0x04, 0x5D, 0x76, 0x04, 0x4D, 0x76, 0x1B, 0x02,
+       0x00, 0x00, 0x00, 0xB0, 0x01, 0x06, 0x75, 0xAE, 0x00, 0x00, 0xB5, 0x83,
+       0x06, 0x0E, 0x3A, 0x26, 0x05, 0x06, 0x41, 0x01, 0x00, 0x01, 0x00, 0x00,
+       0xB5, 0x6B, 0x04, 0x08, 0x8F, 0x06, 0x05, 0x25, 0x01, 0x00, 0x04, 0x00,
+       0x00, 0x00, 0xB6, 0x83, 0x06, 0x0E, 0x3A, 0x26, 0x05, 0x06, 0x41, 0x01,
+       0x00, 0x01, 0x00, 0x00, 0xB6, 0x6B, 0x04, 0x08, 0x8F, 0x06, 0x05, 0x25,
+       0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0xB7, 0x26, 0x01, 0x81, 0x00, 0x0D,
+       0x06, 0x04, 0x00, 0x04, 0x80, 0x55, 0x26, 0x01, 0x81, 0x40, 0x0D, 0x06,
+       0x07, 0x25, 0x01, 0x00, 0x00, 0x04, 0x80, 0x47, 0x26, 0x01, 0x81, 0x60,
+       0x0D, 0x06, 0x0E, 0x01, 0x1F, 0x15, 0x01, 0x01, 0xA0, 0x01, 0x81, 0x00,
+       0x01, 0x8F, 0x7F, 0x04, 0x32, 0x26, 0x01, 0x81, 0x70, 0x0D, 0x06, 0x0F,
+       0x01, 0x0F, 0x15, 0x01, 0x02, 0xA0, 0x01, 0x90, 0x00, 0x01, 0x83, 0xFF,
+       0x7F, 0x04, 0x1C, 0x26, 0x01, 0x81, 0x78, 0x0D, 0x06, 0x11, 0x01, 0x07,
+       0x15, 0x01, 0x03, 0xA0, 0x01, 0x84, 0x80, 0x00, 0x01, 0x80, 0xC3, 0xFF,
+       0x7F, 0x04, 0x04, 0x25, 0x01, 0x00, 0x00, 0x6F, 0x05, 0x03, 0x25, 0x01,
+       0x00, 0x00, 0x00, 0x3A, 0x26, 0x05, 0x06, 0x41, 0x01, 0x00, 0x01, 0x7F,
+       0x00, 0xB7, 0x33, 0x26, 0x3C, 0x06, 0x03, 0x3A, 0x25, 0x00, 0x01, 0x06,
+       0x0E, 0x3A, 0x26, 0x01, 0x06, 0x14, 0x01, 0x02, 0x10, 0x06, 0x04, 0x41,
+       0x01, 0x7F, 0x00, 0x01, 0x3F, 0x15, 0x09, 0x00, 0x00, 0x26, 0x06, 0x06,
+       0x0B, 0x9F, 0x33, 0x40, 0x04, 0x77, 0x25, 0x26, 0x00, 0x00, 0xB0, 0x01,
+       0x03, 0x75, 0xAA, 0xB7, 0x06, 0x02, 0x54, 0x29, 0x00, 0x00, 0x3A, 0x26,
+       0x06, 0x07, 0x31, 0x26, 0x06, 0x01, 0x1A, 0x04, 0x76, 0x41, 0x00, 0x00,
+       0x01, 0x01, 0x75, 0xA9, 0x01, 0x01, 0x10, 0x06, 0x02, 0x42, 0x29, 0xB7,
+       0x3D, 0x00, 0x04, 0xB0, 0x26, 0x01, 0x17, 0x01, 0x18, 0x6F, 0x05, 0x02,
+       0x47, 0x29, 0x01, 0x18, 0x11, 0x03, 0x00, 0x72, 0xAA, 0xA5, 0x02, 0x00,
+       0x06, 0x0C, 0x01, 0x80, 0x64, 0x08, 0x03, 0x01, 0xA5, 0x02, 0x01, 0x09,
+       0x04, 0x0E, 0x26, 0x01, 0x32, 0x0D, 0x06, 0x04, 0x01, 0x80, 0x64, 0x09,
+       0x01, 0x8E, 0x6C, 0x09, 0x03, 0x01, 0x02, 0x01, 0x01, 0x82, 0x6D, 0x08,
+       0x02, 0x01, 0x01, 0x03, 0x09, 0x01, 0x04, 0x0C, 0x09, 0x02, 0x01, 0x01,
+       0x80, 0x63, 0x09, 0x01, 0x80, 0x64, 0x0C, 0x0A, 0x02, 0x01, 0x01, 0x83,
+       0x0F, 0x09, 0x01, 0x83, 0x10, 0x0C, 0x09, 0x03, 0x03, 0x01, 0x01, 0x01,
+       0x0C, 0xA6, 0x40, 0x01, 0x01, 0x0E, 0x02, 0x01, 0x01, 0x04, 0x07, 0x3E,
+       0x02, 0x01, 0x01, 0x80, 0x64, 0x07, 0x3D, 0x02, 0x01, 0x01, 0x83, 0x10,
+       0x07, 0x3E, 0x2F, 0x15, 0x06, 0x03, 0x01, 0x18, 0x09, 0x91, 0x09, 0x78,
+       0x26, 0x01, 0x05, 0x14, 0x02, 0x03, 0x09, 0x03, 0x03, 0x01, 0x1F, 0x15,
+       0x01, 0x01, 0x3A, 0xA6, 0x02, 0x03, 0x09, 0x40, 0x03, 0x03, 0x01, 0x00,
+       0x01, 0x17, 0xA6, 0x01, 0x9C, 0x10, 0x08, 0x03, 0x02, 0x01, 0x00, 0x01,
+       0x3B, 0xA6, 0x01, 0x3C, 0x08, 0x02, 0x02, 0x09, 0x03, 0x02, 0x01, 0x00,
+       0x01, 0x3C, 0xA6, 0x02, 0x02, 0x09, 0x03, 0x02, 0xB7, 0x26, 0x01, 0x2E,
+       0x11, 0x06, 0x0D, 0x25, 0xB7, 0x26, 0x01, 0x30, 0x01, 0x39, 0x6F, 0x06,
+       0x03, 0x25, 0x04, 0x74, 0x01, 0x80, 0x5A, 0x10, 0x06, 0x02, 0x47, 0x29,
+       0x76, 0x02, 0x03, 0x02, 0x02, 0x00, 0x01, 0xB7, 0x7A, 0x01, 0x0A, 0x08,
+       0x03, 0x00, 0xB7, 0x7A, 0x02, 0x00, 0x09, 0x00, 0x02, 0x03, 0x00, 0x03,
+       0x01, 0xA5, 0x26, 0x02, 0x01, 0x02, 0x00, 0x6F, 0x05, 0x02, 0x47, 0x29,
+       0x00, 0x00, 0x33, 0xB0, 0x01, 0x02, 0x75, 0x0B, 0xA8, 0x00, 0x03, 0x26,
+       0x03, 0x00, 0x03, 0x01, 0x03, 0x02, 0xAA, 0xB7, 0x26, 0x01, 0x81, 0x00,
+       0x13, 0x06, 0x02, 0x53, 0x29, 0x26, 0x01, 0x00, 0x11, 0x06, 0x0B, 0x25,
+       0x26, 0x05, 0x04, 0x25, 0x01, 0x00, 0x00, 0xB7, 0x04, 0x6F, 0x02, 0x01,
+       0x26, 0x05, 0x02, 0x4F, 0x29, 0x40, 0x03, 0x01, 0x02, 0x02, 0x36, 0x02,
+       0x02, 0x3F, 0x03, 0x02, 0x26, 0x06, 0x03, 0xB7, 0x04, 0x68, 0x25, 0x02,
+       0x00, 0x02, 0x01, 0x0A, 0x00, 0x01, 0xB7, 0x26, 0x01, 0x81, 0x00, 0x0D,
+       0x06, 0x01, 0x00, 0x01, 0x81, 0x00, 0x0A, 0x26, 0x05, 0x02, 0x4D, 0x29,
+       0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x12, 0x06, 0x19, 0x02,
+       0x00, 0x40, 0x03, 0x00, 0x26, 0x01, 0x83, 0xFF, 0xFF, 0x7F, 0x12, 0x06,
+       0x02, 0x4E, 0x29, 0x01, 0x08, 0x0E, 0x3A, 0xB7, 0x33, 0x09, 0x04, 0x60,
+       0x00, 0x00, 0xA9, 0x92, 0x00, 0x00, 0xAA, 0xBF, 0x00, 0x00, 0xB0, 0x73,
+       0xAA, 0x00, 0x01, 0xAA, 0x26, 0x05, 0x02, 0x53, 0x29, 0xB7, 0x26, 0x01,
+       0x81, 0x00, 0x13, 0x06, 0x02, 0x53, 0x29, 0x03, 0x00, 0x26, 0x06, 0x16,
+       0xB7, 0x02, 0x00, 0x26, 0x01, 0x87, 0xFF, 0xFF, 0x7F, 0x13, 0x06, 0x02,
+       0x53, 0x29, 0x01, 0x08, 0x0E, 0x09, 0x03, 0x00, 0x04, 0x67, 0x25, 0x02,
+       0x00, 0x00, 0x00, 0xAA, 0x26, 0x01, 0x81, 0x7F, 0x12, 0x06, 0x08, 0xBF,
+       0x01, 0x00, 0x66, 0x36, 0x01, 0x00, 0x00, 0x26, 0x66, 0x36, 0x66, 0x3F,
+       0xA2, 0x01, 0x7F, 0x00, 0x00, 0xB0, 0x01, 0x0C, 0x30, 0x11, 0x06, 0x05,
+       0x25, 0x72, 0xB3, 0x04, 0x3E, 0x01, 0x12, 0x30, 0x11, 0x06, 0x05, 0x25,
+       0x72, 0xB4, 0x04, 0x33, 0x01, 0x13, 0x30, 0x11, 0x06, 0x05, 0x25, 0x72,
+       0xB4, 0x04, 0x28, 0x01, 0x14, 0x30, 0x11, 0x06, 0x05, 0x25, 0x72, 0xB4,
+       0x04, 0x1D, 0x01, 0x16, 0x30, 0x11, 0x06, 0x05, 0x25, 0x72, 0xB4, 0x04,
+       0x12, 0x01, 0x1E, 0x30, 0x11, 0x06, 0x05, 0x25, 0x72, 0xB2, 0x04, 0x07,
+       0x41, 0xAB, 0x01, 0x00, 0x01, 0x00, 0x25, 0x00, 0x01, 0xB7, 0x03, 0x00,
+       0x02, 0x00, 0x01, 0x05, 0x14, 0x01, 0x01, 0x15, 0x2D, 0x02, 0x00, 0x01,
+       0x06, 0x14, 0x26, 0x01, 0x01, 0x15, 0x06, 0x02, 0x45, 0x29, 0x01, 0x04,
+       0x0E, 0x02, 0x00, 0x01, 0x1F, 0x15, 0x26, 0x01, 0x1F, 0x11, 0x06, 0x02,
+       0x46, 0x29, 0x09, 0x00, 0x00, 0x26, 0x05, 0x05, 0x01, 0x00, 0x01, 0x7F,
+       0x00, 0xB0, 0x00, 0x01, 0xAA, 0x26, 0x05, 0x05, 0x66, 0x36, 0x01, 0x7F,
+       0x00, 0x01, 0x01, 0x03, 0x00, 0x9C, 0x26, 0x01, 0x83, 0xFF, 0x7E, 0x11,
+       0x06, 0x16, 0x25, 0x26, 0x06, 0x10, 0x9D, 0x26, 0x05, 0x05, 0x25, 0xBF,
+       0x01, 0x00, 0x00, 0x02, 0x00, 0x81, 0x03, 0x00, 0x04, 0x6D, 0x04, 0x1B,
+       0x26, 0x05, 0x05, 0x25, 0xBF, 0x01, 0x00, 0x00, 0x02, 0x00, 0x81, 0x03,
+       0x00, 0x26, 0x06, 0x0B, 0x9C, 0x26, 0x05, 0x05, 0x25, 0xBF, 0x01, 0x00,
+       0x00, 0x04, 0x6D, 0x25, 0x02, 0x00, 0x26, 0x05, 0x01, 0x00, 0x40, 0x66,
+       0x36, 0x01, 0x7F, 0x00, 0x01, 0xAA, 0x01, 0x01, 0x03, 0x00, 0x26, 0x06,
+       0x10, 0x9E, 0x26, 0x05, 0x05, 0x25, 0xBF, 0x01, 0x00, 0x00, 0x02, 0x00,
+       0x81, 0x03, 0x00, 0x04, 0x6D, 0x25, 0x02, 0x00, 0x26, 0x05, 0x01, 0x00,
+       0x40, 0x66, 0x36, 0x01, 0x7F, 0x00, 0x01, 0xAA, 0x01, 0x01, 0x03, 0x00,
+       0x26, 0x06, 0x10, 0xB7, 0x26, 0x05, 0x05, 0x25, 0xBF, 0x01, 0x00, 0x00,
+       0x02, 0x00, 0x81, 0x03, 0x00, 0x04, 0x6D, 0x25, 0x02, 0x00, 0x26, 0x05,
+       0x01, 0x00, 0x40, 0x66, 0x36, 0x01, 0x7F, 0x00, 0x00, 0xB7, 0x01, 0x08,
+       0x0E, 0x3A, 0xB7, 0x33, 0x09, 0x00, 0x00, 0xB7, 0x3A, 0xB7, 0x01, 0x08,
+       0x0E, 0x33, 0x09, 0x00, 0x00, 0x26, 0x05, 0x02, 0x4E, 0x29, 0x40, 0xB8,
+       0x00, 0x00, 0x32, 0x26, 0x01, 0x00, 0x13, 0x06, 0x01, 0x00, 0x25, 0x1A,
+       0x04, 0x74, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x0B, 0x00, 0x00, 0x01,
+       0x15, 0x00, 0x00, 0x01, 0x1F, 0x00, 0x00, 0x01, 0x29, 0x00, 0x00, 0x01,
+       0x33, 0x00, 0x00, 0xC0, 0x25, 0x00, 0x00, 0x26, 0x06, 0x07, 0xC1, 0x26,
+       0x06, 0x01, 0x1A, 0x04, 0x76, 0x00, 0x00, 0x01, 0x00, 0x30, 0x31, 0x0B,
+       0x41, 0x00, 0x00, 0x01, 0x81, 0x70, 0x00, 0x00, 0x01, 0x82, 0x0D, 0x00,
+       0x00, 0x01, 0x82, 0x22, 0x00, 0x00, 0x01, 0x82, 0x05, 0x00, 0x00, 0x26,
+       0x01, 0x83, 0xFB, 0x50, 0x01, 0x83, 0xFB, 0x6F, 0x6F, 0x06, 0x04, 0x25,
+       0x01, 0x00, 0x00, 0x26, 0x01, 0x83, 0xB0, 0x00, 0x01, 0x83, 0xBF, 0x7F,
+       0x6F, 0x06, 0x04, 0x25, 0x01, 0x00, 0x00, 0x01, 0x83, 0xFF, 0x7F, 0x15,
+       0x01, 0x83, 0xFF, 0x7E, 0x0D, 0x00
 };
 
 static const uint16_t t0_caddr[] = {
@@ -755,106 +752,103 @@ static const uint16_t t0_caddr[] = {
        188,
        193,
        198,
-       202,
-       207,
-       212,
-       217,
-       238,
-       243,
-       248,
-       253,
-       282,
-       297,
+       203,
+       208,
+       213,
+       234,
+       239,
+       244,
+       249,
+       264,
+       269,
+       275,
+       281,
+       286,
+       294,
        302,
        308,
-       314,
-       319,
-       327,
-       335,
-       341,
-       346,
-       357,
-       992,
-       1007,
-       1011,
-       1016,
-       1021,
-       1026,
-       1031,
-       1036,
+       313,
+       324,
+       960,
+       975,
+       979,
+       984,
+       989,
+       994,
+       999,
+       1004,
+       1118,
+       1123,
+       1135,
+       1140,
+       1145,
        1150,
-       1155,
-       1167,
-       1172,
-       1177,
-       1182,
-       1186,
-       1191,
-       1196,
-       1201,
+       1154,
+       1159,
+       1164,
+       1169,
+       1174,
+       1184,
+       1189,
+       1194,
        1206,
-       1216,
        1221,
        1226,
-       1238,
-       1253,
-       1258,
-       1272,
-       1294,
-       1305,
-       1408,
-       1455,
-       1488,
-       1579,
-       1585,
-       1648,
-       1655,
-       1683,
-       1711,
-       1816,
-       1858,
-       1871,
-       1883,
-       1897,
-       1912,
-       2132,
-       2146,
-       2163,
-       2172,
-       2239,
-       2295,
-       2299,
-       2303,
-       2308,
-       2356,
-       2382,
-       2458,
-       2502,
-       2513,
-       2598,
-       2636,
-       2674,
+       1240,
+       1262,
+       1273,
+       1376,
+       1423,
+       1456,
+       1547,
+       1553,
+       1616,
+       1623,
+       1651,
+       1679,
+       1784,
+       1826,
+       1839,
+       1851,
+       1865,
+       1880,
+       2100,
+       2114,
+       2131,
+       2140,
+       2207,
+       2263,
+       2267,
+       2271,
+       2276,
+       2324,
+       2350,
+       2426,
+       2470,
+       2481,
+       2566,
+       2604,
+       2642,
+       2652,
+       2662,
+       2671,
        2684,
-       2694,
-       2703,
-       2716,
-       2720,
+       2688,
+       2692,
+       2696,
+       2700,
+       2704,
+       2708,
+       2712,
        2724,
-       2728,
        2732,
-       2736,
-       2740,
-       2744,
-       2756,
-       2764,
-       2769,
-       2774,
-       2779,
-       2784,
-       2792
+       2737,
+       2742,
+       2747,
+       2752
 };
 
-#define T0_INTERPRETED   61
+#define T0_INTERPRETED   60
 
 #define T0_ENTER(ip, rp, slot)   do { \
                const unsigned char *t0_newip; \
@@ -875,7 +869,7 @@ name(void *ctx) \
        T0_ENTER(t0ctx->ip, t0ctx->rp, slot); \
 }
 
-T0_DEFENTRY(br_x509_minimal_init_main, 147)
+T0_DEFENTRY(br_x509_minimal_init_main, 144)
 
 #define T0_NEXT(t0ipp)   (*(*(t0ipp)) ++)
 
@@ -1205,11 +1199,61 @@ br_x509_minimal_run(void *t0ctx)
                                }
                                break;
                        case 25: {
+                               /* check-validity-range */
+
+       uint32_t nbs = T0_POP();
+       uint32_t nbd = T0_POP();
+       uint32_t nas = T0_POP();
+       uint32_t nad = T0_POP();
+       int r;
+       if (CTX->itime != 0) {
+               r = CTX->itime(CTX->itime_ctx, nbd, nbs, nad, nas);
+               if (r < -1 || r > 1) {
+                       CTX->err = BR_ERR_X509_TIME_UNKNOWN;
+                       T0_CO();
+               }
+       } else {
+               uint32_t vd = CTX->days;
+               uint32_t vs = CTX->seconds;
+               if (vd == 0 && vs == 0) {
+#if BR_USE_UNIX_TIME
+                       time_t x = time(NULL);
+
+                       vd = (uint32_t)(x / 86400) + 719528;
+                       vs = (uint32_t)(x % 86400);
+#elif BR_USE_WIN32_TIME
+                       FILETIME ft;
+                       uint64_t x;
+
+                       GetSystemTimeAsFileTime(&ft);
+                       x = ((uint64_t)ft.dwHighDateTime << 32)
+                               + (uint64_t)ft.dwLowDateTime;
+                       x = (x / 10000000);
+                       vd = (uint32_t)(x / 86400) + 584754;
+                       vs = (uint32_t)(x % 86400);
+#else
+                       CTX->err = BR_ERR_X509_TIME_UNKNOWN;
+                       T0_CO();
+#endif
+               }
+               if (vd < nbd || (vd == nbd && vs < nbs)) {
+                       r = -1;
+               } else if (vd > nad || (vd == nad && vs > nas)) {
+                       r = 1;
+               } else {
+                       r = 0;
+               }
+       }
+       T0_PUSHi(r);
+
+                               }
+                               break;
+                       case 26: {
                                /* co */
  T0_CO(); 
                                }
                                break;
-                       case 26: {
+                       case 27: {
                                /* compute-dn-hash */
 
        CTX->dn_hash_impl->out(&CTX->dn_hash.vtable, CTX->current_dn_hash);
@@ -1217,7 +1261,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 27: {
+                       case 28: {
                                /* compute-tbs-hash */
 
        int id = T0_POPi();
@@ -1227,7 +1271,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 28: {
+                       case 29: {
                                /* copy-ee-ec-pkey */
 
        size_t qlen = T0_POP();
@@ -1240,7 +1284,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 29: {
+                       case 30: {
                                /* copy-ee-rsa-pkey */
 
        size_t elen = T0_POP();
@@ -1254,7 +1298,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 30: {
+                       case 31: {
                                /* copy-name-SAN */
 
        unsigned tag = T0_POP();
@@ -1280,7 +1324,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 31: {
+                       case 32: {
                                /* copy-name-element */
 
        size_t len;
@@ -1306,7 +1350,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 32: {
+                       case 33: {
                                /* data-get8 */
 
        size_t addr = T0_POP();
@@ -1314,14 +1358,14 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 33: {
+                       case 34: {
                                /* dn-hash-length */
 
        T0_PUSH(DNHASH_LEN);
 
                                }
                                break;
-                       case 34: {
+                       case 35: {
                                /* do-ecdsa-vrfy */
 
        size_t qlen = T0_POP();
@@ -1336,7 +1380,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 35: {
+                       case 36: {
                                /* do-rsa-vrfy */
 
        size_t elen = T0_POP();
@@ -1352,17 +1396,17 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 36: {
+                       case 37: {
                                /* drop */
  (void)T0_POP(); 
                                }
                                break;
-                       case 37: {
+                       case 38: {
                                /* dup */
  T0_PUSH(T0_PEEK(0)); 
                                }
                                break;
-                       case 38: {
+                       case 39: {
                                /* eqOID */
 
        const unsigned char *a2 = &t0_datablock[T0_POP()];
@@ -1378,7 +1422,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 39: {
+                       case 40: {
                                /* eqblob */
 
        size_t len = T0_POP();
@@ -1388,42 +1432,12 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 40: {
+                       case 41: {
                                /* fail */
 
        CTX->err = T0_POPi();
        T0_CO();
 
-                               }
-                               break;
-                       case 41: {
-                               /* get-system-date */
-
-       if (CTX->days == 0 && CTX->seconds == 0) {
-#if BR_USE_UNIX_TIME
-               time_t x = time(NULL);
-
-               T0_PUSH((uint32_t)(x / 86400) + 719528);
-               T0_PUSH((uint32_t)(x % 86400));
-#elif BR_USE_WIN32_TIME
-               FILETIME ft;
-               uint64_t x;
-
-               GetSystemTimeAsFileTime(&ft);
-               x = ((uint64_t)ft.dwHighDateTime << 32)
-                       + (uint64_t)ft.dwLowDateTime;
-               x = (x / 10000000);
-               T0_PUSH((uint32_t)(x / 86400) + 584754);
-               T0_PUSH((uint32_t)(x % 86400));
-#else
-               CTX->err = BR_ERR_X509_TIME_UNKNOWN;
-               T0_CO();
-#endif
-       } else {
-               T0_PUSH(CTX->days);
-               T0_PUSH(CTX->seconds);
-       }
-
                                }
                                break;
                        case 42: {
@@ -1579,16 +1593,11 @@ br_x509_minimal_run(void *t0ctx)
                                }
                                break;
                        case 51: {
-                               /* roll */
- T0_ROLL(T0_POP()); 
-                               }
-                               break;
-                       case 52: {
                                /* rot */
  T0_ROT(); 
                                }
                                break;
-                       case 53: {
+                       case 52: {
                                /* set16 */
 
        uint32_t addr = T0_POP();
@@ -1596,7 +1605,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 54: {
+                       case 53: {
                                /* set32 */
 
        uint32_t addr = T0_POP();
@@ -1604,7 +1613,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 55: {
+                       case 54: {
                                /* set8 */
 
        uint32_t addr = T0_POP();
@@ -1612,7 +1621,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 56: {
+                       case 55: {
                                /* start-dn-hash */
 
        CTX->dn_hash_impl->init(&CTX->dn_hash.vtable);
@@ -1620,7 +1629,7 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 57: {
+                       case 56: {
                                /* start-tbs-hash */
 
        br_multihash_init(&CTX->mhash);
@@ -1628,19 +1637,19 @@ br_x509_minimal_run(void *t0ctx)
 
                                }
                                break;
-                       case 58: {
+                       case 57: {
                                /* stop-tbs-hash */
 
        CTX->do_mhash = 0;
 
                                }
                                break;
-                       case 59: {
+                       case 58: {
                                /* swap */
  T0_SWAP(); 
                                }
                                break;
-                       case 60: {
+                       case 59: {
                                /* zero-server-name */
 
        T0_PUSHi(-(CTX->server_name == NULL));

diff --git a/src/x509/x509_minimal.t0 b/src/x509/x509_minimal.t0
index 50995dc..80a3701 100644 (file)
--- a/src/x509/x509_minimal.t0
+++ b/src/x509/x509_minimal.t0
@@ -698,42 +698,60 @@ cc: copy-name-SAN ( bool tag -- ) {
        \ Return the CN match flag.
        eename-matches ;
 
-\ Get the validation date and time from the context or system.
-cc: get-system-date ( -- days seconds ) {
-       if (CTX->days == 0 && CTX->seconds == 0) {
+\ Check the provided validity range against the current (or configured)
+\ date and time ("na" = notAfter, "nb = notBefore). Returned value:
+\   -1   current date/time is before the notBefore date
+\    0   current date/time is within the allowed range
+\   +1   current date/time is after the notAfter range
+\ If the current date/time is not available, then this function triggers a
+\ failure and does not return.
+cc: check-validity-range ( na-days na-seconds nb-days nb-seconds -- int ) {
+       uint32_t nbs = T0_POP();
+       uint32_t nbd = T0_POP();
+       uint32_t nas = T0_POP();
+       uint32_t nad = T0_POP();
+       int r;
+       if (CTX->itime != 0) {
+               r = CTX->itime(CTX->itime_ctx, nbd, nbs, nad, nas);
+               if (r < -1 || r > 1) {
+                       CTX->err = BR_ERR_X509_TIME_UNKNOWN;
+                       T0_CO();
+               }
+       } else {
+               uint32_t vd = CTX->days;
+               uint32_t vs = CTX->seconds;
+               if (vd == 0 && vs == 0) {
 #if BR_USE_UNIX_TIME
-               time_t x = time(NULL);
+                       time_t x = time(NULL);
 
-               T0_PUSH((uint32_t)(x / 86400) + 719528);
-               T0_PUSH((uint32_t)(x % 86400));
+                       vd = (uint32_t)(x / 86400) + 719528;
+                       vs = (uint32_t)(x % 86400);
 #elif BR_USE_WIN32_TIME
-               FILETIME ft;
-               uint64_t x;
-
-               GetSystemTimeAsFileTime(&ft);
-               x = ((uint64_t)ft.dwHighDateTime << 32)
-                       + (uint64_t)ft.dwLowDateTime;
-               x = (x / 10000000);
-               T0_PUSH((uint32_t)(x / 86400) + 584754);
-               T0_PUSH((uint32_t)(x % 86400));
+                       FILETIME ft;
+                       uint64_t x;
+
+                       GetSystemTimeAsFileTime(&ft);
+                       x = ((uint64_t)ft.dwHighDateTime << 32)
+                               + (uint64_t)ft.dwLowDateTime;
+                       x = (x / 10000000);
+                       vd = (uint32_t)(x / 86400) + 584754;
+                       vs = (uint32_t)(x % 86400);
 #else
-               CTX->err = BR_ERR_X509_TIME_UNKNOWN;
-               T0_CO();
+                       CTX->err = BR_ERR_X509_TIME_UNKNOWN;
+                       T0_CO();
 #endif
-       } else {
-               T0_PUSH(CTX->days);
-               T0_PUSH(CTX->seconds);
+               }
+               if (vd < nbd || (vd == nbd && vs < nbs)) {
+                       r = -1;
+               } else if (vd > nad || (vd == nad && vs > nas)) {
+                       r = 1;
+               } else {
+                       r = 0;
+               }
        }
+       T0_PUSHi(r);
 }
 
-\ Compare two dates (days+seconds) together.
-: before ( days1 seconds1 days2 seconds2 -- bool )
-       { d1 s1 d2 s2 }
-       d1 d2 = if s1 s2 < else d1 d2 < then ;
-
-: after ( days1 seconds1 days2 seconds2 -- bool )
-       swap2 before ;
-
 \ Swap the top two elements with the two elements immediately below.
 : swap2 ( a b c d -- c d a b )
        3 roll 3 roll ;
@@ -1189,8 +1207,8 @@ OID: subjectInfoAccess             1.3.6.1.5.5.7.1.11
 
        \ Validity dates.
        read-sequence-open
-       read-date get-system-date after if ERR_X509_EXPIRED fail then
-       read-date get-system-date before if ERR_X509_EXPIRED fail then
+       read-date { nbd nbs } read-date nbd nbs check-validity-range
+       if ERR_X509_EXPIRED fail then
        close-elt
 
        \ Subject name.

diff --git a/test/test_x509.c b/test/test_x509.c
index 2c61cf5..c007068 100644 (file)
--- a/test/test_x509.c
+++ b/test/test_x509.c
@@ -1438,6 +1438,21 @@ eqpkey(const br_x509_pkey *pk1, const br_x509_pkey *pk2)
 static size_t max_dp_usage;
 static size_t max_rp_usage;
 
+static int
+check_time(void *ctx, uint32_t nbd, uint32_t nbs, uint32_t nad, uint32_t nas)
+{
+       test_case *tc;
+
+       tc = ctx;
+       if (tc->days < nbd || (tc->days == nbd && tc->seconds < nbs)) {
+               return -1;
+       }
+       if (tc->days > nad || (tc->days == nad && tc->seconds > nas)) {
+               return 1;
+       }
+       return 0;
+}
+
 static void
 run_test_case(test_case *tc)
 {
@@ -1452,6 +1467,7 @@ run_test_case(test_case *tc)
        const br_x509_pkey *ee_pkey;
        unsigned usages;
        unsigned status;
+       int j;
 
        printf("%s: ", tc->name);
        fflush(stdout);
@@ -1520,110 +1536,130 @@ run_test_case(test_case *tc)
        }
 
        /*
-        * Initialise the engine.
+        * We do the test twice, to exercise distinct API functions.
         */
-       br_x509_minimal_init(&ctx, dnhash, anchors, num_anchors);
-       for (u = 0; hash_impls[u].id; u ++) {
-               int id;
+       for (j = 0; j < 2; j ++) {
+               /*
+                * Initialise the engine.
+                */
+               br_x509_minimal_init(&ctx, dnhash, anchors, num_anchors);
+               for (u = 0; hash_impls[u].id; u ++) {
+                       int id;
+
+                       id = hash_impls[u].id;
+                       if ((tc->hashes & ((unsigned)1 << id)) != 0) {
+                               br_x509_minimal_set_hash(&ctx,
+                                       id, hash_impls[u].impl);
+                       }
+               }
+               br_x509_minimal_set_rsa(&ctx, br_rsa_pkcs1_vrfy_get_default());
+               br_x509_minimal_set_ecdsa(&ctx,
+                       br_ec_get_default(), br_ecdsa_vrfy_asn1_get_default());
 
-               id = hash_impls[u].id;
-               if ((tc->hashes & ((unsigned)1 << id)) != 0) {
-                       br_x509_minimal_set_hash(&ctx, id, hash_impls[u].impl);
+               /*
+                * Set the validation date.
+                */
+               if (j == 0) {
+                       br_x509_minimal_set_time(&ctx, tc->days, tc->seconds);
+               } else {
+                       br_x509_minimal_set_time_callback(&ctx,
+                               tc, &check_time);
                }
-       }
-       br_x509_minimal_set_rsa(&ctx, br_rsa_pkcs1_vrfy_get_default());
-       br_x509_minimal_set_ecdsa(&ctx,
-               br_ec_get_default(), br_ecdsa_vrfy_asn1_get_default());
 
-       /*
-        * Set the validation date.
-        */
-       br_x509_minimal_set_time(&ctx, tc->days, tc->seconds);
+               /*
+                * Put "canaries" to detect actual stack usage.
+                */
+               for (u = 0; u < (sizeof ctx.dp_stack) / sizeof(uint32_t);
+                       u ++)
+               {
+                       ctx.dp_stack[u] = 0xA7C083FE;
+               }
+               for (u = 0; u < (sizeof ctx.rp_stack) / sizeof(uint32_t);
+                       u ++)
+               {
+                       ctx.rp_stack[u] = 0xA7C083FE;
+               }
 
-       /*
-        * Put "canaries" to detect actual stack usage.
-        */
-       for (u = 0; u < (sizeof ctx.dp_stack) / sizeof(uint32_t); u ++) {
-               ctx.dp_stack[u] = 0xA7C083FE;
-       }
-       for (u = 0; u < (sizeof ctx.rp_stack) / sizeof(uint32_t); u ++) {
-               ctx.rp_stack[u] = 0xA7C083FE;
-       }
+               /*
+                * Run the engine. We inject certificates by chunks of 100
+                * bytes in order to exercise the coroutine API.
+                */
+               ctx.vtable->start_chain(&ctx.vtable, tc->servername);
+               for (u = 0; u < num_certs; u ++) {
+                       size_t v;
 
-       /*
-        * Run the engine. We inject certificates by chunks of 100 bytes
-        * in order to exercise the coroutine API.
-        */
-       ctx.vtable->start_chain(&ctx.vtable, tc->servername);
-       for (u = 0; u < num_certs; u ++) {
-               size_t v;
+                       ctx.vtable->start_cert(&ctx.vtable, certs[u].len);
+                       v = 0;
+                       while (v < certs[u].len) {
+                               size_t w;
 
-               ctx.vtable->start_cert(&ctx.vtable, certs[u].len);
-               v = 0;
-               while (v < certs[u].len) {
-                       size_t w;
+                               w = certs[u].len - v;
+                               if (w > 100) {
+                                       w = 100;
+                               }
+                               ctx.vtable->append(&ctx.vtable,
+                                       certs[u].data + v, w);
+                               v += w;
+                       }
+                       ctx.vtable->end_cert(&ctx.vtable);
+               }
+               status = ctx.vtable->end_chain(&ctx.vtable);
+               ee_pkey = ctx.vtable->get_pkey(&ctx.vtable, &usages);
 
-                       w = certs[u].len - v;
-                       if (w > 100) {
-                               w = 100;
+               /*
+                * Check key type and usage.
+                */
+               if (ee_pkey != NULL) {
+                       unsigned ktu;
+
+                       ktu = ee_pkey->key_type | usages;
+                       if (tc->key_type_usage != (ktu & tc->key_type_usage)) {
+                               fprintf(stderr, "wrong key type + usage"
+                                       " (expected 0x%02X, got 0x%02X)\n",
+                                       tc->key_type_usage, ktu);
+                               exit(EXIT_FAILURE);
                        }
-                       ctx.vtable->append(&ctx.vtable, certs[u].data + v, w);
-                       v += w;
                }
-               ctx.vtable->end_cert(&ctx.vtable);
-       }
-       status = ctx.vtable->end_chain(&ctx.vtable);
-       ee_pkey = ctx.vtable->get_pkey(&ctx.vtable, &usages);
 
-       /*
-        * Check key type and usage.
-        */
-       if (ee_pkey != NULL) {
-               unsigned ktu;
-
-               ktu = ee_pkey->key_type | usages;
-               if (tc->key_type_usage != (ktu & tc->key_type_usage)) {
-                       fprintf(stderr, "wrong key type + usage"
-                               " (expected 0x%02X, got 0x%02X)\n",
-                               tc->key_type_usage, ktu);
+               /*
+                * Check results. Note that we may still get a public key if
+                * the path is "not trusted" (but otherwise fine).
+                */
+               if (status != tc->status) {
+                       fprintf(stderr, "wrong status (got %d, expected %d)\n",
+                               status, tc->status);
+                       exit(EXIT_FAILURE);
+               }
+               if (status == BR_ERR_X509_NOT_TRUSTED) {
+                       ee_pkey = NULL;
+               }
+               if (!eqpkey(ee_pkey, ee_pkey_ref)) {
+                       fprintf(stderr, "wrong EE public key\n");
                        exit(EXIT_FAILURE);
                }
-       }
-
-       /*
-        * Check results. Note that we may still get a public key if
-        * the path is "not trusted" (but otherwise fine).
-        */
-       if (status != tc->status) {
-               fprintf(stderr, "wrong status (got %d, expected %d)\n",
-                       status, tc->status);
-               exit(EXIT_FAILURE);
-       }
-       if (status == BR_ERR_X509_NOT_TRUSTED) {
-               ee_pkey = NULL;
-       }
-       if (!eqpkey(ee_pkey, ee_pkey_ref)) {
-               fprintf(stderr, "wrong EE public key\n");
-               exit(EXIT_FAILURE);
-       }
 
-       /*
-        * Check stack usage.
-        */
-       for (u = (sizeof ctx.dp_stack) / sizeof(uint32_t); u > 0; u --) {
-               if (ctx.dp_stack[u - 1] != 0xA7C083FE) {
-                       if (max_dp_usage < u) {
-                               max_dp_usage = u;
+               /*
+                * Check stack usage.
+                */
+               for (u = (sizeof ctx.dp_stack) / sizeof(uint32_t);
+                       u > 0; u --)
+               {
+                       if (ctx.dp_stack[u - 1] != 0xA7C083FE) {
+                               if (max_dp_usage < u) {
+                                       max_dp_usage = u;
+                               }
+                               break;
                        }
-                       break;
                }
-       }
-       for (u = (sizeof ctx.rp_stack) / sizeof(uint32_t); u > 0; u --) {
-               if (ctx.rp_stack[u - 1] != 0xA7C083FE) {
-                       if (max_rp_usage < u) {
-                               max_rp_usage = u;
+               for (u = (sizeof ctx.rp_stack) / sizeof(uint32_t);
+                       u > 0; u --)
+               {
+                       if (ctx.rp_stack[u - 1] != 0xA7C083FE) {
+                               if (max_rp_usage < u) {
+                                       max_rp_usage = u;
+                               }
+                               break;
                        }
-                       break;
                }
        }