mod_md: Fix ARI renewal time selection and RFC 3339 offset parsing.

changes-entries/70309.txt

@@ -0,0 +1,4 @@
+  *) mod_md: Fix the ARI renewal time sometimes falling before the
+     CA's suggested window, never reaching its second half, and
+     parsing the hours of a non-UTC timezone offset as zero.
+     PR 70309 [Arturo Bernal]

modules/md/md_acme_drive.c

@@ -1218,7 +1218,7 @@ static apr_status_t acme_get_ari(md_proto_driver_t *d,
                           renew_end);
             continue;
         }
-        if (start > end) {
+        if (start >= end) {
             md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, rv, d->p,
                           "CA advises weird renewal between '%s' and '%s'",
                           renew_start, renew_end);
@@ -1229,9 +1229,13 @@ static apr_status_t acme_get_ari(md_proto_driver_t *d,
                       " (explantion: %s)",
                       renew_start, renew_end,
                       ari_expl_url? ari_expl_url : "none given");
-        /* select a random value between start and end */
+        /* select a random value between start and end. 'c' is an unsigned
+         * byte, 0-255; treat it as a fraction of the window (c/256, which
+         * is always < 1) rather than subtracting 128 and turning half the
+         * range negative, which put the result before 'start' half the
+         * time and never let it reach the second half of the window. */
         md_rand_bytes(&c, sizeof(c), d->p);
-        start += apr_time_from_sec((apr_time_sec(end - start) * (c - 128)) / 256);
+        start += apr_time_from_sec((apr_time_sec(end - start) * c) / 256);
         if (!*prenew_at || (start < *prenew_at)) {
           *prenew_at = start;
           *purl = apr_pstrdup(d->p, ari_expl_url);

modules/md/md_time.c

@@ -378,7 +378,7 @@ apr_time_t md_time_parse_rfc3339(const char *s)
         /* tm_gmtoff is in seconds */
         t.tm_gmtoff = (s[i+1] - '0') * 10 * (60 * 60);
         t.tm_gmtoff += (s[i+2] - '0') * (60 * 60);
-        t.tm_gmtoff = (s[i+4] - '0') * 10 * 60;
+        t.tm_gmtoff += (s[i+4] - '0') * 10 * 60;
         t.tm_gmtoff += (s[i+5] - '0') * 60;
         if (s[i] == '-')
             t.tm_gmtoff *= -1;