|
 |
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/x509/x509_lu.c.multi-crl openssl-fips-0.9.8e/crypto/x509/x509_lu.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/x509/x509_lu.c.multi-crl 2005-05-11 05:45:35.000000000 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/x509/x509_lu.c 2009-03-26 15:09:49.000000000 +0100
|
|
|
5820f5 |
@@ -453,19 +453,41 @@ X509_OBJECT *X509_OBJECT_retrieve_by_sub
|
|
|
5820f5 |
return sk_X509_OBJECT_value(h, idx);
|
|
|
5820f5 |
}
|
|
|
5820f5 |
|
|
|
5820f5 |
+static int x509_crl_match(const X509_CRL *a, const X509_CRL *b)
|
|
|
5820f5 |
+{
|
|
|
5820f5 |
+ if (a->signature == NULL || b->signature == NULL)
|
|
|
5820f5 |
+ return a->signature != b->signature;
|
|
|
5820f5 |
+
|
|
|
5820f5 |
+ if (a->signature->length != b->signature->length)
|
|
|
5820f5 |
+ return 0;
|
|
|
5820f5 |
+
|
|
|
5820f5 |
+ return memcmp(a->signature->data, b->signature->data, a->signature->length);
|
|
|
5820f5 |
+}
|
|
|
5820f5 |
+
|
|
|
5820f5 |
X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
int idx, i;
|
|
|
5820f5 |
X509_OBJECT *obj;
|
|
|
5820f5 |
idx = sk_X509_OBJECT_find(h, x);
|
|
|
5820f5 |
if (idx == -1) return NULL;
|
|
|
5820f5 |
- if (x->type != X509_LU_X509) return sk_X509_OBJECT_value(h, idx);
|
|
|
5820f5 |
+ if ((x->type != X509_LU_X509) && (x->type != X509_LU_CRL))
|
|
|
5820f5 |
+ return sk_X509_OBJECT_value(h, idx);
|
|
|
5820f5 |
for (i = idx; i < sk_X509_OBJECT_num(h); i++)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
obj = sk_X509_OBJECT_value(h, i);
|
|
|
5820f5 |
if (x509_object_cmp((const X509_OBJECT **)&obj, (const X509_OBJECT **)&x))
|
|
|
5820f5 |
return NULL;
|
|
|
5820f5 |
- if ((x->type != X509_LU_X509) || !X509_cmp(obj->data.x509, x->data.x509))
|
|
|
5820f5 |
+ if (x->type == X509_LU_X509)
|
|
|
5820f5 |
+ {
|
|
|
5820f5 |
+ if (!X509_cmp(obj->data.x509, x->data.x509))
|
|
|
5820f5 |
+ return obj;
|
|
|
5820f5 |
+ }
|
|
|
5820f5 |
+ else if (x->type == X509_LU_CRL)
|
|
|
5820f5 |
+ {
|
|
|
5820f5 |
+ if (!x509_crl_match(obj->data.crl, x->data.crl))
|
|
|
5820f5 |
+ return obj;
|
|
|
5820f5 |
+ }
|
|
|
5820f5 |
+ else
|
|
|
5820f5 |
return obj;
|
|
|
5820f5 |
}
|
|
|
5820f5 |
return NULL;
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.multi-crl openssl-fips-0.9.8e/crypto/x509/x509_vfy.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.multi-crl 2007-02-07 02:42:51.000000000 +0100
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/x509/x509_vfy.c 2009-03-26 15:00:05.000000000 +0100
|
|
|
5820f5 |
@@ -721,7 +721,38 @@ static int get_crl(X509_STORE_CTX *ctx,
|
|
|
5820f5 |
return 0;
|
|
|
5820f5 |
}
|
|
|
5820f5 |
|
|
|
5820f5 |
- *pcrl = xobj.data.crl;
|
|
|
5820f5 |
+ /* If CRL times not valid look through store */
|
|
|
5820f5 |
+ if (!check_crl_time(ctx, xobj.data.crl, 0))
|
|
|
5820f5 |
+ {
|
|
|
5820f5 |
+ int idx, i;
|
|
|
5820f5 |
+ X509_OBJECT *pobj;
|
|
|
5820f5 |
+ X509_OBJECT_free_contents(&xobj);
|
|
|
5820f5 |
+ idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs,
|
|
|
5820f5 |
+ X509_LU_CRL, nm);
|
|
|
5820f5 |
+ if (idx == -1)
|
|
|
5820f5 |
+ return 0;
|
|
|
5820f5 |
+ *pcrl = NULL;
|
|
|
5820f5 |
+ for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
|
|
|
5820f5 |
+ {
|
|
|
5820f5 |
+ pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
|
|
|
5820f5 |
+ /* Check to see if it is a CRL and issuer matches */
|
|
|
5820f5 |
+ if (pobj->type != X509_LU_CRL)
|
|
|
5820f5 |
+ break;
|
|
|
5820f5 |
+ if (X509_NAME_cmp(nm,
|
|
|
5820f5 |
+ X509_CRL_get_issuer(pobj->data.crl)))
|
|
|
5820f5 |
+ break;
|
|
|
5820f5 |
+ /* Set *pcrl because the CRL will either be valid or
|
|
|
5820f5 |
+ * a "best fit" CRL.
|
|
|
5820f5 |
+ */
|
|
|
5820f5 |
+ *pcrl = pobj->data.crl;
|
|
|
5820f5 |
+ if (check_crl_time(ctx, *pcrl, 0))
|
|
|
5820f5 |
+ break;
|
|
|
5820f5 |
+ }
|
|
|
5820f5 |
+ if (*pcrl)
|
|
|
5820f5 |
+ CRYPTO_add(&(*pcrl)->references, 1, CRYPTO_LOCK_X509);
|
|
|
5820f5 |
+ }
|
|
|
5820f5 |
+ else
|
|
|
5820f5 |
+ *pcrl = xobj.data.crl;
|
|
|
5820f5 |
if (crl)
|
|
|
5820f5 |
X509_CRL_free(crl);
|
|
|
5820f5 |
return 1;
|