diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2016-07-22 13:43:41 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2016-07-22 16:15:02 +0100 |
| commit | 325da8231c8d441e6bb7f15d1a5a23ff63c842e5 (patch) | |
| tree | e015737293e61db078712059e6b63b3449f4ca7e | |
| parent | 02f873c5410e8b96c6a55cc906b8f10cd84b0835 (diff) | |
| download | openssl-325da8231c8d441e6bb7f15d1a5a23ff63c842e5.tar.gz | |
Use newest CRL.
If two CRLs are equivalent then use the one with a later lastUpdate field:
this will result in the newest CRL available being used.
RT#4615
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 626aa24849be549b7ef4f049d8427989940c8a37)
| -rw-r--r-- | crypto/x509/x509_vfy.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 389b1c2909..5873ad4c63 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1122,13 +1122,21 @@ static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509_CRL **pdcrl, crl = sk_X509_CRL_value(crls, i); reasons = *preasons; crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x); - - if (crl_score > best_score) { - best_crl = crl; - best_crl_issuer = crl_issuer; - best_score = crl_score; - best_reasons = reasons; + if (crl_score < best_score) + continue; + /* If current CRL is equivalent use it if it is newer */ + if (crl_score == best_score) { + int day, sec; + if (ASN1_TIME_diff(&day, &sec, X509_CRL_get_lastUpdate(best_crl), + X509_CRL_get_lastUpdate(crl)) == 0) + continue; + if (day < 0 || sec <= 0) + continue; } + best_crl = crl; + best_crl_issuer = crl_issuer; + best_score = crl_score; + best_reasons = reasons; } if (best_crl) { |