feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #2124 from mstaz/ocsp_date_nonce_check_fix

Browse Source 
Ocsp date and nonce check fix
This commit is contained in:
toddouska
2019-03-11 13:29:08 -07:00
committed by GitHub
parent c0ee01bbf6 de869080be
commit b8035371f4
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
wolfcrypt/src/asn.c
View File

@@ -47,6 +47,13 @@ ASN Options:
* WOLFSSL_SMALL_CERT_VERIFY: Verify the certificate signature without using * WOLFSSL_SMALL_CERT_VERIFY: Verify the certificate signature without using
DecodedCert. Doubles up on some code but allows smaller dynamic memory DecodedCert. Doubles up on some code but allows smaller dynamic memory
usage. usage.
* WOLFSSL_NO_OCSP_DATE_CHECK: Disable date checks for OCSP responses. This
may be required when the system's real-time clock is not very accurate.
It is recommended to enforce the nonce check instead if possible.
* WOLFSSL_FORCE_OCSP_NONCE_CHECK: Require nonces to be available in OCSP
responses. The nonces are optional and may not be supported by all
responders. If it can be ensured that the used responder sends nonces this
option may improve security.
*/ */
#ifndef NO_ASN #ifndef NO_ASN
@@ -14138,8 +14145,10 @@ static int DecodeSingleResponse(byte* source,
return ASN_PARSE_E; return ASN_PARSE_E;
#ifndef NO_ASN_TIME #ifndef NO_ASN_TIME
#ifndef WOLFSSL_NO_OCSP_DATE_CHECK
if (!XVALIDATE_DATE(cs->thisDate, cs->thisDateFormat, BEFORE)) if (!XVALIDATE_DATE(cs->thisDate, cs->thisDateFormat, BEFORE))
return ASN_BEFORE_DATE_E; return ASN_BEFORE_DATE_E;
#endif
#endif #endif
/* The following items are optional. Only check for them if there is more /* The following items are optional. Only check for them if there is more
@@ -14159,8 +14168,10 @@ static int DecodeSingleResponse(byte* source,
return ASN_PARSE_E; return ASN_PARSE_E;
#ifndef NO_ASN_TIME #ifndef NO_ASN_TIME
#ifndef WOLFSSL_NO_OCSP_DATE_CHECK
if (!XVALIDATE_DATE(cs->nextDate, cs->nextDateFormat, AFTER)) if (!XVALIDATE_DATE(cs->nextDate, cs->nextDateFormat, AFTER))
return ASN_AFTER_DATE_E; return ASN_AFTER_DATE_E;
#endif
#endif #endif
} }
if (((int)(idx - prevIndex) < wrapperSz) && if (((int)(idx - prevIndex) < wrapperSz) &&
@@ -14745,7 +14756,11 @@ int CompareOcspReqResp(OcspRequest* req, OcspResponse* resp)
/* Nonces are not critical. The responder may not necessarily add /* Nonces are not critical. The responder may not necessarily add
* the nonce to the response. */ * the nonce to the response. */
if (resp->nonceSz != 0) { if (req->nonceSz
#ifndef WOLFSSL_FORCE_OCSP_NONCE_CHECK
&& resp->nonceSz != 0
#endif
) {
cmp = req->nonceSz - resp->nonceSz; cmp = req->nonceSz - resp->nonceSz;
if (cmp != 0) if (cmp != 0)
{ {