From cdef51f537ca523434873f5ab4bb386bcd9be028 Mon Sep 17 00:00:00 2001 From: David Garske Date: Mon, 30 Oct 2023 15:45:33 -0700 Subject: [PATCH] Add build option for disabling CRL date check (`WOLFSSL_NO_CRL_DATE_CHECK`). ZD 16675 --- wolfcrypt/src/asn.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c index e97445f56..addabe854 100644 --- a/wolfcrypt/src/asn.c +++ b/wolfcrypt/src/asn.c @@ -70,6 +70,8 @@ ASN Options: * WOLFSSL_NO_OCSP_DATE_CHECK: Disable date checks for OCSP responses. This may be required when the system's real-time clock is not very accurate. It is recommended to enforce the nonce check instead if possible. + * WOLFSSL_NO_CRL_DATE_CHECK: Disable date checks for CRL's. + * WOLFSSL_NO_CRL_NEXT_DATE: Do not fail if CRL next date is missing * WOLFSSL_FORCE_OCSP_NONCE_CHECK: Require nonces to be available in OCSP responses. The nonces are optional and may not be supported by all responders. If it can be ensured that the used responder sends nonces this @@ -36661,7 +36663,7 @@ static int ParseCRL_CertList(RevokedCert* rcert, DecodedCRL* dcrl, if (doNextDate) #endif { -#ifndef NO_ASN_TIME +#if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK) if (verify != NO_VERIFY && !XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, AFTER)) { WOLFSSL_MSG("CRL after date is no longer valid"); @@ -37191,7 +37193,7 @@ end: dcrl->nextDateFormat = (dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag != 0) ? dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag : dataASN[CRLASN_IDX_TBS_NEXTUPDATE_GT].tag; - #ifndef NO_ASN_TIME + #if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK) if (dcrl->nextDateFormat != 0) { /* Next date was set, so validate it. */ if (verify != NO_VERIFY && @@ -37202,8 +37204,8 @@ end: } } } - if (ret == 0) { - #endif + if (ret == 0) { /* in "no time" cases above "ret" is not set */ + #endif /* !NO_ASN_TIME && !WOLFSSL_NO_CRL_DATE_CHECK */ #ifdef OPENSSL_EXTRA /* Parse and store the issuer name. */ dcrl->issuerSz = GetASNItem_Length(dataASN[CRLASN_IDX_TBS_ISSUER],