wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 18:57:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6927 from dgarske/crl_no_date

Browse Source 
Add build option for disabling CRL date check
This commit is contained in:
JacobBarthelmeh
2023-11-01 14:48:28 -06:00
committed by GitHub
parent 21f34ef028 cdef51f537
commit 9e34ed937e
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
wolfcrypt/src/asn.c
View File

@ -70,6 +70,8 @@ ASN Options:
* WOLFSSL_NO_OCSP_DATE_CHECK: Disable date checks for OCSP responses. This * WOLFSSL_NO_OCSP_DATE_CHECK: Disable date checks for OCSP responses. This
may be required when the system's real-time clock is not very accurate. may be required when the system's real-time clock is not very accurate.
It is recommended to enforce the nonce check instead if possible. It is recommended to enforce the nonce check instead if possible.
* WOLFSSL_NO_CRL_DATE_CHECK: Disable date checks for CRL's.
* WOLFSSL_NO_CRL_NEXT_DATE: Do not fail if CRL next date is missing
* WOLFSSL_FORCE_OCSP_NONCE_CHECK: Require nonces to be available in OCSP * WOLFSSL_FORCE_OCSP_NONCE_CHECK: Require nonces to be available in OCSP
responses. The nonces are optional and may not be supported by all responses. The nonces are optional and may not be supported by all
responders. If it can be ensured that the used responder sends nonces this responders. If it can be ensured that the used responder sends nonces this
@ -36667,7 +36669,7 @@ static int ParseCRL_CertList(RevokedCert* rcert, DecodedCRL* dcrl,
if (doNextDate) if (doNextDate)
#endif #endif
{ {
#ifndef NO_ASN_TIME #if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK)
if (verify != NO_VERIFY && if (verify != NO_VERIFY &&
!XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, AFTER)) { !XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, AFTER)) {
WOLFSSL_MSG("CRL after date is no longer valid"); WOLFSSL_MSG("CRL after date is no longer valid");
@ -37197,7 +37199,7 @@ end:
dcrl->nextDateFormat = (dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag != 0) dcrl->nextDateFormat = (dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag != 0)
? dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag ? dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag
: dataASN[CRLASN_IDX_TBS_NEXTUPDATE_GT].tag; : dataASN[CRLASN_IDX_TBS_NEXTUPDATE_GT].tag;
#ifndef NO_ASN_TIME #if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK)
if (dcrl->nextDateFormat != 0) { if (dcrl->nextDateFormat != 0) {
/* Next date was set, so validate it. */ /* Next date was set, so validate it. */
if (verify != NO_VERIFY && if (verify != NO_VERIFY &&
@ -37208,8 +37210,8 @@ end:
} }
} }
} }
if (ret == 0) { if (ret == 0) { /* in "no time" cases above "ret" is not set */
#endif #endif /* !NO_ASN_TIME && !WOLFSSL_NO_CRL_DATE_CHECK */
#ifdef OPENSSL_EXTRA #ifdef OPENSSL_EXTRA
/* Parse and store the issuer name. */ /* Parse and store the issuer name. */
dcrl->issuerSz = GetASNItem_Length(dataASN[CRLASN_IDX_TBS_ISSUER], dcrl->issuerSz = GetASNItem_Length(dataASN[CRLASN_IDX_TBS_ISSUER],