mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2635 from dgarske/async_date

Browse Source 
Fix for async date check issue
This commit is contained in:
toddouska 2019-12-18 09:34:08 -08:00 committed by GitHub
commit b89121236f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
wolfcrypt/src/asn.c
View File

@ -8606,8 +8606,6 @@ int CheckCertSignature(const byte* cert, word32 certSz, void* heap, void* cm)
int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
{
int ret = 0;
int badDate = 0;
int criticalExt = 0;
int checkPathLen = 0;
int decrementMaxPathLen = 0;
word32 confirmOID;
@ -8619,9 +8617,11 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
}
if (cert->sigCtx.state == SIG_STATE_BEGIN) {
cert->badDate = 0;
cert->criticalExt = 0;
if ((ret = DecodeToKey(cert, verify)) < 0) {
if (ret == ASN_BEFORE_DATE_E || ret == ASN_AFTER_DATE_E)
badDate = ret;
cert->badDate = ret;
else
return ret;
}
@ -8643,7 +8643,7 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
if ((ret = DecodeCertExtensions(cert)) < 0) {
if (ret == ASN_CRIT_EXT_E)
criticalExt = ret;
cert->criticalExt = ret;
else
return ret;
}
@ -8933,11 +8933,15 @@ int ParseCertRelative(DecodedCert* cert, int type, int verify, void* cm)
exit_pcr:
#endif
if (badDate != 0 && verify != VERIFY_SKIP_DATE)
return badDate;
if (cert->badDate != 0) {
if (verify != VERIFY_SKIP_DATE) {
return cert->badDate;
}
WOLFSSL_MSG("Date error: Verify option is skipping");
}
if (criticalExt != 0)
return criticalExt;
if (cert->criticalExt != 0)
return cert->criticalExt;
return ret;
}

3
wolfssl/wolfcrypt/asn.h
View File

@ -892,6 +892,9 @@ struct DecodedCert {
#endif
byte* tsip_encRsaKeyIdx;
int badDate;
int criticalExt;
/* Option Bits */
byte subjectCNStored : 1; /* have we saved a copy we own */
byte extSubjKeyIdSet : 1; /* Set when the SKID was read from cert */