mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add build option for disabling CRL date check (WOLFSSL_NO_CRL_DATE_CHECK). ZD 16675

Browse Source
This commit is contained in:
David Garske 2023-10-30 15:45:33 -07:00
parent 37884f864d
commit cdef51f537
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
wolfcrypt/src/asn.c
View File

@ -70,6 +70,8 @@ ASN Options:
* WOLFSSL_NO_OCSP_DATE_CHECK: Disable date checks for OCSP responses. This
may be required when the system's real-time clock is not very accurate.
It is recommended to enforce the nonce check instead if possible.
* WOLFSSL_NO_CRL_DATE_CHECK: Disable date checks for CRL's.
* WOLFSSL_NO_CRL_NEXT_DATE: Do not fail if CRL next date is missing
* WOLFSSL_FORCE_OCSP_NONCE_CHECK: Require nonces to be available in OCSP
responses. The nonces are optional and may not be supported by all
responders. If it can be ensured that the used responder sends nonces this
@ -36661,7 +36663,7 @@ static int ParseCRL_CertList(RevokedCert* rcert, DecodedCRL* dcrl,
if (doNextDate)
#endif
{
#ifndef NO_ASN_TIME
#if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK)
if (verify != NO_VERIFY &&
!XVALIDATE_DATE(dcrl->nextDate, dcrl->nextDateFormat, AFTER)) {
WOLFSSL_MSG("CRL after date is no longer valid");
@ -37191,7 +37193,7 @@ end:
dcrl->nextDateFormat = (dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag != 0)
? dataASN[CRLASN_IDX_TBS_NEXTUPDATE_UTC].tag
: dataASN[CRLASN_IDX_TBS_NEXTUPDATE_GT].tag;
#ifndef NO_ASN_TIME
#if !defined(NO_ASN_TIME) && !defined(WOLFSSL_NO_CRL_DATE_CHECK)
if (dcrl->nextDateFormat != 0) {
/* Next date was set, so validate it. */
if (verify != NO_VERIFY &&
@ -37202,8 +37204,8 @@ end:
}
}
}
if (ret == 0) {
#endif
if (ret == 0) { /* in "no time" cases above "ret" is not set */
#endif /* !NO_ASN_TIME && !WOLFSSL_NO_CRL_DATE_CHECK */
#ifdef OPENSSL_EXTRA
/* Parse and store the issuer name. */
dcrl->issuerSz = GetASNItem_Length(dataASN[CRLASN_IDX_TBS_ISSUER],