diff options
Diffstat (limited to 'src/lib/libcrypto/ocsp/ocsp_cl.c')
| -rw-r--r-- | src/lib/libcrypto/ocsp/ocsp_cl.c | 29 |
1 files changed, 10 insertions, 19 deletions
diff --git a/src/lib/libcrypto/ocsp/ocsp_cl.c b/src/lib/libcrypto/ocsp/ocsp_cl.c index 6b8fb87880..04ea6866a5 100644 --- a/src/lib/libcrypto/ocsp/ocsp_cl.c +++ b/src/lib/libcrypto/ocsp/ocsp_cl.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ocsp_cl.c,v 1.13 2016/12/30 15:31:58 jsing Exp $ */ | 1 | /* $OpenBSD: ocsp_cl.c,v 1.14 2017/01/29 17:49:23 beck Exp $ */ |
| 2 | /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL | 2 | /* Written by Tom Titchener <Tom_Titchener@groove.net> for the OpenSSL |
| 3 | * project. */ | 3 | * project. */ |
| 4 | 4 | ||
| @@ -159,8 +159,7 @@ OCSP_request_sign(OCSP_REQUEST *req, X509 *signer, EVP_PKEY *key, | |||
| 159 | goto err; | 159 | goto err; |
| 160 | if (key) { | 160 | if (key) { |
| 161 | if (!X509_check_private_key(signer, key)) { | 161 | if (!X509_check_private_key(signer, key)) { |
| 162 | OCSPerr(OCSP_F_OCSP_REQUEST_SIGN, | 162 | OCSPerror(OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); |
| 163 | OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE); | ||
| 164 | goto err; | 163 | goto err; |
| 165 | } | 164 | } |
| 166 | if (!OCSP_REQUEST_sign(req, key, dgst)) | 165 | if (!OCSP_REQUEST_sign(req, key, dgst)) |
| @@ -202,13 +201,11 @@ OCSP_response_get1_basic(OCSP_RESPONSE *resp) | |||
| 202 | 201 | ||
| 203 | rb = resp->responseBytes; | 202 | rb = resp->responseBytes; |
| 204 | if (!rb) { | 203 | if (!rb) { |
| 205 | OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC, | 204 | OCSPerror(OCSP_R_NO_RESPONSE_DATA); |
| 206 | OCSP_R_NO_RESPONSE_DATA); | ||
| 207 | return NULL; | 205 | return NULL; |
| 208 | } | 206 | } |
| 209 | if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) { | 207 | if (OBJ_obj2nid(rb->responseType) != NID_id_pkix_OCSP_basic) { |
| 210 | OCSPerr(OCSP_F_OCSP_RESPONSE_GET1_BASIC, | 208 | OCSPerror(OCSP_R_NOT_BASIC_RESPONSE); |
| 211 | OCSP_R_NOT_BASIC_RESPONSE); | ||
| 212 | return NULL; | 209 | return NULL; |
| 213 | } | 210 | } |
| 214 | 211 | ||
| @@ -341,16 +338,14 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, | |||
| 341 | /* Check thisUpdate is valid and not more than nsec in the future */ | 338 | /* Check thisUpdate is valid and not more than nsec in the future */ |
| 342 | if (ASN1_time_parse(thisupd->data, thisupd->length, &tm_this, | 339 | if (ASN1_time_parse(thisupd->data, thisupd->length, &tm_this, |
| 343 | V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) { | 340 | V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) { |
| 344 | OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, | 341 | OCSPerror(OCSP_R_ERROR_IN_THISUPDATE_FIELD); |
| 345 | OCSP_R_ERROR_IN_THISUPDATE_FIELD); | ||
| 346 | return 0; | 342 | return 0; |
| 347 | } else { | 343 | } else { |
| 348 | t_tmp = t_now + nsec; | 344 | t_tmp = t_now + nsec; |
| 349 | if (gmtime_r(&t_tmp, &tm_tmp) == NULL) | 345 | if (gmtime_r(&t_tmp, &tm_tmp) == NULL) |
| 350 | return 0; | 346 | return 0; |
| 351 | if (ASN1_time_tm_cmp(&tm_this, &tm_tmp) > 0) { | 347 | if (ASN1_time_tm_cmp(&tm_this, &tm_tmp) > 0) { |
| 352 | OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, | 348 | OCSPerror(OCSP_R_STATUS_NOT_YET_VALID); |
| 353 | OCSP_R_STATUS_NOT_YET_VALID); | ||
| 354 | return 0; | 349 | return 0; |
| 355 | } | 350 | } |
| 356 | 351 | ||
| @@ -363,8 +358,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, | |||
| 363 | if (gmtime_r(&t_tmp, &tm_tmp) == NULL) | 358 | if (gmtime_r(&t_tmp, &tm_tmp) == NULL) |
| 364 | return 0; | 359 | return 0; |
| 365 | if (ASN1_time_tm_cmp(&tm_this, &tm_tmp) < 0) { | 360 | if (ASN1_time_tm_cmp(&tm_this, &tm_tmp) < 0) { |
| 366 | OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, | 361 | OCSPerror(OCSP_R_STATUS_TOO_OLD); |
| 367 | OCSP_R_STATUS_TOO_OLD); | ||
| 368 | return 0; | 362 | return 0; |
| 369 | } | 363 | } |
| 370 | } | 364 | } |
| @@ -376,24 +370,21 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, | |||
| 376 | /* Check nextUpdate is valid and not more than nsec in the past */ | 370 | /* Check nextUpdate is valid and not more than nsec in the past */ |
| 377 | if (ASN1_time_parse(nextupd->data, nextupd->length, &tm_next, | 371 | if (ASN1_time_parse(nextupd->data, nextupd->length, &tm_next, |
| 378 | V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) { | 372 | V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) { |
| 379 | OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, | 373 | OCSPerror(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD); |
| 380 | OCSP_R_ERROR_IN_NEXTUPDATE_FIELD); | ||
| 381 | return 0; | 374 | return 0; |
| 382 | } else { | 375 | } else { |
| 383 | t_tmp = t_now - nsec; | 376 | t_tmp = t_now - nsec; |
| 384 | if (gmtime_r(&t_tmp, &tm_tmp) == NULL) | 377 | if (gmtime_r(&t_tmp, &tm_tmp) == NULL) |
| 385 | return 0; | 378 | return 0; |
| 386 | if (ASN1_time_tm_cmp(&tm_next, &tm_tmp) < 0) { | 379 | if (ASN1_time_tm_cmp(&tm_next, &tm_tmp) < 0) { |
| 387 | OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, | 380 | OCSPerror(OCSP_R_STATUS_EXPIRED); |
| 388 | OCSP_R_STATUS_EXPIRED); | ||
| 389 | return 0; | 381 | return 0; |
| 390 | } | 382 | } |
| 391 | } | 383 | } |
| 392 | 384 | ||
| 393 | /* Also don't allow nextUpdate to precede thisUpdate */ | 385 | /* Also don't allow nextUpdate to precede thisUpdate */ |
| 394 | if (ASN1_time_tm_cmp(&tm_next, &tm_this) < 0) { | 386 | if (ASN1_time_tm_cmp(&tm_next, &tm_this) < 0) { |
| 395 | OCSPerr(OCSP_F_OCSP_CHECK_VALIDITY, | 387 | OCSPerror(OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE); |
| 396 | OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE); | ||
| 397 | return 0; | 388 | return 0; |
| 398 | } | 389 | } |
| 399 | 390 | ||
