WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

1. When OCSP and CRL enabled, checks CRL if unable to contact OCSP responder 

and OCSP was enabled.
2. Fixed a couple string typos.
3. Only check OCSP if cert successfully parsed.
pull/1/head
John Safranek 2012-12-17 22:19:20 -08:00
parent c314dc3940
commit 359e86adf6
1 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
src/internal.c
View File

@ -2285,33 +2285,46 @@ static int DoCertificate(CYASSL* ssl, byte* input, word32* inOutIdx)
else { else {
CYASSL_MSG("Failed to verify Peer's cert"); CYASSL_MSG("Failed to verify Peer's cert");
if (ssl->verifyCallback) { if (ssl->verifyCallback) {
CYASSL_MSG("\tCallback override availalbe, will continue"); CYASSL_MSG("\tCallback override available, will continue");
fatal = 0; fatal = 0;
} }
else { else {
CYASSL_MSG("\tNo callback override availalbe, fatal"); CYASSL_MSG("\tNo callback override available, fatal");
fatal = 1; fatal = 1;
} }
} }
#ifdef HAVE_OCSP #ifdef HAVE_OCSP
ret = CyaSSL_OCSP_Lookup_Cert(&ssl->ctx->ocsp, &dCert); if (fatal == 0) {
if (ret != 0) { ret = CyaSSL_OCSP_Lookup_Cert(&ssl->ctx->ocsp, &dCert);
CYASSL_MSG("\tOCSP Lookup not ok"); if (ret != 0) {
fatal = 0; CYASSL_MSG("\tOCSP Lookup not ok");
fatal = 0;
}
} }
#endif #endif
#ifdef HAVE_CRL #ifdef HAVE_CRL
if (fatal == 0 && ssl->ctx->cm->crlEnabled) { if (fatal == 0 && ssl->ctx->cm->crlEnabled) {
CYASSL_MSG("Doing Leaf CRL check"); int doCrlLookup = 1;
ret = CheckCertCRL(ssl->ctx->cm->crl, &dCert);
if (ret != 0) { #ifdef HAVE_OCSP
CYASSL_MSG("\tCRL check not ok"); if (ssl->ctx->ocsp.enabled) {
fatal = 0; doCrlLookup = (ret == OCSP_CERT_UNKNOWN);
}
#endif /* HAVE_OCSP */
if (doCrlLookup) {
CYASSL_MSG("Doing Leaf CRL check");
ret = CheckCertCRL(ssl->ctx->cm->crl, &dCert);
if (ret != 0) {
CYASSL_MSG("\tCRL check not ok");
fatal = 0;
}
} }
} }
#endif /* HAVE_CRL */ #endif /* HAVE_CRL */
#ifdef OPENSSL_EXTRA #ifdef OPENSSL_EXTRA