denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revocation: Reject OCSP error responses

Browse Source 
Otherwise, there is lengthy code that tries to validate such responses,
even though they don't contain any signatures.
This commit is contained in:
Tobias Brunner
2023-11-24 17:41:18 +01:00
parent b3e66aca5c
commit 6d345b3dde
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/revocation/revocation_validator.c
+7 -1
View File
@@ -121,8 +121,14 @@ static certificate_t *fetch_ocsp(char *url, certificate_t *subject,
request->destroy(request); request->destroy(request);
return NULL; return NULL;
} }
ocsp_request = (ocsp_request_t*)request;
ocsp_response = (ocsp_response_t*)response; ocsp_response = (ocsp_response_t*)response;
if (ocsp_response->get_ocsp_status(ocsp_response) != OCSP_SUCCESSFUL)
{
response->destroy(response);
request->destroy(request);
return NULL;
}
ocsp_request = (ocsp_request_t*)request;
if (ocsp_response->get_nonce(ocsp_response).len && if (ocsp_response->get_nonce(ocsp_response).len &&
!chunk_equals_const(ocsp_request->get_nonce(ocsp_request), !chunk_equals_const(ocsp_request->get_nonce(ocsp_request),
ocsp_response->get_nonce(ocsp_response))) ocsp_response->get_nonce(ocsp_response)))