denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for issuer only if we actually got a CRL

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:46:06 +01:00
parent 06e6535151
commit d3a18dade1
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/revocation/revocation_validator.c
+2 -2
View File
@@ -457,6 +457,8 @@ static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
{ {
*uri_found = TRUE; *uri_found = TRUE;
current = fetch_crl(uri); current = fetch_crl(uri);
if (current)
{
if (!current->has_issuer(current, issuer)) if (!current->has_issuer(current, issuer))
{ {
DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL " DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
@@ -464,8 +466,6 @@ static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
current->destroy(current); current->destroy(current);
continue; continue;
} }
if (current)
{
*best = get_better_crl(current, *best, subject, *best = get_better_crl(current, *best, subject,
&valid, auth, TRUE); &valid, auth, TRUE);
if (*best && valid != VALIDATION_STALE) if (*best && valid != VALIDATION_STALE)