ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

openssl: Accept CRLs issued by non-CA certificates with cRLSign keyUsage flag 

The x509 plugin accepted CRL signers since forever, to be precise, since
dffb176f2b ("CRLSign keyUsage or CA basicConstraint are sufficient
for CRL validation")).

References #3529.
This commit is contained in:
Tobias Brunner 2020-07-29 18:40:20 +02:00
parent 428c0b293d
commit 7f170e4c9c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/libstrongswan/plugins/openssl/openssl_crl.c
View File

@ -303,7 +303,7 @@ METHOD(certificate_t, issued_by, bool,
return FALSE;
}
x509 = (x509_t*)issuer;
if (!(x509->get_flags(x509) & X509_CA))
if (!(x509->get_flags(x509) & (X509_CA | X509_CRL_SIGN)))
{
return FALSE;
}