diff options
| author | Sebastian Benoit <benno@cvs.openbsd.org> | 2019-11-29 17:53:00 +0000 |
|---|---|---|
| committer | Sebastian Benoit <benno@cvs.openbsd.org> | 2019-11-29 17:53:00 +0000 |
| commit | d50b796751661e8674e8ded958a55011b3514568 (patch) | |
| tree | 939b3381ba3848db56471fd555272d1a0f96f696 /usr.sbin | |
| parent | 2b80dabc696eaa345942c19df4c81c8a6644c040 (diff) | |
bring back CRL checks, noted by claudio@
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/rpki-client/main.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c index 4b6fb98f5c7..e72053c5bb6 100644 --- a/usr.sbin/rpki-client/main.c +++ b/usr.sbin/rpki-client/main.c @@ -1,4 +1,4 @@ -/* $OpenBSD: main.c,v 1.43 2019/11/29 16:25:59 deraadt Exp $ */ +/* $OpenBSD: main.c,v 1.44 2019/11/29 17:52:59 benno Exp $ */ /* * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv> * @@ -841,7 +841,8 @@ proc_parser_roa(struct entity *entp, if ((param = X509_STORE_CTX_get0_param(ctx)) == NULL) cryptoerrx("X509_STORE_CTX_get0_param"); fl = X509_VERIFY_PARAM_get_flags(param); - nfl = X509_V_FLAG_IGNORE_CRITICAL; + nfl = X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK | + X509_V_FLAG_CRL_CHECK_ALL if (!X509_VERIFY_PARAM_set_flags(param, fl | nfl)) cryptoerrx("X509_VERIFY_PARAM_set_flags"); X509_STORE_CTX_set0_crls(ctx, crls); @@ -911,7 +912,8 @@ proc_parser_mft(struct entity *entp, int force, X509_STORE *store, if ((param = X509_STORE_CTX_get0_param(ctx)) == NULL) cryptoerrx("X509_STORE_CTX_get0_param"); fl = X509_VERIFY_PARAM_get_flags(param); - nfl = X509_V_FLAG_IGNORE_CRITICAL; + nfl = X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK | + X509_V_FLAG_CRL_CHECK_ALL; if (!X509_VERIFY_PARAM_set_flags(param, fl | nfl)) cryptoerrx("X509_VERIFY_PARAM_set_flags"); X509_STORE_CTX_set0_crls(ctx, crls); @@ -981,7 +983,8 @@ proc_parser_cert(const struct entity *entp, if ((param = X509_STORE_CTX_get0_param(ctx)) == NULL) cryptoerrx("X509_STORE_CTX_get0_param"); fl = X509_VERIFY_PARAM_get_flags(param); - nfl = X509_V_FLAG_IGNORE_CRITICAL; + nfl = X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK | + X509_V_FLAG_CRL_CHECK_ALL; if (!X509_VERIFY_PARAM_set_flags(param, fl | nfl)) cryptoerrx("X509_VERIFY_PARAM_set_flags"); X509_STORE_CTX_set0_crls(ctx, crls); |