Lines Matching refs:crl
73 /* CRL score values */
79 /* certificate is within CRL scope */
83 /* CRL times valid */
91 /* If this score or above CRL is probably valid */
95 /* CRL issuer is certificate issuer */
99 /* CRL issuer is on certificate path */
103 /* CRL issuer matches CRL AKID */
107 /* Have a delta CRL with valid times */
123 X509_CRL *crl, X509 *x);
128 static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl,
130 static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
359 * because they may be needed for CRL signature verification.
373 /* RFC 3779 path validation, now that CRL check has been done */
472 /* CRL path validation */
678 /* If checking CRL paths this isn't the EE certificate */
694 X509_CRL *crl = NULL, *dcrl = NULL;
705 /* Try to retrieve relevant CRL */
707 ok = ctx->get_crl(ctx, &crl, x);
709 ok = get_crl_delta(ctx, &crl, &dcrl, x);
710 /* If error looking up CRL, nothing we can do except
719 ctx->current_crl = crl;
720 ok = ctx->check_crl(ctx, crl);
736 /* Don't look in full CRL if delta reason is removefromCRL */
739 ok = ctx->cert_crl(ctx, crl, x);
744 X509_CRL_free(crl);
746 crl = NULL;
750 X509_CRL_free(crl);
758 /* Check CRL times against values in X509_STORE_CTX */
760 static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
765 ctx->current_crl = crl;
771 i=X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);
790 if(X509_CRL_get_nextUpdate(crl))
792 i=X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime);
802 /* Ignore expiry of base CRL is delta is valid */
826 X509_CRL *crl, *best_crl = NULL;
831 crl = sk_X509_CRL_value(crls, i);
833 crl_score = get_crl_score(ctx, &crl_issuer, &reasons, crl, x);
837 best_crl = crl;
867 /* Compare two CRL extensions for delta checking purposes. They should be
915 /* Delta CRL must be a delta */
918 /* Base must have a CRL number */
930 /* Delta CRL base number must not exceed Full CRL number. */
933 /* Delta CRL number must exceed full CRL number */
939 /* For a given base CRL find a delta... maybe extend to delta scoring
967 /* For a given CRL return how suitable it is for the supplied certificate 'x'.
970 * The reasons mask is also used to determine if the CRL is suitable: if
971 * no new reasons the CRL is rejected, otherwise reasons is updated.
976 X509_CRL *crl, X509 *x)
982 /* First see if we can reject CRL straight away */
985 if (crl->idp_flags & IDP_INVALID)
987 /* Reason codes or indirect CRLs need extended CRL support */
990 if (crl->idp_flags & (IDP_INDIRECT | IDP_REASONS))
993 else if (crl->idp_flags & IDP_REASONS)
996 if (!(crl->idp_reasons & ~tmp_reasons))
1000 else if (crl->base_crl_number)
1002 /* If issuer name doesn't match certificate need indirect CRL */
1003 if (X509_NAME_cmp(X509_get_issuer_name(x), X509_CRL_get_issuer(crl)))
1005 if (!(crl->idp_flags & IDP_INDIRECT))
1011 if (!(crl->flags & EXFLAG_CRITICAL))
1015 if (check_crl_time(ctx, crl, 0))
1019 crl_akid_check(ctx, crl, pissuer, &crl_score);
1026 /* Check cert for matching CRL distribution points */
1028 if (crl_crldp_check(x, crl, crl_score, &crl_reasons))
1043 static void crl_akid_check(X509_STORE_CTX *ctx, X509_CRL *crl,
1047 X509_NAME *cnm = X509_CRL_get_issuer(crl);
1056 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK)
1071 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK)
1079 /* Anything else needs extended CRL support */
1084 /* Otherwise the CRL issuer is not on the path. Look for it in the
1092 if (X509_check_akid(crl_issuer, crl->akid) == X509_V_OK)
1101 /* Check the path of a CRL issuer certificate. This creates a new
1112 /* Don't allow recursive CRL path validation */
1125 /* Verify CRL issuer */
1139 /* RFC3280 says nothing about the relationship between CRL path
1233 static int crldp_check_crlissuer(DIST_POINT *dp, X509_CRL *crl, int crl_score)
1236 X509_NAME *nm = X509_CRL_get_issuer(crl);
1253 static int crl_crldp_check(X509 *x, X509_CRL *crl, int crl_score,
1257 if (crl->idp_flags & IDP_ONLYATTR)
1261 if (crl->idp_flags & IDP_ONLYUSER)
1266 if (crl->idp_flags & IDP_ONLYCA)
1269 *preasons = crl->idp_reasons;
1273 if (crldp_check_crlissuer(dp, crl, crl_score))
1275 if (!crl->idp ||
1276 idp_check_dp(dp->distpoint, crl->idp->distpoint))
1283 if ((!crl->idp || !crl->idp->distpoint) && (crl_score & CRL_SCORE_ISSUER_NAME))
1288 /* Retrieve CRL corresponding to current certificate.
1289 * If deltas enabled try to find a delta CRL too
1299 X509_CRL *crl = NULL, *dcrl = NULL;
1303 ok = get_crl_sk(ctx, &crl, &dcrl,
1314 if (!skcrl && crl)
1317 get_crl_sk(ctx, &crl, &dcrl, &issuer, &crl_score, &reasons, skcrl);
1323 /* If we got any kind of CRL use it and return success */
1324 if (crl)
1329 *pcrl = crl;
1337 /* Check CRL validity */
1338 static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
1345 /* if we have an alternative CRL issuer cert use that */
1349 /* Else find CRL issuer: if not last certificate then issuer
1371 if (!crl->base_crl_number)
1399 if (crl->idp_flags & IDP_INVALID)
1411 ok = check_crl_time(ctx, crl, 1);
1427 /* Verify CRL signature */
1428 if(X509_CRL_verify(crl, ikey) <= 0)
1444 /* Check certificate against CRL */
1445 static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
1449 /* The rules changed for this... previously if a CRL contained
1452 * critical extension can change the meaning of CRL entries.
1454 if (crl->flags & EXFLAG_CRITICAL)
1463 /* Look for serial number of certificate in CRL
1466 if (X509_CRL_get0_by_cert(crl, &rev, x))