diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-12 19:16:03 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-21 09:04:11 +0200 |
| commit | 2300083887342650e1ad8071855d87a0e814dba4 (patch) | |
| tree | 1a8cbdccb0a8faf18d0f336902ebced749b9b727 /crypto/cmp/cmp_vfy.c | |
| parent | ab28b59064b3f46c7a62b540cd17cad718738108 (diff) | |
crypto/cmp: Prevent misleading errors in case x509v3_cache_extensions() fails
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/11808)
Diffstat (limited to 'crypto/cmp/cmp_vfy.c')
| -rw-r--r-- | crypto/cmp/cmp_vfy.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/crypto/cmp/cmp_vfy.c b/crypto/cmp/cmp_vfy.c index aa7b916a8c..7ab96590a5 100644 --- a/crypto/cmp/cmp_vfy.c +++ b/crypto/cmp/cmp_vfy.c @@ -24,12 +24,7 @@ DEFINE_STACK_OF(X509) -/*- - * Verify a message protected by signature according to section 5.1.3.3 - * (sha1+RSA/DSA or any other algorithm supported by OpenSSL). - * - * Returns 1 on successful validation and 0 otherwise. - */ +/* Verify a message protected by signature according to RFC section 5.1.3.3 */ static int verify_signature(const OSSL_CMP_CTX *cmp_ctx, const OSSL_CMP_MSG *msg, X509 *cert) { @@ -304,6 +299,11 @@ static int cert_acceptable(const OSSL_CMP_CTX *ctx, if (!check_kid(ctx, X509_get0_subject_key_id(cert), msg->header->senderKID)) return 0; + /* prevent misleading error later in case x509v3_cache_extensions() fails */ + if (!x509v3_cache_extensions(cert)) { + ossl_cmp_warn(ctx, "cert appears to be invalid"); + return 0; + } if (!verify_signature(ctx, msg, cert)) { ossl_cmp_warn(ctx, "msg signature verification failed"); return 0; |