| 501 | } |
| 502 | |
| 503 | int |
| 504 | TS_OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd, ASN1_GENERALIZEDTIME *nextupd, long nsec, long maxsec) |
| 505 | { |
| 506 | int ret = 1; |
| 507 | time_t t_now, t_tmp; |
| 508 | |
| 509 | time(&t_now); |
| 510 | /* Check thisUpdate is valid and not more than nsec in the future */ |
| 511 | if (!ASN1_GENERALIZEDTIME_check(thisupd)) { |
| 512 | Dbg(dbg_ctl_ssl_ocsp, "Error in thisUpdate field"); |
| 513 | ret = 0; |
| 514 | } else { |
| 515 | t_tmp = t_now + nsec; |
| 516 | if (X509_cmp_time(thisupd, &t_tmp) > 0) { |
| 517 | Dbg(dbg_ctl_ssl_ocsp, "Status not yet valid"); |
| 518 | ret = 0; |
| 519 | } |
| 520 | |
| 521 | /* |
| 522 | * If maxsec specified check thisUpdate is not more than maxsec in |
| 523 | * the past |
| 524 | */ |
| 525 | if (maxsec >= 0) { |
| 526 | t_tmp = t_now - maxsec; |
| 527 | if (X509_cmp_time(thisupd, &t_tmp) < 0) { |
| 528 | Dbg(dbg_ctl_ssl_ocsp, "Status too old"); |
| 529 | ret = 0; |
| 530 | } |
| 531 | } |
| 532 | } |
| 533 | |
| 534 | if (nextupd == nullptr) { |
| 535 | return ret; |
| 536 | } |
| 537 | |
| 538 | /* Check nextUpdate is valid and not more than nsec in the past */ |
| 539 | if (!ASN1_GENERALIZEDTIME_check(nextupd)) { |
| 540 | Dbg(dbg_ctl_ssl_ocsp, "Error in nextUpdate field"); |
| 541 | ret = 0; |
| 542 | } else { |
| 543 | t_tmp = t_now - nsec; |
| 544 | if (X509_cmp_time(nextupd, &t_tmp) < 0) { |
| 545 | Dbg(dbg_ctl_ssl_ocsp, "Status expired"); |
| 546 | ret = 0; |
| 547 | } |
| 548 | } |
| 549 | |
| 550 | /* Also don't allow nextUpdate to precede thisUpdate */ |
| 551 | if (ASN1_STRING_cmp(nextupd, thisupd) < 0) { |
| 552 | Dbg(dbg_ctl_ssl_ocsp, "nextUpdate precedes thisUpdate"); |
| 553 | ret = 0; |
| 554 | } |
| 555 | |
| 556 | return ret; |
| 557 | } |
| 558 | |
| 559 | TS_OCSP_ONEREQ * |
| 560 | TS_OCSP_request_add0_id(TS_OCSP_REQUEST *req, TS_OCSP_CERTID *cid) |
no outgoing calls
no test coverage detected