oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

just mark sig algs as weak instead of expiration date

Browse Source
This commit is contained in:
Love Hornquist Astrand
2012-06-08 18:08:23 +02:00
parent d2c37acf7c
commit 671c91fd5f
2 changed files with 10 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/hx509/cert.c
View File

@@ -2353,20 +2353,12 @@ hx509_verify_path(hx509_context context,
goto out;
}
/*
* Verify that the sigature algorithm "best-before" date is
* before the creation date of the certificate, do this for
* trust anchors too, since any trust anchor that is created
* after a algorithm is known to be bad deserved to be invalid.
*
* Skip the leaf certificate for now...
* Verify that the sigature algorithm is not weak. Ignore
* trust anchors since they are provisioned by the user.
*/
if (i != 0 && (ctx->flags & HX509_VERIFY_CTX_F_NO_BEST_BEFORE_CHECK) == 0) {
time_t notBefore =
_hx509_Time2time_t(&c->tbsCertificate.validity.notBefore);
ret = _hx509_signature_best_before(context,
&c->signatureAlgorithm,
notBefore);
if (i + 1 != path.len && (ctx->flags & HX509_VERIFY_CTX_F_NO_BEST_BEFORE_CHECK) == 0) {
ret = _hx509_signature_is_weak(context, &c->signatureAlgorithm);
if (ret)
goto out;
}