From 7e31c425c9ea67f884f76a588c447e3a2c22f163 Mon Sep 17 00:00:00 2001 From: Steffen Eiden Date: Wed, 19 Jun 2024 13:04:07 +0200 Subject: [PATCH] rust/pv: Try again if first CRL-URI is invalid MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous implementation did stop after the first download was successful, even if it did not contain a CRL. This behavior renders a second, third, ... link as backup location useless as the code ignores them if the URI e.g. contains a error message. That results in not having a CRL and probably a failed certificate verification. Fix this by trying again if the download was successful but did not contain a CRL Reviewed-by: Jan Höppner Signed-off-by: Steffen Eiden --- rust/pv/src/verify/helper.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rust/pv/src/verify/helper.rs b/rust/pv/src/verify/helper.rs index 0ccf4024..8c28b16d 100644 --- a/rust/pv/src/verify/helper.rs +++ b/rust/pv/src/verify/helper.rs @@ -302,8 +302,8 @@ pub fn x509_dist_points(cert: &X509Ref) -> Vec { /// Searches for CRL Distribution points and downloads the CRL. Stops after the first successful /// download. /// -/// Error if something bad(=unexpected) happens (not bad: CRL not available at link, unexpected -/// format) Other issues are mapped to Ok(None) +/// Error if something bad(=unexpected) happens +/// CRL not available at all URIs and unexpected format at all URIs are mapped to Ok(None) #[cfg(not(test))] pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result>> { use crate::utils::read_crls; @@ -333,6 +333,7 @@ pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result continue, + Ok(crl) if crl.is_empty() => continue, Ok(crl) => return Ok(Some(crl)), } }