typo in version string

[freeradius.git] / src / main / tls.c

diff --git a/src/main/tls.c b/src/main/tls.c
index ce73f2f..bf1a359 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -77,7 +77,28 @@ static libssl_defect_t libssl_defects[] =
                .id             = "CVE-2014-0160",
                .name           = "Heartbleed",
                .comment        = "For more information see http://heartbleed.com"
-       }
+       },
+       {
+               .low            = 0x01000100f,          /* 1.0.1  */
+               .high           = 0x01000114f,          /* 1.0.1t */
+               .id             = "CVE-2016-6304",
+               .name           = "OCSP status request extension",
+               .comment        = "For more information see https://www.openssl.org/news/secadv/20160922.txt"
+       },
+       {
+               .low            = 0x01000200f,          /* 1.0.2  */
+               .high           = 0x01000208f,          /* 1.0.2h */
+               .id             = "CVE-2016-6304",
+               .name           = "OCSP status request extension",
+               .comment        = "For more information see https://www.openssl.org/news/secadv/20160922.txt"
+       },
+       {
+               .low            = 0x01010100f,          /* 1.1.0  */
+               .high           = 0x01010100f,          /* 1.1.0 */
+               .id             = "CVE-2016-6304",
+               .name           = "OCSP status request extension",
+               .comment        = "For more information see https://www.openssl.org/news/secadv/20160922.txt"
+       },
 };
 #endif /* ENABLE_OPENSSL_VERSION_CHECK */
 
@@ -118,25 +139,6 @@ static unsigned int        record_plus(record_t *buf, void const *ptr,
 static unsigned int    record_minus(record_t *buf, void *ptr,
                                     unsigned int size);
 
-#ifdef PSK_MAX_IDENTITY_LEN
-static bool identity_is_safe(const char *identity)
-{
-       char c;
-
-       if (!identity) return true;
-
-       while ((c = *(identity++)) != '\0') {
-               if (isalpha((int) c) || isdigit((int) c) || isspace((int) c) ||
-                   (c == '@') || (c == '-') || (c == '_') || (c == '.')) {
-                       continue;
-               }
-
-               return false;
-       }
-
-       return true;
-}
-
 DIAG_OFF(format-nonliteral)
 /** Print errors in the TLS thread local error stack
  *
@@ -314,6 +316,25 @@ int tls_error_io_log(REQUEST *request, tls_session_t *session, int ret, char con
        return 1;
 }
 
+#ifdef PSK_MAX_IDENTITY_LEN
+static bool identity_is_safe(const char *identity)
+{
+       char c;
+
+       if (!identity) return true;
+
+       while ((c = *(identity++)) != '\0') {
+               if (isalpha((int) c) || isdigit((int) c) || isspace((int) c) ||
+                   (c == '@') || (c == '-') || (c == '_') || (c == '.')) {
+                       continue;
+               }
+
+               return false;
+       }
+
+       return true;
+}
+
 /*
  *     When a client uses TLS-PSK to talk to a server, this callback
  *     is used by the server to determine the PSK to use.
@@ -1921,7 +1942,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
 
        identity = (char **)SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_IDENTITY);
 #ifdef HAVE_OPENSSL_OCSP_H
-       ocsp_store = (X509_STORE *)SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_STORE);
+       ocsp_store = conf->ocsp_store;
 #endif
 
        talloc_ctx = SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_TALLOC);
@@ -2195,7 +2216,8 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
 #ifdef HAVE_OPENSSL_OCSP_H
                if (my_ok && conf->ocsp_enable){
                        RDEBUG2("Starting OCSP Request");
-                       if (X509_STORE_CTX_get1_issuer(&issuer_cert, ctx, client_cert) != 1) {
+                       if ((X509_STORE_CTX_get1_issuer(&issuer_cert, ctx, client_cert) != 1) ||
+                           !issuer_cert) {
                                RERROR("Couldn't get issuer_cert for %s", common_name);
                        } else {
                                my_ok = ocsp_check(request, ocsp_store, issuer_cert, client_cert, conf);
@@ -2213,9 +2235,12 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
                 *      If OCSP returns skipped (2), we run the verify command, unless
                 *      conf->verify_skip_if_ocsp_ok is true.
                 */
-               if ((my_ok != 0)
+               if ((my_ok != OCSP_STATUS_FAILED)
 #ifdef HAVE_OPENSSL_OCSP_H
-                   && conf->ocsp_enable && (my_ok != OCSP_STATUS_OK) && conf->verify_skip_if_ocsp_ok
+                   && conf->ocsp_enable &&
+                   (((my_ok == OCSP_STATUS_OK) && !conf->verify_skip_if_ocsp_ok) ||
+                    ((my_ok == OCSP_STATUS_SKIPPED) && conf->verify_skip_if_ocsp_ok))
+
 #endif
                        ) while (conf->verify_client_cert_cmd) {
                        char filename[256];