mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
112 lines
3.9 KiB
C
112 lines
3.9 KiB
C
/* Provenance: openssl/openssl check_revocation (vuln).
|
|
* repo: openssl/openssl
|
|
* commit: 5097ec4dae239112498abb722e255ea60ef7ac48
|
|
* parent: 5097ec4dae239112498abb722e255ea60ef7ac48
|
|
* commit_url: https://github.com/openssl/openssl/commit/a9af3442290e8a04706a3cd5f284ffd5b486e3f6
|
|
* cve: CVE-2026-42765
|
|
* license: Apache-2.0
|
|
* function: check_revocation
|
|
* relpath: crypto/x509/x509_vfy.c
|
|
*/
|
|
|
|
static int check_revocation(X509_STORE_CTX *ctx)
|
|
{
|
|
int i = 0, last = 0, ok = 0;
|
|
int crl_check_enabled = (ctx->param->flags & X509_V_FLAG_CRL_CHECK) != 0;
|
|
int crl_check_all_enabled = crl_check_enabled && (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) != 0;
|
|
int ocsp_check_enabled = (ctx->param->flags & X509_V_FLAG_OCSP_RESP_CHECK) != 0;
|
|
int ocsp_check_all_enabled = ocsp_check_enabled && (ctx->param->flags & X509_V_FLAG_OCSP_RESP_CHECK_ALL) != 0;
|
|
|
|
if (!crl_check_enabled && !ocsp_check_enabled)
|
|
return 1;
|
|
|
|
if (ocsp_check_enabled) {
|
|
#ifndef OPENSSL_NO_OCSP
|
|
/*
|
|
* certificate status checking with OCSP
|
|
*/
|
|
if (ocsp_check_all_enabled)
|
|
last = sk_X509_num(ctx->chain) - 1;
|
|
else if (!crl_check_all_enabled && ctx->parent != NULL)
|
|
return 1; /* If checking CRL paths this isn't the EE certificate */
|
|
|
|
for (i = 0; i <= last; i++) {
|
|
ctx->error_depth = i;
|
|
ctx->current_cert = sk_X509_value(ctx->chain, i);
|
|
|
|
/* skip if cert is apparently self-signed */
|
|
if (ctx->current_cert->ex_flags & EXFLAG_SS)
|
|
continue;
|
|
|
|
/* the issuer certificate is the next in the chain */
|
|
ctx->current_issuer = sk_X509_value(ctx->chain, i + 1);
|
|
|
|
ok = check_cert_ocsp_resp(ctx);
|
|
|
|
/*
|
|
* In the case the certificate status is REVOKED, the verification
|
|
* can stop here.
|
|
*/
|
|
if (ok == V_OCSP_CERTSTATUS_REVOKED) {
|
|
return verify_cb_ocsp(ctx, ctx->error != 0 ? ctx->error : X509_V_ERR_OCSP_VERIFY_FAILED);
|
|
}
|
|
|
|
/*
|
|
* In the case the certificate status is GOOD, continue with the next
|
|
* certificate.
|
|
*/
|
|
if (ok == V_OCSP_CERTSTATUS_GOOD)
|
|
continue;
|
|
|
|
/*
|
|
* As stated in RFC 6961 section 2.2:
|
|
* If OCSP is not enabled or the client receives a "ocsp_response_list"
|
|
* that does not contain a response for one or more of the certificates
|
|
* in the completed certificate chain, the client SHOULD attempt to
|
|
* validate the certificate using an alternative retrieval method,
|
|
* such as downloading the relevant CRL;
|
|
*/
|
|
if (crl_check_all_enabled || (crl_check_enabled && i == 0)) {
|
|
ok = check_cert_crl(ctx);
|
|
if (!ok)
|
|
return ok;
|
|
} else {
|
|
ok = verify_cb_ocsp(ctx, X509_V_ERR_OCSP_VERIFY_FAILED);
|
|
if (!ok)
|
|
return ok;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
if (crl_check_enabled && !ocsp_check_all_enabled) {
|
|
/* certificate status check with CRLs */
|
|
if (crl_check_all_enabled) {
|
|
last = sk_X509_num(ctx->chain) - 1;
|
|
} else {
|
|
/* If checking CRL paths this isn't the EE certificate */
|
|
if (ctx->parent != NULL)
|
|
return 1;
|
|
last = 0;
|
|
}
|
|
|
|
/*
|
|
* in the case that OCSP is only enabled for the server certificate
|
|
* and CRL for the complete chain, the rest of the chain has to be
|
|
* checked here
|
|
*/
|
|
if (ocsp_check_enabled && crl_check_all_enabled)
|
|
i = 1;
|
|
else
|
|
i = 0;
|
|
for (; i <= last; i++) {
|
|
ctx->error_depth = i;
|
|
ok = check_cert_crl(ctx);
|
|
if (!ok)
|
|
return ok;
|
|
}
|
|
}
|
|
|
|
return 1;
|
|
}
|