From 9177d65315147771026640d9af4c101435eb737d Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Sun, 12 Nov 2023 14:05:24 -0500 Subject: [PATCH] Remove removedFromCRL handling This is part of delta CRLs, where OpenSSL would return 2 instead of 1 to signal a removedFromCRL entry. The logic that caught that was removed in the preceeding CL. Bug: 601 Change-Id: I5ac0b32a864b09d303198ca99ecbfc1219906e36 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/63933 Auto-Submit: David Benjamin Reviewed-by: Bob Beck Commit-Queue: David Benjamin --- crypto/x509/x509_vfy.c | 6 +----- crypto/x509/x_crl.c | 3 --- include/openssl/x509.h | 8 ++------ 3 files changed, 3 insertions(+), 14 deletions(-) diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 02bf51fc3..1abbc00b5 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -1432,12 +1432,8 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) { return 0; } } - // Look for serial number of certificate in CRL If found make sure reason - // is not removeFromCRL. + // Look for serial number of certificate in CRL. if (X509_CRL_get0_by_cert(crl, &rev, x)) { - if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) { - return 2; - } ctx->error = X509_V_ERR_CERT_REVOKED; ok = ctx->verify_cb(0, ctx); if (!ok) { diff --git a/crypto/x509/x_crl.c b/crypto/x509/x_crl.c index 37aed8260..e7b5edad6 100644 --- a/crypto/x509/x_crl.c +++ b/crypto/x509/x_crl.c @@ -440,9 +440,6 @@ static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, if (ret) { *ret = rev; } - if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) { - return 2; - } return 1; } } diff --git a/include/openssl/x509.h b/include/openssl/x509.h index ebbf1ff73..5e4a6b015 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h @@ -570,9 +570,8 @@ OPENSSL_EXPORT const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl); OPENSSL_EXPORT X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); // X509_CRL_get0_by_serial finds the entry in |crl| whose serial number is -// |serial|. If found, it sets |*out| to the entry. It then returns two if the -// reason code is removeFromCRL and one if it was revoked. If not found, it -// returns zero. +// |serial|. If found, it sets |*out| to the entry and returns one. If not +// found, it returns zero. // // On success, |*out| continues to be owned by |crl|. It is an error to free or // otherwise modify |*out|. @@ -580,9 +579,6 @@ OPENSSL_EXPORT X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); // TODO(crbug.com/boringssl/600): Ideally |crl| would be const. It is broadly // thread-safe, but changes the order of entries in |crl|. It cannot be called // concurrently with |i2d_X509_CRL|. -// -// TODO(crbug.com/boringssl/601): removeFromCRL is part of delta CRLs. Remove -// this special case. OPENSSL_EXPORT int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **out, const ASN1_INTEGER *serial);