Merge remote-tracking branch 'origin/1.3' into merge_13_14_16

jpfr · Sep 17, 2024 · 60b6f5f · 60b6f5f
2 parents 7a1dfce + 90661da
commit 60b6f5f
Show file tree

Hide file tree

Showing 4 changed files with 1,131 additions and 3 deletions.
diff --git a/plugins/crypto/mbedtls/ua_pki_mbedtls.c b/plugins/crypto/mbedtls/ua_pki_mbedtls.c
@@ -385,7 +385,13 @@ certificateVerification_verify(const UA_CertificateVerification *cv,
 
                 /* If the CRL file corresponding to the parent certificate is not present
                  * then return UA_STATUSCODE_BADCERTIFICATEISSUERREVOCATIONUNKNOWN */
-                if(!issuerKnown) {
+                if(issuerKnown) {
+                    flags = 0;
+                    mbedErr = mbedtls_x509_crt_verify_with_profile(parentCert,
+                                                                   &ci->certificateIssuerList,
+                                                                   &ci->certificateRevocationList,
+                                                                   &crtProfile, NULL, &flags, NULL, NULL);
+                } else {
                     return UA_STATUSCODE_BADCERTIFICATEISSUERREVOCATIONUNKNOWN;
                 }
 
@@ -427,8 +433,14 @@ certificateVerification_verify(const UA_CertificateVerification *cv,
 
             /* If the CRL file corresponding to the parent certificate is not present
              * then return UA_STATUSCODE_BADCERTIFICATEREVOCATIONUNKNOWN */
-            if(!issuerKnown) {
-                return UA_STATUSCODE_BADCERTIFICATEREVOCATIONUNKNOWN;
+            if(issuerKnown) {
+                flags = 0;
+                mbedErr = mbedtls_x509_crt_verify_with_profile(parentCert,
+                                                               &ci->certificateIssuerList,
+                                                               &ci->certificateRevocationList,
+                                                               &crtProfile, NULL, &flags, NULL, NULL);
+            } else {
+                return UA_STATUSCODE_BADCERTIFICATEISSUERREVOCATIONUNKNOWN;
             }
 
         }

diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
@@ -419,6 +419,7 @@ endif()
 
 if(UA_ENABLE_ENCRYPTION)
     ua_add_test(client/check_client_encryption.c)
+    ua_add_test(encryption/check_crl_validation.c)
 
     if(UA_ENABLE_ENCRYPTION_OPENSSL OR UA_ENABLE_ENCRYPTION_MBEDTLS)
         ua_add_test(client/check_client_authentication.c)