[gnutls-devel] GnuTLS | pkcs11: respect Mozilla's time-based distrust upon issuer lookup (!1725)

[Read-only notification of GnuTLS library development activities]

Merge request https://gitlab.com/gnutls/gnutls/-/merge_requests/1725 was reviewed by Zoltán Fridrich

--
  
Zoltán Fridrich started a new discussion on lib/x509/verify.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725#note_1316886545

>  
> +	/* check if the raw issuer is assigned with a time-based
> +	 * distruct and the certificate is issued after that period

typo: s/distruct/distrust/

--
  
Zoltán Fridrich started a new discussion on lib/x509/verify.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725#note_1316886552

> +					      GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED);
> +	if (distrust_after != (time_t) - 1
> +	    && distrust_after <=

Probably irrelevant, but "after" means distrust after the time_t value (not inclusive), it should be < instead of <=

--
  
Zoltán Fridrich started a new discussion on lib/pkcs11.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725#note_1316886563

> +	}
> +
> +	return PKCS11_DISTRUST_AFTER_EMAIL;

Shouldn't the default return value be PKCS11_DISTRUST_AFTER_NONE?

--
  
Zoltán Fridrich started a new discussion on lib/pkcs11.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725#note_1316886568

> +static enum distrust_purpose distrust_purpose_from_oid(const char *oid)
> +{
> +	static const struct {

`map` doesn't have to be static when its used only in this function.


-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1725
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20230316/0f14ba3f/attachment-0001.html>