From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 25 Apr 2018 09:38:22 +0000 (+0200)
Subject: openssl: Fail CRL validity check if thisUpdate is in the future
X-Git-Tag: 5.6.3dr2~5^2~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9c6b102ee0a687985fa0f1ed834aacef3064b1a4;p=thirdparty%2Fstrongswan.git

openssl: Fail CRL validity check if thisUpdate is in the future
---

diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c
index 88f7a67c20..bb5f20dcff 100644
--- a/src/libstrongswan/plugins/openssl/openssl_crl.c
+++ b/src/libstrongswan/plugins/openssl/openssl_crl.c
@@ -358,7 +358,7 @@ METHOD(certificate_t, get_validity, bool,
 	{
 		*not_after = this->nextUpdate;
 	}
-	return t <= this->nextUpdate;
+	return (t >= this->thisUpdate && t <= this->nextUpdate);
 }
 
 METHOD(certificate_t, get_encoding, bool,