From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 11 Nov 2015 13:26:00 +0000 (+0100)
Subject: revocation: Allow CRLs to be encoded in PEM format
X-Git-Tag: 5.3.4rc1~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e161238e8e9b14cbc3ba36e8897ec2473d36b0fd;p=thirdparty%2Fstrongswan.git

revocation: Allow CRLs to be encoded in PEM format

Since the textual representation for a CRL is now standardized
in RFC 7468 one could argue that we should accept that too, even
though RFC 5280 explicitly demands CRLs fetched via HTTP/FTP to
be in DER format.  But in particular for file URIs enforcing that
seems inconvenient.

Fixes #1203.
---

diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c
index 9fd5b2a227..fdcb9902be 100644
--- a/src/libstrongswan/plugins/revocation/revocation_validator.c
+++ b/src/libstrongswan/plugins/revocation/revocation_validator.c
@@ -367,7 +367,7 @@ static certificate_t* fetch_crl(char *url)
 		return NULL;
 	}
 	crl = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_CRL,
-							 BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
+							 BUILD_BLOB_PEM, chunk, BUILD_END);
 	chunk_free(&chunk);
 	if (!crl)
 	{