Handle redirect on AIA issuer fetch

IB-7006 Signed-off-by: Raul Metsma <raul@metsma.ee>
open-eid · Oct 7, 2021 · d6af5d6 · d6af5d6
1 parent b42174f
commit d6af5d6
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 12 deletions.
diff --git a/src/crypto/OCSP.cpp b/src/crypto/OCSP.cpp
@@ -299,15 +299,6 @@ void OCSP::verifyResponse(const X509Cert &cert) const
     if(!resp)
         THROW("Failed to verify OCSP response.");
 
-    // Find issuer before OCSP validation to activate region TSL
-    X509Cert issuer = X509CertStore::instance()->findIssuer(cert, X509CertStore::CA);
-    if(!issuer)
-    {
-        Exception e(EXCEPTION_PARAMS("Certificate status: unknown"));
-        e.setCode(Exception::CertificateUnknown);
-        throw e;
-    }
-
     time_t t = util::date::ASN1TimeToTime_t(producedAt());
     SCOPE(X509_STORE, store, X509CertStore::createStore(X509CertStore::OCSP, &t));
     STACK_OF(X509) *stack = sk_X509_new_null();
@@ -325,6 +316,15 @@ void OCSP::verifyResponse(const X509Cert &cert) const
     if(result <= 0)
         THROW_OPENSSLEXCEPTION("Failed to verify OCSP response.");
 
+    // Find issuer before OCSP validation to activate region TSL
+    X509Cert issuer = X509CertStore::instance()->findIssuer(cert, X509CertStore::CA);
+    if(!issuer)
+    {
+        Exception e(EXCEPTION_PARAMS("Certificate status: unknown"));
+        e.setCode(Exception::CertificateUnknown);
+        throw e;
+    }
+
     int status = V_OCSP_CERTSTATUS_UNKNOWN;
     for(int i = 0, count = OCSP_resp_count(basic.get()); i < count; ++i)
     {

diff --git a/src/crypto/X509Cert.cpp b/src/crypto/X509Cert.cpp
@@ -235,7 +235,7 @@ X509Cert::X509Cert(const vector<unsigned char> &bytes, Format format)
 X509Cert::X509Cert(const unsigned char *bytes, size_t size, Format format)
 {
     if(!bytes || size == 0)
-        THROW("No bytes given to parse X509.");
+        return;
     if(format == Der)
     {
         const unsigned char *p = bytes;

diff --git a/src/crypto/X509CertStore.cpp b/src/crypto/X509CertStore.cpp
@@ -165,7 +165,9 @@ X509Cert X509CertStore::issuerFromAIA(const X509Cert &cert) const
     }
     if(url.empty())
         return X509Cert();
-    Connect::Result result = Connect(url, "GET", 0, {}).exec();
+    Connect::Result result = Connect(url, "GET").exec();
+    if(result.isRedirect())
+        result = Connect(result.headers["Location"], "GET").exec();
     return X509Cert((const unsigned char*)result.content.c_str(), result.content.size());
 }
 
@@ -278,7 +280,7 @@ bool X509CertStore::verify(const X509Cert &cert, bool noqscd) const
             return all_of(policySet.cbegin(), policySet.cend(), containsPolicy);
         };
         auto matchKeyUsageSet = [&keyUsage](const map<X509Cert::KeyUsage,bool> &keyUsageSet){
-            return all_of(keyUsageSet.cbegin(), keyUsageSet.cend(), [&keyUsage](const pair<X509Cert::KeyUsage,bool> &keyUsageBit){
+            return all_of(keyUsageSet.cbegin(), keyUsageSet.cend(), [&keyUsage](pair<X509Cert::KeyUsage, bool> keyUsageBit) {
                 return (find(keyUsage.cbegin(), keyUsage.cend(), keyUsageBit.first) != keyUsage.cend()) == keyUsageBit.second;
             });
         };