openssl: Fail CRL validity check if thisUpdate is in the future
authorTobias Brunner <tobias@strongswan.org>
Wed, 25 Apr 2018 09:38:22 +0000 (11:38 +0200)
committerTobias Brunner <tobias@strongswan.org>
Tue, 22 May 2018 07:50:47 +0000 (09:50 +0200)
src/libstrongswan/plugins/openssl/openssl_crl.c

index 88f7a67..bb5f20d 100644 (file)
@@ -358,7 +358,7 @@ METHOD(certificate_t, get_validity, bool,
        {
                *not_after = this->nextUpdate;
        }
-       return t <= this->nextUpdate;
+       return (t >= this->thisUpdate && t <= this->nextUpdate);
 }
 
 METHOD(certificate_t, get_encoding, bool,