diff options
| author | Paul Kehrer <paul.l.kehrer@gmail.com> | 2016-03-10 22:58:12 -0400 |
|---|---|---|
| committer | Paul Kehrer <paul.l.kehrer@gmail.com> | 2016-03-10 22:58:12 -0400 |
| commit | 4fe9debd848dfed7afd61d1e2e3799311f93adbc (patch) | |
| tree | d5a6ecc5a780b085f6b9e53060198eb81061926a | |
| parent | d4853b494b2a7f290264d40bef65f152eb2d4727 (diff) | |
| download | cryptography-4fe9debd848dfed7afd61d1e2e3799311f93adbc.tar.gz cryptography-4fe9debd848dfed7afd61d1e2e3799311f93adbc.tar.bz2 cryptography-4fe9debd848dfed7afd61d1e2e3799311f93adbc.zip | |
modify how revocation date is set on X509_REVOKED in the openssl backend
In OpenSSL 1.1.0 there isn't a pre-existing ASN1_TIME object so we have
ASN1_TIME_set make us a new one. In older OpenSSLs this is still safe
because ASN1_TIME_set checks and frees any current value in the object.
| -rw-r--r-- | src/cryptography/hazmat/backends/openssl/backend.py | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index e47f747c..064f9ad6 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -1003,11 +1003,14 @@ class Backend(object): x509_revoked, serial_number ) self.openssl_assert(res == 1) - res = self._lib.ASN1_TIME_set( - x509_revoked.revocationDate, + rev_date = self._lib.ASN1_TIME_set( + self._ffi.NULL, calendar.timegm(builder._revocation_date.timetuple()) ) - self.openssl_assert(res != self._ffi.NULL) + self.openssl_assert(rev_date != self._ffi.NULL) + rev_date = self._ffi.gc(rev_date, self._lib.ASN1_TIME_free) + res = self._lib.X509_REVOKED_set_revocationDate(x509_revoked, rev_date) + self.openssl_assert(res == 1) # add CRL entry extensions self._create_x509_extensions( extensions=builder._extensions, |