The Tor Browser / annotate

security/nss/lib/libpkix/pkix/checker/pkix_revocationchecker.c@b8a032363ba2 (annotated)

security/nss/lib/libpkix/pkix/checker/pkix_revocationchecker.c

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rwxr-xr-x

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4 /*
michael@0 5 * pkix_revocationchecker.c
michael@0 6 *
michael@0 7 * RevocationChecker Object Functions
michael@0 8 *
michael@0 9 */
michael@0 10
michael@0 11 #include "pkix_revocationchecker.h"
michael@0 12 #include "pkix_tools.h"
michael@0 13
michael@0 14 /* --Private-Functions-------------------------------------------- */
michael@0 15
michael@0 16 /*
michael@0 17 * FUNCTION: pkix_RevocationChecker_Destroy
michael@0 18 * (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
michael@0 19 */
michael@0 20 static PKIX_Error *
michael@0 21 pkix_RevocationChecker_Destroy(
michael@0 22 PKIX_PL_Object *object,
michael@0 23 void *plContext)
michael@0 24 {
michael@0 25 PKIX_RevocationChecker *checker = NULL;
michael@0 26
michael@0 27 PKIX_ENTER(REVOCATIONCHECKER, "pkix_RevocationChecker_Destroy");
michael@0 28 PKIX_NULLCHECK_ONE(object);
michael@0 29
michael@0 30 /* Check that this object is a revocation checker */
michael@0 31 PKIX_CHECK(pkix_CheckType
michael@0 32 (object, PKIX_REVOCATIONCHECKER_TYPE, plContext),
michael@0 33 PKIX_OBJECTNOTREVOCATIONCHECKER);
michael@0 34
michael@0 35 checker = (PKIX_RevocationChecker *)object;
michael@0 36
michael@0 37 PKIX_DECREF(checker->leafMethodList);
michael@0 38 PKIX_DECREF(checker->chainMethodList);
michael@0 39
michael@0 40 cleanup:
michael@0 41
michael@0 42 PKIX_RETURN(REVOCATIONCHECKER);
michael@0 43 }
michael@0 44
michael@0 45 /*
michael@0 46 * FUNCTION: pkix_RevocationChecker_Duplicate
michael@0 47 * (see comments for PKIX_PL_DuplicateCallback in pkix_pl_system.h)
michael@0 48 */
michael@0 49 static PKIX_Error *
michael@0 50 pkix_RevocationChecker_Duplicate(
michael@0 51 PKIX_PL_Object *object,
michael@0 52 PKIX_PL_Object **pNewObject,
michael@0 53 void *plContext)
michael@0 54 {
michael@0 55 PKIX_RevocationChecker *checker = NULL;
michael@0 56 PKIX_RevocationChecker *checkerDuplicate = NULL;
michael@0 57 PKIX_List *dupLeafList = NULL;
michael@0 58 PKIX_List *dupChainList = NULL;
michael@0 59
michael@0 60 PKIX_ENTER(REVOCATIONCHECKER, "pkix_RevocationChecker_Duplicate");
michael@0 61 PKIX_NULLCHECK_TWO(object, pNewObject);
michael@0 62
michael@0 63 PKIX_CHECK(pkix_CheckType
michael@0 64 (object, PKIX_REVOCATIONCHECKER_TYPE, plContext),
michael@0 65 PKIX_OBJECTNOTCERTCHAINCHECKER);
michael@0 66
michael@0 67 checker = (PKIX_RevocationChecker *)object;
michael@0 68
michael@0 69 if (checker->leafMethodList){
michael@0 70 PKIX_CHECK(PKIX_PL_Object_Duplicate
michael@0 71 ((PKIX_PL_Object *)checker->leafMethodList,
michael@0 72 (PKIX_PL_Object **)&dupLeafList,
michael@0 73 plContext),
michael@0 74 PKIX_OBJECTDUPLICATEFAILED);
michael@0 75 }
michael@0 76 if (checker->chainMethodList){
michael@0 77 PKIX_CHECK(PKIX_PL_Object_Duplicate
michael@0 78 ((PKIX_PL_Object *)checker->chainMethodList,
michael@0 79 (PKIX_PL_Object **)&dupChainList,
michael@0 80 plContext),
michael@0 81 PKIX_OBJECTDUPLICATEFAILED);
michael@0 82 }
michael@0 83
michael@0 84 PKIX_CHECK(
michael@0 85 PKIX_RevocationChecker_Create(checker->leafMethodListFlags,
michael@0 86 checker->chainMethodListFlags,
michael@0 87 &checkerDuplicate,
michael@0 88 plContext),
michael@0 89 PKIX_REVOCATIONCHECKERCREATEFAILED);
michael@0 90
michael@0 91 checkerDuplicate->leafMethodList = dupLeafList;
michael@0 92 checkerDuplicate->chainMethodList = dupChainList;
michael@0 93 dupLeafList = NULL;
michael@0 94 dupChainList = NULL;
michael@0 95
michael@0 96 *pNewObject = (PKIX_PL_Object *)checkerDuplicate;
michael@0 97
michael@0 98 cleanup:
michael@0 99 PKIX_DECREF(dupLeafList);
michael@0 100 PKIX_DECREF(dupChainList);
michael@0 101
michael@0 102 PKIX_RETURN(REVOCATIONCHECKER);
michael@0 103 }
michael@0 104
michael@0 105 /*
michael@0 106 * FUNCTION: pkix_RevocationChecker_RegisterSelf
michael@0 107 * DESCRIPTION:
michael@0 108 * Registers PKIX_REVOCATIONCHECKER_TYPE and its related functions with
michael@0 109 * systemClasses[]
michael@0 110 * THREAD SAFETY:
michael@0 111 * Not Thread Safe - for performance and complexity reasons
michael@0 112 *
michael@0 113 * Since this function is only called by PKIX_PL_Initialize, which should
michael@0 114 * only be called once, it is acceptable that this function is not
michael@0 115 * thread-safe.
michael@0 116 */
michael@0 117 PKIX_Error *
michael@0 118 pkix_RevocationChecker_RegisterSelf(void *plContext)
michael@0 119 {
michael@0 120 extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
michael@0 121 pkix_ClassTable_Entry entry;
michael@0 122
michael@0 123 PKIX_ENTER(REVOCATIONCHECKER, "pkix_RevocationChecker_RegisterSelf");
michael@0 124
michael@0 125 entry.description = "RevocationChecker";
michael@0 126 entry.objCounter = 0;
michael@0 127 entry.typeObjectSize = sizeof(PKIX_RevocationChecker);
michael@0 128 entry.destructor = pkix_RevocationChecker_Destroy;
michael@0 129 entry.equalsFunction = NULL;
michael@0 130 entry.hashcodeFunction = NULL;
michael@0 131 entry.toStringFunction = NULL;
michael@0 132 entry.comparator = NULL;
michael@0 133 entry.duplicateFunction = pkix_RevocationChecker_Duplicate;
michael@0 134
michael@0 135 systemClasses[PKIX_REVOCATIONCHECKER_TYPE] = entry;
michael@0 136
michael@0 137 PKIX_RETURN(REVOCATIONCHECKER);
michael@0 138 }
michael@0 139
michael@0 140 /* Sort methods by theirs priorities */
michael@0 141 static PKIX_Error *
michael@0 142 pkix_RevocationChecker_SortComparator(
michael@0 143 PKIX_PL_Object *obj1,
michael@0 144 PKIX_PL_Object *obj2,
michael@0 145 PKIX_Int32 *pResult,
michael@0 146 void *plContext)
michael@0 147 {
michael@0 148 pkix_RevocationMethod *method1 = NULL, *method2 = NULL;
michael@0 149
michael@0 150 PKIX_ENTER(BUILD, "pkix_RevocationChecker_SortComparator");
michael@0 151
michael@0 152 method1 = (pkix_RevocationMethod *)obj1;
michael@0 153 method2 = (pkix_RevocationMethod *)obj2;
michael@0 154
michael@0 155 *pResult = (method1->priority > method2->priority);
michael@0 156
michael@0 157 PKIX_RETURN(BUILD);
michael@0 158 }
michael@0 159
michael@0 160
michael@0 161 /* --Public-Functions--------------------------------------------- */
michael@0 162
michael@0 163
michael@0 164 /*
michael@0 165 * FUNCTION: PKIX_RevocationChecker_Create (see comments in pkix_revchecker.h)
michael@0 166 */
michael@0 167 PKIX_Error *
michael@0 168 PKIX_RevocationChecker_Create(
michael@0 169 PKIX_UInt32 leafMethodListFlags,
michael@0 170 PKIX_UInt32 chainMethodListFlags,
michael@0 171 PKIX_RevocationChecker **pChecker,
michael@0 172 void *plContext)
michael@0 173 {
michael@0 174 PKIX_RevocationChecker *checker = NULL;
michael@0 175
michael@0 176 PKIX_ENTER(REVOCATIONCHECKER, "PKIX_RevocationChecker_Create");
michael@0 177 PKIX_NULLCHECK_ONE(pChecker);
michael@0 178
michael@0 179 PKIX_CHECK(
michael@0 180 PKIX_PL_Object_Alloc(PKIX_REVOCATIONCHECKER_TYPE,
michael@0 181 sizeof (PKIX_RevocationChecker),
michael@0 182 (PKIX_PL_Object **)&checker,
michael@0 183 plContext),
michael@0 184 PKIX_COULDNOTCREATECERTCHAINCHECKEROBJECT);
michael@0 185
michael@0 186 checker->leafMethodListFlags = leafMethodListFlags;
michael@0 187 checker->chainMethodListFlags = chainMethodListFlags;
michael@0 188 checker->leafMethodList = NULL;
michael@0 189 checker->chainMethodList = NULL;
michael@0 190
michael@0 191 *pChecker = checker;
michael@0 192 checker = NULL;
michael@0 193
michael@0 194 cleanup:
michael@0 195 PKIX_DECREF(checker);
michael@0 196
michael@0 197 PKIX_RETURN(REVOCATIONCHECKER);
michael@0 198 }
michael@0 199
michael@0 200 /*
michael@0 201 * FUNCTION: PKIX_RevocationChecker_CreateAndAddMethod
michael@0 202 */
michael@0 203 PKIX_Error *
michael@0 204 PKIX_RevocationChecker_CreateAndAddMethod(
michael@0 205 PKIX_RevocationChecker *revChecker,
michael@0 206 PKIX_ProcessingParams *params,
michael@0 207 PKIX_RevocationMethodType methodType,
michael@0 208 PKIX_UInt32 flags,
michael@0 209 PKIX_UInt32 priority,
michael@0 210 PKIX_PL_VerifyCallback verificationFn,
michael@0 211 PKIX_Boolean isLeafMethod,
michael@0 212 void *plContext)
michael@0 213 {
michael@0 214 PKIX_List **methodList = NULL;
michael@0 215 PKIX_List *unsortedList = NULL;
michael@0 216 PKIX_List *certStores = NULL;
michael@0 217 pkix_RevocationMethod *method = NULL;
michael@0 218 pkix_LocalRevocationCheckFn *localRevChecker = NULL;
michael@0 219 pkix_ExternalRevocationCheckFn *externRevChecker = NULL;
michael@0 220 PKIX_UInt32 miFlags;
michael@0 221
michael@0 222 PKIX_ENTER(REVOCATIONCHECKER, "PKIX_RevocationChecker_CreateAndAddMethod");
michael@0 223 PKIX_NULLCHECK_ONE(revChecker);
michael@0 224
michael@0 225 /* If the caller has said "Either one is sufficient, then don't let the
michael@0 226 * absence of any one method's info lead to an overall failure.
michael@0 227 */
michael@0 228 miFlags = isLeafMethod ? revChecker->leafMethodListFlags
michael@0 229 : revChecker->chainMethodListFlags;
michael@0 230 if (miFlags & PKIX_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE)
michael@0 231 flags &= ~PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO;
michael@0 232
michael@0 233 switch (methodType) {
michael@0 234 case PKIX_RevocationMethod_CRL:
michael@0 235 localRevChecker = pkix_CrlChecker_CheckLocal;
michael@0 236 externRevChecker = pkix_CrlChecker_CheckExternal;
michael@0 237 PKIX_CHECK(
michael@0 238 PKIX_ProcessingParams_GetCertStores(params, &certStores,
michael@0 239 plContext),
michael@0 240 PKIX_PROCESSINGPARAMSGETCERTSTORESFAILED);
michael@0 241 PKIX_CHECK(
michael@0 242 pkix_CrlChecker_Create(methodType, flags, priority,
michael@0 243 localRevChecker, externRevChecker,
michael@0 244 certStores, verificationFn,
michael@0 245 &method,
michael@0 246 plContext),
michael@0 247 PKIX_COULDNOTCREATECRLCHECKEROBJECT);
michael@0 248 break;
michael@0 249 case PKIX_RevocationMethod_OCSP:
michael@0 250 localRevChecker = pkix_OcspChecker_CheckLocal;
michael@0 251 externRevChecker = pkix_OcspChecker_CheckExternal;
michael@0 252 PKIX_CHECK(
michael@0 253 pkix_OcspChecker_Create(methodType, flags, priority,
michael@0 254 localRevChecker, externRevChecker,
michael@0 255 verificationFn,
michael@0 256 &method,
michael@0 257 plContext),
michael@0 258 PKIX_COULDNOTCREATEOCSPCHECKEROBJECT);
michael@0 259 break;
michael@0 260 default:
michael@0 261 PKIX_ERROR(PKIX_INVALIDREVOCATIONMETHOD);
michael@0 262 }
michael@0 263
michael@0 264 if (isLeafMethod) {
michael@0 265 methodList = &revChecker->leafMethodList;
michael@0 266 } else {
michael@0 267 methodList = &revChecker->chainMethodList;
michael@0 268 }
michael@0 269
michael@0 270 if (*methodList == NULL) {
michael@0 271 PKIX_CHECK(
michael@0 272 PKIX_List_Create(methodList, plContext),
michael@0 273 PKIX_LISTCREATEFAILED);
michael@0 274 }
michael@0 275 unsortedList = *methodList;
michael@0 276 PKIX_CHECK(
michael@0 277 PKIX_List_AppendItem(unsortedList, (PKIX_PL_Object*)method, plContext),
michael@0 278 PKIX_LISTAPPENDITEMFAILED);
michael@0 279 PKIX_CHECK(
michael@0 280 pkix_List_BubbleSort(unsortedList,
michael@0 281 pkix_RevocationChecker_SortComparator,
michael@0 282 methodList, plContext),
michael@0 283 PKIX_LISTBUBBLESORTFAILED);
michael@0 284
michael@0 285 cleanup:
michael@0 286 PKIX_DECREF(method);
michael@0 287 PKIX_DECREF(unsortedList);
michael@0 288 PKIX_DECREF(certStores);
michael@0 289
michael@0 290 PKIX_RETURN(REVOCATIONCHECKER);
michael@0 291 }
michael@0 292
michael@0 293 /*
michael@0 294 * FUNCTION: PKIX_RevocationChecker_Check
michael@0 295 */
michael@0 296 PKIX_Error *
michael@0 297 PKIX_RevocationChecker_Check(
michael@0 298 PKIX_PL_Cert *cert,
michael@0 299 PKIX_PL_Cert *issuer,
michael@0 300 PKIX_RevocationChecker *revChecker,
michael@0 301 PKIX_ProcessingParams *procParams,
michael@0 302 PKIX_Boolean chainVerificationState,
michael@0 303 PKIX_Boolean testingLeafCert,
michael@0 304 PKIX_RevocationStatus *pRevStatus,
michael@0 305 PKIX_UInt32 *pReasonCode,
michael@0 306 void **pNbioContext,
michael@0 307 void *plContext)
michael@0 308 {
michael@0 309 PKIX_RevocationStatus overallStatus = PKIX_RevStatus_NoInfo;
michael@0 310 PKIX_RevocationStatus methodStatus[PKIX_RevocationMethod_MAX];
michael@0 311 PKIX_Boolean onlyUseRemoteMethods = PKIX_FALSE;
michael@0 312 PKIX_UInt32 revFlags = 0;
michael@0 313 PKIX_List *revList = NULL;
michael@0 314 PKIX_PL_Date *date = NULL;
michael@0 315 pkix_RevocationMethod *method = NULL;
michael@0 316 void *nbioContext;
michael@0 317 int tries;
michael@0 318
michael@0 319 PKIX_ENTER(REVOCATIONCHECKER, "PKIX_RevocationChecker_Check");
michael@0 320 PKIX_NULLCHECK_TWO(revChecker, procParams);
michael@0 321
michael@0 322 nbioContext = *pNbioContext;
michael@0 323 *pNbioContext = NULL;
michael@0 324
michael@0 325 if (testingLeafCert) {
michael@0 326 revList = revChecker->leafMethodList;
michael@0 327 revFlags = revChecker->leafMethodListFlags;
michael@0 328 } else {
michael@0 329 revList = revChecker->chainMethodList;
michael@0 330 revFlags = revChecker->chainMethodListFlags;
michael@0 331 }
michael@0 332 if (!revList) {
michael@0 333 /* Return NoInfo status */
michael@0 334 goto cleanup;
michael@0 335 }
michael@0 336
michael@0 337 PORT_Memset(methodStatus, PKIX_RevStatus_NoInfo,
michael@0 338 sizeof(PKIX_RevocationStatus) * PKIX_RevocationMethod_MAX);
michael@0 339
michael@0 340 date = procParams->date;
michael@0 341
michael@0 342 /* Need to have two loops if we testing all local info first:
michael@0 343 * first we are going to test all local(cached) info
michael@0 344 * second, all remote info(fetching) */
michael@0 345 for (tries = 0;tries < 2;tries++) {
michael@0 346 int methodNum = 0;
michael@0 347 for (;methodNum < revList->length;methodNum++) {
michael@0 348 PKIX_UInt32 methodFlags = 0;
michael@0 349
michael@0 350 PKIX_DECREF(method);
michael@0 351 PKIX_CHECK(
michael@0 352 PKIX_List_GetItem(revList, methodNum,
michael@0 353 (PKIX_PL_Object**)&method, plContext),
michael@0 354 PKIX_LISTGETITEMFAILED);
michael@0 355 methodFlags = method->flags;
michael@0 356 if (!(methodFlags & PKIX_REV_M_TEST_USING_THIS_METHOD)) {
michael@0 357 /* Will not check with this method. Skipping... */
michael@0 358 continue;
michael@0 359 }
michael@0 360 if (!onlyUseRemoteMethods &&
michael@0 361 methodStatus[methodNum] == PKIX_RevStatus_NoInfo) {
michael@0 362 PKIX_RevocationStatus revStatus = PKIX_RevStatus_NoInfo;
michael@0 363 PKIX_CHECK_NO_GOTO(
michael@0 364 (*method->localRevChecker)(cert, issuer, date,
michael@0 365 method, procParams,
michael@0 366 methodFlags,
michael@0 367 chainVerificationState,
michael@0 368 &revStatus,
michael@0 369 pReasonCode, plContext),
michael@0 370 PKIX_REVCHECKERCHECKFAILED);
michael@0 371 methodStatus[methodNum] = revStatus;
michael@0 372 if (revStatus == PKIX_RevStatus_Revoked) {
michael@0 373 /* if error was generated use it as final error. */
michael@0 374 overallStatus = PKIX_RevStatus_Revoked;
michael@0 375 goto cleanup;
michael@0 376 }
michael@0 377 if (pkixErrorResult) {
michael@0 378 /* Disregard errors. Only returned revStatus matters. */
michael@0 379 PKIX_PL_Object_DecRef((PKIX_PL_Object*)pkixErrorResult,
michael@0 380 plContext);
michael@0 381 pkixErrorResult = NULL;
michael@0 382 }
michael@0 383 }
michael@0 384 if ((!(revFlags & PKIX_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST) ||
michael@0 385 onlyUseRemoteMethods) &&
michael@0 386 chainVerificationState &&
michael@0 387 methodStatus[methodNum] == PKIX_RevStatus_NoInfo) {
michael@0 388 if (!(methodFlags & PKIX_REV_M_FORBID_NETWORK_FETCHING)) {
michael@0 389 PKIX_RevocationStatus revStatus = PKIX_RevStatus_NoInfo;
michael@0 390 PKIX_CHECK_NO_GOTO(
michael@0 391 (*method->externalRevChecker)(cert, issuer, date,
michael@0 392 method,
michael@0 393 procParams, methodFlags,
michael@0 394 &revStatus, pReasonCode,
michael@0 395 &nbioContext, plContext),
michael@0 396 PKIX_REVCHECKERCHECKFAILED);
michael@0 397 methodStatus[methodNum] = revStatus;
michael@0 398 if (revStatus == PKIX_RevStatus_Revoked) {
michael@0 399 /* if error was generated use it as final error. */
michael@0 400 overallStatus = PKIX_RevStatus_Revoked;
michael@0 401 goto cleanup;
michael@0 402 }
michael@0 403 if (pkixErrorResult) {
michael@0 404 /* Disregard errors. Only returned revStatus matters. */
michael@0 405 PKIX_PL_Object_DecRef((PKIX_PL_Object*)pkixErrorResult,
michael@0 406 plContext);
michael@0 407 pkixErrorResult = NULL;
michael@0 408 }
michael@0 409 } else if (methodFlags &
michael@0 410 PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO) {
michael@0 411 /* Info is not in the local cache. Network fetching is not
michael@0 412 * allowed. If need to fail on missing fresh info for the
michael@0 413 * the method, then we should fail right here.*/
michael@0 414 overallStatus = PKIX_RevStatus_Revoked;
michael@0 415 goto cleanup;
michael@0 416 }
michael@0 417 }
michael@0 418 /* If success and we should not check the next method, then
michael@0 419 * return a success. */
michael@0 420 if (methodStatus[methodNum] == PKIX_RevStatus_Success &&
michael@0 421 !(methodFlags & PKIX_REV_M_CONTINUE_TESTING_ON_FRESH_INFO)) {
michael@0 422 overallStatus = PKIX_RevStatus_Success;
michael@0 423 goto cleanup;
michael@0 424 }
michael@0 425 } /* inner loop */
michael@0 426 if (!onlyUseRemoteMethods &&
michael@0 427 revFlags & PKIX_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST &&
michael@0 428 chainVerificationState) {
michael@0 429 onlyUseRemoteMethods = PKIX_TRUE;
michael@0 430 continue;
michael@0 431 }
michael@0 432 break;
michael@0 433 } /* outer loop */
michael@0 434
michael@0 435 if (overallStatus == PKIX_RevStatus_NoInfo &&
michael@0 436 chainVerificationState) {
michael@0 437 /* The following check makes sence only for chain
michael@0 438 * validation step, sinse we do not fetch info while
michael@0 439 * in the process of finding trusted anchor.
michael@0 440 * For chain building step it is enough to know, that
michael@0 441 * the cert was not directly revoked by any of the
michael@0 442 * methods. */
michael@0 443
michael@0 444 /* Still have no info. But one of the method could
michael@0 445 * have returned success status(possible if CONTINUE
michael@0 446 * TESTING ON FRESH INFO flag was used).
michael@0 447 * If any of the methods have returned Success status,
michael@0 448 * the overallStatus should be success. */
michael@0 449 int methodNum = 0;
michael@0 450 for (;methodNum < PKIX_RevocationMethod_MAX;methodNum++) {
michael@0 451 if (methodStatus[methodNum] == PKIX_RevStatus_Success) {
michael@0 452 overallStatus = PKIX_RevStatus_Success;
michael@0 453 goto cleanup;
michael@0 454 }
michael@0 455 }
michael@0 456 if (revFlags & PKIX_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE) {
michael@0 457 overallStatus = PKIX_RevStatus_Revoked;
michael@0 458 }
michael@0 459 }
michael@0 460
michael@0 461 cleanup:
michael@0 462 *pRevStatus = overallStatus;
michael@0 463 PKIX_DECREF(method);
michael@0 464
michael@0 465 PKIX_RETURN(REVOCATIONCHECKER);
michael@0 466 }
michael@0 467

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial