cryptnet: Move revocation cache check to verify_cert_revocation_from_dist_points_ext().

Paves the way for falling back from OCSP to online CRL verification. It's not clear if a cache is needed for OCSP responses, or if the wininet cache wouldn't be sufficient.

cryptnet: Move revocation cache check to verify_cert_revocation_from_dist_points_ext().
f08dcbf8 · Hans Leidekker · Alexandre Julliard · bbb3990c · f08dcbf8
Commit f08dcbf8 authored Jun 15, 2022 by Hans Leidekker Committed by Alexandre Julliard Jun 15, 2022
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 3 deletions

cryptnet_main.c dlls/cryptnet/cryptnet_main.c +3 -3

No files found.
--- a/dlls/cryptnet/cryptnet_main.c
+++ b/dlls/cryptnet/cryptnet_main.c
@@ -1696,6 +1696,9 @@ static DWORD verify_cert_revocation_from_dist_points_ext(const CRYPT_DATA_BLOB *
        return CRYPT_E_REVOCATION_OFFLINE;
    }

+    if (find_cached_revocation_status(&cert->pCertInfo->SerialNumber, time, status))
+        return status->dwError;
+
    if (!CRYPT_GetUrlFromCRLDistPointsExt(value, NULL, &url_array_size, NULL, NULL))
        return GetLastError();

@@ -2143,9 +2146,6 @@ static DWORD verify_cert_revocation(const CERT_CONTEXT *cert, FILETIME *pTime,
    DWORD error = ERROR_SUCCESS;
    PCERT_EXTENSION ext;

-    if (find_cached_revocation_status(&cert->pCertInfo->SerialNumber, pTime, pRevStatus))
-        return pRevStatus->dwError;
-
    if ((ext = CertFindExtension(szOID_AUTHORITY_INFO_ACCESS, cert->pCertInfo->cExtension, cert->pCertInfo->rgExtension)))
    {
        error = verify_cert_revocation_from_aia_ext(&ext->Value, cert, pTime, dwFlags, pRevPara, pRevStatus);