diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-08-25 16:13:40 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-11 07:42:22 +0200 |
| commit | 89f13ca4342be5b541b0885e3058617e5cce0de8 (patch) | |
| tree | 40ff59843c44d516e66fd9df4eed481e6dc69960 /crypto/x509/v3_purp.c | |
| parent | 8a639b9d7234ed490f85ea46e4e8c74620452acd (diff) | |
| download | openssl-new-89f13ca4342be5b541b0885e3058617e5cce0de8.tar.gz | |
check_chain_extensions(): Add check that AKID and SKID are not marked critical
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Diffstat (limited to 'crypto/x509/v3_purp.c')
| -rw-r--r-- | crypto/x509/v3_purp.c | 22 |
1 files changed, 17 insertions, 5 deletions
diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c index 2f9890d8be..bced482df4 100644 --- a/crypto/x509/v3_purp.c +++ b/crypto/x509/v3_purp.c @@ -401,7 +401,6 @@ int x509v3_cache_extensions(X509 *x) ASN1_BIT_STRING *usage; ASN1_BIT_STRING *ns; EXTENDED_KEY_USAGE *extusage; - X509_EXTENSION *ex; int i; int res; @@ -588,17 +587,30 @@ int x509v3_cache_extensions(X509 *x) x->ex_flags |= EXFLAG_INVALID; #endif for (i = 0; i < X509_get_ext_count(x); i++) { - ex = X509_get_ext(x, i); - if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == NID_freshest_crl) + X509_EXTENSION *ex = X509_get_ext(x, i); + int nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex)); + + if (nid == NID_freshest_crl) x->ex_flags |= EXFLAG_FRESHEST; if (!X509_EXTENSION_get_critical(ex)) continue; - if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == NID_basic_constraints) - x->ex_flags |= EXFLAG_BCONS_CRITICAL; if (!X509_supported_extension(ex)) { x->ex_flags |= EXFLAG_CRITICAL; break; } + switch (nid) { + case NID_basic_constraints: + x->ex_flags |= EXFLAG_BCONS_CRITICAL; + break; + case NID_authority_key_identifier: + x->ex_flags |= EXFLAG_AKID_CRITICAL; + break; + case NID_subject_key_identifier: + x->ex_flags |= EXFLAG_SKID_CRITICAL; + break; + default: + break; + } } /* Set x->siginf, ignoring errors due to unsupported algos */ |