From 89f13ca4342be5b541b0885e3058617e5cce0de8 Mon Sep 17 00:00:00 2001 From: "Dr. David von Oheimb" Date: Tue, 25 Aug 2020 16:13:40 +0200 Subject: check_chain_extensions(): Add check that AKID and SKID are not marked critical Reviewed-by: Kurt Roeckx Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/12478) --- crypto/x509/v3_purp.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) (limited to 'crypto/x509/v3_purp.c') diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c index 2f9890d8be..bced482df4 100644 --- a/crypto/x509/v3_purp.c +++ b/crypto/x509/v3_purp.c @@ -401,7 +401,6 @@ int x509v3_cache_extensions(X509 *x) ASN1_BIT_STRING *usage; ASN1_BIT_STRING *ns; EXTENDED_KEY_USAGE *extusage; - X509_EXTENSION *ex; int i; int res; @@ -588,17 +587,30 @@ int x509v3_cache_extensions(X509 *x) x->ex_flags |= EXFLAG_INVALID; #endif for (i = 0; i < X509_get_ext_count(x); i++) { - ex = X509_get_ext(x, i); - if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == NID_freshest_crl) + X509_EXTENSION *ex = X509_get_ext(x, i); + int nid = OBJ_obj2nid(X509_EXTENSION_get_object(ex)); + + if (nid == NID_freshest_crl) x->ex_flags |= EXFLAG_FRESHEST; if (!X509_EXTENSION_get_critical(ex)) continue; - if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) == NID_basic_constraints) - x->ex_flags |= EXFLAG_BCONS_CRITICAL; if (!X509_supported_extension(ex)) { x->ex_flags |= EXFLAG_CRITICAL; break; } + switch (nid) { + case NID_basic_constraints: + x->ex_flags |= EXFLAG_BCONS_CRITICAL; + break; + case NID_authority_key_identifier: + x->ex_flags |= EXFLAG_AKID_CRITICAL; + break; + case NID_subject_key_identifier: + x->ex_flags |= EXFLAG_SKID_CRITICAL; + break; + default: + break; + } } /* Set x->siginf, ignoring errors due to unsupported algos */ -- cgit v1.2.1