diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-08 09:39:33 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-11 07:43:52 +0200 |
| commit | 82bdd6419361136e7be533d31a990ba0476fced3 (patch) | |
| tree | ce6cc42bdb92065dfa4c6dc4efb4eed1b60e39bc /crypto/x509/x509_vfy.c | |
| parent | e41a2c4c609a8f64dfab2d832e975b0b37ff286d (diff) | |
check_chain_extensions(): Require X.509 v3 if extensions are present
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Diffstat (limited to 'crypto/x509/x509_vfy.c')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 83dae9a79b..4a067e5ff4 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -26,6 +26,7 @@ #include "x509_local.h" DEFINE_STACK_OF(X509) +DEFINE_STACK_OF(X509_EXTENSION) DEFINE_STACK_OF(X509_REVOKED) DEFINE_STACK_OF(GENERAL_NAME) DEFINE_STACK_OF(X509_CRL) @@ -585,6 +586,9 @@ static int check_chain_extensions(X509_STORE_CTX *ctx) /* Check SKID presence acc. to RFC 5280 section 4.2.1.2 */ if ((x->ex_flags & EXFLAG_CA) != 0 && x->skid == NULL) ctx->error = X509_V_ERR_MISSING_SUBJECT_KEY_IDENTIFIER; + } else { + if (sk_X509_EXTENSION_num(X509_get0_extensions(x)) > 0) + ctx->error = X509_V_ERR_EXTENSIONS_REQUIRE_VERSION_3; } } if (ctx->error != X509_V_OK) |