diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-07 22:38:46 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2020-09-11 07:43:34 +0200 |
| commit | e41a2c4c609a8f64dfab2d832e975b0b37ff286d (patch) | |
| tree | 13e49b110371fe9a550221e4a09b20184bccb4a8 /crypto/x509/x509_vfy.c | |
| parent | d72c8b457b77c31a20cf66e9c92aa19a4b7b5884 (diff) | |
check_chain_extensions(): Change exclusion condition w.r.t. RFC 6818 section 2
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
Diffstat (limited to 'crypto/x509/x509_vfy.c')
| -rw-r--r-- | crypto/x509/x509_vfy.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 29a7f3ff52..83dae9a79b 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -526,8 +526,11 @@ static int check_chain_extensions(X509_STORE_CTX *ctx) * because RFC 5280 does not apply to them according RFC 6818 section 2. */ if ((ctx->param->flags & X509_V_FLAG_X509_STRICT) != 0 - && !(i == 0 && (x->ex_flags & EXFLAG_CA) == 0 - && (x->ex_flags & EXFLAG_SI) != 0)) { + && num > 1) { /* + * this should imply + * !(i == 0 && (x->ex_flags & EXFLAG_CA) == 0 + * && (x->ex_flags & EXFLAG_SI) != 0) + */ /* Check Basic Constraints according to RFC 5280 section 4.2.1.9 */ if (x->ex_pathlen != -1) { if ((x->ex_flags & EXFLAG_CA) == 0) |