Revert "Recognize critical IssuingDistributionPoint CRL extension"
It might not be a good idea to blindly accept such extensions. A scoped
CRL could be accepted for the wrong scope. So just reject them again.
This reverts commit 126778679f.
This commit is contained in:
@@ -543,10 +543,6 @@ static bool parse_extensions(private_openssl_crl_t *this)
|
||||
case NID_freshest_crl:
|
||||
ok = openssl_parse_crlDistributionPoints(ext, this->crl_uris);
|
||||
break;
|
||||
case NID_issuing_distribution_point:
|
||||
/* TODO support of IssuingDistributionPoints */
|
||||
ok = TRUE;
|
||||
break;
|
||||
default:
|
||||
ok = X509_EXTENSION_get_critical(ext) == 0 ||
|
||||
!lib->settings->get_bool(lib->settings,
|
||||
|
||||
@@ -315,9 +315,6 @@ static bool parse(private_x509_crl_t *this)
|
||||
}
|
||||
this->baseCrlNumber = object;
|
||||
break;
|
||||
case OID_ISSUING_DIST_POINT:
|
||||
/* TODO support of IssuingDistributionPoints */
|
||||
break;
|
||||
default:
|
||||
if (critical && lib->settings->get_bool(lib->settings,
|
||||
"%s.x509.enforce_critical", TRUE, lib->ns))
|
||||
|
||||
Reference in New Issue
Block a user