From 2092fe67220e0b5b54ea504c8523a64b0e4bf04a Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 23 Jul 2026 14:58:18 +0200 Subject: [PATCH] Revert "Recognize critical IssuingDistributionPoint CRL extension" It might not be a good idea to blindly accept such extensions. A scoped CRL could be accepted for the wrong scope. So just reject them again. This reverts commit 126778679f9edc8ff2de38feddaf84759936939d. --- src/libstrongswan/plugins/openssl/openssl_crl.c | 4 ---- src/libstrongswan/plugins/x509/x509_crl.c | 3 --- 2 files changed, 7 deletions(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_crl.c b/src/libstrongswan/plugins/openssl/openssl_crl.c index 97072ec2e..953b69c0d 100644 --- a/src/libstrongswan/plugins/openssl/openssl_crl.c +++ b/src/libstrongswan/plugins/openssl/openssl_crl.c @@ -543,10 +543,6 @@ static bool parse_extensions(private_openssl_crl_t *this) case NID_freshest_crl: ok = openssl_parse_crlDistributionPoints(ext, this->crl_uris); break; - case NID_issuing_distribution_point: - /* TODO support of IssuingDistributionPoints */ - ok = TRUE; - break; default: ok = X509_EXTENSION_get_critical(ext) == 0 || !lib->settings->get_bool(lib->settings, diff --git a/src/libstrongswan/plugins/x509/x509_crl.c b/src/libstrongswan/plugins/x509/x509_crl.c index 9dbb7b5f2..178bdc0a9 100644 --- a/src/libstrongswan/plugins/x509/x509_crl.c +++ b/src/libstrongswan/plugins/x509/x509_crl.c @@ -315,9 +315,6 @@ static bool parse(private_x509_crl_t *this) } this->baseCrlNumber = object; break; - case OID_ISSUING_DIST_POINT: - /* TODO support of IssuingDistributionPoints */ - break; default: if (critical && lib->settings->get_bool(lib->settings, "%s.x509.enforce_critical", TRUE, lib->ns))