Revert "Recognize critical IssuingDistributionPoint CRL extension"
It might not be a good idea to blindly accept such extensions. A scoped
CRL could be accepted for the wrong scope. So just reject them again.
This reverts commit 126778679f.
This commit is contained in:
@@ -543,10 +543,6 @@ static bool parse_extensions(private_openssl_crl_t *this)
|
|||||||
case NID_freshest_crl:
|
case NID_freshest_crl:
|
||||||
ok = openssl_parse_crlDistributionPoints(ext, this->crl_uris);
|
ok = openssl_parse_crlDistributionPoints(ext, this->crl_uris);
|
||||||
break;
|
break;
|
||||||
case NID_issuing_distribution_point:
|
|
||||||
/* TODO support of IssuingDistributionPoints */
|
|
||||||
ok = TRUE;
|
|
||||||
break;
|
|
||||||
default:
|
default:
|
||||||
ok = X509_EXTENSION_get_critical(ext) == 0 ||
|
ok = X509_EXTENSION_get_critical(ext) == 0 ||
|
||||||
!lib->settings->get_bool(lib->settings,
|
!lib->settings->get_bool(lib->settings,
|
||||||
|
|||||||
@@ -315,9 +315,6 @@ static bool parse(private_x509_crl_t *this)
|
|||||||
}
|
}
|
||||||
this->baseCrlNumber = object;
|
this->baseCrlNumber = object;
|
||||||
break;
|
break;
|
||||||
case OID_ISSUING_DIST_POINT:
|
|
||||||
/* TODO support of IssuingDistributionPoints */
|
|
||||||
break;
|
|
||||||
default:
|
default:
|
||||||
if (critical && lib->settings->get_bool(lib->settings,
|
if (critical && lib->settings->get_bool(lib->settings,
|
||||||
"%s.x509.enforce_critical", TRUE, lib->ns))
|
"%s.x509.enforce_critical", TRUE, lib->ns))
|
||||||
|
|||||||
Reference in New Issue
Block a user