diff options
| author | tb <> | 2023-06-25 13:52:27 +0000 |
|---|---|---|
| committer | tb <> | 2023-06-25 13:52:27 +0000 |
| commit | 8919d61b9c2ddf1361401516b4966661c64921e2 (patch) | |
| tree | 0a021ec29597e06c18b7ca843457986e9d026455 /src/lib/libc | |
| parent | ee2a1487217437d0cbc8d2cba036b6b755509997 (diff) | |
| download | openbsd-8919d61b9c2ddf1361401516b4966661c64921e2.tar.gz openbsd-8919d61b9c2ddf1361401516b4966661c64921e2.tar.bz2 openbsd-8919d61b9c2ddf1361401516b4966661c64921e2.zip | |
Check for duplicate X.509v3 extension OIDs
Per RFC 5280, 4.2: A certificate MUST NOT include more than one instance
of a particular extension.
This implements such a check in x509v3_cache_extensions() by sorting the
list of extensions and looking for duplicate neighbors. This sidesteps
complications from extensions we do not know about and keeps algorithmic
complexity reasonable. If the check fails, EXFLAG_INVALID is set on the
certificate, which means that the verifier will not validate it.
ok jsing
Diffstat (limited to 'src/lib/libc')
0 files changed, 0 insertions, 0 deletions