Lay groundwork to support X.509 v3 extensions for IP Addresses and AS Identifiers

These extensions are defined in RFC 3779 and used in the RPKI (RFC 6482, RFC 8360).
Imported from OpenSSL 1.1.1j (aaf2fcb575cdf6491b98ab4829abf78a3dec8402b8b81efc8f23c00d443981bf)
This changeset is a no-op, as there are 10+ issues and at least 2 security issues.
Work will continue in-tree.

OK tb@, discussed with beck@

1 files changed, 14 insertions, 1 deletions

diff --git a/src/lib/libcrypto/x509/x509_purp.c b/src/lib/libcrypto/x509/x509_purp.c
index aff9f607bc..3f0081fe40 100644
--- a/src/lib/libcrypto/x509/x509_purp.c
+++ b/src/lib/libcrypto/x509/x509_purp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_purp.c,v 1.5 2021/07/23 20:40:49 schwarze Exp $ */
+/* $OpenBSD: x509_purp.c,v 1.6 2021/09/02 12:41:44 job Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -366,6 +366,10 @@ X509_supported_extension(X509_EXTENSION *ex)
                 NID_basic_constraints,  /* 87 */
                 NID_certificate_policies, /* 89 */
                 NID_ext_key_usage,      /* 126 */
+#ifndef OPENSSL_NO_RFC3779
+                NID_sbgp_ipAddrBlock,   /* 290 */
+                NID_sbgp_autonomousSysNum, /* 291 */
+#endif
                 NID_policy_constraints, /* 401 */
                 NID_proxyCertInfo,      /* 663 */
                 NID_name_constraints,   /* 666 */
@@ -587,6 +591,15 @@ x509v3_cache_extensions(X509 *x)
                 x->ex_flags |= EXFLAG_INVALID;
         setup_crldp(x);
 
+#ifndef OPENSSL_NO_RFC3779
+        x->rfc3779_addr = X509_get_ext_d2i(x, NID_sbgp_ipAddrBlock, &i, NULL);
+        if (x->rfc3779_addr == NULL && i != -1)
+                x->ex_flags |= EXFLAG_INVALID;
+        x->rfc3779_asid = X509_get_ext_d2i(x, NID_sbgp_autonomousSysNum, &i, NULL);
+        if (x->rfc3779_asid == NULL && i != -1)
+                x->ex_flags |= EXFLAG_INVALID;
+#endif
+
         for (i = 0; i < X509_get_ext_count(x); i++) {
                 ex = X509_get_ext(x, i);
                 if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) ==