Add RFC 3779 checks to both legacy and new verifier

OK beck@

1 files changed, 11 insertions, 1 deletions

diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index c54444c91b..4c3fe7f3e3 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.91 2021/10/24 13:52:13 tb Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.92 2021/10/26 15:14:18 job Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -549,6 +549,16 @@ X509_verify_cert_legacy(X509_STORE_CTX *ctx)
         if (!ok)
                 goto end;
 
+#ifndef OPENSSL_NO_RFC3779
+        ok = X509v3_asid_validate_path(ctx);
+        if (!ok)
+                goto end;
+
+        ok = X509v3_addr_validate_path(ctx);
+        if (!ok)
+                goto end;
+#endif
+
         ok = check_id(ctx);
         if (!ok)
                 goto end;