1 files changed, 14 insertions, 1 deletions

diff --git a/src/lib/libcrypto/x509/x509_purp.c b/src/lib/libcrypto/x509/x509_purp.c
index aff9f607bc..3f0081fe40 100644
--- a/src/lib/libcrypto/x509/x509_purp.c
+++ b/src/lib/libcrypto/x509/x509_purp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_purp.c,v 1.5 2021/07/23 20:40:49 schwarze Exp $ */
+/* $OpenBSD: x509_purp.c,v 1.6 2021/09/02 12:41:44 job Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -366,6 +366,10 @@ X509_supported_extension(X509_EXTENSION *ex)
                 NID_basic_constraints,  /* 87 */
                 NID_certificate_policies, /* 89 */
                 NID_ext_key_usage,      /* 126 */
+#ifndef OPENSSL_NO_RFC3779
+                NID_sbgp_ipAddrBlock,   /* 290 */
+                NID_sbgp_autonomousSysNum, /* 291 */
+#endif
                 NID_policy_constraints, /* 401 */
                 NID_proxyCertInfo,      /* 663 */
                 NID_name_constraints,   /* 666 */
@@ -587,6 +591,15 @@ x509v3_cache_extensions(X509 *x)
                 x->ex_flags |= EXFLAG_INVALID;
         setup_crldp(x);
 
+#ifndef OPENSSL_NO_RFC3779
+        x->rfc3779_addr = X509_get_ext_d2i(x, NID_sbgp_ipAddrBlock, &i, NULL);
+        if (x->rfc3779_addr == NULL && i != -1)
+                x->ex_flags |= EXFLAG_INVALID;
+        x->rfc3779_asid = X509_get_ext_d2i(x, NID_sbgp_autonomousSysNum, &i, NULL);
+        if (x->rfc3779_asid == NULL && i != -1)
+                x->ex_flags |= EXFLAG_INVALID;
+#endif
+
         for (i = 0; i < X509_get_ext_count(x); i++) {
                 ex = X509_get_ext(x, i);
                 if (OBJ_obj2nid(X509_EXTENSION_get_object(ex)) ==