PR: 2183

[openssl.git] / crypto / x509v3 / v3_conf.c

diff --git a/crypto/x509v3/v3_conf.c b/crypto/x509v3/v3_conf.c
index 6730f9a6ee96f5437f413ec8df3c49cf39b0a5a0..24b21d4ea2d592c1bcbe979884273b1b67221327 100644 (file)
--- a/crypto/x509v3/v3_conf.c
+++ b/crypto/x509v3/v3_conf.c
@@ -317,6 +317,19 @@ static unsigned char *generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len)
        return ext_der;
        }
 
        return ext_der;
        }
 

+static void delete_ext(STACK_OF(X509_EXTENSION) *sk, X509_EXTENSION *dext)
+       {
+       int idx;
+       ASN1_OBJECT *obj;
+       obj = X509_EXTENSION_get_object(dext);
+       while ((idx = X509_EXTENSION_get_by_OBJ(sk, obj, -1)) >= 0)
+               {
+               X509_EXTENSION *tmpext= X509_get_ext(sk, idx);
+               X509_del_ext(sk, idx);
+               X509_EXTENSION_free(tmpext);
+               }
+       }
+

 /* This is the main function: add a bunch of extensions based on a config file
  * section to an extension STACK.
  */
 /* This is the main function: add a bunch of extensions based on a config file
  * section to an extension STACK.
  */


@@ -335,6 +348,8 @@ int X509V3_EXT_add_nconf_sk(CONF *conf, X509V3_CTX *ctx, char *section,
                val = sk_CONF_VALUE_value(nval, i);
                if (!(ext = X509V3_EXT_nconf(conf, ctx, val->name, val->value)))
                                                                return 0;
                val = sk_CONF_VALUE_value(nval, i);
                if (!(ext = X509V3_EXT_nconf(conf, ctx, val->name, val->value)))
                                                                return 0;

+               if (ctx->flags == X509V3_CTX_FLAG_REPLACE)      
+                       delete_ext(*sk, ext);

                if (sk) X509v3_add_ext(sk, ext, -1);
                X509_EXTENSION_free(ext);
                }
                if (sk) X509v3_add_ext(sk, ext, -1);
                X509_EXTENSION_free(ext);
                }