Extend X509 cert checks and error reporting in v3_{purp,crld}.c and x509_{set,vfy}.c
authorDr. David von Oheimb <David.von.Oheimb@siemens.com>
Sat, 27 Jun 2020 14:16:12 +0000 (16:16 +0200)
committerDr. David von Oheimb <David.von.Oheimb@siemens.com>
Fri, 11 Sep 2020 05:42:22 +0000 (07:42 +0200)
commit1e41dadfa7b9f792ed0f4714a3d3d36f070cf30e
tree3dae7b7b2ad8bf6e4db27dd8eb52230d7bdae1c1
parentb0a4cbead384e2ac8dbb697795ace242e1b07c18
Extend X509 cert checks and error reporting in v3_{purp,crld}.c and x509_{set,vfy}.c

add various checks for malformedness to static check_chain_extensions() in x509_vfc.c
improve error reporting of X509v3_cache_extensions() in v3_purp.c
add error reporting to x509_init_sig_info() in x509_set.c
improve static setup_dp() and related functions in v3_purp.c and v3_crld.c
add test case for non-conforming cert from https://tools.ietf.org/html/rfc8410#section-10.2

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12478)
16 files changed:
crypto/err/openssl.txt
crypto/x509/v3_crld.c
crypto/x509/v3_purp.c
crypto/x509/v3err.c
crypto/x509/x509_err.c
crypto/x509/x509_set.c
crypto/x509/x509_txt.c
crypto/x509/x509_vfy.c
doc/internal/man3/x509v3_cache_extensions.pod [new file with mode: 0644]
doc/man1/openssl.pod
include/crypto/x509.h
include/openssl/x509_vfy.h
include/openssl/x509err.h
include/openssl/x509v3err.h
test/recipes/25-test_verify.t
test/testx509.pem