summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
3d6e91c)
Returning untrusted is enough for for full chains that end in
self-signed roots, because when explicit trust is specified it
suppresses the default blanket trust of self-signed objects.
But for partial chains, this is not enough, because absent a similar
trust-self-signed policy, non matching EKUs are indistinguishable
from lack of EKU constraints.
Therefore, failure to match any trusted purpose must trigger an
explicit reject.
Reviewed-by: Richard Levitte <levitte@openssl.org>
if (OBJ_obj2nid(obj) == id)
return X509_TRUST_TRUSTED;
}
if (OBJ_obj2nid(obj) == id)
return X509_TRUST_TRUSTED;
}
+ /*
+ * Reject when explicit trust EKU are set and none match.
+ *
+ * Returning untrusted is enough for for full chains that end in
+ * self-signed roots, because when explicit trust is specified it
+ * suppresses the default blanket trust of self-signed objects.
+ *
+ * But for partial chains, this is not enough, because absent a similar
+ * trust-self-signed policy, non matching EKUs are indistinguishable
+ * from lack of EKU constraints.
+ *
+ * Therefore, failure to match any trusted purpose must trigger an
+ * explicit reject.
+ */
+ return X509_TRUST_REJECTED;
}
return X509_TRUST_UNTRUSTED;
}
}
return X509_TRUST_UNTRUSTED;
}