From fa86e2ee3533bb7fa9f3c62c38920cf960e9fec0 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Thu, 2 Apr 2020 17:31:21 +0200 Subject: [PATCH] Set X509_V_ERR_INVALID_EXTENSION error for invalid basic constraints If we encounter certificate with basic constraints CA:false, pathlen present and X509_V_FLAG_X509_STRICT is set we set X509_V_ERR_INVALID_EXTENSION error. Reviewed-by: Bernd Edlinger Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/11463) --- crypto/x509/x509_vfy.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index b338b63531..510b4f1109 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -509,6 +509,12 @@ static int check_chain_extensions(X509_STORE_CTX *ctx) ret = 1; break; } + if ((x->ex_flags & EXFLAG_CA) == 0 + && x->ex_pathlen != -1 + && (ctx->param->flags & X509_V_FLAG_X509_STRICT)) { + ctx->error = X509_V_ERR_INVALID_EXTENSION; + ret = 0; + } if (ret == 0 && !verify_cb_cert(ctx, x, i, X509_V_OK)) return 0; /* check_purpose() makes the callback as needed */ -- 2.25.1