CVSROOT: /cvs
Module name: src
Changes by: t...@cvs.openbsd.org 2022/05/10 13:42:52
Modified files:
lib/libcrypto/x509: x509_purp.c
Log message:
X509_check_ca() has 5 return values but still can't fail
The values 0, 1, 3, 4, 5 all have some meaning, none of which is failure.
If caching of X509v3 extensions fails, returning X509_V_ERR_UNSPECIFIED,
i.e., 1 is a bad idea since that means the cert is a CA with appropriate
basic constraints. Revert to OpenSSL behavior which is to ignore failure
to cache extensions at the risk of reporting lies.
Since no return value can indicate failure, we can't fix this in
X509_check_ca() itself. Application code will have to call (and check)
the magic X509_check_purpose(x, -1, -1) to ensure extensions are cached,
then X509_check_ca() can't lie.
ok jsing
