Check for duplicate extensions in a CRL #8608
Conversation
| WOLFSSL_MSG("\tcouldn't parse AuthKeyId extension"); | ||
| } | ||
| #endif | ||
| /* Check for duplicate extension */ |
There was a problem hiding this comment.
Please comment with the RFC for the reason this is enforced. Also should it be guarded by WOLFSSL_NO_ASN_STRICT? i.e does it differ in behavior for OpenSSL compatibility uses and with wolfCLU?
There was a problem hiding this comment.
No guarding required. 2 extensions of the same type makes no sense as it there would be ambiguity as one would have to be ignored.
There was a problem hiding this comment.
More what I'm concerned about is that our wolfCLU app after these changes can not parse the bad example CRL with duplicate extensions (which yes our library should not act on by default...) but OpenSSL command line utility can parse it.
|
The commented github issue fixed is an arduino build issue from Apr 2017. Was that a typo? |
|
Yes. typo!! Hold on. |
|
Jacob makes a valid point. If OpenSSL validates then we should make it possible for wolfCLU to validate as well. |
Fixes #8591