tree d358750a94aff58c3b1332083d807476e519ddfd
parent e7b78770eca9724a7af2f344588693dcf8b327df
author Adam Langley <agl@google.com> 1533079157 -0700
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1533149750 +0000

Add X509_V_FLAG_REQUIRE_CA_BASIC_CONSTRAINTS.

This change adds a new flag, X509_V_FLAG_REQUIRE_CA_BASIC_CONSTRAINTS,
which causes basicConstraints with isCA to be required for intermediate
CA certificates. Without this, intermediates are also acceptable if
they're missing basicConstraints, but include either a certSign
keyUsage, or a CA Netscape certificate type.

This is a short-term change for patching. I'll undo a lot of it and make
this the default in the next change.

Change-Id: I7f42ffd76c57de3037f054108951e230c1b4e415
Reviewed-on: https://boringssl-review.googlesource.com/30184
Commit-Queue: Adam Langley <agl@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Reviewed-by: Matt Braithwaite <mab@google.com>