commit 4251d0d3f66a182e1b1ff22e9d0085613a1253ec
author Adam Langley <alangley@gmail.com> Fri Jan 29 12:30:02 2021 -0800
committer Adam Langley <agl@google.com> Fri Jan 29 22:56:19 2021 +0000
tree 2382baeb15ae15d57b60c5b9a0dbbbf9723b1932
parent c5e4538e3b0bcfdda30d2dabecbee952faf54c1c

Revert "Disable check that X.509 extensions implies v3."

This reverts commit 5850a016b212407708a963f4f94e4217ae18dd0e.

Bug: 375
Change-Id: Ife8184ded5b09f175924bfc29ac113d3186e60ed
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/45344
Reviewed-by: David Benjamin <davidben@google.com>

crypto/x509/x509_test.cc

diff --git a/crypto/x509/x509_test.cc b/crypto/x509/x509_test.cc
index bde4339..0debb8a 100644
--- a/crypto/x509/x509_test.cc
+++ b/crypto/x509/x509_test.cc
@@ -2576,11 +2576,6 @@
 -----END CERTIFICATE-----
 )";
 
-/*
-
-Test cases disabled. TODO re-enable in Jan 2021.
-https://crbug.com/boringssl/375
-
 // kV1WithExtensionsPEM is an X.509v1 certificate with extensions.
 static const char kV1WithExtensionsPEM[] = R"(
 -----BEGIN CERTIFICATE-----
@@ -2612,7 +2607,6 @@
 BwIgfB55FGohg/B6dGh5XxSZmmi08cueFV7mHzJSYV51yRQ=
 -----END CERTIFICATE-----
 )";
-*/
 
 // kV1WithIssuerUniqueIDPEM is an X.509v1 certificate with an issuerUniqueID.
 static const char kV1WithIssuerUniqueIDPEM[] = R"(
@@ -2654,10 +2648,8 @@
   EXPECT_FALSE(CertFromPEM(kNegativeVersionPEM));
   EXPECT_FALSE(CertFromPEM(kFutureVersionPEM));
   EXPECT_FALSE(CertFromPEM(kOverflowVersionPEM));
-  // Test cases disabled. TODO re-enable in Jan 2021.
-  // https://crbug.com/boringssl/375
-  //EXPECT_FALSE(CertFromPEM(kV1WithExtensionsPEM));
-  //EXPECT_FALSE(CertFromPEM(kV2WithExtensionsPEM));
+  EXPECT_FALSE(CertFromPEM(kV1WithExtensionsPEM));
+  EXPECT_FALSE(CertFromPEM(kV2WithExtensionsPEM));
   EXPECT_FALSE(CertFromPEM(kV1WithIssuerUniqueIDPEM));
   EXPECT_FALSE(CertFromPEM(kV1WithSubjectUniqueIDPEM));
 }

crypto/x509/x_x509.c

diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c
index 397230c..ff0bff8 100644
--- a/crypto/x509/x_x509.c
+++ b/crypto/x509/x_x509.c
@@ -136,12 +136,10 @@
         }
 
         /* Per RFC5280, section 4.1.2.9, extensions require v3. */
-        /* Check disabled. TODO re-enable in Jan 2021.
-           https://crbug.com/boringssl/375
         if (version != 2 && ret->cert_info->extensions != NULL) {
             OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
             return 0;
-        }*/
+        }
 
         break;
     }