tree 5bf0125149aa5893196dbc3b5a9361c8e867af00
parent 39cc892c73d6c3faf2e604c44509f132c232f24c
author David Benjamin <davidben@google.com> 1699817331 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1700512701 +0000

Don't process DistributionPoints with a reasons field

This isn't *quite* a no-op, but it's the other half of removing support
for partitioned CRLs. The distribution point's reasons field and the
CRL's onlySomeReasons field are masked together to determine which
reasons we have covered so far. This is used in some complex logic from
RFC 5280, section 6.3.3 to loop through a bunch of CRLs before
determining that we've covered evertything.

OpenSSL's "extended CRL" feature skipped all CRLs with an
onlySomeReasons field, but did not condition on the distribution point,
so the loop was still active in some cases.

The new verifier from Chromium doesn't support either. If the
distribution point has a reasons field, we ignore it. Align with
Chromium. Now the reasons field is always the special all-reasons value.

As part of this, this removed the dp_reasons field from DIST_POINT. This
is a public struct, but was unused outside of cl/581761514, so we can
stop computing it.

Update-Note: See above.

Bug: 601
Change-Id: I9b0a9766b281d3486874e1b6d4d415a51e50ba59
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/63935
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>