commit 94e21e153fc8e0b185df675b6f34b795d86dd06b
author Przemek Stekiel <przemyslaw.stekiel@mobica.com> Wed Jan 25 11:08:32 2023 +0100
committer Przemek Stekiel <przemyslaw.stekiel@mobica.com> Wed Jan 25 11:08:32 2023 +0100
tree 47ddec948004606d463f013cc365a2f11f6c1e47
parent 92cce3fe6dce2f659d6a5985197e1eb44a2dbd85

Skip unsupported extensions

Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>

library/x509_csr.c

diff --git a/library/x509_csr.c b/library/x509_csr.c
index 3b3aa1c..baa0618 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -112,52 +112,47 @@
         }
 
         /*
-         * Detect supported extensions
+         * Detect supported extensions and skip unsupported extensions
          */
         ret = mbedtls_oid_get_x509_ext_type(&extn_oid, &ext_type);
 
-        if (ret != 0) {
-            *p = end_ext_data;
-            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
-                                     ret);
+        if (ret == 0) {
+            /* Forbid repeated extensions */
+            if ((csr->ext_types & ext_type) != 0) {
+                return (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
+                                        MBEDTLS_ERR_ASN1_INVALID_DATA));
+            }
+
+            csr->ext_types |= ext_type;
+
+            switch (ext_type) {
+                case MBEDTLS_X509_EXT_KEY_USAGE:
+                    /* Parse key usage */
+                    if ((ret = mbedtls_x509_get_key_usage(p, end_ext_data,
+                                                            &csr->key_usage)) != 0) {
+                        return ret;
+                    }
+                    break;
+
+                case MBEDTLS_X509_EXT_SUBJECT_ALT_NAME:
+                    /* Parse subject alt name */
+                    if ((ret = mbedtls_x509_get_subject_alt_name(p, end_ext_data,
+                                                                    &csr->subject_alt_names)) != 0) {
+                        return ret;
+                    }
+                    break;
+
+                case MBEDTLS_X509_EXT_NS_CERT_TYPE:
+                    /* Parse netscape certificate type */
+                    if ((ret = mbedtls_x509_get_ns_cert_type(p, end_ext_data,
+                                                                &csr->ns_cert_type)) != 0) {
+                        return ret;
+                    }
+                    break;
+                default:
+                    break;
+            }
         }
-
-        /* Forbid repeated extensions */
-        if ((csr->ext_types & ext_type) != 0) {
-            return (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
-                                      MBEDTLS_ERR_ASN1_INVALID_DATA));
-        }
-
-        csr->ext_types |= ext_type;
-
-        switch (ext_type) {
-            case MBEDTLS_X509_EXT_KEY_USAGE:
-                /* Parse key usage */
-                if ((ret = mbedtls_x509_get_key_usage(p, end_ext_data,
-                                                        &csr->key_usage)) != 0) {
-                    return ret;
-                }
-                break;
-
-            case MBEDTLS_X509_EXT_SUBJECT_ALT_NAME:
-                /* Parse subject alt name */
-                if ((ret = mbedtls_x509_get_subject_alt_name(p, end_ext_data,
-                                                                &csr->subject_alt_names)) != 0) {
-                    return ret;
-                }
-                break;
-
-            case MBEDTLS_X509_EXT_NS_CERT_TYPE:
-                /* Parse netscape certificate type */
-                if ((ret = mbedtls_x509_get_ns_cert_type(p, end_ext_data,
-                                                            &csr->ns_cert_type)) != 0) {
-                    return ret;
-                }
-                break;
-            default:
-                break;
-        }
-
         *p = end_ext_data;
     }
 
@@ -201,7 +196,6 @@
 
         /* Check that this is an extension-request attribute */
         if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS9_CSR_EXT_REQ, &attr_oid) == 0) {
-
             if ((ret = mbedtls_asn1_get_tag(p, end, &len,
                                             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET)) != 0) {
                 return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);