Description
The current RevocationListEntry path prevents callers from supplying a reasonCode extension in ExtraExtensions and also setting ReasonCode. However, the deprecated RevokedCertificates path copies pkix.RevokedCertificate.Extensions unchanged. That lets callers emit reasonCode extensions through the deprecated path, including duplicate reasonCode entries, instead of using the structured RevocationListEntry ReasonCode field.
This is limited to deprecated CRL generation behavior.
Specification
RFC 5280 Section 5.3 defines CRL entry extensions, and Section 5.3.1 defines the reasonCode CRL entry extension. Duplicate instances of the same entry extension are not part of the CRL entry profile and create ambiguous parser behavior.
Code references
go/src/crypto/x509/x509.go:2420 defines RevocationListEntry.go/src/crypto/x509/x509.go:2433 through go/src/crypto/x509/x509.go:2440 documents ReasonCode.go/src/crypto/x509/x509.go:2608 through go/src/crypto/x509/x509.go:2614 rejects a ReasonCode ExtraExtension on the newer entry path.go/src/crypto/x509/x509.go:2581 through go/src/crypto/x509/x509.go:2590 still processes the deprecated RevokedCertificates field when the newer entries field is empty.
Test case
This should be a Go in-tree crypto/x509 API regression test covering the deprecated RevokedCertificates input path and asserting that duplicate reasonCode extensions cannot be emitted.
Description
The current
RevocationListEntrypath prevents callers from supplying areasonCodeextension inExtraExtensionsand also settingReasonCode. However, the deprecatedRevokedCertificatespath copiespkix.RevokedCertificate.Extensionsunchanged. That lets callers emitreasonCodeextensions through the deprecated path, including duplicatereasonCodeentries, instead of using the structuredRevocationListEntryReasonCodefield.This is limited to deprecated CRL generation behavior.
Specification
RFC 5280 Section 5.3 defines CRL entry extensions, and Section 5.3.1 defines the
reasonCodeCRL entry extension. Duplicate instances of the same entry extension are not part of the CRL entry profile and create ambiguous parser behavior.Code references
go/src/crypto/x509/x509.go:2420definesRevocationListEntry.go/src/crypto/x509/x509.go:2433throughgo/src/crypto/x509/x509.go:2440documentsReasonCode.go/src/crypto/x509/x509.go:2608throughgo/src/crypto/x509/x509.go:2614rejects aReasonCodeExtraExtensionon the newer entry path.go/src/crypto/x509/x509.go:2581throughgo/src/crypto/x509/x509.go:2590still processes the deprecatedRevokedCertificatesfield when the newer entries field is empty.Test case
This should be a Go in-tree
crypto/x509API regression test covering the deprecatedRevokedCertificatesinput path and asserting that duplicatereasonCodeextensions cannot be emitted.