Skip to content

Commit

Permalink
Fix openssl req with -addext subjectAltName=dirName
Browse files Browse the repository at this point in the history
The syntax check of the -addext fails because the
X509V3_CTX is used to lookup the referenced section,
but the wrong configuration file is used, where only
a default section with all passed in -addext lines is available.
Thus it was not possible to use the subjectAltName=dirName:section
as an -addext parameter.  Probably other extensions as well.

This change affects only the syntax check, the real extension
was already created with correct parameters.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from #23669)

(cherry picked from commit 3874188)
  • Loading branch information
bernd-edlinger authored and t8m committed Apr 2, 2024
1 parent c3e0ea5 commit 996ccb5
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 2 deletions.
2 changes: 1 addition & 1 deletion apps/req.c
Original file line number Diff line number Diff line change
Expand Up @@ -573,7 +573,7 @@ int req_main(int argc, char **argv)
X509V3_CTX ctx;

X509V3_set_ctx_test(&ctx);
X509V3_set_nconf(&ctx, addext_conf);
X509V3_set_nconf(&ctx, req_conf);
if (!X509V3_EXT_add_nconf(addext_conf, &ctx, "default", NULL)) {
BIO_printf(bio_err, "Error checking extensions defined using -addext\n");
goto end;
Expand Down
3 changes: 2 additions & 1 deletion test/recipes/25-test_req.t
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;

setup("test_req");

plan tests => 107;
plan tests => 108;

require_ok(srctop_file('test', 'recipes', 'tconversion.pl'));

Expand Down Expand Up @@ -53,6 +53,7 @@ ok(!run(app([@addext_args, "-addext", $val, "-addext", $val2])));
ok(!run(app([@addext_args, "-addext", $val, "-addext", $val3])));
ok(!run(app([@addext_args, "-addext", $val2, "-addext", $val3])));
ok(run(app([@addext_args, "-addext", "SXNetID=1:one, 2:two, 3:three"])));
ok(run(app([@addext_args, "-addext", "subjectAltName=dirName:dirname_sec"])));

# If a CSR is provided with neither of -key or -CA/-CAkey, this should fail.
ok(!run(app(["openssl", "req", "-x509",
Expand Down
6 changes: 6 additions & 0 deletions test/test.cnf
Original file line number Diff line number Diff line change
Expand Up @@ -72,3 +72,9 @@ commonName = CN field
commonName_value = Eric Young
emailAddress = email field
emailAddress_value = eay@mincom.oz.au

[ dirname_sec ]
C = UK
O = My Organization
OU = My Unit
CN = My Name

0 comments on commit 996ccb5

Please sign in to comment.