Commit 1a9b0c2aed for strongswan.org

commit 1a9b0c2aed21e73b93c144af459cde1280af88d8
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Tue Oct 27 14:22:06 2026 +0100

    x509: Reject attribute certificates with unknown critical extensions

    This in compliance with RFC 5755, section 4.2.9.  Note that because
    the audit identity extension, which MUST be critical if encoded, is
    currently not supported, it's possible that this causes failures when
    used with third-party attribute certificates that encode it.

diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
index 0d11679f9f..a25d19504f 100644
--- a/src/libstrongswan/plugins/x509/x509_ac.c
+++ b/src/libstrongswan/plugins/x509/x509_ac.c
@@ -410,7 +410,7 @@ static bool parse_certificate(private_x509_ac_t *this)
 	int type     = OID_UNKNOWN;
 	int extn_oid = OID_UNKNOWN;
 	signature_params_t sig_alg = {};
-	bool success = FALSE;
+	bool critical = FALSE, success = FALSE;

 	parser = asn1_parser_create(acObjects, this->encoding);

@@ -510,8 +510,8 @@ static bool parse_certificate(private_x509_ac_t *this)
 				extn_oid = asn1_known_oid(object);
 				break;
 			case AC_OBJ_CRITICAL:
-				DBG2(DBG_ASN, "  %s",
-					 object.len && *object.ptr ? "TRUE" : "FALSE");
+				critical = object.len && *object.ptr;
+				DBG2(DBG_ASN, "  %s", critical ? "TRUE" : "FALSE");
 				break;
 			case AC_OBJ_EXTN_VALUE:
 			{
@@ -533,6 +533,14 @@ static bool parse_certificate(private_x509_ac_t *this)
 						this->noRevAvail = TRUE;
 						break;
 					default:
+						if (critical && lib->settings->get_bool(lib->settings,
+							"%s.x509.enforce_critical", TRUE, lib->ns))
+						{
+							DBG1(DBG_ASN, "critical '%s' extension not supported",
+								 (extn_oid == OID_UNKNOWN) ? "unknown" :
+								 (char*)oid_names[extn_oid].name);
+							goto end;
+						}
 						break;
 				}
 				break;