[Backport 2.16] Mark basic constraints critical as appropriate. #4044
Conversation
Per RFC 5280 4.2.1.9 if the 'cA' field is set to true, the extension must be marked critical. Signed-off-by: Darren Krahn <dkrahn@google.com>
daverodgman
added
bug
Community
component-x509
needs-review
|
@hanno-arm can you review? |
hanno-becker
removed
the
needs-review
|
@daverodgman anything else we need before this can be merged? |
gilles-peskine-arm
added
needs: changelog
and removed
needs-reviewer
|
@darrenkrahn This is approved and CI is passing so in principle it's ready for merge, however as a gatekeeper I find it surprising to have what looks like a bug fix in a long-time support branch without a changelog entry describing the impact of the bug. Can you please summarize the bug and its impact in a few words (is it just a compliance issue? Can it permit exploits in common scenarios?) and add a file in |
|
Yes, this is just a compliance issue; specifically when creating CA certs. For motivation on why one may want to do this in an embedded environment see https://trustedcomputinggroup.org/resource/dice-layering-architecture/. I missed the ChangeLog requirement, I'll take a look. FWIW, I don't feel strongly about whether or not to backport this fix, if you'd like to reverse the decision and abandon this PR I'm fine with that. |
The change made by PR Mbed-TLS#4044 was previously advertised in the 2.16.10 ChangeLog, however Mbed-TLS#4044 had not yet been merged. Create a new entry for Mbed-TLS#4044, with a note that the previous entry was in error. Signed-off-by: David Horstmann <david.horstmann@arm.com>
|
The CI passed 5 months ago: re-running the merge job to get current results. |
|
The CI run has passed: |
Create ChangeLog entry correcting the record on #4044
Per RFC 5280 4.2.1.9 if the 'cA' field is set to true, the extension
must be marked critical.
Signed-off-by: Darren Krahn dkrahn@google.com
Description
This is a backport to 2.16 of #3698.
Status
READY