Fail when parsing unsupported critical extensions in openssl_x509

diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c
index 80639ddc0c9dd0a2b0eb6dee858b9703c6d8ce82..80e421ab66b50461aa09f229e708e1db82c0861d 100644 (file)
--- a/src/libstrongswan/plugins/openssl/openssl_x509.c
+++ b/src/libstrongswan/plugins/openssl/openssl_x509.c
@@ -841,7 +841,11 @@ static bool parse_extensions(private_openssl_x509_t *this)
                                        ok = parse_crlDistributionPoints_ext(this, ext);
                                        break;
                                default:
-                                       ok = TRUE;
+                                       ok = X509_EXTENSION_get_critical(ext) != 0;
+                                       if (!ok)
+                                       {
+                                               DBG1(DBG_LIB, "found unsupported critical X.509 extension");
+                                       }
                                        break;
                        }
                        if (!ok)