Tobias Frauenschläger dedba75ad4 Reject duplicate certificatePolicies extension in WOLFSSL_CERT_EXT builds ...

DecodeExtensionType() guarded the certificatePolicies duplicate check
(VERIFY_AND_SET_OID) under WOLFSSL_SEP only, because the extCertPolicySet
tracking bit was SEP-only. In a WOLFSSL_CERT_EXT-without-WOLFSSL_SEP build a
cert with two certificatePolicies extensions was accepted and the second
silently overwrote the first (RFC 5280 4.2 forbids repeats). Make the bit and
the guard available under WOLFSSL_CERT_EXT too, matching every other
non-repeatable extension.

Add test_DecodeCertExtensions_dup_certpol (DecodeExtensionType now
WOLFSSL_TEST_VIS).

2026-06-17 19:14:21 +02:00

..

benchmark

Merge pull request #10571 from Frauschi/mlkem_rename

2026-06-05 11:00:44 -05:00

src

Reject duplicate certificatePolicies extension in WOLFSSL_CERT_EXT builds

2026-06-17 19:14:21 +02:00

test

Merge pull request #10668 from holtrop-wolfssl/f-5394

2026-06-12 16:35:31 -07:00