Skip to content

OpenSSL's late extension caching is a flaming bag of ass that keeps burning. #1300

Description

@bob-beck

The late extension caching such that v3 things are not parsed when an X509 certificate is deserialized, but only by side
effect after the fact, sucks. it forces X509 objects to be mutated when the should not need to be, and forces the need
to realize things are not there and to call magical functions to do "yes I really need the v3 stuff" - which has been effecitvely
unversally the case for a very long time.

We should just stop this BS and parse the entire cert up front, and hopefully stop making more memory copies while we are at it
akin to OpenSSL's efforts in openssl/openssl#29117

Solving this probably looks like ensuring d2i fills in the "caches" with an eye to eventually removing them as any sort of notion of a cache. having all sorts of locking nonsense around parsing only part of a certificate is counterproductive complexity.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions