diff options
| author | Job Snijders <job@cvs.openbsd.org> | 2022-11-04 09:43:14 +0000 |
|---|---|---|
| committer | Job Snijders <job@cvs.openbsd.org> | 2022-11-04 09:43:14 +0000 |
| commit | 663972c47aa61292de03a32b2ad8390ac5e00eca (patch) | |
| tree | 9a318dd93a8ef80962691b218b6d61edc6e97815 /usr.sbin/rpki-client/aspa.c | |
| parent | 7d5ffd488437dd0b1bbc4e51c7141e73840c6635 (diff) | |
Check the SIA signedObject in ROA/MFT/ASPA/TAK/GBR EE certificates
Unfortunately we can't yet error out when accessMethods other than
signedObject are encountered in the SubjectInformationAccess extension
because there is pollution in the ecosystem.
OK tb@
Diffstat (limited to 'usr.sbin/rpki-client/aspa.c')
| -rw-r--r-- | usr.sbin/rpki-client/aspa.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/usr.sbin/rpki-client/aspa.c b/usr.sbin/rpki-client/aspa.c index 5ed3d9a8324..aab730b8ce4 100644 --- a/usr.sbin/rpki-client/aspa.c +++ b/usr.sbin/rpki-client/aspa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: aspa.c,v 1.6 2022/11/02 10:04:41 tb Exp $ */ +/* $OpenBSD: aspa.c,v 1.7 2022/11/04 09:43:13 job Exp $ */ /* * Copyright (c) 2022 Job Snijders <job@fastly.com> * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> @@ -207,11 +207,14 @@ aspa_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len) goto out; if (!x509_get_aki(*x509, fn, &p.res->aki)) goto out; + if (!x509_get_sia(*x509, fn, &p.res->sia)) + goto out; if (!x509_get_ski(*x509, fn, &p.res->ski)) goto out; - if (p.res->aia == NULL || p.res->aki == NULL || p.res->ski == NULL) { + if (p.res->aia == NULL || p.res->aki == NULL || p.res->sia == NULL || + p.res->ski == NULL) { warnx("%s: RFC 6487 section 4.8: " - "missing AIA, AKI or SKI X509 extension", fn); + "missing AIA, AKI, SIA, or SKI X509 extension", fn); goto out; } @@ -268,6 +271,7 @@ aspa_free(struct aspa *p) free(p->aia); free(p->aki); + free(p->sia); free(p->ski); free(p->providers); free(p); |