diff options
| author | Theo Buehler <tb@cvs.openbsd.org> | 2024-06-08 13:31:39 +0000 |
|---|---|---|
| committer | Theo Buehler <tb@cvs.openbsd.org> | 2024-06-08 13:31:39 +0000 |
| commit | 48b255b45801cb855d735efff59a007e02ca069c (patch) | |
| tree | a5552f88334785c6af4f324345680c3f2e56de1c /usr.sbin/rpki-client/main.c | |
| parent | 2474256db6c5b3ef3f42698511a2c94b167aaac1 (diff) | |
Improve x509_get_purpose()
Instead of only differentiating between CA and BGPsec Router certs,
make it recognize TA and EE certs as well. TAs and CAs have the cA
boolean in the basic constraints, while EE and BGPsec router certs
do not.
TAs are self-signed, CAs not self-issued, all other certs with the
cA boolean are invalid. EE certs do not have an extended key usage
and BGPsec certs contain the id-kp-bgpsec-router OID.
Handle the new purposes where needed.
ok job
Diffstat (limited to 'usr.sbin/rpki-client/main.c')
| -rw-r--r-- | usr.sbin/rpki-client/main.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c index 8546861a310..342548ce3ec 100644 --- a/usr.sbin/rpki-client/main.c +++ b/usr.sbin/rpki-client/main.c @@ -1,4 +1,4 @@ -/* $OpenBSD: main.c,v 1.259 2024/06/07 08:22:53 claudio Exp $ */ +/* $OpenBSD: main.c,v 1.260 2024/06/08 13:31:38 tb Exp $ */ /* * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org> * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv> @@ -618,6 +618,7 @@ entity_process(struct ibuf *b, struct stats *st, struct vrp_tree *tree, } cert = cert_read(b); switch (cert->purpose) { + case CERT_PURPOSE_TA: case CERT_PURPOSE_CA: queue_add_from_cert(cert); break; @@ -626,7 +627,7 @@ entity_process(struct ibuf *b, struct stats *st, struct vrp_tree *tree, repo_stat_inc(rp, talid, type, STYPE_BGPSEC); break; default: - errx(1, "unexpected cert purpose received"); + errx(1, "unexpected %s", purpose2str(cert->purpose)); break; } cert_free(cert); |