diff options
| author | Job Snijders <job@cvs.openbsd.org> | 2022-11-04 09:43:14 +0000 |
|---|---|---|
| committer | Job Snijders <job@cvs.openbsd.org> | 2022-11-04 09:43:14 +0000 |
| commit | 663972c47aa61292de03a32b2ad8390ac5e00eca (patch) | |
| tree | 9a318dd93a8ef80962691b218b6d61edc6e97815 /usr.sbin/rpki-client/mft.c | |
| parent | 7d5ffd488437dd0b1bbc4e51c7141e73840c6635 (diff) | |
Check the SIA signedObject in ROA/MFT/ASPA/TAK/GBR EE certificates
Unfortunately we can't yet error out when accessMethods other than
signedObject are encountered in the SubjectInformationAccess extension
because there is pollution in the ecosystem.
OK tb@
Diffstat (limited to 'usr.sbin/rpki-client/mft.c')
| -rw-r--r-- | usr.sbin/rpki-client/mft.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/usr.sbin/rpki-client/mft.c b/usr.sbin/rpki-client/mft.c index 7fde67f823f..b86775e7705 100644 --- a/usr.sbin/rpki-client/mft.c +++ b/usr.sbin/rpki-client/mft.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mft.c,v 1.76 2022/11/02 12:43:02 job Exp $ */ +/* $OpenBSD: mft.c,v 1.77 2022/11/04 09:43:13 job Exp $ */ /* * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv> @@ -368,11 +368,14 @@ mft_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len) goto out; if (!x509_get_aki(*x509, fn, &p.res->aki)) goto out; + if (!x509_get_sia(*x509, fn, &p.res->sia)) + goto out; if (!x509_get_ski(*x509, fn, &p.res->ski)) goto out; - if (p.res->aia == NULL || p.res->aki == NULL || p.res->ski == NULL) { + if (p.res->aia == NULL || p.res->aki == NULL || p.res->sia == NULL || + p.res->ski == NULL) { warnx("%s: RFC 6487 section 4.8: " - "missing AIA, AKI or SKI X509 extension", fn); + "missing AIA, AKI, SIA, or SKI X509 extension", fn); goto out; } @@ -433,6 +436,7 @@ mft_free(struct mft *p) free(p->aia); free(p->aki); + free(p->sia); free(p->ski); free(p->path); free(p->files); |