diff options
| author | Job Snijders <job@cvs.openbsd.org> | 2022-11-04 09:43:14 +0000 |
|---|---|---|
| committer | Job Snijders <job@cvs.openbsd.org> | 2022-11-04 09:43:14 +0000 |
| commit | 663972c47aa61292de03a32b2ad8390ac5e00eca (patch) | |
| tree | 9a318dd93a8ef80962691b218b6d61edc6e97815 /usr.sbin/rpki-client/tak.c | |
| parent | 7d5ffd488437dd0b1bbc4e51c7141e73840c6635 (diff) | |
Check the SIA signedObject in ROA/MFT/ASPA/TAK/GBR EE certificates
Unfortunately we can't yet error out when accessMethods other than
signedObject are encountered in the SubjectInformationAccess extension
because there is pollution in the ecosystem.
OK tb@
Diffstat (limited to 'usr.sbin/rpki-client/tak.c')
| -rw-r--r-- | usr.sbin/rpki-client/tak.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/usr.sbin/rpki-client/tak.c b/usr.sbin/rpki-client/tak.c index d621acac31e..cd1f643fc2b 100644 --- a/usr.sbin/rpki-client/tak.c +++ b/usr.sbin/rpki-client/tak.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tak.c,v 1.1 2022/11/02 12:43:02 job Exp $ */ +/* $OpenBSD: tak.c,v 1.2 2022/11/04 09:43:13 job Exp $ */ /* * Copyright (c) 2022 Job Snijders <job@fastly.com> * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> @@ -247,11 +247,14 @@ tak_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len) goto out; if (!x509_get_aki(*x509, fn, &p.res->aki)) goto out; + if (!x509_get_sia(*x509, fn, &p.res->sia)) + goto out; if (!x509_get_ski(*x509, fn, &p.res->ski)) goto out; - if (p.res->aia == NULL || p.res->aki == NULL || p.res->ski == NULL) { + if (p.res->aia == NULL || p.res->aki == NULL || p.res->sia == NULL || + p.res->ski == NULL) { warnx("%s: RFC 6487 section 4.8: " - "missing AIA, AKI or SKI X509 extension", fn); + "missing AIA, AKI, SIA, or SKI X509 extension", fn); goto out; } |