diff options
| author | Job Snijders <job@cvs.openbsd.org> | 2023-02-16 14:25:28 +0000 |
|---|---|---|
| committer | Job Snijders <job@cvs.openbsd.org> | 2023-02-16 14:25:28 +0000 |
| commit | 8eaab8ace0a9a3b3a1bd90629be6f915c37a63f4 (patch) | |
| tree | 50323af65d398d7a9f6e3a6ba340dee9b7cf9108 /usr.sbin | |
| parent | 1864809170f68fb919cb340438e66deb8db6ab22 (diff) | |
Add missing RFC 6487 section 4.8.6 CRLDP compliance checks
OK tb@ claudio@
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/rpki-client/x509.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/usr.sbin/rpki-client/x509.c b/usr.sbin/rpki-client/x509.c index a143e209d6f..688c1c2e7c0 100644 --- a/usr.sbin/rpki-client/x509.c +++ b/usr.sbin/rpki-client/x509.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509.c,v 1.63 2023/02/09 22:50:07 tb Exp $ */ +/* $OpenBSD: x509.c,v 1.64 2023/02/16 14:25:27 job Exp $ */ /* * Copyright (c) 2022 Theo Buehler <tb@openbsd.org> * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org> @@ -590,11 +590,26 @@ x509_get_crl(X509 *x, const char *fn, char **crl) } dp = sk_DIST_POINT_value(crldp, 0); + if (dp->CRLissuer != NULL) { + warnx("%s: RFC 6487 section 4.8.6: CRL CRLIssuer field" + " disallowed", fn); + goto out; + } + if (dp->reasons != NULL) { + warnx("%s: RFC 6487 section 4.8.6: CRL Reasons field" + " disallowed", fn); + goto out; + } if (dp->distpoint == NULL) { warnx("%s: RFC 6487 section 4.8.6: CRL: " "no distribution point name", fn); goto out; } + if (dp->distpoint->dpname != NULL) { + warnx("%s: RFC 6487 section 4.8.6: nameRelativeToCRLIssuer" + " disallowed", fn); + goto out; + } if (dp->distpoint->type != GEN_OTHERNAME) { warnx("%s: RFC 6487 section 4.8.6: CRL: " "expected GEN_OTHERNAME, have %d", fn, dp->distpoint->type); |