From 8eaab8ace0a9a3b3a1bd90629be6f915c37a63f4 Mon Sep 17 00:00:00 2001 From: Job Snijders Date: Thu, 16 Feb 2023 14:25:28 +0000 Subject: Add missing RFC 6487 section 4.8.6 CRLDP compliance checks OK tb@ claudio@ --- usr.sbin/rpki-client/x509.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) (limited to 'usr.sbin') diff --git a/usr.sbin/rpki-client/x509.c b/usr.sbin/rpki-client/x509.c index a143e209d6f..688c1c2e7c0 100644 --- a/usr.sbin/rpki-client/x509.c +++ b/usr.sbin/rpki-client/x509.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509.c,v 1.63 2023/02/09 22:50:07 tb Exp $ */ +/* $OpenBSD: x509.c,v 1.64 2023/02/16 14:25:27 job Exp $ */ /* * Copyright (c) 2022 Theo Buehler * Copyright (c) 2021 Claudio Jeker @@ -590,11 +590,26 @@ x509_get_crl(X509 *x, const char *fn, char **crl) } dp = sk_DIST_POINT_value(crldp, 0); + if (dp->CRLissuer != NULL) { + warnx("%s: RFC 6487 section 4.8.6: CRL CRLIssuer field" + " disallowed", fn); + goto out; + } + if (dp->reasons != NULL) { + warnx("%s: RFC 6487 section 4.8.6: CRL Reasons field" + " disallowed", fn); + goto out; + } if (dp->distpoint == NULL) { warnx("%s: RFC 6487 section 4.8.6: CRL: " "no distribution point name", fn); goto out; } + if (dp->distpoint->dpname != NULL) { + warnx("%s: RFC 6487 section 4.8.6: nameRelativeToCRLIssuer" + " disallowed", fn); + goto out; + } if (dp->distpoint->type != GEN_OTHERNAME) { warnx("%s: RFC 6487 section 4.8.6: CRL: " "expected GEN_OTHERNAME, have %d", fn, dp->distpoint->type); -- cgit v1.2.3