From: job <job@openbsd.org>
Date: Wed, 10 Aug 2022 14:37:33 +0000 (+0000)
Subject: Disallow AS Resources extension on ROA EE certificates
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=a0c9452ca2958327fcc7904b72637f6af6d81131;p=openbsd

Disallow AS Resources extension on ROA EE certificates

The ROA specification (RFC 6482 section 4) is a bit underspecified, however
in the wild the RFC 3779 AS Resources extension never ever appears on ROA EE
certificates, as it serves no purpose in the validation process.

OK tb@
---

diff --git a/usr.sbin/rpki-client/roa.c b/usr.sbin/rpki-client/roa.c
index 0b5ff2832f7..b525a2bcf06 100644
--- a/usr.sbin/rpki-client/roa.c
+++ b/usr.sbin/rpki-client/roa.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: roa.c,v 1.47 2022/06/10 10:36:43 tb Exp $ */
+/*	$OpenBSD: roa.c,v 1.48 2022/08/10 14:37:33 job Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -229,6 +229,11 @@ roa_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
 		goto out;
 	}
 
+	if (X509_get_ext_by_NID(*x509, NID_sbgp_autonomousSysNum, -1) != -1) {
+		warnx("%s: superfluous AS Resources extension present", fn);
+		goto out;
+	}
+
 	at = X509_get0_notAfter(*x509);
 	if (at == NULL) {
 		warnx("%s: X509_get0_notAfter failed", fn);