From c1d2420b12c754b3d10d5a9e0064113148e6e807 Mon Sep 17 00:00:00 2001 From: job Date: Thu, 16 Feb 2023 14:25:27 +0000 Subject: [PATCH] Add missing RFC 6487 section 4.8.6 CRLDP compliance checks OK tb@ claudio@ --- usr.sbin/rpki-client/x509.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/usr.sbin/rpki-client/x509.c b/usr.sbin/rpki-client/x509.c index a143e209d6f..688c1c2e7c0 100644 --- a/usr.sbin/rpki-client/x509.c +++ b/usr.sbin/rpki-client/x509.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509.c,v 1.63 2023/02/09 22:50:07 tb Exp $ */ +/* $OpenBSD: x509.c,v 1.64 2023/02/16 14:25:27 job Exp $ */ /* * Copyright (c) 2022 Theo Buehler * Copyright (c) 2021 Claudio Jeker @@ -590,11 +590,26 @@ x509_get_crl(X509 *x, const char *fn, char **crl) } dp = sk_DIST_POINT_value(crldp, 0); + if (dp->CRLissuer != NULL) { + warnx("%s: RFC 6487 section 4.8.6: CRL CRLIssuer field" + " disallowed", fn); + goto out; + } + if (dp->reasons != NULL) { + warnx("%s: RFC 6487 section 4.8.6: CRL Reasons field" + " disallowed", fn); + goto out; + } if (dp->distpoint == NULL) { warnx("%s: RFC 6487 section 4.8.6: CRL: " "no distribution point name", fn); goto out; } + if (dp->distpoint->dpname != NULL) { + warnx("%s: RFC 6487 section 4.8.6: nameRelativeToCRLIssuer" + " disallowed", fn); + goto out; + } if (dp->distpoint->type != GEN_OTHERNAME) { warnx("%s: RFC 6487 section 4.8.6: CRL: " "expected GEN_OTHERNAME, have %d", fn, dp->distpoint->type); -- 2.20.1