Download raw body.
rpki-client: convert rsc, tak, x509 to opaque ASN1_STRING
These three are entirely straightforward conversions. There's a
forgotten XXX in parse_takey() which I'll fix in a follow-up.
Index: rsc.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/rsc.c,v
diff -u -p -r1.42 rsc.c
--- rsc.c 24 Aug 2025 12:34:39 -0000 1.42
+++ rsc.c 29 Nov 2025 09:32:00 -0000
@@ -228,7 +228,6 @@ rsc_parse_checklist(const char *fn, stru
const STACK_OF(FileNameAndHash) *checkList)
{
FileNameAndHash *fh;
- ASN1_IA5STRING *fileName;
struct rscfile *file;
size_t num_files, i;
@@ -249,25 +248,33 @@ rsc_parse_checklist(const char *fn, stru
rsc->num_files = num_files;
for (i = 0; i < num_files; i++) {
+ const unsigned char *data;
+ int length;
+
fh = sk_FileNameAndHash_value(checkList, i);
file = &rsc->files[i];
- if (fh->hash->length != SHA256_DIGEST_LENGTH) {
+ data = ASN1_STRING_get0_data(fh->hash);
+ length = ASN1_STRING_length(fh->hash);
+ if (length != SHA256_DIGEST_LENGTH) {
warnx("%s: RSC Digest: invalid SHA256 length", fn);
return 0;
}
- memcpy(file->hash, fh->hash->data, SHA256_DIGEST_LENGTH);
+ memcpy(file->hash, data, length);
- if ((fileName = fh->fileName) == NULL)
+ if (fh->fileName == NULL)
continue;
- if (!valid_filename(fileName->data, fileName->length)) {
+ data = ASN1_STRING_get0_data(fh->fileName);
+ length = ASN1_STRING_length(fh->fileName);
+
+ if (!valid_filename(data, length)) {
warnx("%s: RSC FileNameAndHash: bad filename", fn);
return 0;
}
- file->filename = strndup(fileName->data, fileName->length);
+ file->filename = strndup(data, length);
if (file->filename == NULL)
err(1, NULL);
}
Index: tak.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/tak.c,v
diff -u -p -r1.27 tak.c
--- tak.c 19 Aug 2025 11:30:20 -0000 1.27
+++ tak.c 29 Nov 2025 09:32:00 -0000
@@ -68,9 +68,10 @@ parse_takey(const char *fn, const TAKey
const ASN1_IA5STRING *certURI;
X509_PUBKEY *pubkey;
struct takey *res = NULL;
+ const unsigned char *data;
unsigned char *der = NULL;
size_t i;
- int der_len;
+ int der_len, length;
if ((res = calloc(1, sizeof(struct takey))) == NULL)
err(1, NULL);
@@ -83,11 +84,12 @@ parse_takey(const char *fn, const TAKey
for (i = 0; i < res->num_comments; i++) {
comment = sk_ASN1_UTF8STRING_value(takey->comments, i);
- res->comments[i] = calloc(comment->length + 1, 4);
+ data = ASN1_STRING_get0_data(comment);
+ length = ASN1_STRING_length(comment);
+ res->comments[i] = calloc(length + 1, 4);
if (res->comments[i] == NULL)
err(1, NULL);
- (void)strvisx(res->comments[i], comment->data,
- comment->length, VIS_SAFE);
+ (void)strvisx(res->comments[i], data, length, VIS_SAFE);
}
}
@@ -101,14 +103,16 @@ parse_takey(const char *fn, const TAKey
for (i = 0; i < res->num_uris; i++) {
certURI = sk_ASN1_IA5STRING_value(takey->certificateURIs, i);
- if (!valid_uri(certURI->data, certURI->length, NULL)) {
+ data = ASN1_STRING_get0_data(certURI);
+ length = ASN1_STRING_length(certURI);
+ if (!valid_uri(data, length, NULL)) {
warnx("%s: invalid TA URI", fn);
goto err;
}
/* XXX: enforce that protocol is rsync or https. */
- res->uris[i] = strndup(certURI->data, certURI->length);
+ res->uris[i] = strndup(data, length);
if (res->uris[i] == NULL)
err(1, NULL);
}
Index: x509.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/x509.c,v
diff -u -p -r1.123 x509.c
--- x509.c 18 Nov 2025 14:04:45 -0000 1.123
+++ x509.c 29 Nov 2025 09:32:00 -0000
@@ -312,7 +312,7 @@ int
x509_get_generalized_time(const char *fn, const char *descr,
const ASN1_TIME *at, time_t *t)
{
- if (at->length != GENTIME_LENGTH) {
+ if (ASN1_STRING_length(at) != GENTIME_LENGTH) {
warnx("%s: %s time format invalid", fn, descr);
return 0;
}
@@ -331,7 +331,8 @@ int
x509_location(const char *fn, const char *descr, GENERAL_NAME *location,
char **out)
{
- ASN1_IA5STRING *uri;
+ const unsigned char *data;
+ int length;
assert(*out == NULL);
@@ -340,14 +341,15 @@ x509_location(const char *fn, const char
return 0;
}
- uri = location->d.uniformResourceIdentifier;
+ data = ASN1_STRING_get0_data(location->d.uniformResourceIdentifier);
+ length = ASN1_STRING_length(location->d.uniformResourceIdentifier);
- if (!valid_uri(uri->data, uri->length, NULL)) {
+ if (!valid_uri(data, length, NULL)) {
warnx("%s: RFC 6487 section 4.8: %s bad location", fn, descr);
return 0;
}
- if ((*out = strndup(uri->data, uri->length)) == NULL)
+ if ((*out = strndup(data, length)) == NULL)
err(1, NULL);
return 1;
@@ -375,7 +377,8 @@ valid_printable_octet(const uint8_t u8)
static int
valid_printable_string(const char *fn, const char *descr, const ASN1_STRING *as)
{
- int i;
+ const unsigned char *data;
+ int i, length;
/*
* The following check can be enabled after AFRINIC re-issues CA certs.
@@ -388,10 +391,12 @@ valid_printable_string(const char *fn, c
return 0;
}
- for (i = 0; i < as->length; i++) {
- if (!valid_printable_octet(as->data[i])) {
+ data = ASN1_STRING_get0_data(as);
+ length = ASN1_STRING_length(as);
+ for (i = 0; i < length; i++) {
+ if (!valid_printable_octet(data[i])) {
warnx("%s: invalid %s: PrintableString contains 0x%02x",
- fn, descr, as->data[i]);
+ fn, descr, data[i]);
return 0;
}
}
rpki-client: convert rsc, tak, x509 to opaque ASN1_STRING