On Sat, Sep 12, 2026 at 12:55:04AM +0000, Job Snijders wrote:
> RFC 6480 section 4.2 figure 2 shows that all valid products in the same
> CA repository (i.e., listed on the same manifest) point to the same CRL.
> 
> Already today rpki-client checks whether the CRLDP in a given Manifest
> EE certificate aligns with the CRL location derived from the fileList
> (see mft.c lines 193-197). This diff adds a similar check to verify
> alignment of the CRLDP in CA certificates, BGPsec certs, and the EE
> certs in other signed objects.

We have only done this for CA and BGPsec certs for now. In order not to
introduce further complications with deduplication efforts, I think the
correct placement for this check is at the end of valid_x509() at which
point we know we have a CRL (due to passing X509_V_FLAG_CRL_CHECK).

Here's a first, trivial refactoring step towards this goal. The second
step will add the strcmp(). Subsequent steps will deal with valid_cert()
and the somewhat unfortunate naming.

Index: extern.h
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/extern.h,v
diff -u -p -r1.296 extern.h
--- extern.h	12 Sep 2026 12:46:04 -0000	1.296
+++ extern.h	24 Sep 2026 06:29:10 -0000
@@ -832,8 +832,8 @@ int		 valid_hash(unsigned char *, size_t
 int		 valid_filename(const char *, size_t);
 int		 valid_uri(const char *, size_t, const char *);
 int		 valid_origin(const char *, const char *);
-int		 valid_x509(char *, X509_STORE_CTX *, X509 *, struct auth *,
-		    struct crl *, const char **);
+int		 valid_x509(char *, X509_STORE_CTX *, struct cert *,
+		    struct auth *, struct crl *, const char **);
 int		 valid_rsc(const char *, struct cert *, struct rsc *);
 int		 valid_econtent_version(const char *, const ASN1_INTEGER *,
 		    uint64_t);
Index: filemode.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/filemode.c,v
diff -u -p -r1.87 filemode.c
--- filemode.c	3 Sep 2026 17:16:51 -0000	1.87
+++ filemode.c	24 Sep 2026 06:29:22 -0000
@@ -219,7 +219,7 @@ parse_load_certchain(char *uri)
 		uri = filestack[i - 1];
 
 		crl = crl_get(&crls, a);
-		if (!valid_x509(uri, ctx, cert->x509, a, crl, &errstr) ||
+		if (!valid_x509(uri, ctx, cert, a, crl, &errstr) ||
 		    !valid_cert(uri, a, cert)) {
 			if (errstr != NULL)
 				warnx("%s: %s", uri, errstr);
@@ -591,7 +591,7 @@ proc_parser_file(char *file, unsigned ch
 		a = parse_load_certchain(aia);
 		c = crl_get(&crls, a);
 
-		if ((status = valid_x509(file, ctx, cert->x509, a, c, &errstr))) {
+		if ((status = valid_x509(file, ctx, cert, a, c, &errstr))) {
 			switch (type) {
 			case RTYPE_ASPA:
 				status = aspa->valid;
Index: parser.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/parser.c,v
diff -u -p -r1.185 parser.c
--- parser.c	12 Sep 2026 12:46:04 -0000	1.185
+++ parser.c	24 Sep 2026 06:29:50 -0000
@@ -220,7 +220,7 @@ proc_parser_roa(char *file, const unsign
 		goto out;
 	crl = crl_get(&crls, a);
 
-	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
+	if (!valid_x509(file, ctx, cert, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
 	}
@@ -262,7 +262,7 @@ proc_parser_spl(char *file, const unsign
 		goto out;
 	crl = crl_get(&crls, a);
 
-	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
+	if (!valid_x509(file, ctx, cert, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
 	}
@@ -440,7 +440,7 @@ proc_parser_mft_pre(struct entity *entp,
 	a = find_issuer(file, entp->certid, mft->aki, NULL);
 	if (a == NULL)
 		goto err;
-	if (!valid_x509(file, ctx, cert->x509, a, *crl, errstr))
+	if (!valid_x509(file, ctx, cert, a, *crl, errstr))
 		goto err;
 	cert_free(cert);
 	cert = NULL;
@@ -630,7 +630,7 @@ proc_parser_cert(char *file, const unsig
 		goto out;
 	}
 
-	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr) ||
+	if (!valid_x509(file, ctx, cert, a, crl, &errstr) ||
 	    !valid_cert(file, a, cert)) {
 		if (errstr != NULL)
 			warnx("%s: %s", file, errstr);
@@ -792,7 +792,7 @@ proc_parser_aspa(char *file, const unsig
 		goto out;
 	crl = crl_get(&crls, a);
 
-	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
+	if (!valid_x509(file, ctx, cert, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
 	}
@@ -833,7 +833,7 @@ proc_parser_tak(char *file, const unsign
 		goto out;
 	crl = crl_get(&crls, a);
 
-	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
+	if (!valid_x509(file, ctx, cert, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
 	}
Index: validate.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/validate.c,v
diff -u -p -r1.86 validate.c
--- validate.c	12 Sep 2026 07:03:00 -0000	1.86
+++ validate.c	24 Sep 2026 06:30:25 -0000
@@ -408,9 +408,10 @@ pretty_revocation_time(X509 *x509, X509_
  * returned by X509_verify_cert_error_string().
  */
 int
-valid_x509(char *file, X509_STORE_CTX *store_ctx, X509 *x509, struct auth *a,
-    struct crl *crl, const char **errstr)
+valid_x509(char *file, X509_STORE_CTX *store_ctx, struct cert *cert,
+    struct auth *a, struct crl *crl, const char **errstr)
 {
+	X509			*x509 = cert->x509;
 	X509_VERIFY_PARAM	*params;
 	ASN1_OBJECT		*cp_oid;
 	STACK_OF(X509)		*intermediates, *root;