From: Theo Buehler <tb@theobuehler.org>
Subject: rpki-client: remove another cms layer
To: tech@openbsd.org
Date: Thu, 3 Sep 2026 20:55:39 +0200

Trivial diff to remove another layer in this horrific mess. The old
parse_validate() function was needed for dealing with the detached
econtent for geofeed so has not been very useful for a long time. The
doc comment is mostly gibberish to me, so drop that, too.

Index: cms.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/cms.c,v
diff -u -p -r1.63 cms.c
--- cms.c	3 Sep 2026 17:19:30 -0000	1.63
+++ cms.c	3 Sep 2026 18:43:38 -0000
@@ -175,7 +175,7 @@ cms_SignerInfo_check_attributes(const ch
 }
 
 static int
-cms_parse_validate_internal(struct cert **out_cert, const char *fn, int talid,
+cms_parse_validate(struct cert **out_cert, const char *fn, int talid,
     const unsigned char *der, size_t len, const ASN1_OBJECT *oid,
     unsigned char **res, size_t *rsz, time_t *signtime)
 {
@@ -196,8 +196,6 @@ cms_parse_validate_internal(struct cert 
 
 	assert(*out_cert == NULL);
 
-	if (rsz != NULL)
-		*rsz = 0;
 	*signtime = 0;
 
 	/* just fail for empty buffers, the warning was printed elsewhere */
@@ -395,26 +393,6 @@ cms_parse_validate_internal(struct cert 
 	return rc;
 }
 
-/*
- * Parse and validate a self-signed CMS message.
- * Conforms to RFC 6488.
- * The eContentType of the message must be an oid object.
- * Return the eContent as a string and set "rsz" to be its length.
- */
-static unsigned char *
-cms_parse_validate(struct cert **out_cert, const char *fn, int talid,
-    const unsigned char *der, size_t derlen, const ASN1_OBJECT *oid,
-    size_t *rsz, time_t *st)
-{
-	unsigned char *res = NULL;
-
-	if (!cms_parse_validate_internal(out_cert, fn, talid, der, derlen, oid,
-	    &res, rsz, st))
-		return NULL;
-
-	return res;
-}
-
 static const struct signed_obj *
 cms_object_from_rtype(const char *fn, enum rtype rtype)
 {
@@ -444,8 +422,8 @@ signed_object_parse(struct cert **out_ce
 	const ASN1_OBJECT *oid;
 	void *obj = NULL;
 	struct cert *cert = NULL;
-	size_t cmsz;
-	unsigned char *cms;
+	unsigned char *cms = NULL;
+	size_t cmsz = 0;
 	time_t signtime = 0;
 	int rc = 0;
 
@@ -454,9 +432,8 @@ signed_object_parse(struct cert **out_ce
 	sobj = cms_object_from_rtype(fn, rtype);
 	oid = sobj->oid();
 
-	cms = cms_parse_validate(&cert, fn, talid, der, len, oid, &cmsz,
-	    &signtime);
-	if (cms == NULL)
+	if (!cms_parse_validate(&cert, fn, talid, der, len, oid, &cms, &cmsz,
+	    &signtime))
 		return NULL;
 
 	obj = sobj->new(len, signtime);