From: Claudio Jeker <cjeker@diehard.n-r-g.com>
Subject: Re: rpki-client: remove another cms layer
To: Theo Buehler <tb@theobuehler.org>
Cc: tech@openbsd.org
Date: Thu, 3 Sep 2026 21:03:48 +0200

On Thu, Sep 03, 2026 at 08:55:39PM +0200, Theo Buehler wrote:
> Trivial diff to remove another layer in this horrific mess. The old
> parse_validate() function was needed for dealing with the detached
> econtent for geofeed so has not been very useful for a long time. The
> doc comment is mostly gibberish to me, so drop that, too.

OK claudio@
 
> Index: cms.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/rpki-client/cms.c,v
> diff -u -p -r1.63 cms.c
> --- cms.c	3 Sep 2026 17:19:30 -0000	1.63
> +++ cms.c	3 Sep 2026 18:43:38 -0000
> @@ -175,7 +175,7 @@ cms_SignerInfo_check_attributes(const ch
>  }
>  
>  static int
> -cms_parse_validate_internal(struct cert **out_cert, const char *fn, int talid,
> +cms_parse_validate(struct cert **out_cert, const char *fn, int talid,
>      const unsigned char *der, size_t len, const ASN1_OBJECT *oid,
>      unsigned char **res, size_t *rsz, time_t *signtime)
>  {
> @@ -196,8 +196,6 @@ cms_parse_validate_internal(struct cert 
>  
>  	assert(*out_cert == NULL);
>  
> -	if (rsz != NULL)
> -		*rsz = 0;
>  	*signtime = 0;
>  
>  	/* just fail for empty buffers, the warning was printed elsewhere */
> @@ -395,26 +393,6 @@ cms_parse_validate_internal(struct cert 
>  	return rc;
>  }
>  
> -/*
> - * Parse and validate a self-signed CMS message.
> - * Conforms to RFC 6488.
> - * The eContentType of the message must be an oid object.
> - * Return the eContent as a string and set "rsz" to be its length.
> - */
> -static unsigned char *
> -cms_parse_validate(struct cert **out_cert, const char *fn, int talid,
> -    const unsigned char *der, size_t derlen, const ASN1_OBJECT *oid,
> -    size_t *rsz, time_t *st)
> -{
> -	unsigned char *res = NULL;
> -
> -	if (!cms_parse_validate_internal(out_cert, fn, talid, der, derlen, oid,
> -	    &res, rsz, st))
> -		return NULL;
> -
> -	return res;
> -}
> -
>  static const struct signed_obj *
>  cms_object_from_rtype(const char *fn, enum rtype rtype)
>  {
> @@ -444,8 +422,8 @@ signed_object_parse(struct cert **out_ce
>  	const ASN1_OBJECT *oid;
>  	void *obj = NULL;
>  	struct cert *cert = NULL;
> -	size_t cmsz;
> -	unsigned char *cms;
> +	unsigned char *cms = NULL;
> +	size_t cmsz = 0;
>  	time_t signtime = 0;
>  	int rc = 0;
>  
> @@ -454,9 +432,8 @@ signed_object_parse(struct cert **out_ce
>  	sobj = cms_object_from_rtype(fn, rtype);
>  	oid = sobj->oid();
>  
> -	cms = cms_parse_validate(&cert, fn, talid, der, len, oid, &cmsz,
> -	    &signtime);
> -	if (cms == NULL)
> +	if (!cms_parse_validate(&cert, fn, talid, der, len, oid, &cms, &cmsz,
> +	    &signtime))
>  		return NULL;
>  
>  	obj = sobj->new(len, signtime);
> 

-- 
:wq Claudio