From: Job Snijders <job@bsd.nl>
Subject: Re: rpki-client: check certificate CRLDP alignment
To: Theo Buehler <tb@theobuehler.org>
Cc: tech@openbsd.org
Date: Sat, 12 Sep 2026 10:09:34 +0000

On Sat, Sep 12, 2026 at 06:40:36AM +0200, Theo Buehler wrote:
> Also, I'm not sure mftpath and path are great names. Perhaps we can come
> up with something better? Maybe mftsia and mftcrldp (yeah, that's ugly).
> At least these would give a clearer hint where they come from.

good suggestion

> Ultimately, both crl->mftpath and crl->path come from the mft's EE cert,
> so I wonder if we should not just add mft->crldp which would be set next
> to the mft->aki and mft->sia in mft_cert_info(). Then we can strdup that
> member directly in parse_load_crl_from_mft().

Perhaps like so?

I think a comment in 'struct mft' helps differentiate the 'crldp' and
'crl' members.


Index: crl.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/crl.c,v
diff -u -p -r1.52 crl.c
--- crl.c	1 Dec 2025 14:40:56 -0000	1.52
+++ crl.c	12 Sep 2026 10:05:42 -0000
@@ -360,6 +360,7 @@ crl_free(struct crl *crl)
 		return;
 	free(crl->aki);
 	free(crl->mftpath);
+	free(crl->mftcrldp);
 	X509_CRL_free(crl->x509_crl);
 	free(crl);
 }
Index: extern.h
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/extern.h,v
diff -u -p -r1.295 extern.h
--- extern.h	12 Sep 2026 07:13:09 -0000	1.295
+++ extern.h	12 Sep 2026 10:05:42 -0000
@@ -277,6 +277,7 @@ struct mft {
 	char		*seqnum; /* manifestNumber */
 	char		*aki; /* AKI */
 	char		*sia; /* SIA signedObject */
+	char		*crldp; /* full canonical path rsync://... */
 	char		*crl; /* CRL file name */
 	unsigned char	 mfthash[SHA256_DIGEST_LENGTH];
 	size_t		 mftsize;
@@ -543,6 +544,7 @@ struct crl {
 	RB_ENTRY(crl)	 entry;
 	char		*aki;
 	char		*mftpath;
+	char		*mftcrldp;
 	X509_CRL	*x509_crl;
 	time_t		 thisupdate;	/* do not use before */
 	time_t		 nextupdate;	/* do not use after */
Index: mft.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/mft.c,v
diff -u -p -r1.143 mft.c
--- mft.c	3 Sep 2026 17:19:30 -0000	1.143
+++ mft.c	12 Sep 2026 10:05:42 -0000
@@ -390,6 +390,8 @@ mft_cert_info(const char *fn, void *obj,
 		err(1, NULL);
 	if ((mft->sia = strdup(cert->signedobj)) == NULL)
 		err(1, NULL);
+	if ((mft->crldp = strdup(cert->crl)) == NULL)
+		err(1, NULL);
 
 	crlfile = strrchr(cert->crl, '/');
 	if (crlfile == NULL) {
@@ -487,6 +489,7 @@ mft_free(struct mft *p)
 	free(p->seqnum);
 	free(p->aki);
 	free(p->sia);
+	free(p->crldp);
 	free(p->crl);
 	free(p);
 }
Index: parser.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/parser.c,v
diff -u -p -r1.184 parser.c
--- parser.c	3 Sep 2026 17:16:51 -0000	1.184
+++ parser.c	12 Sep 2026 10:05:43 -0000
@@ -220,6 +220,11 @@ proc_parser_roa(char *file, const unsign
 		goto out;
 	crl = crl_get(&crls, a);
 
+	if (strcmp(cert->crl, crl->mftcrldp) != 0) {
+		warnx("%s: invalid CRLDP pointer", file);
+		goto out;
+	}
+
 	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
@@ -262,6 +267,11 @@ proc_parser_spl(char *file, const unsign
 		goto out;
 	crl = crl_get(&crls, a);
 
+	if (strcmp(cert->crl, crl->mftcrldp) != 0) {
+		warnx("%s: invalid CRLDP pointer", file);
+		goto out;
+	}
+
 	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
@@ -372,6 +382,9 @@ parse_load_crl_from_mft(struct entity *e
 	if ((crl->mftpath = strdup(mft->sia)) == NULL)
 		err(1, NULL);
 
+	if ((crl->mftcrldp = strdup (mft->crldp)) == NULL)
+		err(1, NULL);
+
 	*crlfile = fn;
 	free(f);
 
@@ -622,6 +635,11 @@ proc_parser_cert(char *file, const unsig
 		goto out;
 	crl = crl_get(&crls, a);
 
+	if (strcmp(cert->crl, crl->mftcrldp) != 0) {
+		warnx("%s: invalid CRLDP pointer", file);
+		goto out;
+	}
+
 	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr) ||
 	    !valid_cert(file, a, cert)) {
 		if (errstr != NULL)
@@ -784,6 +802,11 @@ proc_parser_aspa(char *file, const unsig
 		goto out;
 	crl = crl_get(&crls, a);
 
+	if (strcmp(cert->crl, crl->mftcrldp) != 0) {
+		warnx("%s: invalid CRLDP pointer", file);
+		goto out;
+	}
+
 	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);
 		goto out;
@@ -824,6 +847,11 @@ proc_parser_tak(char *file, const unsign
 	if (a == NULL)
 		goto out;
 	crl = crl_get(&crls, a);
+
+	if (strcmp(cert->crl, crl->mftcrldp) != 0) {
+		warnx("%s: invalid CRLDP pointer", file);
+		goto out;
+	}
 
 	if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) {
 		warnx("%s: %s", file, errstr);