From: Theo Buehler <tb@theobuehler.org>
Subject: Re: rpki-client: check certificate CRLDP alignment
To: Job Snijders <job@bsd.nl>
Cc: tech@openbsd.org
Date: Sat, 12 Sep 2026 12:19:45 +0200

On Sat, Sep 12, 2026 at 10:09:34AM +0000, Job Snijders wrote:
> On Sat, Sep 12, 2026 at 06:40:36AM +0200, Theo Buehler wrote:
> > Also, I'm not sure mftpath and path are great names. Perhaps we can come
> > up with something better? Maybe mftsia and mftcrldp (yeah, that's ugly).
> > At least these would give a clearer hint where they come from.
> 
> good suggestion
> 
> > Ultimately, both crl->mftpath and crl->path come from the mft's EE cert,
> > so I wonder if we should not just add mft->crldp which would be set next
> > to the mft->aki and mft->sia in mft_cert_info(). Then we can strdup that
> > member directly in parse_load_crl_from_mft().
> 
> Perhaps like so?

Yes, but please leave out the proc_parser_foo changes for foo != cert.

> I think a comment in 'struct mft' helps differentiate the 'crldp' and
> 'crl' members.

Agreed, that comment makes sense to me.

> @@ -372,6 +382,9 @@ parse_load_crl_from_mft(struct entity *e
>  	if ((crl->mftpath = strdup(mft->sia)) == NULL)
>  		err(1, NULL);
>  
> +	if ((crl->mftcrldp = strdup (mft->crldp)) == NULL)

extra space between strdup and (