From: Theo Buehler Subject: Re: rpki-client: check certificate CRLDP alignment To: Job Snijders Cc: tech@openbsd.org Date: Thu, 24 Sep 2026 08:47:17 +0200 On Sat, Sep 12, 2026 at 12:55:04AM +0000, Job Snijders wrote: > RFC 6480 section 4.2 figure 2 shows that all valid products in the same > CA repository (i.e., listed on the same manifest) point to the same CRL. > > Already today rpki-client checks whether the CRLDP in a given Manifest > EE certificate aligns with the CRL location derived from the fileList > (see mft.c lines 193-197). This diff adds a similar check to verify > alignment of the CRLDP in CA certificates, BGPsec certs, and the EE > certs in other signed objects. We have only done this for CA and BGPsec certs for now. In order not to introduce further complications with deduplication efforts, I think the correct placement for this check is at the end of valid_x509() at which point we know we have a CRL (due to passing X509_V_FLAG_CRL_CHECK). Here's a first, trivial refactoring step towards this goal. The second step will add the strcmp(). Subsequent steps will deal with valid_cert() and the somewhat unfortunate naming. Index: extern.h =================================================================== RCS file: /cvs/src/usr.sbin/rpki-client/extern.h,v diff -u -p -r1.296 extern.h --- extern.h 12 Sep 2026 12:46:04 -0000 1.296 +++ extern.h 24 Sep 2026 06:29:10 -0000 @@ -832,8 +832,8 @@ int valid_hash(unsigned char *, size_t int valid_filename(const char *, size_t); int valid_uri(const char *, size_t, const char *); int valid_origin(const char *, const char *); -int valid_x509(char *, X509_STORE_CTX *, X509 *, struct auth *, - struct crl *, const char **); +int valid_x509(char *, X509_STORE_CTX *, struct cert *, + struct auth *, struct crl *, const char **); int valid_rsc(const char *, struct cert *, struct rsc *); int valid_econtent_version(const char *, const ASN1_INTEGER *, uint64_t); Index: filemode.c =================================================================== RCS file: /cvs/src/usr.sbin/rpki-client/filemode.c,v diff -u -p -r1.87 filemode.c --- filemode.c 3 Sep 2026 17:16:51 -0000 1.87 +++ filemode.c 24 Sep 2026 06:29:22 -0000 @@ -219,7 +219,7 @@ parse_load_certchain(char *uri) uri = filestack[i - 1]; crl = crl_get(&crls, a); - if (!valid_x509(uri, ctx, cert->x509, a, crl, &errstr) || + if (!valid_x509(uri, ctx, cert, a, crl, &errstr) || !valid_cert(uri, a, cert)) { if (errstr != NULL) warnx("%s: %s", uri, errstr); @@ -591,7 +591,7 @@ proc_parser_file(char *file, unsigned ch a = parse_load_certchain(aia); c = crl_get(&crls, a); - if ((status = valid_x509(file, ctx, cert->x509, a, c, &errstr))) { + if ((status = valid_x509(file, ctx, cert, a, c, &errstr))) { switch (type) { case RTYPE_ASPA: status = aspa->valid; Index: parser.c =================================================================== RCS file: /cvs/src/usr.sbin/rpki-client/parser.c,v diff -u -p -r1.185 parser.c --- parser.c 12 Sep 2026 12:46:04 -0000 1.185 +++ parser.c 24 Sep 2026 06:29:50 -0000 @@ -220,7 +220,7 @@ proc_parser_roa(char *file, const unsign goto out; crl = crl_get(&crls, a); - if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) { + if (!valid_x509(file, ctx, cert, a, crl, &errstr)) { warnx("%s: %s", file, errstr); goto out; } @@ -262,7 +262,7 @@ proc_parser_spl(char *file, const unsign goto out; crl = crl_get(&crls, a); - if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) { + if (!valid_x509(file, ctx, cert, a, crl, &errstr)) { warnx("%s: %s", file, errstr); goto out; } @@ -440,7 +440,7 @@ proc_parser_mft_pre(struct entity *entp, a = find_issuer(file, entp->certid, mft->aki, NULL); if (a == NULL) goto err; - if (!valid_x509(file, ctx, cert->x509, a, *crl, errstr)) + if (!valid_x509(file, ctx, cert, a, *crl, errstr)) goto err; cert_free(cert); cert = NULL; @@ -630,7 +630,7 @@ proc_parser_cert(char *file, const unsig goto out; } - if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr) || + if (!valid_x509(file, ctx, cert, a, crl, &errstr) || !valid_cert(file, a, cert)) { if (errstr != NULL) warnx("%s: %s", file, errstr); @@ -792,7 +792,7 @@ proc_parser_aspa(char *file, const unsig goto out; crl = crl_get(&crls, a); - if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) { + if (!valid_x509(file, ctx, cert, a, crl, &errstr)) { warnx("%s: %s", file, errstr); goto out; } @@ -833,7 +833,7 @@ proc_parser_tak(char *file, const unsign goto out; crl = crl_get(&crls, a); - if (!valid_x509(file, ctx, cert->x509, a, crl, &errstr)) { + if (!valid_x509(file, ctx, cert, a, crl, &errstr)) { warnx("%s: %s", file, errstr); goto out; } Index: validate.c =================================================================== RCS file: /cvs/src/usr.sbin/rpki-client/validate.c,v diff -u -p -r1.86 validate.c --- validate.c 12 Sep 2026 07:03:00 -0000 1.86 +++ validate.c 24 Sep 2026 06:30:25 -0000 @@ -408,9 +408,10 @@ pretty_revocation_time(X509 *x509, X509_ * returned by X509_verify_cert_error_string(). */ int -valid_x509(char *file, X509_STORE_CTX *store_ctx, X509 *x509, struct auth *a, - struct crl *crl, const char **errstr) +valid_x509(char *file, X509_STORE_CTX *store_ctx, struct cert *cert, + struct auth *a, struct crl *crl, const char **errstr) { + X509 *x509 = cert->x509; X509_VERIFY_PARAM *params; ASN1_OBJECT *cp_oid; STACK_OF(X509) *intermediates, *root;