From: Job Snijders <job@bsd.nl>
Subject: Re: rpki-client: check certificate CRLDP alignment
To: Theo Buehler <tb@theobuehler.org>
Cc: tech@openbsd.org
Date: Thu, 24 Sep 2026 10:23:42 +0000

On Thu, Sep 24, 2026 at 11:08:29AM +0200, Theo Buehler wrote:
> The second step has two parts to it:
> 
> Match the cert's CRL distribution point against the CA repository from
> which the CRL was obtained. Do this in valid_x509() after successful
> validation. This way we know from X509_V_CHECK_CRL that a CRL was
> present and we also cover all EE certs with the same check. Although a
> TA cert should never get there, I feel better checking the cert->purpose
> for !TA. Use an exit path that frees things rather than adding third copy
> of the same freeing stanza.
> 
> Teach filemode about crl->mftcrldp: the CRL lookup path in the cache.
> To make this work nicely add a file variable that points into the uri.
> The assert() is only there to avoid a possible future leak. This way
> filemode keeps working with the new strcmp() check in valid_cert()
> without special casing in the valid_x509() code.

OK job@