From: Theo Buehler <tb@theobuehler.org>
Subject: Re: rpki-client: check certificate CRLDP alignment
To: Job Snijders <job@bsd.nl>
Cc: tech@openbsd.org
Date: Thu, 24 Sep 2026 13:15:37 +0200

Next step: rename valid_cert() to valid_resources(), make it static and
call it at the end of valid_x509(). This is another missing check for EE
certs, namely that the resources are covered by the issuing cert. This
check isn't super expensive since valid_resources() uses a logic similar
to partial chains.

valid_resources() isn't a particularly great name but I think it is
better than valid_cert() for this function. This frees up valid_cert()
which will become the new name of valid_x509() in the last step.

Index: extern.h
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/extern.h,v
diff -u -p -r1.297 extern.h
--- extern.h	24 Sep 2026 08:37:38 -0000	1.297
+++ extern.h	24 Sep 2026 11:05:34 -0000
@@ -825,7 +825,6 @@ void		 crl_tree_free(struct crl_tree *);
 
 /* Validation of our objects. */
 
-int		 valid_cert(const char *, struct auth *, const struct cert *);
 int		 valid_roa(const char *, struct cert *, struct roa *);
 int		 valid_filehash(int, const char *, size_t);
 int		 valid_hash(unsigned char *, size_t, const char *, size_t);
Index: filemode.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/filemode.c,v
diff -u -p -r1.89 filemode.c
--- filemode.c	24 Sep 2026 10:48:43 -0000	1.89
+++ filemode.c	24 Sep 2026 11:05:34 -0000
@@ -224,8 +224,7 @@ parse_load_certchain(char *uri)
 		uri = filestack[i - 1];
 
 		crl = crl_get(&crls, a);
-		if (!valid_x509(uri, ctx, cert, a, crl, &errstr) ||
-		    !valid_cert(uri, a, cert)) {
+		if (!valid_x509(uri, ctx, cert, a, crl, &errstr)) {
 			if (errstr != NULL)
 				warnx("%s: %s", uri, errstr);
 			goto fail;
Index: parser.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/parser.c,v
diff -u -p -r1.187 parser.c
--- parser.c	24 Sep 2026 10:52:31 -0000	1.187
+++ parser.c	24 Sep 2026 11:05:34 -0000
@@ -625,8 +625,7 @@ proc_parser_cert(char *file, const unsig
 		goto out;
 	crl = crl_get(&crls, a);
 
-	if (!valid_x509(file, ctx, cert, a, crl, &errstr) ||
-	    !valid_cert(file, a, cert)) {
+	if (!valid_x509(file, ctx, cert, a, crl, &errstr)) {
 		if (errstr != NULL)
 			warnx("%s: %s", file, errstr);
 		goto out;
Index: validate.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/validate.c,v
diff -u -p -r1.88 validate.c
--- validate.c	24 Sep 2026 10:52:31 -0000	1.88
+++ validate.c	24 Sep 2026 11:05:34 -0000
@@ -80,11 +80,11 @@ valid_ip(struct auth *a, enum afi afi,
 
 /*
  * Validate a non-TA certificate: make sure its IP and AS resources are
- * fully covered by those in the authority key (which must exist).
+ * fully covered by those in the issuing certificate.
  * Returns 1 if valid, 0 otherwise.
  */
-int
-valid_cert(const char *fn, struct auth *a, const struct cert *cert)
+static int
+valid_resources(const char *fn, struct auth *a, const struct cert *cert)
 {
 	size_t		 i;
 	uint32_t	 min, max;
@@ -464,6 +464,8 @@ valid_x509(char *file, X509_STORE_CTX *s
 			*errstr = "invalid CRLDP pointer";
 			goto out;
 		}
+		if (!valid_resources(file, a, cert))
+			goto out;
 	}
 
 	ret = 1;