CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/14 00:41:29
Modified files:
usr.sbin/rpki-client: cert.c cms.c extern.h
Log message:
rpki-client: implement a CBS-based RFC 6488 parser
This commit gets rid of the use of the crazy CMS API from libcrypto
in normal mode, replacing it with CBS-based parsing code written from
scratch. This only adds about 300 simple lines of code (according to
cloc) to cms.c. A big part of the additions are copious comments.
This ensures that whatever is parsed is properly DER encoded.
One approach of fixing regress and enabling history spelunking
is in the follow-up commit.
The parser is essentially zero-copy with the following exceptions:
- deserialization of the EE cert
- signature validation needs some contortions because CMS is weird
- parsing of signing-time
Since we now get our hands on the raw cert DER, cert_parse_ee_cert()
can be like the other cert parsing functions (except for the talid).
This passes the fixture test and the one remaining TODO item is error
reporting.
ok beck claudio job
