CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/14 00:48:24
Modified files:
usr.sbin/rpki-client: cms.c
Log message:
rpki-client: accept indefinite lengths in filemode
ARIN special. In filemode re-encode the "der" buffer into definite
length encoding. The DER parser can then deserialize the signed
object. This miraculously works because of the way CMS signatures
are computed: signedAttrs MUST be DER encoded (per RFC 5652, 5.3)
and the value octets of the eContent do not use the invalid encoding
(but its length octets do!). The signature and the message-digest
attribute therefore check out despite this modification.
I say "miraculous" above because this is partly because of how CMS
works, but ARIN could also have used BER encoding for the eContent,
breaking this hack. Rumor has it that there used to be a CA out
there that used to use constructed encoding for octet strings.
This unbreaks regress after the previous commit.
ok and "oh dear god" beck
ok claudio job
