main.c
/*
 * Parse and validate a ROA.
 * This is standard stuff.
 * Returns the roa on success, NULL on failure.
 */
Parse and validate a ROA.
This is standard stuff.
Returns the roa on success, NULL on failure.
Parse and validate a ROA . This is standard stuff . Returns the roa on success NULL on failure .
static struct roa *
proc_parser_roa(struct entity *entp,
    X509_STORE *store, X509_STORE_CTX *ctx,
    struct auth_tree *auths, struct crl_tree *crlt)
{
	struct roa		*roa;
	X509			*x509;
	int			 c;
	struct auth		*a;
	STACK_OF(X509)		*chain;
	STACK_OF(X509_CRL)	*crls;
	assert(entp->has_dgst);
	if ((roa = roa_parse(&x509, entp->uri, entp->dgst)) == NULL)
		return NULL;
	a = valid_ski_aki(entp->uri, auths, roa->ski, roa->aki);
	build_chain(a, &chain);
	build_crls(a, crlt, &crls);
	assert(x509 != NULL);
	if (!X509_STORE_CTX_init(ctx, store, x509, chain))
		cryptoerrx("X509_STORE_CTX_init");
	X509_STORE_CTX_set_flags(ctx,
	    X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK);
	X509_STORE_CTX_set0_crls(ctx, crls);
	if (X509_verify_cert(ctx) <= 0) {
		c = X509_STORE_CTX_get_error(ctx);
		X509_STORE_CTX_cleanup(ctx);
		if (verbose > 0 || c != X509_V_ERR_UNABLE_TO_GET_CRL)
			warnx("%s: %s", entp->uri,
			    X509_verify_cert_error_string(c));
		X509_free(x509);
		roa_free(roa);
		sk_X509_free(chain);
		sk_X509_CRL_free(crls);
		return NULL;
	}
	X509_STORE_CTX_cleanup(ctx);
	sk_X509_free(chain);
	sk_X509_CRL_free(crls);
	X509_free(x509);
	if (valid_roa(entp->uri, auths, roa))
		roa->valid = 1;
	return roa;
}
static struct roa * proc_parser_roa ( struct entity * entp , X509_STORE * store , X509_STORE_CTX * ctx , struct auth_tree * auths , struct crl_tree * crlt ) { struct roa * roa ; X509 * x509 ; int c ; struct auth * a ; STACK_OF ( X509 ) * chain ; STACK_OF ( X509_CRL ) * crls ; assert ( entp -> has_dgst ) ; if ( ( roa = roa_parse ( & x509 , entp -> uri , entp -> dgst ) ) == NULL ) return NULL ; a = valid_ski_aki ( entp -> uri , auths , roa -> ski , roa -> aki ) ; build_chain ( a , & chain ) ; build_crls ( a , crlt , & crls ) ; assert ( x509 != NULL ) ; if ( ! X509_STORE_CTX_init ( ctx , store , x509 , chain ) ) cryptoerrx ( " " ) ; X509_STORE_CTX_set_flags ( ctx , X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK ) ; X509_STORE_CTX_set0_crls ( ctx , crls ) ; if ( X509_verify_cert ( ctx ) <= 0 ) { c = X509_STORE_CTX_get_error ( ctx ) ; X509_STORE_CTX_cleanup ( ctx ) ; if ( verbose > 0 || c != X509_V_ERR_UNABLE_TO_GET_CRL ) warnx ( " " , entp -> uri , X509_verify_cert_error_string ( c ) ) ; X509_free ( x509 ) ; roa_free ( roa ) ; sk_X509_free ( chain ) ; sk_X509_CRL_free ( crls ) ; return NULL ; } X509_STORE_CTX_cleanup ( ctx ) ; sk_X509_free ( chain ) ; sk_X509_CRL_free ( crls ) ; X509_free ( x509 ) ; if ( valid_roa ( entp -> uri , auths , roa ) ) roa -> valid = 1 ; return roa ; }
Parse and validate a ROA.
Parse and validate a ROA .
/*
	 * If the ROA isn't valid, we accept it anyway and depend upon
	 * the code around roa_read() to check the "valid" field itself.
	 */