main.c
/*
 * Certificates are from manifests (has a digest and is signed with another
 * certificate) or TALs (has a pkey and is self-signed).  Parse the certificate,
 * make sure its signatures are valid (with CRLs), then validate the RPKI
 * content.  This returns a certificate (which must not be freed) or NULL on
 * parse failure.
 */
Certificates are from manifests (has a digest and is signed with another
certificate) or TALs (has a pkey and is self-signed).  Parse the certificate,
make sure its signatures are valid (with CRLs), then validate the RPKI
content.  This returns a certificate (which must not be freed) or NULL on
parse failure.
Certificates are from manifests ( has a digest and is signed with another certificate ) or TALs ( has a pkey and is self - signed ) . Parse the certificate make sure its signatures are valid ( with CRLs ) then validate the RPKI content . This returns a certificate ( which must not be freed ) or NULL on parse failure .
static struct cert *
proc_parser_cert(const struct entity *entp,
    X509_STORE *store, X509_STORE_CTX *ctx,
    struct auth_tree *auths, struct crl_tree *crlt)
{
	struct cert		*cert;
	X509			*x509;
	int			 c;
	struct auth		*a = NULL, *na;
	char			*tal;
	STACK_OF(X509)		*chain;
	STACK_OF(X509_CRL)	*crls;
	assert(!entp->has_dgst != !entp->has_pkey);
	cert = entp->has_dgst ? cert_parse(&x509, entp->uri, entp->dgst) :
	    ta_parse(&x509, entp->uri, entp->pkey, entp->pkeysz);
	if (cert == NULL)
		return NULL;
	if (entp->has_dgst)
		a = valid_ski_aki(entp->uri, auths, cert->ski, cert->aki);
	build_chain(a, &chain);
	build_crls(a, crlt, &crls);
	assert(x509 != NULL);
	if (!X509_STORE_CTX_init(ctx, store, x509, chain))
		cryptoerrx("X509_STORE_CTX_init");
	X509_STORE_CTX_set_flags(ctx,
	    X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK);
	X509_STORE_CTX_set0_crls(ctx, crls);
	if (X509_verify_cert(ctx) <= 0) {
		c = X509_STORE_CTX_get_error(ctx);
		if (c != X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ||
		    !entp->has_pkey) {
			warnx("%s: %s", entp->uri,
			    X509_verify_cert_error_string(c));
			X509_STORE_CTX_cleanup(ctx);
			cert_free(cert);
			sk_X509_free(chain);
			sk_X509_CRL_free(crls);
			X509_free(x509);
			return NULL;
		}
	}
	X509_STORE_CTX_cleanup(ctx);
	sk_X509_free(chain);
	sk_X509_CRL_free(crls);
	if (!(entp->has_pkey ?
		valid_ta(entp->uri, auths, cert) :
		valid_cert(entp->uri, auths, cert))) {
		X509_free(x509); 
		return cert;
	}
	cert->valid = 1;
	na = malloc(sizeof(*na));
	if (na == NULL)
		err(1, NULL);
	if (entp->has_pkey) {
		if ((tal = strdup(entp->descr)) == NULL)
			err(1, NULL);
	} else
		tal = a->tal;
	na->parent = a;
	na->cert = cert;
	na->tal = tal;
	na->fn = strdup(entp->uri);
	if (na->fn == NULL)
		err(1, NULL);
	if (RB_INSERT(auth_tree, auths, na) != NULL)
		err(1, "auth tree corrupted");
	if (a == NULL)
		X509_STORE_add_cert(store, x509);
	return cert;
}
static struct cert * proc_parser_cert ( const struct entity * entp , X509_STORE * store , X509_STORE_CTX * ctx , struct auth_tree * auths , struct crl_tree * crlt ) { struct cert * cert ; X509 * x509 ; int c ; struct auth * a = NULL , * na ; char * tal ; STACK_OF ( X509 ) * chain ; STACK_OF ( X509_CRL ) * crls ; assert ( ! entp -> has_dgst != ! entp -> has_pkey ) ; cert = entp -> has_dgst ? cert_parse ( & x509 , entp -> uri , entp -> dgst ) : ta_parse ( & x509 , entp -> uri , entp -> pkey , entp -> pkeysz ) ; if ( cert == NULL ) return NULL ; if ( entp -> has_dgst ) a = valid_ski_aki ( entp -> uri , auths , cert -> ski , cert -> aki ) ; build_chain ( a , & chain ) ; build_crls ( a , crlt , & crls ) ; assert ( x509 != NULL ) ; if ( ! X509_STORE_CTX_init ( ctx , store , x509 , chain ) ) cryptoerrx ( " " ) ; X509_STORE_CTX_set_flags ( ctx , X509_V_FLAG_IGNORE_CRITICAL | X509_V_FLAG_CRL_CHECK ) ; X509_STORE_CTX_set0_crls ( ctx , crls ) ; if ( X509_verify_cert ( ctx ) <= 0 ) { c = X509_STORE_CTX_get_error ( ctx ) ; if ( c != X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT || ! entp -> has_pkey ) { warnx ( " " , entp -> uri , X509_verify_cert_error_string ( c ) ) ; X509_STORE_CTX_cleanup ( ctx ) ; cert_free ( cert ) ; sk_X509_free ( chain ) ; sk_X509_CRL_free ( crls ) ; X509_free ( x509 ) ; return NULL ; } } X509_STORE_CTX_cleanup ( ctx ) ; sk_X509_free ( chain ) ; sk_X509_CRL_free ( crls ) ; if ( ! ( entp -> has_pkey ? valid_ta ( entp -> uri , auths , cert ) : valid_cert ( entp -> uri , auths , cert ) ) ) { X509_free ( x509 ) ; return cert ; } cert -> valid = 1 ; na = malloc ( sizeof ( * na ) ) ; if ( na == NULL ) err ( 1 , NULL ) ; if ( entp -> has_pkey ) { if ( ( tal = strdup ( entp -> descr ) ) == NULL ) err ( 1 , NULL ) ; } else tal = a -> tal ; na -> parent = a ; na -> cert = cert ; na -> tal = tal ; na -> fn = strdup ( entp -> uri ) ; if ( na -> fn == NULL ) err ( 1 , NULL ) ; if ( RB_INSERT ( auth_tree , auths , na ) != NULL ) err ( 1 , " " ) ; if ( a == NULL ) X509_STORE_add_cert ( store , x509 ) ; return cert ; }
Certificates are from manifests (has a digest and is signed with another
 certificate) or TALs (has a pkey and is self-signed).
Certificates are from manifests ( has a digest and is signed with another certificate ) or TALs ( has a pkey and is self - signed ) .
/* Extract certificate data and X509. */ /*
	 * Validate certificate chain w/CRLs.
	 * Only check the CRLs if specifically asked.
	 */ /*
	 * FIXME: can we pass any options to the verification that make
	 * the depth-zero self-signed bits verify properly?
	 */ /* Validate the cert to get the parent */ // needed? XXX /*
	 * Only on success of all do we add the certificate to the store
	 * of trusted certificates, both X509 and RPKI semantic.
	 */ /* only a ta goes into the store */