Be more lenient in accepting RFC8181/6492 CMS structures and Id Certs - because they are poorly defined. (#13)

Cargo.toml

@@ -2,5 +2,5 @@
 members = [ "client", "commons", "daemon", "pubc", "pubd" ]
 
 [patch.crates-io]
-rpki = { git="https://github.com/NLnetLabs/rpki-rs.git" }
+rpki = { git="https://github.com/NLnetLabs/rpki-rs.git", branch="accept-signed-message-cms" }
 bcder = { git="https://github.com/NLnetLabs/bcder.git" }

commons/src/remote/id.rs

@@ -509,14 +509,10 @@ impl IdExtensions {
                         AuthorityKeyIdentifier::take(
                             content, critical, &mut authority_key_id
                         )
-                    } else if critical {
-                        // ignore for now, lacnic has key usage marked crit
-                        Ok(())
-//                        xerr!(Err(decode::Malformed))
                     } else {
-                        // RFC 5280 says we can ignore non-critical
-                        // extensions we don’t know of. RFC 6487
-                        // agrees. So let’s do that.
+                        // Id Certificates are poorly defined and may
+                        // contain critical extensions we do not actually
+                        // understand or need.
                         Ok(())
                     }
                 })?;

commons/src/remote/sigmsg.rs

@@ -102,7 +102,7 @@ impl SignedMessage {
 
             let id_cert = Self::take_certificates(cons)?;
 
-            Self::drop_crls(cons)?;
+            let _whatever = Self::drop_crls(cons);
 
 
             let (sid, attrs, signature) = { // signerInfos
@@ -118,7 +118,7 @@ impl SignedMessage {
                         if alg != digest_algorithm {
                             return Err(decode::Malformed.into())
                         }
-                        let attrs = SignedAttrs::take_from(cons)?;
+                        let attrs = SignedAttrs::take_from_signed_message(cons)?;
                         if attrs.2 != content_type {
                             return Err(decode::Malformed.into())
                         }
@@ -157,7 +157,6 @@ impl SignedMessage {
         })
     }
 
-    #[allow(dead_code)]
     fn take_certificates<S: decode::Source>(
         cons: &mut decode::Constructed<S>
     ) -> Result<IdCert, S::Err> {
@@ -272,4 +271,13 @@ mod tests {
             ValidationError,
         );
     }
+
+    #[test]
+    fn parse_lacnic_issue_response() {
+        let der = include_bytes!("../../test-resources/remote/lacnic-res-2.der");
+        let _msg = SignedMessage::decode(
+            Bytes::from_static(der),
+            false
+        ).unwrap();
+    }
 }

commons/src/util/softsigner.rs

@@ -20,7 +20,6 @@ use serde::{de, ser};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use std::fs::File;
 use std::io::Write;
-use std::str::from_utf8_unchecked;
 
 
 //------------ SignerKeyId ---------------------------------------------------

daemon/tests/ca_under_ta.rs

@@ -160,8 +160,5 @@ fn ca_under_ta() {
         add_parent_to_ca(&cms_child_handle, parent);
 
         wait_for_resources_on_current_key(&cms_child_handle, &cms_child_resources);
-
-
-        panic!("stop");
     });
 }