From 1ea10bb0cd8b4e511ae989d41ca974bcec424d05 Mon Sep 17 00:00:00 2001 From: Tim Bruijnzeels Date: Wed, 24 Jul 2019 16:26:30 -0400 Subject: [PATCH] Be more lenient in accepting RFC8181/6492 CMS structures and Id Certs - because they are poorly defined. (#13) --- Cargo.toml | 2 +- commons/src/remote/id.rs | 10 +++------- commons/src/remote/sigmsg.rs | 14 +++++++++++--- commons/src/util/softsigner.rs | 1 - commons/test-resources/remote/lacnic-res-2.der | Bin 0 -> 2023 bytes commons/test-resources/remote/lacnic-res.der | Bin 0 -> 2071 bytes daemon/tests/ca_under_ta.rs | 3 --- 7 files changed, 15 insertions(+), 15 deletions(-) create mode 100644 commons/test-resources/remote/lacnic-res-2.der create mode 100644 commons/test-resources/remote/lacnic-res.der diff --git a/Cargo.toml b/Cargo.toml index 42e7f4ff..d8a0b316 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,5 +2,5 @@ members = [ "client", "commons", "daemon", "pubc", "pubd" ] [patch.crates-io] -rpki = { git="https://github.com/NLnetLabs/rpki-rs.git" } +rpki = { git="https://github.com/NLnetLabs/rpki-rs.git", branch="accept-signed-message-cms" } bcder = { git="https://github.com/NLnetLabs/bcder.git" } diff --git a/commons/src/remote/id.rs b/commons/src/remote/id.rs index aca9c411..cde64c4c 100644 --- a/commons/src/remote/id.rs +++ b/commons/src/remote/id.rs @@ -509,14 +509,10 @@ impl IdExtensions { AuthorityKeyIdentifier::take( content, critical, &mut authority_key_id ) - } else if critical { - // ignore for now, lacnic has key usage marked crit - Ok(()) -// xerr!(Err(decode::Malformed)) } else { - // RFC 5280 says we can ignore non-critical - // extensions we don’t know of. RFC 6487 - // agrees. So let’s do that. + // Id Certificates are poorly defined and may + // contain critical extensions we do not actually + // understand or need. Ok(()) } })?; diff --git a/commons/src/remote/sigmsg.rs b/commons/src/remote/sigmsg.rs index 87669c67..58f31c21 100644 --- a/commons/src/remote/sigmsg.rs +++ b/commons/src/remote/sigmsg.rs @@ -102,7 +102,7 @@ impl SignedMessage { let id_cert = Self::take_certificates(cons)?; - Self::drop_crls(cons)?; + let _whatever = Self::drop_crls(cons); let (sid, attrs, signature) = { // signerInfos @@ -118,7 +118,7 @@ impl SignedMessage { if alg != digest_algorithm { return Err(decode::Malformed.into()) } - let attrs = SignedAttrs::take_from(cons)?; + let attrs = SignedAttrs::take_from_signed_message(cons)?; if attrs.2 != content_type { return Err(decode::Malformed.into()) } @@ -157,7 +157,6 @@ impl SignedMessage { }) } - #[allow(dead_code)] fn take_certificates( cons: &mut decode::Constructed ) -> Result { @@ -272,4 +271,13 @@ mod tests { ValidationError, ); } + + #[test] + fn parse_lacnic_issue_response() { + let der = include_bytes!("../../test-resources/remote/lacnic-res-2.der"); + let _msg = SignedMessage::decode( + Bytes::from_static(der), + false + ).unwrap(); + } } diff --git a/commons/src/util/softsigner.rs b/commons/src/util/softsigner.rs index 8a866299..bf34f1f5 100644 --- a/commons/src/util/softsigner.rs +++ b/commons/src/util/softsigner.rs @@ -20,7 +20,6 @@ use serde::{de, ser}; use serde::{Deserialize, Deserializer, Serialize, Serializer}; use std::fs::File; use std::io::Write; -use std::str::from_utf8_unchecked; //------------ SignerKeyId --------------------------------------------------- diff --git a/commons/test-resources/remote/lacnic-res-2.der b/commons/test-resources/remote/lacnic-res-2.der new file mode 100644 index 0000000000000000000000000000000000000000..e55eca562b6c347bed6b5ea47d3a0677e89e884f GIT binary patch literal 2023 zcmai#dsGv57RNK0@LoU!F{?<^5zs=zOhO(6LlCKe2tI&-a%v?c6B7wZOu}=qhJaMd zqj0PsmX{S#5W%9DMG$IL1Qt{f0zN=03W#_RC@A8Q9n|hxyL&qS&F^>T{_gMdo$tMf zTHnYq)i?EpDPVvvRwHUW08-2mQ+=cGR9^rE33xychp6>U-Uk^i0&I%ac4~qKptC*V zq9mjkRG}2hr0x*K8G%TslrIyArMuiAZm>7m74qO1v!hU@lD7*bVbM~hJ0w!6XXDOkBL)fAM;;L)iFmB&YUXatMlibe>TJXgM}P{5}NX#!UkpHD|!5Dfr*SOKOwr~%Az z*t#)Z0|2BNiG zVJ=^;?)IyBM(57`nn7$0XjndYuij+Co{>n;$8)Q-#<+_z+CEH!)bw6Z!%le3O zhu`FC&M=Xo*#lYA-~Bw;QC0e&CcjHhoOm?hAv?5Rmf5pZJMSLODyyi1yHg_D&F)Fv zZ-a@3`1men3GA?)=mp4KjWBf zRgko~BP81T!YBf6sPV;0CK3)?FRM8sNc z72=;PDff45nLi}4tBy8(7*?j|g_tb_m;=B(fdJwS)E`pEbjPRzI0t1RRLQ8jzb5MW z@@AjtbS-$g{rXL)Ep9g5qV;LwtMGic$CG#ML((4q>)R*b?K|Hvk;Cq;P5Tww8uY77 z$UA7E(hO z6GgwlJ32zF(+KDDp4xJ8Z#cTr8(d9E!5960m5Fy|wiH3KYU*&---MO?liuHbHRGA- z*9&jmFL?9n0si|ck%7~i!%m&&KM%S#rd?%dBUfbR2l$mM42ZItbA1M?GMek@`O%$>H+;yhbYew)mH|Gs&>iMINUMJAV4BraN?o0gxCw|#y2JiIY?5X!OCMGd8i?k5G6opcmm zw@RAo=A4?Sj-F**wy_U-n3KGosP1x<47VQlwpOl9G;4aPo2(ZfjDaDqeU~oIGCmvQ6Xg$qw=zOOzf z_uOc2yF1IcA+BuYN52X-q;MieNzSuUoAD7UN0dh1FUqaoOZ1r1w}#oHe$?cFBw+|E zjo~Z*MbP?!SXlq0?%U|XJbSy*;n>=y+$={LmFDoO#mu*`opd3#!obN+_+`qrnJuU5 z8e7}!u8*vJJyRHCP3+vcP7tgw4X@mm+Or~gzHeYHduirY5`5Medm>Y}}7Q z;+B(f=f;j-8gE@U$vorp_@A^*VfnWHPnN}N*!w#+3D-Dgbg8JtCU=O;{#Ol~;xZNw z_12qCnA{?dvdV85#|yhPIgt;}Hh(?UYu>h`X~)uMhZOA#PU0gFE%ODG$VTz96fs>QNI=noKuZ$r3Ar=bFpI;6-D9aHOvud>;;84V<8p{ zLyVVyZj5(J5PGmYAtnH7U}wL=kbJpI^PJMRJIQf^y;Tl1P8t$9Uh``hKDE1x{4?+}G7G}}*3 zePmo~Zoc({@EXfKk?)h|dJo%GJ+ap!+~m)#4dBRzfs1EpQw-?OoMTcWl@``y1vSXR96Z!m&8eGj!Ot}NnbCer zzdnhNZkx_B`~kE8gI%BY6(-&N$9&a@pksDH5AR(X@PlM zi@GKTzwx#qOp|r|gH!*Rtti>YDtabMb?h@UOzD4k z;TqX{vjyRtx+#V(FJtFaZM&knGgYrW!J(WDERQnFAF%}Uur~HoQUmszq-V&qK zT<-V&sBkgw=+S$);Op&o;~fdEht+lUKTYqMXC)1Eq}>Keo=ke3qW9iqJFfGCoameF!G$eX$*tX|C9LMnePowMJs)>|$p|fbKr1B=rA`zijc6k4PdJIM zP&5mJzIAgAswK}(s|}IkrFnr=^?;M)$E!6#7K%;T#@{Xu&9{m7f5@Qmayl>awT~7w zQE}g`W=2J5L!&vvTIyy~qA@kZ(^fV&kAt#xR0l^42F?XWP-zl9aXRQ1NpWV}wt!!$fNa?}ii8;X!* z+;;1|)6_K8c&Oom%s+I4P4eG~mon?^-*{T6sbO3)7gAcKzwVwF$5$KmUQ#Wsjmc@T z9^;Y+c2S4(ntRPjHgveItT#3>hBN0gJ8|-2@x}f52gwzDJC6elTUL##WY*lfSn7M~ zX{22?Rk4n{ZSCLz{A0ZUcT+?Qq(vy6Mk`F|m zHJruz`L>saH-7H&5rd?v-iB&g~e|-I45uX`1I4e!id%PgnpKO`PZHk55>wZzBj5I kAO;+`8S7eUDfRq0wDTEr)3Zu<&G@C(kzJm${+Isr8}NPtL;wH) literal 0 HcmV?d00001 diff --git a/daemon/tests/ca_under_ta.rs b/daemon/tests/ca_under_ta.rs index 2f9156b3..88a257b0 100644 --- a/daemon/tests/ca_under_ta.rs +++ b/daemon/tests/ca_under_ta.rs @@ -160,8 +160,5 @@ fn ca_under_ta() { add_parent_to_ca(&cms_child_handle, parent); wait_for_resources_on_current_key(&cms_child_handle, &cms_child_resources); - - - panic!("stop"); }); }