Patch two memory leaks and bad rsync

The 'root' download strategy should not apply to the certificate
pointed by the TAL, because we don't trust that URL at that point
yet.

Fixes #4.

diff --git a/src/asn1/content_info.c b/src/asn1/content_info.c
index 9b1f87b25295df01a379b6a1ebdcaa3a54399b95..8489b869a2b9da6568a4548ff42d64cdebada984 100644 (file)
--- a/src/asn1/content_info.c
+++ b/src/asn1/content_info.c
@@ -3,6 +3,7 @@
 #include <errno.h>
 #include <libcmscodec/ContentType.h>
 #include "file.h"
+#include "log.h"
 #include "oid.h"
 #include "asn1/decode.h"
 
@@ -19,12 +20,11 @@ validate(struct ContentInfo *info)
        if (error)
                return error;
 
-       if (!ARCS_EQUAL_OIDS(&arcs, oid_sdata)) {
-               fprintf(stderr, "Incorrect content-type.");
-               return -EINVAL;
-       }
+       if (!ARCS_EQUAL_OIDS(&arcs, oid_sdata))
+               error = pr_err("Incorrect content-type.");
 
-       return 0;
+       free_arcs(&arcs);
+       return error;
 }
 
 static int

diff --git a/src/asn1/oid.c b/src/asn1/oid.c
index 91cbc334562f831aedd7f3f1f1f47d03325550d0..d592f652ca6d129de5b3547e31dfe52168569f15 100644 (file)
--- a/src/asn1/oid.c
+++ b/src/asn1/oid.c
@@ -15,6 +15,9 @@ free_arcs(struct oid_arcs *arcs)
  * Wrapper for OBJECT_IDENTIFIER_get_arcs().
  *
  * Callers must free @result.
+ *
+ * TODO (whatever) Most of the time, this function is called to compare @result
+ * to some oid. Maybe create a wrapper that takes care of all the boilerplate.
  */
 int
 oid2arcs(OBJECT_IDENTIFIER_t *oid, struct oid_arcs *result)
@@ -58,23 +61,6 @@ oid2arcs(OBJECT_IDENTIFIER_t *oid, struct oid_arcs *result)
        return 0;
 }
 
-/* Callers must free @result. */
-int
-any2arcs(ANY_t *any, struct oid_arcs *result)
-{
-       OBJECT_IDENTIFIER_t *oid;
-       int error;
-
-       error = asn1_decode_any(any, &asn_DEF_OBJECT_IDENTIFIER,
-           (void **) &oid);
-       if (error)
-               return error;
-
-       error = oid2arcs(oid, result);
-       ASN_STRUCT_FREE(asn_DEF_OBJECT_IDENTIFIER, oid);
-       return error;
-}
-
 bool oid_equal(OBJECT_IDENTIFIER_t *a, OBJECT_IDENTIFIER_t *b)
 {
        return (a->size == b->size) && (memcmp(a->buf, b->buf, a->size) == 0);

diff --git a/src/asn1/oid.h b/src/asn1/oid.h
index 8e98496899ad425c1ca8241c8f37df33385dcc20..14d0a1bc8ad5c1f93bedcbaad59ea5bcd365de18 100644 (file)
--- a/src/asn1/oid.h
+++ b/src/asn1/oid.h
@@ -43,7 +43,6 @@ typedef asn_oid_arc_t OID[];
 #define OID_SHA256                   { 2, 16, 840, 1, 101, 3, 4, 2, 1 }
 
 int oid2arcs(OBJECT_IDENTIFIER_t *, struct oid_arcs *);
-int any2arcs(ANY_t *, struct oid_arcs *);
 
 bool oid_equal(OBJECT_IDENTIFIER_t *, OBJECT_IDENTIFIER_t *);
 bool arcs_equal(struct oid_arcs const *, struct oid_arcs const *);

diff --git a/src/asn1/signed_data.c b/src/asn1/signed_data.c
index a5e917aeddb02dac0fdbb83bf4834bfadcc8dcf8..04f41ba9f291fcbf937a0d4de483a2b275a4f3a8 100644 (file)
--- a/src/asn1/signed_data.c
+++ b/src/asn1/signed_data.c
@@ -162,10 +162,8 @@ validate_message_digest_attribute(CMSAttributeValue_t *value,
        MessageDigest_t *digest;
        int error;
 
-       if (eci->eContent == NULL) {
-               pr_err("There's no content being signed.");
-               return -EINVAL;
-       }
+       if (eci->eContent == NULL)
+               return pr_err("There's no content being signed.");
 
        error = asn1_decode_any(value, &asn_DEF_MessageDigest,
            (void **) &digest);
@@ -176,7 +174,7 @@ validate_message_digest_attribute(CMSAttributeValue_t *value,
        if (error)
                pr_err("The content's hash does not match the Message-Digest Attribute.");
 
-       free(digest);
+       ASN_STRUCT_FREE(asn_DEF_MessageDigest, digest);
        return error;
 }
 

diff --git a/src/main.c b/src/main.c
index ea6ba4d907098ad74bf0ddad610b136665f8dd23..5d71671be9b62108d61c9c12ea38edbdaf40d0e3 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -39,7 +39,7 @@ handle_tal_uri(struct tal *tal, struct rpki_uri const *uri)
        struct validation *state;
        int error;
 
-       error = download_files(uri);
+       error = download_files(uri, true);
        if (error) {
                return pr_warn("TAL URI '%s' could not be RSYNC'd.",
                    uri->global);

diff --git a/src/object/certificate.c b/src/object/certificate.c
index ad98ae4ea5445e6423e58a1cf8634580ea6e5d8f..31d0e5c03000dd03de141920a3e422dd552063e7 100644 (file)
--- a/src/object/certificate.c
+++ b/src/object/certificate.c
@@ -861,7 +861,7 @@ static int
 handle_caRepository(struct rpki_uri *uri, void *arg)
 {
        pr_debug("caRepository: %s", uri_get_printable(uri));
-       return download_files(uri);
+       return download_files(uri, false);
 }
 
 static int

diff --git a/src/rsync/rsync.c b/src/rsync/rsync.c
index 515293d67942c59054605ef4a63f4ec1eaf761cf..47e6206ff555ca7cfa528bdaf3c245cd64979974 100644 (file)
--- a/src/rsync/rsync.c
+++ b/src/rsync/rsync.c
@@ -130,8 +130,12 @@ handle_root_strategy(struct rpki_uri const *src, struct rpki_uri *dst)
 }
 
 static int
-get_rsync_uri(struct rpki_uri const *requested_uri, struct rpki_uri *rsync_uri)
+get_rsync_uri(struct rpki_uri const *requested_uri, bool force_strict,
+    struct rpki_uri *rsync_uri)
 {
+       if (force_strict)
+               return handle_strict_strategy(requested_uri, rsync_uri);
+
        switch (config_get_sync_strategy()) {
        case SYNC_ROOT:
                return handle_root_strategy(requested_uri, rsync_uri);
@@ -335,8 +339,19 @@ do_rsync(struct rpki_uri *uri)
        exit(-EINVAL);
 }
 
+/**
+ * @force_srict:
+ *     true:
+ *         SYNC_OFF    -> SYNC_OFF
+ *         SYNC_STRICT -> SYNC_STRICT
+ *         SYNC_ROOT   -> SYNC_STRICT
+ *     false:
+ *         SYNC_OFF    -> SYNC_OFF
+ *         SYNC_STRICT -> SYNC_STRICT
+ *         SYNC_ROOT   -> SYNC_ROOT
+ */
 int
-download_files(struct rpki_uri const *requested_uri)
+download_files(struct rpki_uri const *requested_uri, bool force_strict)
 {
        /**
         * Note:
@@ -355,7 +370,7 @@ download_files(struct rpki_uri const *requested_uri)
                return 0;
        }
 
-       error = get_rsync_uri(requested_uri, &rsync_uri);
+       error = get_rsync_uri(requested_uri, force_strict, &rsync_uri);
        if (error)
                return error;
 

diff --git a/src/rsync/rsync.h b/src/rsync/rsync.h
index 50d924376c70efe46a3a585b033f87dda9db70f5..bb94814a8fe3972d9531e22d05437e314eaec0b6 100644 (file)
--- a/src/rsync/rsync.h
+++ b/src/rsync/rsync.h
@@ -1,9 +1,10 @@
 #ifndef SRC_RSYNC_RSYNC_H_
 #define SRC_RSYNC_RSYNC_H_
 
+#include <stdbool.h>
 #include "uri.h"
 
-int download_files(struct rpki_uri const *);
+int download_files(struct rpki_uri const *, bool);
 int rsync_init(void);
 void rsync_destroy(void);