Reject more than one AS in ASPA EEs

Fixes #168.

diff --git a/src/object/certificate.c b/src/object/certificate.c
index 799ea4c074e897942746384f4ae10021fa6e4195..e71613dcffbc1797a42c01d9caa26fe57dca27e6 100644 (file)
--- a/src/object/certificate.c
+++ b/src/object/certificate.c
@@ -1131,8 +1131,7 @@ abort:
 }
 
 static int
-handle_ip_extension(X509_EXTENSION *ext, struct resources *resources,
-    bool allow_inherit)
+handle_ip_extension(X509_EXTENSION *ext, struct resources *resources, int flags)
 {
        ASN1_OCTET_STRING *string;
        struct IPAddrBlocks *blocks;
@@ -1176,8 +1175,7 @@ handle_ip_extension(X509_EXTENSION *ext, struct resources *resources,
        }
 
        for (i = 0; i < blocks->list.count && !error; i++)
-               error = resources_add_ip(resources, blocks->list.array[i],
-                   allow_inherit);
+               error = resources_add_ip(resources, blocks->list.array[i], flags);
 
 end:
        ASN_STRUCT_FREE(asn_DEF_IPAddrBlocks, blocks);
@@ -1186,7 +1184,7 @@ end:
 
 static int
 handle_asn_extension(X509_EXTENSION *ext, struct resources *resources,
-    bool allow_inherit)
+    int flags)
 {
        ASN1_OCTET_STRING *string;
        struct ASIdentifiers *ids;
@@ -1198,7 +1196,7 @@ handle_asn_extension(X509_EXTENSION *ext, struct resources *resources,
        if (error)
                return error;
 
-       error = resources_add_asn(resources, ids, allow_inherit);
+       error = resources_add_asn(resources, ids, flags);
 
        ASN_STRUCT_FREE(asn_DEF_ASIdentifiers, ids);
        return error;
@@ -1213,7 +1211,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
 {
        int allowed_ip_nid = NID_undef;
        int allowed_as_nid = NID_undef;
-       bool allow_inherit = true;
+       int flags = RF_ALLOW_ALL;
 
        int nid_ip1 = NID_sbgp_ipAddrBlock;
        int nid_ip2 = nid_ipAddrBlocksv2();
@@ -1248,7 +1246,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
                        case RPKI_POLICY_RFC8360:
                                allowed_ip_nid = nid_ip2;
                        }
-                       allow_inherit = false;
+                       flags &= ~RF_ALLOW_INHERIT;
                        break;
                case EET_ASPA:
                        switch (resources_get_policy(resources)) {
@@ -1257,7 +1255,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
                        case RPKI_POLICY_RFC8360:
                                allowed_as_nid = nid_as2;
                        }
-                       allow_inherit = false;
+                       flags = 0;
                        break;
                case EET_MFT:
                case EET_GBR:
@@ -1293,7 +1291,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
                        if (extnid != allowed_ip_nid)
                                return pr_val_err("Found an unexpected IP Resources extension.");
 
-                       error = handle_ip_extension(ext, resources, allow_inherit);
+                       error = handle_ip_extension(ext, resources, flags);
                        if (error)
                                return error;
                        allowed_ip_nid = NID_undef;
@@ -1302,7 +1300,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
                        if (extnid != allowed_as_nid)
                                return pr_val_err("Found an unexpected AS Resources extension.");
 
-                       error = handle_asn_extension(ext, resources, allow_inherit);
+                       error = handle_asn_extension(ext, resources, flags);
                        if (error)
                                return error;
                        allowed_as_nid = NID_undef;

diff --git a/src/resource.c b/src/resource.c
index 772742f23298fd517f7c27e1b5679e7aed9c652f..5cfca59c0ef8b4acb39853308e12ee6bf24d1a28 100644 (file)
--- a/src/resource.c
+++ b/src/resource.c
@@ -354,7 +354,7 @@ add_aors(struct resources *resources, int family,
 
 int
 resources_add_ip(struct resources *resources, struct IPAddressFamily *obj,
-    bool allow_inherit)
+    int flags)
 {
        int family;
 
@@ -366,7 +366,7 @@ resources_add_ip(struct resources *resources, struct IPAddressFamily *obj,
        case IPAddressChoice_PR_NOTHING:
                break;
        case IPAddressChoice_PR_inherit:
-               return allow_inherit
+               return (flags & RF_ALLOW_INHERIT)
                    ? inherit_aors(resources, family)
                    : pr_val_err("IP extension is not allowed to contain 'inherit' elements.");
        case IPAddressChoice_PR_addressesOrRanges:
@@ -463,7 +463,7 @@ add_asn(struct resources *resources, struct asn_range const *asns,
 }
 
 static int
-add_asior(struct resources *resources, struct ASIdOrRange *obj)
+add_asior(struct resources *resources, struct ASIdOrRange *obj, int flags)
 {
        struct resources *parent;
        struct asn_range asns;
@@ -486,6 +486,8 @@ add_asior(struct resources *resources, struct ASIdOrRange *obj)
                return add_asn(resources, &asns, parent);
 
        case ASIdOrRange_PR_range:
+               if ((flags & RF_ALLOW_RANGES) == 0)
+                       return pr_val_err("ASN extension is not allowed to contain 'range' elements.");
                error = ASId2u32(&obj->choice.range.min, &asns.min);
                if (error)
                        return error;
@@ -499,7 +501,7 @@ add_asior(struct resources *resources, struct ASIdOrRange *obj)
 }
 
 static int
-add_asiors(struct resources *resources, struct ASIdentifiers *ids)
+add_asiors(struct resources *resources, struct ASIdentifiers *ids, int flags)
 {
        struct ASIdentifierChoice__asIdsOrRanges *iors;
        int i;
@@ -512,8 +514,11 @@ add_asiors(struct resources *resources, struct ASIdentifiers *ids)
        if (iors->list.count == 0)
                return pr_val_err("AS extension's set of AS number records is empty.");
 
+       if ((flags & RF_ALLOW_MULTIPLE) == 0 && iors->list.count != 1)
+               return pr_val_err("AS resources list more than one ASIdOrRange.");
+
        for (i = 0; i < iors->list.count; i++) {
-               error = add_asior(resources, iors->list.array[i]);
+               error = add_asior(resources, iors->list.array[i], flags);
                if (error)
                        return error;
        }
@@ -523,7 +528,7 @@ add_asiors(struct resources *resources, struct ASIdentifiers *ids)
 
 int
 resources_add_asn(struct resources *resources, struct ASIdentifiers *ids,
-    bool allow_inherit)
+    int flags)
 {
        if (ids->asnum == NULL)
                return pr_val_err("ASN extension lacks 'asnum' element.");
@@ -532,11 +537,11 @@ resources_add_asn(struct resources *resources, struct ASIdentifiers *ids,
 
        switch (ids->asnum->present) {
        case ASIdentifierChoice_PR_inherit:
-               if (!allow_inherit)
+               if ((flags & RF_ALLOW_INHERIT) == 0)
                        return pr_val_err("ASN extension is not allowed to contain 'inherit' elements.");
                return inherit_asiors(resources);
        case ASIdentifierChoice_PR_asIdsOrRanges:
-               return add_asiors(resources, ids);
+               return add_asiors(resources, ids, flags);
        case ASIdentifierChoice_PR_NOTHING:
                break;
        }

diff --git a/src/resource.h b/src/resource.h
index e541d9561faf240676cc85f222d9a3d66c04d8e4..41e880df3f0245b01d9e8f7c04e3984d337cfdbb 100644 (file)
--- a/src/resource.h
+++ b/src/resource.h
@@ -26,8 +26,13 @@ struct resources;
 struct resources *resources_create(enum rpki_policy, bool);
 void resources_destroy(struct resources *);
 
-int resources_add_ip(struct resources *, struct IPAddressFamily *, bool);
-int resources_add_asn(struct resources *, struct ASIdentifiers *, bool);
+#define RF_ALLOW_INHERIT  (1 << 0)
+#define RF_ALLOW_MULTIPLE (1 << 1)
+#define RF_ALLOW_RANGES   (1 << 2)
+#define RF_ALLOW_ALL (RF_ALLOW_INHERIT | RF_ALLOW_MULTIPLE | RF_ALLOW_RANGES)
+
+int resources_add_ip(struct resources *, struct IPAddressFamily *, int);
+int resources_add_asn(struct resources *, struct ASIdentifiers *, int);
 
 bool resources_empty(struct resources *);
 bool resources_contains_asns(struct resources *, struct asn_range const *);