From: Alberto Leiva Popper <ydahhrk@gmail.com>
Date: Fri, 20 Mar 2026 18:49:18 +0000 (-0300)
Subject: Reject more than one AS in ASPA EEs
X-Git-Tag: 1.7.0.experimental~28
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b66d77813bf32aa08647940d975882660e0c5ceb;p=thirdparty%2FFORT-validator.git

Reject more than one AS in ASPA EEs

Fixes #168.
---

diff --git a/src/object/certificate.c b/src/object/certificate.c
index 799ea4c0..e71613dc 100644
--- a/src/object/certificate.c
+++ b/src/object/certificate.c
@@ -1131,8 +1131,7 @@ abort:
 }
 
 static int
-handle_ip_extension(X509_EXTENSION *ext, struct resources *resources,
-    bool allow_inherit)
+handle_ip_extension(X509_EXTENSION *ext, struct resources *resources, int flags)
 {
 	ASN1_OCTET_STRING *string;
 	struct IPAddrBlocks *blocks;
@@ -1176,8 +1175,7 @@ handle_ip_extension(X509_EXTENSION *ext, struct resources *resources,
 	}
 
 	for (i = 0; i < blocks->list.count && !error; i++)
-		error = resources_add_ip(resources, blocks->list.array[i],
-		    allow_inherit);
+		error = resources_add_ip(resources, blocks->list.array[i], flags);
 
 end:
 	ASN_STRUCT_FREE(asn_DEF_IPAddrBlocks, blocks);
@@ -1186,7 +1184,7 @@ end:
 
 static int
 handle_asn_extension(X509_EXTENSION *ext, struct resources *resources,
-    bool allow_inherit)
+    int flags)
 {
 	ASN1_OCTET_STRING *string;
 	struct ASIdentifiers *ids;
@@ -1198,7 +1196,7 @@ handle_asn_extension(X509_EXTENSION *ext, struct resources *resources,
 	if (error)
 		return error;
 
-	error = resources_add_asn(resources, ids, allow_inherit);
+	error = resources_add_asn(resources, ids, flags);
 
 	ASN_STRUCT_FREE(asn_DEF_ASIdentifiers, ids);
 	return error;
@@ -1213,7 +1211,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
 {
 	int allowed_ip_nid = NID_undef;
 	int allowed_as_nid = NID_undef;
-	bool allow_inherit = true;
+	int flags = RF_ALLOW_ALL;
 
 	int nid_ip1 = NID_sbgp_ipAddrBlock;
 	int nid_ip2 = nid_ipAddrBlocksv2();
@@ -1248,7 +1246,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
 			case RPKI_POLICY_RFC8360:
 				allowed_ip_nid = nid_ip2;
 			}
-			allow_inherit = false;
+			flags &= ~RF_ALLOW_INHERIT;
 			break;
 		case EET_ASPA:
 			switch (resources_get_policy(resources)) {
@@ -1257,7 +1255,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
 			case RPKI_POLICY_RFC8360:
 				allowed_as_nid = nid_as2;
 			}
-			allow_inherit = false;
+			flags = 0;
 			break;
 		case EET_MFT:
 		case EET_GBR:
@@ -1293,7 +1291,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
 			if (extnid != allowed_ip_nid)
 				return pr_val_err("Found an unexpected IP Resources extension.");
 
-			error = handle_ip_extension(ext, resources, allow_inherit);
+			error = handle_ip_extension(ext, resources, flags);
 			if (error)
 				return error;
 			allowed_ip_nid = NID_undef;
@@ -1302,7 +1300,7 @@ certificate_get_resources(X509 *cert, struct resources *resources,
 			if (extnid != allowed_as_nid)
 				return pr_val_err("Found an unexpected AS Resources extension.");
 
-			error = handle_asn_extension(ext, resources, allow_inherit);
+			error = handle_asn_extension(ext, resources, flags);
 			if (error)
 				return error;
 			allowed_as_nid = NID_undef;
diff --git a/src/resource.c b/src/resource.c
index 772742f2..5cfca59c 100644
--- a/src/resource.c
+++ b/src/resource.c
@@ -354,7 +354,7 @@ add_aors(struct resources *resources, int family,
 
 int
 resources_add_ip(struct resources *resources, struct IPAddressFamily *obj,
-    bool allow_inherit)
+    int flags)
 {
 	int family;
 
@@ -366,7 +366,7 @@ resources_add_ip(struct resources *resources, struct IPAddressFamily *obj,
 	case IPAddressChoice_PR_NOTHING:
 		break;
 	case IPAddressChoice_PR_inherit:
-		return allow_inherit
+		return (flags & RF_ALLOW_INHERIT)
 		    ? inherit_aors(resources, family)
 		    : pr_val_err("IP extension is not allowed to contain 'inherit' elements.");
 	case IPAddressChoice_PR_addressesOrRanges:
@@ -463,7 +463,7 @@ add_asn(struct resources *resources, struct asn_range const *asns,
 }
 
 static int
-add_asior(struct resources *resources, struct ASIdOrRange *obj)
+add_asior(struct resources *resources, struct ASIdOrRange *obj, int flags)
 {
 	struct resources *parent;
 	struct asn_range asns;
@@ -486,6 +486,8 @@ add_asior(struct resources *resources, struct ASIdOrRange *obj)
 		return add_asn(resources, &asns, parent);
 
 	case ASIdOrRange_PR_range:
+		if ((flags & RF_ALLOW_RANGES) == 0)
+			return pr_val_err("ASN extension is not allowed to contain 'range' elements.");
 		error = ASId2u32(&obj->choice.range.min, &asns.min);
 		if (error)
 			return error;
@@ -499,7 +501,7 @@ add_asior(struct resources *resources, struct ASIdOrRange *obj)
 }
 
 static int
-add_asiors(struct resources *resources, struct ASIdentifiers *ids)
+add_asiors(struct resources *resources, struct ASIdentifiers *ids, int flags)
 {
 	struct ASIdentifierChoice__asIdsOrRanges *iors;
 	int i;
@@ -512,8 +514,11 @@ add_asiors(struct resources *resources, struct ASIdentifiers *ids)
 	if (iors->list.count == 0)
 		return pr_val_err("AS extension's set of AS number records is empty.");
 
+	if ((flags & RF_ALLOW_MULTIPLE) == 0 && iors->list.count != 1)
+		return pr_val_err("AS resources list more than one ASIdOrRange.");
+
 	for (i = 0; i < iors->list.count; i++) {
-		error = add_asior(resources, iors->list.array[i]);
+		error = add_asior(resources, iors->list.array[i], flags);
 		if (error)
 			return error;
 	}
@@ -523,7 +528,7 @@ add_asiors(struct resources *resources, struct ASIdentifiers *ids)
 
 int
 resources_add_asn(struct resources *resources, struct ASIdentifiers *ids,
-    bool allow_inherit)
+    int flags)
 {
 	if (ids->asnum == NULL)
 		return pr_val_err("ASN extension lacks 'asnum' element.");
@@ -532,11 +537,11 @@ resources_add_asn(struct resources *resources, struct ASIdentifiers *ids,
 
 	switch (ids->asnum->present) {
 	case ASIdentifierChoice_PR_inherit:
-		if (!allow_inherit)
+		if ((flags & RF_ALLOW_INHERIT) == 0)
 			return pr_val_err("ASN extension is not allowed to contain 'inherit' elements.");
 		return inherit_asiors(resources);
 	case ASIdentifierChoice_PR_asIdsOrRanges:
-		return add_asiors(resources, ids);
+		return add_asiors(resources, ids, flags);
 	case ASIdentifierChoice_PR_NOTHING:
 		break;
 	}
diff --git a/src/resource.h b/src/resource.h
index e541d956..41e880df 100644
--- a/src/resource.h
+++ b/src/resource.h
@@ -26,8 +26,13 @@ struct resources;
 struct resources *resources_create(enum rpki_policy, bool);
 void resources_destroy(struct resources *);
 
-int resources_add_ip(struct resources *, struct IPAddressFamily *, bool);
-int resources_add_asn(struct resources *, struct ASIdentifiers *, bool);
+#define RF_ALLOW_INHERIT  (1 << 0)
+#define RF_ALLOW_MULTIPLE (1 << 1)
+#define RF_ALLOW_RANGES   (1 << 2)
+#define RF_ALLOW_ALL (RF_ALLOW_INHERIT | RF_ALLOW_MULTIPLE | RF_ALLOW_RANGES)
+
+int resources_add_ip(struct resources *, struct IPAddressFamily *, int);
+int resources_add_asn(struct resources *, struct ASIdentifiers *, int);
 
 bool resources_empty(struct resources *);
 bool resources_contains_asns(struct resources *, struct asn_range const *);