CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/24 07:58:36
Modified files:
usr.sbin/rpki-client: extern.h filemode.c parser.c validate.c
Log message:
rpki-client: check all !TA certs for resource coverage
For historic reasons, EE certs did not have their resources checked for
coverage in the parent. Since we have the exception of EE certs that need
special casing for inheritance (MFT/TAK/GBR), this can be done at the end
of valid_x509(). The check is not expensive since this only goes up as
many issuers as needed to hit explicit resources.
Rename the misnamed valid_cert() to valid_resources() for lack of a better
idea and call it from the end of valid_x509(). Remove the remaining calls
since they're now redundant, and make valid_resources() static.
ok job
