More router certificate checks.

svn path=/trunk/; revision=5689

1 files changed, 4 insertions, 2 deletions

diff --git a/rcynic/rcynic.c b/rcynic/rcynic.c
index 3cdd2190..5e90df89 100644
--- a/rcynic/rcynic.c
+++ b/rcynic/rcynic.c
@@ -3850,7 +3850,8 @@ static int check_x509(rcynic_ctx_t *rc,
 
   if (x->rfc3779_addr) {
     ex_count--;
-    if ((loc = X509_get_ext_by_NID(x, NID_sbgp_ipAddrBlock, -1)) < 0 ||
+    if (routercert ||
+	(loc = X509_get_ext_by_NID(x, NID_sbgp_ipAddrBlock, -1)) < 0 ||
 	!X509_EXTENSION_get_critical(X509_get_ext(x, loc)) ||
 	!v3_addr_is_canonical(x->rfc3779_addr) ||
 	sk_IPAddressFamily_num(x->rfc3779_addr) == 0) {
@@ -3877,7 +3878,8 @@ static int check_x509(rcynic_ctx_t *rc,
 	!X509_EXTENSION_get_critical(X509_get_ext(x, loc)) ||
 	!v3_asid_is_canonical(x->rfc3779_asid) ||
 	x->rfc3779_asid->asnum == NULL ||
-	x->rfc3779_asid->rdi != NULL) {
+	x->rfc3779_asid->rdi != NULL ||
+	(routercert && x->rfc3779_asid->asnum->type == ASIdentifierChoice_inherit)) {
       log_validation_status(rc, uri, bad_asidentifiers, generation);
       goto done;
     }