20260826 增加BER兼容告警与分类指标

src/validation/objects.rs

@@ -8,13 +8,13 @@ use crate::data_model::rc::{
     ResourceCertificate,
 };
 use crate::data_model::roa::{IpPrefix, RoaAfi, RoaDecodeError, RoaObject, RoaValidateError};
-use crate::data_model::signed_object::SignedObjectVerifyError;
+use crate::data_model::signed_object::{RpkiSignedObject, SignedObjectVerifyError};
 use crate::parallel::config::ParallelPhase2Config;
 use crate::parallel::object_worker::{
     ObjectTaskExecutor, ObjectWorkerPool, ObjectWorkerSubmitError,
 };
 use crate::policy::{Policy, ResourceValidationMode, SignedObjectFailurePolicy};
-use crate::report::{RfcRef, Warning};
+use crate::report::{RfcRef, Warning, WarningCategory};
 use crate::storage::{
     PackFile, PackTime, RoaCacheObjectMeta, RoaCacheProjection, VcirLocalOutput,
     VcirLocalOutputPayload, VcirOutputType, VcirSourceObjectType,
@@ -34,6 +34,22 @@ const RFC_CRLDP: &[RfcRef] = &[RfcRef("RFC 6487 §4.8.6")];
 const RFC_CRLDP_AND_LOCKED_PACK: &[RfcRef] =
     &[RfcRef("RFC 6487 §4.8.6"), RfcRef("RFC 9286 §4.2.1")];
 
+fn ber_compatible_cms_warning(der: &[u8], rsync_uri: &str, object_kind: &str) -> Option<Warning> {
+    let strict_error = RpkiSignedObject::strict_cms_der_error(der)?;
+    Some(
+        Warning::new(format!(
+            "accepted BER-compatible CMS encoding for {object_kind}: {rsync_uri}: {strict_error}"
+        ))
+        .with_category(WarningCategory::BerCompatibleCmsEncoding)
+        .with_rfc_refs(&[RfcRef("X.690 §10"), RfcRef("RFC 6488 §2")])
+        .with_context(rsync_uri),
+    )
+}
+
+fn ber_compatible_cms_warning_for_file(file: &PackFile, object_kind: &str) -> Option<Warning> {
+    ber_compatible_cms_warning(file.bytes().ok()?, &file.rsync_uri, object_kind)
+}
+
 fn sha256_hex_to_32(hex_value: &str) -> [u8; 32] {
     let bytes = hex::decode(hex_value).expect("internal sha256 hex should decode");
     let mut out = [0u8; 32];
@@ -1015,6 +1031,12 @@ pub fn process_publication_point_for_issuer_with_cache_options<P: PublicationPoi
         }
     };
 
+    if let Some(warning) =
+        ber_compatible_cms_warning(manifest_bytes, manifest_rsync_uri, "manifest")
+    {
+        warnings.push(warning);
+    }
+
     // Decode issuer CA once; if it fails we cannot validate ROA/ASPA EE certificates.
     let issuer_ca = match decode_resource_certificate_with_policy(issuer_ca_der, policy) {
         Ok(v) => v,
@@ -1317,6 +1339,9 @@ pub fn process_publication_point_for_issuer_with_cache_options<P: PublicationPoi
                         result: AuditObjectResult::Ok,
                         detail: None,
                     });
+                    if let Some(warning) = ber_compatible_cms_warning_for_file(file, "ROA") {
+                        warnings.push(warning);
+                    }
                 }
                 Err(e) => match policy.signed_object_failure_policy {
                     SignedObjectFailurePolicy::DropObject => {
@@ -1426,6 +1451,9 @@ pub fn process_publication_point_for_issuer_with_cache_options<P: PublicationPoi
                         result: AuditObjectResult::Ok,
                         detail: None,
                     });
+                    if let Some(warning) = ber_compatible_cms_warning_for_file(file, "ASPA") {
+                        warnings.push(warning);
+                    }
                 }
                 Err(e) => match policy.signed_object_failure_policy {
                     SignedObjectFailurePolicy::DropObject => {
@@ -2050,6 +2078,12 @@ pub(crate) fn prepare_publication_point_for_parallel_roa_with_cache<P: Publicati
         }
     };
 
+    if let Some(warning) =
+        ber_compatible_cms_warning(manifest_bytes, manifest_rsync_uri, "manifest")
+    {
+        warnings.push(warning);
+    }
+
     let issuer_ca = match decode_resource_certificate_with_policy(issuer_ca_der, policy) {
         Ok(v) => v,
         Err(e) => {
@@ -2367,6 +2401,9 @@ pub(crate) fn reduce_parallel_roa_stage(
                         result: AuditObjectResult::Ok,
                         detail: None,
                     });
+                    if let Some(warning) = ber_compatible_cms_warning_for_file(file, "ROA") {
+                        warnings.push(warning);
+                    }
                 }
                 Err(e) => {
                     audit.push(ObjectAuditEntry {
@@ -2418,6 +2455,9 @@ pub(crate) fn reduce_parallel_roa_stage(
                         result: AuditObjectResult::Ok,
                         detail: None,
                     });
+                    if let Some(warning) = ber_compatible_cms_warning_for_file(file, "ASPA") {
+                        warnings.push(warning);
+                    }
                 }
                 Err(e) => {
                     audit.push(ObjectAuditEntry {

src/validation/tree_parallel.rs

@@ -3013,6 +3013,7 @@ mod tests {
         });
         sample.audit.warnings.push(crate::audit::AuditWarning {
             message: "warning".to_string(),
+            category: "unclassified".to_string(),
             rfc_refs: Vec::new(),
             context: None,
         });