![[BACK]](/icons/back.gif){kind=icon}
Up to [local] / src / usr.sbin / rpki-client
Request diff between arbitrary revisions
Default branch: MAIN
Revision 1.33 / (download) - annotate - [select for diffs], Tue Mar 19 05:04:13 2024 UTC (2 months, 3 weeks ago) by tb
Branch: MAIN
CVS Tags: HEAD
Changes since 1.32: +2 -2 lines
Diff to previous 1.32 (colored)
Rename parent to issuer in struct auth Parent is confusing and issuer is the appropriate terminology. This is a mechanical diff. The only remaining uses of 'parent' in this code base now mean 'parent process'. discussed with beck and job ok job
Revision 1.32 / (download) - annotate - [select for diffs], Wed Dec 27 07:15:55 2023 UTC (5 months, 1 week ago) by tb
Branch: MAIN
CVS Tags: OPENBSD_7_5_BASE,
OPENBSD_7_5
Changes since 1.31: +23 -14 lines
Diff to previous 1.31 (colored)
Rework the warnings on internet resources Unify the printing of warnings about AS numbers and IP address blocks to use a call to as_warn() and ip_warn(). Fix a bug in the latter where the upper bound of an IP range didn't take the RFC 3779 encoding into account and passed the address directly to inet_pton() rather than filling the missing bits with 1. Switch the argument order to match the warnings and tweak some warning messages. ok claudio job
Revision 1.31 / (download) - annotate - [select for diffs], Wed Oct 18 07:10:24 2023 UTC (7 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.30: +4 -4 lines
Diff to previous 1.30 (colored)
rpki-client: move inherit in {ip,as}_warn()
While alphabetic order makes sense, having inherit between individual
AS and IP entries and ranges makes little sense. Use the order that we
have elsewhere.
ok claudio job
Revision 1.30 / (download) - annotate - [select for diffs], Wed Oct 18 07:08:19 2023 UTC (7 months, 3 weeks ago) by tb
Branch: MAIN
Changes since 1.29: +13 -28 lines
Diff to previous 1.29 (colored)
rpki-client: rework ip_addr_check_overlap() Avoid conditional early returns and significantly simplify the printing of ip addresses/ranges by using the new ip_warn(). This also eliminates an extremely weird usage of the comma operator and reduces noise levels quite a bit. ok claudio job
Revision 1.29 / (download) - annotate - [select for diffs], Fri Oct 13 12:06:49 2023 UTC (7 months, 3 weeks ago) by job
Branch: MAIN
Changes since 1.28: +29 -2 lines
Diff to previous 1.28 (colored)
Allow imposing constraints on RPKI trust anchors The ability to constrain a RPKI Trust Anchor's effective signing authority to a limited set of Internet Number Resources allows Relying Parties to enjoy the potential benefits of assuming trust, within a bounded scope. Some examples: ARIN does not support inter-RIR IPv6 transfers, so it wouldn't make any sense to see a ROA subordinate to ARIN's trust anchor covering RIPE-managed IPv6 space. Conversely, it wouldn't make sense to observe a ROA covering ARIN-managed IPv6 space under APNIC's, LACNIC's, or RIPE's trust anchor - even if a derived trust arc (a cryptographically valid certificate path) existed. Along these same lines, AFRINIC doesn't support inter-RIR transfers of any kind, and none of the RIRs have authority over private resources like 10.0.0.0/8 and 2001:db8::/32. For more background see: https://datatracker.ietf.org/doc/draft-snijders-constraining-rpki-trust-anchors/ https://mailman.nanog.org/pipermail/nanog/2023-September/223354.html With and OK tb@, OK claudio@
Revision 1.28 / (download) - annotate - [select for diffs], Mon Sep 25 08:48:14 2023 UTC (8 months, 2 weeks ago) by job
Branch: MAIN
CVS Tags: OPENBSD_7_4_BASE,
OPENBSD_7_4
Changes since 1.27: +33 -1 lines
Diff to previous 1.27 (colored)
Introduce ip_addr_range_print() to avoid code repetition OK tb@
Revision 1.27 / (download) - annotate - [select for diffs], Tue Nov 29 20:41:32 2022 UTC (18 months, 1 week ago) by job
Branch: MAIN
CVS Tags: OPENBSD_7_3_BASE,
OPENBSD_7_3
Changes since 1.26: +1 -2 lines
Diff to previous 1.26 (colored)
Only include stdarg.h, if we call any of va_{start,end}()
OK tb@
Revision 1.26 / (download) - annotate - [select for diffs], Tue Nov 29 20:26:22 2022 UTC (18 months, 1 week ago) by job
Branch: MAIN
Changes since 1.25: +1 -2 lines
Diff to previous 1.25 (colored)
Only include assert.h if we call assert() OK tb@
Revision 1.25 / (download) - annotate - [select for diffs], Sun May 15 16:43:34 2022 UTC (2 years ago) by tb
Branch: MAIN
CVS Tags: OPENBSD_7_2_BASE,
OPENBSD_7_2
Changes since 1.24: +2 -2 lines
Diff to previous 1.24 (colored)
More KNF and whitespace fixes.
Revision 1.24 / (download) - annotate - [select for diffs], Sun May 15 15:00:53 2022 UTC (2 years ago) by deraadt
Branch: MAIN
Changes since 1.23: +2 -2 lines
Diff to previous 1.23 (colored)
whitespace spotted during read-thru
Revision 1.23 / (download) - annotate - [select for diffs], Fri May 13 06:18:21 2022 UTC (2 years ago) by tb
Branch: MAIN
Changes since 1.22: +3 -11 lines
Diff to previous 1.22 (colored)
Fix unused bits handling for ip addresses If ASN1_STRING_FLAG_BITS_LEFT is set, only the lower three bits of the flags represent the unused bits. Other flags have nothing to with lengths, so stop interpreting them as such and throwing strange errors. ok claudio
Revision 1.22 / (download) - annotate - [select for diffs], Wed May 11 18:48:35 2022 UTC (2 years ago) by tb
Branch: MAIN
Changes since 1.21: +2 -2 lines
Diff to previous 1.21 (colored)
Zap stray space
Revision 1.21 / (download) - annotate - [select for diffs], Sun Dec 26 12:32:28 2021 UTC (2 years, 5 months ago) by tb
Branch: MAIN
CVS Tags: OPENBSD_7_1_BASE,
OPENBSD_7_1
Changes since 1.20: +3 -3 lines
Diff to previous 1.20 (colored)
fix spelling of inheritance
Revision 1.20 / (download) - annotate - [select for diffs], Wed Nov 10 09:15:29 2021 UTC (2 years, 6 months ago) by claudio
Branch: MAIN
Changes since 1.19: +19 -40 lines
Diff to previous 1.19 (colored)
Collaps the AFI specific IP print functions into ip_addr_print() their only difference was the buffersize and AF argument to inet_ntop. Use INET6_ADDRSTRLEN as the buffer size and convert the AFI to AF in a switch statement. OK denis@ kn@ deraadt@
Revision 1.16.2.1 / (download) - annotate - [select for diffs], Tue Nov 9 13:41:19 2021 UTC (2 years, 6 months ago) by benno
Branch: OPENBSD_6_9
Changes since 1.16: +3 -54 lines
Diff to previous 1.16 (colored) next main 1.17 (colored)
rpki-client(8) should handle CA misbehaviours as soft-errors. This is a merge of usr.sbin/rpki-client and usr.bin/rsync from current and includes all commits in rpki-client 7.5 up to Tue Nov 9 11:03:40 2021 and to openrsync up to Wed Nov 3 14:42:13 2021, including: * Make rpki-client more resilient regarding untrusted input: - fail repository synchronisation after 15min runtime - limit the number of publication points per TAL - don't allow DOCTYPE definitions in RRDP XML files - fix detection of HTTP redirect loops. * limit the number of concurrent rsync processes. * fix CRLF in tal files. This is patches/6.9/common/021_rpki.patch.sig
Revision 1.17.4.1 / (download) - annotate - [select for diffs], Tue Nov 9 13:40:32 2021 UTC (2 years, 6 months ago) by benno
Branch: OPENBSD_7_0
Changes since 1.17: +1 -53 lines
Diff to previous 1.17 (colored) next main 1.18 (colored)
rpki-client(8) should handle CA misbehaviours as soft-errors. This is a merge of usr.sbin/rpki-client and usr.bin/rsync from current and includes all commits in rpki-client 7.5 up to Tue Nov 9 11:03:40 2021 and to openrsync up to Wed Nov 3 14:42:13 2021, including: * Make rpki-client more resilient regarding untrusted input: - fail repository synchronisation after 15min runtime - limit the number of publication points per TAL - don't allow DOCTYPE definitions in RRDP XML files - fix detection of HTTP redirect loops. * limit the number of concurrent rsync processes. * fix CRLF in tal files. This is patches/7.0/common/004_rpki.patch.sig
Revision 1.19 / (download) - annotate - [select for diffs], Fri Nov 5 10:50:41 2021 UTC (2 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.18: +1 -52 lines
Diff to previous 1.18 (colored)
Simplify how IP addresses and AS numbers are passed between processes. Since they are stored in an array just blast the full array in and out of the io buffers at once instead of iterating element by element. It also allows to remove a lot of extra code. OK benno@ job@
Revision 1.18 / (download) - annotate - [select for diffs], Sat Oct 23 16:06:04 2021 UTC (2 years, 7 months ago) by claudio
Branch: MAIN
Changes since 1.17: +7 -8 lines
Diff to previous 1.17 (colored)
Finnally move away from blocking reads in rpki-client. The code was a mish mash of poll, non-blocking writes and blocking reads. Using the introduced ibuf size header in io_buf_new()/io_buf_close() the read side can be changed to pull in a full ibuf and only start the un-marshal once all data has been read. OK benno@
Revision 1.17 / (download) - annotate - [select for diffs], Mon Apr 19 17:04:35 2021 UTC (3 years, 1 month ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_7_0_BASE
Branch point for: OPENBSD_7_0
Changes since 1.16: +3 -2 lines
Diff to previous 1.16 (colored)
code review results in KNF, and moving local variables into lowest scope ok claudio
Revision 1.16 / (download) - annotate - [select for diffs], Mon Mar 29 06:15:29 2021 UTC (3 years, 2 months ago) by deraadt
Branch: MAIN
CVS Tags: OPENBSD_6_9_BASE
Branch point for: OPENBSD_6_9
Changes since 1.15: +15 -9 lines
Diff to previous 1.15 (colored)
Check all inet_ntop() calls, in case we screw up the parameters somehow we prefer a failure rather than some sort of weird truncation ok claudio
Revision 1.15 / (download) - annotate - [select for diffs], Mon Mar 29 03:35:32 2021 UTC (3 years, 2 months ago) by deraadt
Branch: MAIN
Changes since 1.14: +10 -4 lines
Diff to previous 1.14 (colored)
3 additional snprintf() range checks (inconceivable these would ever truncate, but if they do, we prefer to know) ok job claudio
Revision 1.14 / (download) - annotate - [select for diffs], Fri Jan 8 08:09:07 2021 UTC (3 years, 5 months ago) by claudio
Branch: MAIN
Changes since 1.13: +7 -9 lines
Diff to previous 1.13 (colored)
Start using the ibuf API (ibuf_dynamic, ibuf_add, ibuf_close) for writing data between processes. This completely decouples the write side. rpki-client can't really use the imsg framework but it can use the ibuf bits wich imsg is built on. OK benno@ job@
Revision 1.13 / (download) - annotate - [select for diffs], Sat Sep 12 15:46:48 2020 UTC (3 years, 8 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_8_BASE,
OPENBSD_6_8
Changes since 1.12: +1 -3 lines
Diff to previous 1.12 (colored)
Include openssl/x509.h in extern.h since it uses a few of the typedefs from there in structs and prototypes. Remove the openssl/ssl.h and other strange openssl includes in the .c files that don't use openssl specific functions. OK beck@ and tb@
Revision 1.12 / (download) - annotate - [select for diffs], Thu Apr 16 14:39:44 2020 UTC (4 years, 1 month ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_7_BASE,
OPENBSD_6_7
Changes since 1.11: +4 -5 lines
Diff to previous 1.11 (colored)
It is unclear why data is memcpy-ed into a char buf[2] that is used as argument to ntohs(). Just memcpy to a uint16_t value and ntohs this value. Fixes possible alignment issues as reported by newer gcc compilers. OK beck@
Revision 1.11 / (download) - annotate - [select for diffs], Thu Apr 16 11:27:49 2020 UTC (4 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.10: +4 -3 lines
Diff to previous 1.10 (colored)
Revert last commit, this file slipped in.
Revision 1.10 / (download) - annotate - [select for diffs], Thu Apr 16 11:25:43 2020 UTC (4 years, 1 month ago) by claudio
Branch: MAIN
Changes since 1.9: +4 -5 lines
Diff to previous 1.9 (colored)
Replace deprecated ERR_remove_state(0) with ERR_remove_thread_state(NULL); OK tb@
Revision 1.9 / (download) - annotate - [select for diffs], Wed Nov 27 17:18:24 2019 UTC (4 years, 6 months ago) by deraadt
Branch: MAIN
Changes since 1.8: +2 -2 lines
Diff to previous 1.8 (colored)
swap some comparisons
Revision 1.8 / (download) - annotate - [select for diffs], Thu Oct 3 07:55:34 2019 UTC (4 years, 8 months ago) by claudio
Branch: MAIN
CVS Tags: OPENBSD_6_6_BASE,
OPENBSD_6_6
Changes since 1.7: +2 -1 lines
Diff to previous 1.7 (colored)
memset struct ip_addr before assigning values to it. in the IPv4 case 12 bytes of the struct were not touched and left uninitialized which is not the idea. Diff from Alexandre Hamada (hamada at registro dot br)
Revision 1.7 / (download) - annotate - [select for diffs], Thu Jun 20 13:43:10 2019 UTC (4 years, 11 months ago) by claudio
Branch: MAIN
Changes since 1.6: +6 -2 lines
Diff to previous 1.6 (colored)
If the ASN1_BIT_STRING has a length of 0 the unused bit count must be 0. Check this and also adjust the upper limit check to >= 8 since only the values 0 - 7 are valid. Found by jsg@ with afl. OK deraadt@
Revision 1.6 / (download) - annotate - [select for diffs], Wed Jun 19 16:30:37 2019 UTC (4 years, 11 months ago) by deraadt
Branch: MAIN
Changes since 1.5: +1 -1 lines
Diff to previous 1.5 (colored)
use $OpenBSD$ headers
Revision 1.5 / (download) - annotate - [select for diffs], Wed Jun 19 15:47:34 2019 UTC (4 years, 11 months ago) by claudio
Branch: MAIN
Changes since 1.4: +48 -98 lines
Diff to previous 1.4 (colored)
Instead of the strange ASN.1 encoding of IP addresses with a size in bytes and a count of how many bits of the last byte are unused switch to a much more normal prefixlen in bits encoding for internal use. This makes the code easier to understand. Also switch to inet_ntop() for converting a struct ip_addr into a string. OK job@
Revision 1.4 / (download) - annotate - [select for diffs], Wed Jun 19 04:21:43 2019 UTC (4 years, 11 months ago) by deraadt
Branch: MAIN
Changes since 1.3: +29 -31 lines
Diff to previous 1.3 (colored)
indentation adjustments, in particular near warn statements ok claudio
Revision 1.3 / (download) - annotate - [select for diffs], Mon Jun 17 15:08:08 2019 UTC (4 years, 11 months ago) by deraadt
Branch: MAIN
Changes since 1.2: +2 -2 lines
Diff to previous 1.2 (colored)
system includes first, always.
Revision 1.2 / (download) - annotate - [select for diffs], Mon Jun 17 15:04:59 2019 UTC (4 years, 11 months ago) by deraadt
Branch: MAIN
Changes since 1.1: +1 -2 lines
Diff to previous 1.1 (colored)
Don't do -portable in base. It is better done outside the tree. Imagine if we did it throughout the tree, how many copies of strlcpy would we have, and how much time would all the configure shell scripts and includes take? It would be ludicrous.
Revision 1.1.1.1 / (download) - annotate - [select for diffs] (vendor branch), Mon Jun 17 14:31:30 2019 UTC (4 years, 11 months ago) by job
Branch: job
CVS Tags: job_20190617
Changes since 1.1: +0 -0 lines
Diff to previous 1.1 (colored)
Import Kristaps Dzonsons' RPKI validator into the tree rpki-client(1) is an implementation of the Resource Public Key Infrastructure (RPKI), specified by RFC 6480. The client is responsible for downloading, validating and converting Route Origin Authorisations (ROAs) into Validated ROA Payloads (VRPs). The client's output (VRPs) can be used by bgpd(8) to perform BGP Origin Validation (RFC 6811). The current rpki-client(1) version depends on the CMS functions in OpenSSL, this of course needs to be addressed urgently. Thanks to NetNod, IIS.SE, SUNET & 6connect for supporting this effort! OK deraadt@
Revision 1.1 / (download) - annotate - [select for diffs], Mon Jun 17 14:31:30 2019 UTC (4 years, 11 months ago) by job
Branch: MAIN
Initial revision