summaryrefslogtreecommitdiff
path: root/usr.sbin
diff options
context:
space:
mode:
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/rpki-client/aspa.c12
-rw-r--r--usr.sbin/rpki-client/cert.c4
-rw-r--r--usr.sbin/rpki-client/extern.h10
-rw-r--r--usr.sbin/rpki-client/gbr.c12
-rw-r--r--usr.sbin/rpki-client/geofeed.c12
-rw-r--r--usr.sbin/rpki-client/print.c28
-rw-r--r--usr.sbin/rpki-client/roa.c12
-rw-r--r--usr.sbin/rpki-client/rsc.c14
-rw-r--r--usr.sbin/rpki-client/tak.c12
-rw-r--r--usr.sbin/rpki-client/x509.c22
10 files changed, 78 insertions, 60 deletions
diff --git a/usr.sbin/rpki-client/aspa.c b/usr.sbin/rpki-client/aspa.c
index dc197d9e844..827a69d8604 100644
--- a/usr.sbin/rpki-client/aspa.c
+++ b/usr.sbin/rpki-client/aspa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: aspa.c,v 1.12 2023/03/09 09:46:21 job Exp $ */
+/* $OpenBSD: aspa.c,v 1.13 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Job Snijders <job@fastly.com>
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -188,7 +188,6 @@ aspa_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
struct parse p;
size_t cmsz;
unsigned char *cms;
- const ASN1_TIME *at;
struct cert *cert = NULL;
time_t signtime;
int rc = 0;
@@ -226,15 +225,10 @@ aspa_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
goto out;
}
- at = X509_get0_notAfter(*x509);
- if (at == NULL) {
- warnx("%s: X509_get0_notAfter failed", fn);
+ if (!x509_get_notbefore(*x509, fn, &p.res->notbefore))
goto out;
- }
- if (!x509_get_time(at, &p.res->expires)) {
- warnx("%s: ASN1_time_parse failed", fn);
+ if (!x509_get_expire(*x509, fn, &p.res->expires))
goto out;
- }
if (x509_any_inherits(*x509)) {
warnx("%s: inherit elements not allowed in EE cert", fn);
diff --git a/usr.sbin/rpki-client/cert.c b/usr.sbin/rpki-client/cert.c
index 540e2b338e4..cff5af4ad0d 100644
--- a/usr.sbin/rpki-client/cert.c
+++ b/usr.sbin/rpki-client/cert.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cert.c,v 1.104 2023/03/06 16:58:41 job Exp $ */
+/* $OpenBSD: cert.c,v 1.105 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
* Copyright (c) 2021 Job Snijders <job@openbsd.org>
@@ -756,6 +756,8 @@ cert_parse_pre(const char *fn, const unsigned char *der, size_t len)
goto out;
if (!x509_get_crl(x, p.fn, &p.res->crl))
goto out;
+ if (!x509_get_notbefore(x, p.fn, &p.res->notbefore))
+ goto out;
if (!x509_get_expire(x, p.fn, &p.res->expires))
goto out;
p.res->purpose = x509_get_purpose(x, p.fn);
diff --git a/usr.sbin/rpki-client/extern.h b/usr.sbin/rpki-client/extern.h
index 2da10aeb394..6b7e39f76c6 100644
--- a/usr.sbin/rpki-client/extern.h
+++ b/usr.sbin/rpki-client/extern.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: extern.h,v 1.170 2023/03/09 12:54:28 job Exp $ */
+/* $OpenBSD: extern.h,v 1.171 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
*
@@ -139,6 +139,7 @@ struct cert {
enum cert_purpose purpose; /* BGPSec or CA */
char *pubkey; /* Subject Public Key Info */
X509 *x509; /* the cert */
+ time_t notbefore; /* cert's Not Before */
time_t expires; /* do not use after */
};
@@ -245,6 +246,7 @@ struct roa {
char *sia; /* SIA signedObject */
char *ski; /* SKI */
time_t signtime; /* CMS signing-time attribute */
+ time_t notbefore; /* EE cert's Not Before */
time_t expires; /* do not use after */
};
@@ -269,6 +271,7 @@ struct rsc {
char *aki; /* AKI */
char *ski; /* SKI */
time_t signtime; /* CMS signing-time attribute */
+ time_t notbefore; /* EE cert's Not Before */
time_t expires; /* Not After of the RSC EE */
};
@@ -298,6 +301,7 @@ struct tak {
char *sia; /* SIA signed Object */
char *ski; /* SKI */
time_t signtime; /* CMS signing-time attribute */
+ time_t notbefore; /* EE cert's Not Before */
time_t expires; /* Not After of the TAK EE */
};
@@ -319,6 +323,7 @@ struct geofeed {
char *aki; /* AKI */
char *ski; /* SKI */
time_t signtime; /* CMS signing-time attribute */
+ time_t notbefore; /* EE cert's Not Before */
time_t expires; /* Not After of the Geofeed EE */
int valid; /* all resources covered */
};
@@ -333,6 +338,7 @@ struct gbr {
char *sia; /* SIA signedObject */
char *ski; /* SKI */
time_t signtime; /* CMS signing-time attribute */
+ time_t notbefore; /* EE cert's Not Before */
time_t expires; /* Not After of the GBR EE */
};
@@ -355,6 +361,7 @@ struct aspa {
struct aspa_provider *providers; /* the providers */
size_t providersz; /* number of providers */
time_t signtime; /* CMS signing-time attribute */
+ time_t notbefore; /* EE cert's Not Before */
time_t expires; /* NotAfter of the ASPA EE cert */
};
@@ -806,6 +813,7 @@ int x509_get_aia(X509 *, const char *, char **);
int x509_get_aki(X509 *, const char *, char **);
int x509_get_sia(X509 *, const char *, char **);
int x509_get_ski(X509 *, const char *, char **);
+int x509_get_notbefore(X509 *, const char *, time_t *);
int x509_get_expire(X509 *, const char *, time_t *);
int x509_get_crl(X509 *, const char *, char **);
char *x509_crl_get_aki(X509_CRL *, const char *);
diff --git a/usr.sbin/rpki-client/gbr.c b/usr.sbin/rpki-client/gbr.c
index 4062f513fbc..9b1e1b699c4 100644
--- a/usr.sbin/rpki-client/gbr.c
+++ b/usr.sbin/rpki-client/gbr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gbr.c,v 1.23 2023/03/09 18:53:24 tb Exp $ */
+/* $OpenBSD: gbr.c,v 1.24 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
*
@@ -46,7 +46,6 @@ gbr_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
size_t cmsz;
unsigned char *cms;
time_t signtime;
- const ASN1_TIME *at;
memset(&p, 0, sizeof(struct parse));
p.fn = fn;
@@ -77,15 +76,10 @@ gbr_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
goto out;
}
- at = X509_get0_notAfter(*x509);
- if (at == NULL) {
- warnx("%s: X509_get0_notAfter failed", fn);
+ if (!x509_get_notbefore(*x509, fn, &p.res->notbefore))
goto out;
- }
- if (!x509_get_time(at, &p.res->expires)) {
- warnx("%s: ASN1_time_parse failed", fn);
+ if (!x509_get_expire(*x509, fn, &p.res->expires))
goto out;
- }
if (!x509_inherits(*x509)) {
warnx("%s: RFC 3779 extension not set to inherit", fn);
diff --git a/usr.sbin/rpki-client/geofeed.c b/usr.sbin/rpki-client/geofeed.c
index 452b3f72f30..87aed15af2a 100644
--- a/usr.sbin/rpki-client/geofeed.c
+++ b/usr.sbin/rpki-client/geofeed.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: geofeed.c,v 1.11 2023/03/09 09:46:21 job Exp $ */
+/* $OpenBSD: geofeed.c,v 1.12 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Job Snijders <job@fastly.com>
* Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -110,7 +110,6 @@ geofeed_parse(X509 **x509, const char *fn, char *buf, size_t len)
size_t b64sz = 0;
unsigned char *der = NULL;
size_t dersz;
- const ASN1_TIME *at;
struct cert *cert = NULL;
int rpki_signature_seen = 0, end_signature_seen = 0;
int rc = 0;
@@ -248,15 +247,10 @@ geofeed_parse(X509 **x509, const char *fn, char *buf, size_t len)
goto out;
}
- at = X509_get0_notAfter(*x509);
- if (at == NULL) {
- warnx("%s: X509_get0_notAfter failed", fn);
+ if (!x509_get_notbefore(*x509, fn, &p.res->notbefore))
goto out;
- }
- if (!x509_get_time(at, &p.res->expires)) {
- warnx("%s: ASN1_time_parse failed", fn);
+ if (!x509_get_expire(*x509, fn, &p.res->expires))
goto out;
- }
if ((cert = cert_parse_ee_cert(fn, *x509)) == NULL)
goto out;
diff --git a/usr.sbin/rpki-client/print.c b/usr.sbin/rpki-client/print.c
index aa47d4bfadf..ad5901cb4cd 100644
--- a/usr.sbin/rpki-client/print.c
+++ b/usr.sbin/rpki-client/print.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: print.c,v 1.29 2023/03/09 12:54:28 job Exp $ */
+/* $OpenBSD: print.c,v 1.30 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -182,6 +182,7 @@ cert_print(const struct cert *p)
printf("\t\"notify_url\": \"%s\",\n", p->notify);
if (p->pubkey != NULL)
printf("\t\"router_key\": \"%s\",\n", p->pubkey);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
printf("\t\"subordinate_resources\": [\n");
} else {
@@ -201,11 +202,16 @@ cert_print(const struct cert *p)
if (p->pubkey != NULL) {
printf("BGPsec ECDSA public key: %s\n",
p->pubkey);
+ printf("Router key valid since: %s\n",
+ time2str(p->notbefore));
printf("Router key valid until: %s\n",
time2str(p->expires));
- } else
+ } else {
+ printf("Certificate valid since: %s\n",
+ time2str(p->notbefore));
printf("Certificate valid until: %s\n",
time2str(p->expires));
+ }
printf("Subordinate resources: ");
}
@@ -443,6 +449,7 @@ roa_print(const X509 *x, const struct roa *p)
if (p->signtime != 0)
printf("\t\"signing_time\": %lld,\n",
(long long)p->signtime);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
} else {
printf("Subject key identifier: %s\n", pretty_key_id(p->ski));
@@ -453,6 +460,8 @@ roa_print(const X509 *x, const struct roa *p)
if (p->signtime != 0)
printf("Signing time: %s\n",
time2str(p->signtime));
+ printf("ROA valid since: %s\n",
+ time2str(p->notbefore));
printf("ROA valid until: %s\n", time2str(p->expires));
printf("asID: %u\n", p->asid);
printf("IP address blocks: ");
@@ -498,6 +507,7 @@ gbr_print(const X509 *x, const struct gbr *p)
if (p->signtime != 0)
printf("\t\"signing_time\": %lld,\n",
(long long)p->signtime);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
printf("\t\"vcard\": \"");
for (i = 0; i < strlen(p->vcard); i++) {
@@ -520,6 +530,8 @@ gbr_print(const X509 *x, const struct gbr *p)
if (p->signtime != 0)
printf("Signing time: %s\n",
time2str(p->signtime));
+ printf("GBR valid since: %s\n",
+ time2str(p->notbefore));
printf("GBR valid until: %s\n", time2str(p->expires));
printf("vcard:\n%s", p->vcard);
}
@@ -541,6 +553,7 @@ rsc_print(const X509 *x, const struct rsc *p)
if (p->signtime != 0)
printf("\t\"signing_time\": %lld,\n",
(long long)p->signtime);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
printf("\t\"signed_with_resources\": [\n");
} else {
@@ -551,6 +564,8 @@ rsc_print(const X509 *x, const struct rsc *p)
if (p->signtime != 0)
printf("Signing time: %s\n",
time2str(p->signtime));
+ printf("RSC valid since: %s\n",
+ time2str(p->notbefore));
printf("RSC valid until: %s\n", time2str(p->expires));
printf("Signed with resources: ");
}
@@ -673,6 +688,7 @@ aspa_print(const X509 *x, const struct aspa *p)
if (p->signtime != 0)
printf("\t\"signing_time\": %lld,\n",
(long long)p->signtime);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
printf("\t\"customer_asid\": %u,\n", p->custasid);
printf("\t\"provider_set\": [\n");
@@ -697,6 +713,8 @@ aspa_print(const X509 *x, const struct aspa *p)
if (p->signtime != 0)
printf("Signing time: %s\n",
time2str(p->signtime));
+ printf("ASPA valid since: %s\n",
+ time2str(p->notbefore));
printf("ASPA valid until: %s\n", time2str(p->expires));
printf("Customer AS: %u\n", p->custasid);
printf("Provider Set: ");
@@ -784,6 +802,7 @@ tak_print(const X509 *x, const struct tak *p)
if (p->signtime != 0)
printf("\t\"signing_time\": %lld,\n",
(long long)p->signtime);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
printf("\t\"takeys\": [\n");
} else {
@@ -795,6 +814,8 @@ tak_print(const X509 *x, const struct tak *p)
if (p->signtime != 0)
printf("Signing time: %s\n",
time2str(p->signtime));
+ printf("TAK valid since: %s\n",
+ time2str(p->notbefore));
printf("TAK valid until: %s\n", time2str(p->expires));
}
@@ -831,6 +852,7 @@ geofeed_print(const X509 *x, const struct geofeed *p)
if (p->signtime != 0)
printf("\t\"signing_time\": %lld,\n",
(long long)p->signtime);
+ printf("\t\"valid_since\": %lld,\n", (long long)p->notbefore);
printf("\t\"valid_until\": %lld,\n", (long long)p->expires);
printf("\t\"records\": [\n");
} else {
@@ -841,6 +863,8 @@ geofeed_print(const X509 *x, const struct geofeed *p)
if (p->signtime != 0)
printf("Signing time: %s\n",
time2str(p->signtime));
+ printf("Geofeed valid since: %s\n",
+ time2str(p->notbefore));
printf("Geofeed valid until: %s\n", time2str(p->expires));
printf("Geofeed CSV records:\n");
}
diff --git a/usr.sbin/rpki-client/roa.c b/usr.sbin/rpki-client/roa.c
index e53e995e45c..0c814e99729 100644
--- a/usr.sbin/rpki-client/roa.c
+++ b/usr.sbin/rpki-client/roa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: roa.c,v 1.61 2023/03/09 18:53:24 tb Exp $ */
+/* $OpenBSD: roa.c,v 1.62 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
* Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -211,7 +211,6 @@ roa_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
struct parse p;
size_t cmsz;
unsigned char *cms;
- const ASN1_TIME *at;
struct cert *cert = NULL;
time_t signtime;
int rc = 0;
@@ -242,15 +241,10 @@ roa_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
goto out;
}
- at = X509_get0_notAfter(*x509);
- if (at == NULL) {
- warnx("%s: X509_get0_notAfter failed", fn);
+ if (!x509_get_notbefore(*x509, fn, &p.res->notbefore))
goto out;
- }
- if (!x509_get_time(at, &p.res->expires)) {
- warnx("%s: ASN1_time_parse failed", fn);
+ if (!x509_get_expire(*x509, fn, &p.res->expires))
goto out;
- }
if (!roa_parse_econtent(cms, cmsz, &p))
goto out;
diff --git a/usr.sbin/rpki-client/rsc.c b/usr.sbin/rpki-client/rsc.c
index 0250d2e429d..cd5a17aa1da 100644
--- a/usr.sbin/rpki-client/rsc.c
+++ b/usr.sbin/rpki-client/rsc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsc.c,v 1.21 2023/03/09 15:40:41 job Exp $ */
+/* $OpenBSD: rsc.c,v 1.22 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
* Copyright (c) 2022 Job Snijders <job@fastly.com>
@@ -377,7 +377,6 @@ rsc_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
struct parse p;
unsigned char *cms;
size_t cmsz;
- const ASN1_TIME *at;
struct cert *cert = NULL;
time_t signtime;
int rc = 0;
@@ -406,16 +405,11 @@ rsc_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
goto out;
}
- at = X509_get0_notAfter(*x509);
- if (at == NULL) {
- warnx("%s: X509_get0_notAfter failed", fn);
+ if (!x509_get_notbefore(*x509, fn, &p.res->notbefore))
goto out;
- }
- if (!x509_get_time(at, &p.res->expires)) {
- warnx("%s: ASN1_time_parse failed", fn);
+ if (!x509_get_expire(*x509, fn, &p.res->expires))
goto out;
- }
-
+
if (X509_get_ext_by_NID(*x509, NID_sinfo_access, -1) != -1) {
warnx("%s: RSC: EE cert must not have an SIA extension", fn);
goto out;
diff --git a/usr.sbin/rpki-client/tak.c b/usr.sbin/rpki-client/tak.c
index d202fe8f8c5..37e3a049d71 100644
--- a/usr.sbin/rpki-client/tak.c
+++ b/usr.sbin/rpki-client/tak.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tak.c,v 1.5 2023/03/09 18:53:24 tb Exp $ */
+/* $OpenBSD: tak.c,v 1.6 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Job Snijders <job@fastly.com>
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -230,7 +230,6 @@ tak_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
struct parse p;
unsigned char *cms;
size_t cmsz;
- const ASN1_TIME *at;
time_t signtime;
int rc = 0;
@@ -260,15 +259,10 @@ tak_parse(X509 **x509, const char *fn, const unsigned char *der, size_t len)
goto out;
}
- at = X509_get0_notAfter(*x509);
- if (at == NULL) {
- warnx("%s: X509_get0_notAfter failed", fn);
+ if (!x509_get_notbefore(*x509, fn, &p.res->notbefore))
goto out;
- }
- if (!x509_get_time(at, &p.res->expires)) {
- warnx("%s: ASN1_time_parse failed", fn);
+ if (!x509_get_expire(*x509, fn, &p.res->expires))
goto out;
- }
if (!x509_inherits(*x509)) {
warnx("%s: RFC 3779 extension not set to inherit", fn);
diff --git a/usr.sbin/rpki-client/x509.c b/usr.sbin/rpki-client/x509.c
index 433c29455ae..d4930c8a9bc 100644
--- a/usr.sbin/rpki-client/x509.c
+++ b/usr.sbin/rpki-client/x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.c,v 1.66 2023/03/06 21:00:41 job Exp $ */
+/* $OpenBSD: x509.c,v 1.67 2023/03/10 12:02:11 job Exp $ */
/*
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
* Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -486,6 +486,26 @@ x509_get_sia(X509 *x, const char *fn, char **sia)
}
/*
+ * Extract the notBefore of a certificate.
+ */
+int
+x509_get_notbefore(X509 *x, const char *fn, time_t *tt)
+{
+ const ASN1_TIME *at;
+
+ at = X509_get0_notBefore(x);
+ if (at == NULL) {
+ warnx("%s: X509_get0_notBefore failed", fn);
+ return 0;
+ }
+ if (!x509_get_time(at, tt)) {
+ warnx("%s: ASN1_time_parse failed", fn);
+ return 0;
+ }
+ return 1;
+}
+
+/*
* Extract the expire time (not-after) of a certificate.
*/
int