summaryrefslogtreecommitdiff
path: root/usr.sbin/rpki-client/cert.c
AgeCommit message (Collapse)Author
2022-02-04More consistency in the return code docs.Theo Buehler
2022-02-04Document certificate_policies() in a comment.Theo Buehler
2022-02-04Ensure that certificate policies follow RFC 7318Theo Buehler
RFC 7318 makes requirements on the certificate policy extension imposed by RFC 6487 a bit stricter. It requires that exactly one policy OID is present and that it be id-cp-ipAddr-asNumber and if there is a policy qualifier it must be id-qt-cps. These are requirements that the X.509 verifier's policy code can't enforce, so unpack the certificate policy extension by hand and check that it matches expectations. ok claudio
2022-01-20Move the notBefore and notAfter checks from proc_parser_root_cert()Claudio Jeker
to ta_parse(). This fits better there. Also drop extracting and printing the x509 subject of the TAs. The subject is more or less the filename anyway which is already printed. OK tb@
2022-01-18Use X509_get0_pubkey() for opk and remove the EVP_PKEY_free(opk).Claudio Jeker
Suggested by and OK tb@
2022-01-18Change cert_parse() and ta_parse() to no longer take a x509 handle asClaudio Jeker
argument. The x509 cert is also inside struct cert and easy to access. Also switch auth_insert() to a void function since it can't fail. OK tb@
2022-01-18Cleanup the scattered OBJ_txt2obj() calls and move them intoClaudio Jeker
x509_init_oid() to initalize all necessary OID objects at start. OK tb@
2021-12-26fix spelling of inheritanceTheo Buehler
2021-12-26Check ipAddrBlock and autonomousSysNum for criticalityTheo Buehler
These extensions MUST be marked critical. Criticality is determined by the ASN1_BOOLEAN that is extracted and ignored after the FIXME a few lines below each of the two hunks. Rather than getting the info from there, it's easier to use an API call that checks what was already parsed by d2i_X509(). ok claudio job
2021-11-05Simplify how IP addresses and AS numbers are passed between processes.Claudio Jeker
Since they are stored in an array just blast the full array in and out of the io buffers at once instead of iterating element by element. It also allows to remove a lot of extra code. OK benno@ job@
2021-11-04Instead of passing tal descriptions around just pass a tal id andClaudio Jeker
use a small lookup table to print the description in the output path. OK tb@
2021-11-02Only add CA certificates to the auth tree, skip BGPsec certificates.Claudio Jeker
Also make sure that trust anchors are not BGPsec certs. While there fix some overly long lines. OK benno@
2021-11-01Further simplify cert and auth handling. Move common code into auth_insertClaudio Jeker
and skip this distinction between invalid and failed certificates. The difference between the to is getting more and more blurry. OK tb@
2021-10-28Don't exit in certain cases on failures to parse x509 objects.Bob Beck
In most cases we already warn and continue if someone sends us malformed x509 objects. This makes this consistent behaviour in all places so that if someone passes in bogus X509, We end up failing their entry and continuing rather than exiting. We still exit on memory/system failures so that a future run of rpki client can simply do better when the machine is perhaps less hammered on ok job@ claudio@
2021-10-27Add limits on size of certain untrusted inputsBob Beck
ok job@
2021-10-26Also move the cert parser code away from using BIO.Claudio Jeker
OK beck@
2021-10-23Finnally move away from blocking reads in rpki-client. The code was aClaudio Jeker
mish mash of poll, non-blocking writes and blocking reads. Using the introduced ibuf size header in io_buf_new()/io_buf_close() the read side can be changed to pull in a full ibuf and only start the un-marshal once all data has been read. OK benno@
2021-10-15zap 3 commentsJob Snijders
2021-10-12Emit SKI in the JSON output and improve flow in x509_get_pubkey()Job Snijders
OK claudio@
2021-10-11Add support for BGPsec Router Certificates (RFC 8209)Job Snijders
BGPsec router keys are extracted from RPKI certificates and emitted via the JSON output in base64 encoded form. OK tb@ claudio@
2021-10-07Make sure BGPsec router certs don't have a SIAJob Snijders
OK claudio@
2021-10-07Clarify error messageJob Snijders
OK benno@
2021-10-07Add x509_get_expire() to extract the not-after time from a certificateClaudio Jeker
as a epoch time_t. Store the expire time for certs, crls will follow after. OK tb@
2021-10-05Add rudimentary support for BGPsec router certificatesJob Snijders
OK claudio@
2021-09-09Rework how various OIDs are compared in the code.Claudio Jeker
Instead of converting the ASN1_OBJECT into a string and comparing the strings, convert the string into an ASN1_OBJECT once and then compare these objects with OBJ_cmp(). Makes the code a bit easier to read and removes some repetitive conversions. With input and OK tb@
2021-07-13Add more checks for eContent 'version' fields.job
Input from deraadt@, tb@, claudio@ OK deraadt@ claudio@ tb@
2021-05-27Fix more warningsjob
OK tb@
2021-05-27Fix warningjob
OK tb@
2021-03-05Factor out the URI check we do in various places into valid_uri().Claudio Jeker
RRDP will add a bunch more checks so this makes even more sense. With and OK tb@
2021-02-18Use X509_get_ext_d2i() also for x509_get_aki() and x509_get_ski().Claudio Jeker
Now x509_get_extensions() is no longer required to loop over all extensions and the code becomes a lot simpler. While there cleanup x509_get_crl(), as explained by tb@ X509_get_ext_d2i() allocates memory so one needs to free the pointer at the end. For x509_crl_get_aki() use X509_CRL_get_ext_d2i() and more or less copy the rest over from x509_get_aki(). Warn if extensions are missing or present when not expected and also check the the extensions are marked non-critical as required. OK job@ tb@
2021-02-16get Authority Information Access (AIA) from CA & EE certsjob
In the context of the RPKI, the AIA extension identifies the publication point of the certificate of the issuer of the certificate in which the extension appears. A single reference to the publication point of the immediate superior certificate MUST be present, except for a "self-signed" certificate. Thanks tb@ for review OK claudio@
2021-02-08Extract the 1.3.6.1.5.5.7.48.5 (caRepository) SIA from the certificate.Claudio Jeker
Make sure that the caRepository matches the start of the URI of rpkiManifest. The MFT must be a file inside the caRepository. OK tb@
2021-02-04Eventhough most openssl includes include everything try to be a bit moreClaudio Jeker
explicit about what is used where. Seems to be the least worst solution.
2021-01-29A while ago rpki-client was changed to validate the sha256 hashes ofClaudio Jeker
files referenced in MFT files during the validation of the MFT file. An MFT is only valid if all files are present and their hashes are valid. Because of this there is no longer the need to check the hash when these files are parsed later on. Remove these checks for CRT, ROA and CRL files. Use the presence of the pkey when parsing cert files to decide if it is a root cert or not. OK tb@
2021-01-08Start using the ibuf API (ibuf_dynamic, ibuf_add, ibuf_close) for writingClaudio Jeker
data between processes. This completely decouples the write side. rpki-client can't really use the imsg framework but it can use the ibuf bits wich imsg is built on. OK benno@ job@
2020-12-21Now that a NULL string is marshalled as NULL again we can drop someClaudio Jeker
extra has_xyz integers to indicate if the following buffer is present or not. At the same time sprinkle some asserts for strings which must be not NULL. OK tb@
2020-12-07Limit the URL embedded in .cer files to only consist out of isalnum orClaudio Jeker
ispunct characters. Everything else is fishy and so block those early on. OK millert@ job@
2020-10-24Refactor sbgp_sia_resource_mft() similar to sbgp_sia_resource_notify().Claudio Jeker
Instead of rsync_uri_parse() check the start of the uri for rsync:// and also check that the uri ends in .mft. OK tb@
2020-09-12Include openssl/x509.h in extern.h since it uses a few of the typedefs fromClaudio Jeker
there in structs and prototypes. Remove the openssl/ssl.h and other strange openssl includes in the .c files that don't use openssl specific functions. OK beck@ and tb@
2020-07-28One tiny step towards adding RRDP support in rpki-client.Claudio Jeker
Extract the notify URL from the cert if it is available and pass it back to the parent process. The parent process can then use this info to load the repo via RRDP instead of rsync. OK benno@ (some long time ago)
2020-07-27Fix return value check for openssl API. Do not return success if pkey is NULL.tobhe
Feedback and ok cladio@ ok patrick@, tb@
2020-04-02Use fopen() and BIO_new_fd() instead of BIO_new_file so that a possibleClaudio Jeker
open error can be better logged to the operator. The cryptowarnx function logs warnings is a less optimal way (mainly because of OpenSSL error stacks). OK benno@ deraadt@
2020-02-26ugly spaces offended meTheo de Raadt
2019-11-29commited at minus 21 degCSebastian Benoit
s/EXIT_FAILURE/1/ ok claudio@
2019-11-28Convert the auths array into an RB tree indexed by SKI. For fast lookupsClaudio Jeker
the parent auth struct is stored as a pointer so walking up the certificate chain remains simple. Doing this replaces a few slow lookups and speeds up rpki-client by a factor of 2. OK benno@
2019-11-28The root certs do not have a CRL distribution point extension so don'tClaudio Jeker
try to fetch it. OK benno@ (part of a larger diff)
2019-11-28Use x509_get_crl() to get the crl distribution point out of the x509 cert.Claudio Jeker
Simplifies the code a fair bit.
2019-11-28To verify a manifest, a roa, or a certificate, we check its signatureSebastian Benoit
against the CA one layer above it. This check just needs to use the certificate revocation list published by that CA. Instead of loading all CRLs we find into the trust store, we create a STACK_OF(X509_CRL), push the onto it and use it with X509_STORE_CTX_set0_crls(ctx, crls); The x509_get_crl() function to retrieve a crl path from an X509 object is written by claudio@. ok claudio@
2019-11-27Only store ta certs in the trust store and build chains of theSebastian Benoit
intermediate certificates for use in X509_STORE_CTX_init(). To do that save the X509 cert in struct cert. claudio sees > 2x speed increase. ok claudio@ and feedback from jsing@ and beck@.
2019-08-13Show the most common warnings only if verbose is set. Most of these warningsClaudio Jeker
were shown because of an inconsistent rpki database and is no real problem. OK florian@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-27 08:53:50 +0000