summaryrefslogtreecommitdiff
path: root/usr.sbin/rpki-client
AgeCommit message (Collapse)Author
2022-12-15Rework statistic collection to be per repository and add metric output optionClaudio Jeker
Many statistic values are now accounted by repository via repo_stat_inc() At end of the run sum_stats() accumulates these stats per TAL and globally. The new output file metrics is written when the -m output flag is specified. The metrics file is written in OpenMetrics format (with a few tweaks to allow node_exporter to parse the file as well). The ometric code is a copy from bgpctl(8) and should be kept in sync. OK tb@
2022-12-14Optimize io_buf_read() a bit by calling read() again after the initalClaudio Jeker
header of the buf was read. This often saves a round-trip to the main event loop and poll(2). OK job@ tb@
2022-12-14Always initialize b64szJob Snijders
OK tb@
2022-12-14Switch to struct timespec for collecting stats. This allows to useClaudio Jeker
clock_gettime(CLOCK_MONOTONIC) for runtime calculation. OK tb@
2022-12-14Print expiry moment in human-readable filemode in a consistent fashion ↵Job Snijders
across all object types OK claudio@ tb@
2022-12-14Print issuer & serial in filemodeJob Snijders
OK tb@
2022-12-05Prep for rpki-client 8.2Claudio Jeker
2022-12-01Align uppercase / lowercase patternJob Snijders
2022-12-01Adjust comment for rtype_from_mftfile(). It is important that RTYPE_INVALIDClaudio Jeker
is not an error. It marks file as not handled by rpki-client and they will be ignored after checking that the provided hash matches. New file types should only be added once the needed code in parse_entity() is available. OK tb@ job@
2022-11-30Remove unused includesJob Snijders
OK claudio@
2022-11-30Remove unused includesJob Snijders
OK claudio@
2022-11-30Remove unused includeJob Snijders
OK claudio@
2022-11-30Remove unused sys/socket.h includeJob Snijders
OK claudio@
2022-11-30Remove unused ctype.h includeJob Snijders
OK tb@
2022-11-29Only include stdarg.h, if we call any of va_{start,end}()Job Snijders
OK tb@
2022-11-29Only include assert.h if we call assert()Job Snijders
OK tb@
2022-11-29Update valid_x509 comment to reality. crl is no longer optional.Claudio Jeker
OK tb@
2022-11-29Return an error string instead of surpressing the warning in valid_x509.Claudio Jeker
This way manifests can should a better error message when something fails. With and OK tb@
2022-11-28Fix indentTheo Buehler
2022-11-28Reshuffle case a little bit. No functional change.Claudio Jeker
2022-11-28Use ssize_t instead of int as requested on reviewTheo Buehler
discussed with job
2022-11-27BIO_puts return values can be ambiguous, improve the checkJob Snijders
OK tb@
2022-11-26Missing return value check for BIO_new()Theo Buehler
2022-11-26Make error messages about 'inherit' elements in End-Entity certs consistentJob Snijders
OK tb@
2022-11-26Disallow 'inherit' elements in geofeed authenticatorsJob Snijders
RFC 9092 is underspecified in this regard, but other signed objects relating to Internet number resources (ROA, BGPsec, ASPA, RSC) all disallow inherit. See https://mailarchive.ietf.org/arch/msg/opsawg/JXjxCA14BkW4DWyVoUMwqDvB17I/ OK tb@
2022-11-26Fix warning messageJob Snijders
(Geofeed authenticators don't have a SIA)
2022-11-26Two small tweaks to the geofeed codeTheo Buehler
Only allocate b64 when it is needed. This way we can avoid allocating extra memory for the signed data itself. Also, only check for the end signature marker when it is actually expected. It's not forbidden - if stupid - to have a comment '# End Signature:' in the signed data. ok job
2022-11-26Split eContent extration into a small helperTheo Buehler
job didn't like jumping over a bunch of code, so handle this via a small helper. It's not as if cms_parse_validate_internal() could not do with a bit of splitting in general. ok job
2022-11-26Add support for authenticating geofeed data CSV files in filemodeJob Snijders
RFC 9092 describes a scheme in which an authenticator is appended to a geofeed (RFC 8805) file. It is a digest of the main body of the file signed by the private key of the relevant RPKI certificate for a covering address range. The authenticator is a detached CMS signature. with and OK tb@
2022-11-18Move skiplist to main and merge with shortlist.Theo Buehler
With/ok job
2022-11-18zap errant space in usage();Jason McIntyre
2022-11-17Schedule cleanup of '-r' now useless getopt optionJob Snijders
OK tb@
2022-11-17Add shortlist functionality, a compagnion to the skiplistJob Snijders
If the operator specifies the '-H' option once (or more) followed by a FQDN, the utility will *only* connect to those hosts and skip all others. OK claudio@ tb@
2022-11-16Align output to a more tabular viewJob Snijders
OK claudio@
2022-11-10Indicate compliance with work-in-progress spec for ROA objectsJob Snijders
2022-11-09Error out if a ROA payload contains too many ipAddrBlocksJob Snijders
The ASN.1 profile in draft-ietf-sidrops-rfc6482bis section 4 specifies that there must not be more than 2 ipAddrBlocks (one for IPv4, and one for IPv6). Compatible with all published ROAs. OK tb@
2022-11-08stray spaceTheo Buehler
2022-11-07Simplify use of strrchr()Job Snijders
with and OK tb@
2022-11-07Confirm Path Length is absent in the Basic Constraints extensionJob Snijders
OK tb@
2022-11-06Next to signedObject only allow rpkiNotify accessMethodsTheo Buehler
Instead of ignoring all non-signedObject accessMethods, we can be stricter and only allow rpkiNotify (for now) and error on anything else. Also make sure we properly clean up behind ourselves on error. With and ok job
2022-11-04Do not fail on non-rsync URIs in EE cert SIA extensionsTheo Buehler
The spec allows multiple accessMethod entries, ordered by preference. While an rsync URI must be present, others are allowed. Do not fail in that situation and pick the first rsync URI encountered. The logic is very similar to the one in x509_get_crl(). ok job
2022-11-04In very verbose mode, log unexpected accessMethodsTheo Buehler
While RFC 6487, 4.8.2.2 is very explicit about allowing id-ad-signedObject as the only accessMethod, the clear language was lost during the RFC 8182 editing process. APNIC, TWNIC and JPNIC and a few others are currently known to have an id-ad-rpkiNotify. The verbose logging allows us to check the ecosystem while waiting for the point in time where we can turn this into an error. See also https://www.rfc-editor.org/errata/eid7239. ok job
2022-11-04Format filemode output in a tabular fashion to improve readabilityJob Snijders
OK tb@ claudio@
2022-11-04Add missing field initializer.Theo Buehler
ok claudio
2022-11-04whitespaceTheo Buehler
2022-11-04Catch bad characters in rpkiManifest filenames earlier onJob Snijders
This improves the hard-to-read error: rpki-client: .rrdp/59B96A4C078FDCEDBB776D5BE8DF45EAC0149157547270EA7D4647A76611E145/rpki-rsync.us-east-2.amazonaws.com/volume/220c3ec2-ccf9-4b8a-bf61-fd4d1e151271/LAXNBPgDnLLjagP8++RFIoaMCGo.mft: RFC 6487 section 4.8.6: CRL: bad CRL distribution point extension rpki-client: rpki-rsync.us-east-2.amazonaws.com/volume/220c3ec2-ccf9-4b8a-bf61-fd4d1e151271/LAXNBPgDnLLjagP8++RFIoaMCGo.mft: no valid mft available to: rpki-client: rpki.ripe.net/repository/DEFAULT/ZMvVW3ZpjFaCVe2TtDEqMlyFk3E.cer: SIA: rpkiManifest filename contains invalid characters OK tb@
2022-11-04Don't show CPS URIs when in filemodeJob Snijders
OK tb@
2022-11-04Check the SIA signedObject in ROA/MFT/ASPA/TAK/GBR EE certificatesJob Snijders
Unfortunately we can't yet error out when accessMethods other than signedObject are encountered in the SubjectInformationAccess extension because there is pollution in the ecosystem. OK tb@
2022-11-03don't needlessy uppercase Nd;Jason McIntyre
2022-11-03Constrain KeyUsage and ExtendedKeyUsage on both CA & EE certificatesJob Snijders
RFC 6487 section 4.8.4 restricts the KeyUsage extension on EE certificates to only be digitalSignature. RFC 6487 section 4.8.5 forbids the ExtendedKeyUsage extension from appearing on CA certificates. However, this may change in the future through the standardisation process. OK tb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 02:44:15 +0000