rpki-client: implement filemode CMS prober using CBS
This removes the last use of the garbage libcrypto CMS API in rpki-client.
Good riddance.
ok beck claudio job
rpki-client: accept indefinite lengths in filemode
ARIN special. In filemode re-encode the "der" buffer into definite
length encoding. The DER parser can then deserialize the signed
object. This miraculously works because of the way CMS signatures
are computed: signedAttrs MUST be DER encoded (per RFC 5652, 5.3)
and the value octets of the eContent do not use the invalid encoding
(but its length octets do!). The signature and the message-digest
attribute therefore check out despite this modification.
I say "miraculous" above because this is partly because of how CMS
works, but ARIN could also have used BER encoding for the eContent,
breaking this hack. Rumor has it that there used to be a CA out
there that used to use constructed encoding for octet strings.
This unbreaks regress after the previous commit.
ok and "oh dear god" beck
ok claudio job
rpki-client: implement a CBS-based RFC 6488 parser
This commit gets rid of the use of the crazy CMS API from libcrypto
in normal mode, replacing it with CBS-based parsing code written from
scratch. This only adds about 300 simple lines of code (according to
cloc) to cms.c. A big part of the additions are copious comments.
This ensures that whatever is parsed is properly DER encoded.
One approach of fixing regress and enabling history spelunking
is in the follow-up commit.
The parser is essentially zero-copy with the following exceptions:
- deserialization of the EE cert
- signature validation needs some contortions because CMS is weird
- parsing of signing-time
Since we now get our hands on the raw cert DER, cert_parse_ee_cert()
can be like the other cert parsing functions (except for the talid).
This passes the fixture test and the one remaining TODO item is error
[3 lines not shown]
rpki-client: use expire time of the signature path for BRKs
Previously, the expire time in the BRK tree was simply the notAfter in
the BGPsec Router cert. This diff pushes the expire time for all certs
to the main process and switches to using the signature path to compute
the expire time. This way BRKs are treated the same way as VRPs and VAPs
and will probably expire in the next hours up to a week rather than
months from now.
This also makes the data pushed to rtrd and stored in the json output
match what file mode has reported since forever. Since we're still at
exactly two BRKs in the entire RPKI it does not currently matter much.
ok job rcovelli
Rename variable names for consistency
mechnical changes: ncas to ca_tree, ncas_hist to nca_hist_tree, tree to
ca_tree, and needle to nca_hist_needle.
OK tb@
For any binary linked against libc, compare the file setuid/setgid bits
against the internal global variable _permit_setugid.
If either bit is set in the file mode, but the same bit is not set in
the variable, generate a syslog message, output the same to stderr.
It looks like this: /usr/bin/x: not supposed to be setuid, aborting
It does not abort yet because some packages need the correct variable
to be added. Soon, soon, soon...
AuxInfo[ELF_AUX_ENTRIES] is filled based upon a collection of MI and
MD enums. Addition of a new auxval without increasing ELF_AUX_ENTRIES
happened twice to me, and the failure mode is way too subtle. Add
KASSERT() for every enum storage into the array, which the compiler
completely eliminates if it notices the number of array stores is
<= the array size.
ok kettenis
