relayd: add "glob" and "glob ignorecase" matching keywords
In addition to the recent "pattern", the cookie, header, path, query and url
keys and values now accept "glob" and "glob ignorecase". The keywords can also
be given before "file" and then apply to every key read from it.
Without a keyword the old type defaults stay as they were. Header names are
case-insensitive (RFC 9110), so "glob" on a header name is treated as "glob
ignorecase". The "pattern" stays case-sensitive. The defaults are now clearly
documented.
The parser is stricter now! The following are errors now:
- a matching keyword together with "set" or "append"
- a matching keyword without a key or file, except with "log"
- "file" without a preceding lookup type
- a duplicate lookup type in the same rule
Valid configs keep working, configs that were silently misinterpreted before
are now rejected.
[3 lines not shown]
Remove amountpipekva variable and related computations. This variable used
to matter until rev 1.19 27 years ago, when the "direct write" code was
removed.
rpki-client: drop some redundant parentheses in return statements
Almost all of the code omits them, so be consistent. The remaining
two are special: to_encode() is rather complicated and CBS_strdup()
is upstream code.
ok job
Limit impact of quadratic workload caused by duplicate references from manifests
Jacobsen et al., 2026, and, independently, eur1ka, reported that a set
of colluding CAs could cause significant workload by publishing multiple
manifests which all reference the same set of signed objects inside the
same caRepository.
In practice there should never be more than two manifests in any given
caRepository directory since the norm is that caRepositories are not
shared across CAs. In the normal course of operation two valid manifests
existing in the same repository directory only occurs during a keyroll
(RFC 6489), as is also pointed out in RFC 9286, section 2.
This changeset introduces a limit of 20 manifests per Trust Anchor per
caRepository. If this threshold is exceeded, any newly discovered CAs
pointing into that caRepository are considered bad, discarded, and a
counter is incremented in the OpenMetrics output.
With & OK tb@
signify: check last block size for gzip
The gzip header contains a blocksize extended header. This patch adds the
parsing of an extra lastblocksize header. As the name indicates, this marks
the end of the recorded SHA512/256 blocks and allows checking the size of
the signed data. Once its presence is enforced, this will prevent length
extension attacks. While no such attack for SHA512/256 is known or even
expected to exist, having a tighter form is desirable anyway.
This header not yet emitted and the parser treats it as optional to allow
transitioning. In follow up steps the lastblock will be emitted on signing
and then its presence will be required.
looked over by op
from espie
rpki-client: sync wth libcrypto bytestring.h r1.11
Provide CBS_ASN1_IA5_STRING
This will soon be needed in rpki-client for: fileName in Manifest fileList,
cPSuri in certificate policy qualifiers and uniformResourceIdentifier in
GeneralName, to name a few.
Per X.680, section 41, table 8, the universal class number is 22 == 0x16.
The naming of the constant matches BoringSSL's.
bytestring: provide CBS_ASN1_IA5STRING
This will soon be needed in rpki-client for: fileName in Manifest fileList,
cPSuri in certificate policy qualifiers and uniformResourceIdentifier in
GeneralName, to name a few.
Per X.680, section 41, table 8, the universal class number is 22 == 0x16.
The naming of the constant matches BoringSSL's.
ok kenjiro
nc: do not treat tls_read() failures as fatal with -k
tls_read() can fail because the peer sends a malformed record. If -k is
given, treat the failure gracefully, warn, and allow the caller to free
the failed resources before accepting another connection.
Fixes a bug introduced in r1.203 (Feb 2019)
Simplified version of a diff by Acts1631
ok kenjiro
pw_equal: include the password field in the comparison
This fixes a potential race condition where if the user runs chpass(1)
and suspends it, chpass(1) will update the password hash after the
editor is resumed, even if the password has been changed in the
meantime.
From by Acts1631.
Add a storage process to snmpd, which lives in /var/db/snmpd, and use it to
store SNNMP engine information.
Previously snmpEngineBoots was hardcoded to 0, and snmpEngineTime was set
to CLOCK_REALTIME. Having snmpEngineBoots set to 0 is against the
specifications, and snmpEngineTime is a 32 bit integer and thus would
overflow in 2038. With the storage process we start snmpEngineBoots at 1,
and increment it by 1 on every restart as per RFC3414, and snmpEngineTime
is set to the amount of seconds the engine has been up using
CLOCK_MONOTONIC.
feedback and OK jmatthew@
