Remove amountpipekva variable and related computations. This variable used
to matter until rev 1.19 27 years ago, when the "direct write" code was
removed.
rpki-client: drop some redundant parentheses in return statements
Almost all of the code omits them, so be consistent. The remaining
two are special: to_encode() is rather complicated and CBS_strdup()
is upstream code.
ok job
Limit impact of quadratic workload caused by duplicate references from manifests
Jacobsen et al., 2026, and, independently, eur1ka, reported that a set
of colluding CAs could cause significant workload by publishing multiple
manifests which all reference the same set of signed objects inside the
same caRepository.
In practice there should never be more than two manifests in any given
caRepository directory since the norm is that caRepositories are not
shared across CAs. In the normal course of operation two valid manifests
existing in the same repository directory only occurs during a keyroll
(RFC 6489), as is also pointed out in RFC 9286, section 2.
This changeset introduces a limit of 20 manifests per Trust Anchor per
caRepository. If this threshold is exceeded, any newly discovered CAs
pointing into that caRepository are considered bad, discarded, and a
counter is incremented in the OpenMetrics output.
With & OK tb@
signify: check last block size for gzip
The gzip header contains a blocksize extended header. This patch adds the
parsing of an extra lastblocksize header. As the name indicates, this marks
the end of the recorded SHA512/256 blocks and allows checking the size of
the signed data. Once its presence is enforced, this will prevent length
extension attacks. While no such attack for SHA512/256 is known or even
expected to exist, having a tighter form is desirable anyway.
This header not yet emitted and the parser treats it as optional to allow
transitioning. In follow up steps the lastblock will be emitted on signing
and then its presence will be required.
looked over by op
from espie
rpki-client: sync wth libcrypto bytestring.h r1.11
Provide CBS_ASN1_IA5_STRING
This will soon be needed in rpki-client for: fileName in Manifest fileList,
cPSuri in certificate policy qualifiers and uniformResourceIdentifier in
GeneralName, to name a few.
Per X.680, section 41, table 8, the universal class number is 22 == 0x16.
The naming of the constant matches BoringSSL's.
bytestring: provide CBS_ASN1_IA5STRING
This will soon be needed in rpki-client for: fileName in Manifest fileList,
cPSuri in certificate policy qualifiers and uniformResourceIdentifier in
GeneralName, to name a few.
Per X.680, section 41, table 8, the universal class number is 22 == 0x16.
The naming of the constant matches BoringSSL's.
ok kenjiro
nc: do not treat tls_read() failures as fatal with -k
tls_read() can fail because the peer sends a malformed record. If -k is
given, treat the failure gracefully, warn, and allow the caller to free
the failed resources before accepting another connection.
Fixes a bug introduced in r1.203 (Feb 2019)
Simplified version of a diff by Acts1631
ok kenjiro
pw_equal: include the password field in the comparison
This fixes a potential race condition where if the user runs chpass(1)
and suspends it, chpass(1) will update the password hash after the
editor is resumed, even if the password has been changed in the
meantime.
From by Acts1631.
Add a storage process to snmpd, which lives in /var/db/snmpd, and use it to
store SNNMP engine information.
Previously snmpEngineBoots was hardcoded to 0, and snmpEngineTime was set
to CLOCK_REALTIME. Having snmpEngineBoots set to 0 is against the
specifications, and snmpEngineTime is a 32 bit integer and thus would
overflow in 2038. With the storage process we start snmpEngineBoots at 1,
and increment it by 1 on every restart as per RFC3414, and snmpEngineTime
is set to the amount of seconds the engine has been up using
CLOCK_MONOTONIC.
feedback and OK jmatthew@
rpki-client: rename crldp to dps in cert_crldp()
In a later commit I want to use crldp for something else. The one CRL
distribution point is called dp, so call the stack of distribution points
dps.
ok job
make a AuthorizedPrincipalsCommand with no specified arguments do what
it is documented to do: supply the target username as a default argument.
Anthropic ANT-2026-YX19N77E
when updating known_hosts files for UpdateHostKeys, bail out if the
unable to write to the first known_hosts file in the list.
Avoids a situation where a host key could be fully removed from all
known_hosts files.
Anthropic ANT-2026-YH3JNW7S
