]> git.ipfire.org Git - thirdparty/FORT-validator.git/log
thirdparty/FORT-validator.git
6 years agoSave in memory the VRPs loaded from CSV
pcarana [Mon, 18 Feb 2019 16:29:40 +0000 (10:29 -0600)] 
Save in memory the VRPs loaded from CSV

6 years agoAddress several TODOs.
Alberto Leiva Popper [Thu, 14 Feb 2019 23:03:22 +0000 (17:03 -0600)] 
Address several TODOs.

6 years agoUpdate args parser framework
dhfelix [Thu, 14 Feb 2019 21:57:03 +0000 (15:57 -0600)] 
Update args parser framework

6 years agoUpdate usage of the libcmscodec library
Alberto Leiva Popper [Thu, 14 Feb 2019 16:53:19 +0000 (10:53 -0600)] 
Update usage of the libcmscodec library

6 years agoRead VRPs from a CSV file set at JSON config
pcarana [Thu, 14 Feb 2019 15:38:04 +0000 (09:38 -0600)] 
Read VRPs from a CSV file set at JSON config

6 years agoBugfix: policy was not being initialized
Alberto Leiva Popper [Wed, 13 Feb 2019 23:13:00 +0000 (17:13 -0600)] 
Bugfix: policy was not being initialized

6 years agoAdd a bunch of GCC warning flags
Alberto Leiva Popper [Tue, 12 Feb 2019 21:44:06 +0000 (15:44 -0600)] 
Add a bunch of GCC warning flags

Found lots of bugs because of them. Most are fixed.

6 years agoImplement RFC 8360
Alberto Leiva Popper [Tue, 12 Feb 2019 17:56:16 +0000 (11:56 -0600)] 
Implement RFC 8360

Not really tested, because it doesn't look like there are people using
this feature yet.

Also:
- refactor inet_ntop() usage so we don't have to clutter the stack with
  string buffers every time we want to print.
- Patch sometimes undefined behavior `0xFFFFFFFFu >> 32`.

6 years agoMerge branch 'master' into args-parser
dhfelix [Mon, 11 Feb 2019 22:56:20 +0000 (16:56 -0600)] 
Merge branch 'master' into args-parser

Conflicts:
src/config.c
src/config.h
src/main.c

6 years agoAdd RPKI-specific validation for CRLs
Alberto Leiva Popper [Fri, 8 Feb 2019 19:05:05 +0000 (13:05 -0600)] 
Add RPKI-specific validation for CRLs

6 years agoAdd flag parser framework
dhfelix [Fri, 8 Feb 2019 20:26:52 +0000 (14:26 -0600)] 
Add flag parser framework

- checkpoint commit
- First version, stable and working but needs some tweaks

6 years agoCode review
Alberto Leiva Popper [Thu, 7 Feb 2019 21:47:42 +0000 (15:47 -0600)] 
Code review

- Print relevant IP address on address errors
- Add missing resource validations (swapped ranges, AS number out of
  bounds)
- Remove validation of ROA's AS number. The RFCs never state that the
  number must be present in the EE certificate.

6 years agoRemove unnecessary conversion
pcarana [Thu, 7 Feb 2019 17:41:06 +0000 (11:41 -0600)] 
Remove unnecessary conversion

6 years agoKeep validating certs, don't stop on a child cert error
pcarana [Thu, 7 Feb 2019 16:57:06 +0000 (10:57 -0600)] 
Keep validating certs, don't stop on a child cert error

6 years agoCode review
Alberto Leiva Popper [Thu, 7 Feb 2019 16:32:17 +0000 (10:32 -0600)] 
Code review

Patched some segfaults, removed some redundant code, added more
sensible defaults.

6 years agoImplement cert's subject validation
pcarana [Wed, 6 Feb 2019 22:54:41 +0000 (16:54 -0600)] 
Implement cert's subject validation

6 years agoMerge branch 'intstructs' of https://github.com/ydahhrk/rpki-validator into intstructs
pcarana [Tue, 5 Feb 2019 21:15:55 +0000 (15:15 -0600)] 
Merge branch 'intstructs' of https://github.com/ydahhrk/rpki-validator into intstructs

6 years agoValidate certificate policies extension
pcarana [Tue, 5 Feb 2019 18:27:22 +0000 (12:27 -0600)] 
Validate certificate policies extension

6 years agoValidate manifest number size
pcarana [Tue, 5 Feb 2019 18:17:30 +0000 (12:17 -0600)] 
Validate manifest number size

6 years agoCast INTEGER_t as unsigned long and use as such
pcarana [Fri, 1 Feb 2019 23:17:19 +0000 (17:17 -0600)] 
Cast INTEGER_t as unsigned long and use as such

6 years agoAdapt types from long to INTEGER_t
pcarana [Fri, 1 Feb 2019 01:30:44 +0000 (19:30 -0600)] 
Adapt types from long to INTEGER_t

6 years agoValidate certificate policies extension
pcarana [Tue, 5 Feb 2019 18:27:22 +0000 (12:27 -0600)] 
Validate certificate policies extension

6 years agoValidate manifest number size
pcarana [Tue, 5 Feb 2019 18:17:30 +0000 (12:17 -0600)] 
Validate manifest number size

6 years agoImpose a certificate chain length limit by configuration
Alberto Leiva Popper [Sat, 2 Feb 2019 00:08:51 +0000 (18:08 -0600)] 
Impose a certificate chain length limit by configuration

Also add a configuration module, and patch a ROA address iteration
bug.

6 years agoCast INTEGER_t as unsigned long and use as such
pcarana [Fri, 1 Feb 2019 23:17:19 +0000 (17:17 -0600)] 
Cast INTEGER_t as unsigned long and use as such

6 years agoAdd parsing for a config file
dhfelix [Fri, 1 Feb 2019 22:30:09 +0000 (16:30 -0600)] 
Add parsing for a config file

First version of it, needs more tweaks, but first I need
to finish an arg parser framework.

6 years agoCertificate serial number uniqueness validation
Alberto Leiva Popper [Fri, 1 Feb 2019 19:16:06 +0000 (13:16 -0600)] 
Certificate serial number uniqueness validation

6 years agoAdapt types from long to INTEGER_t
pcarana [Fri, 1 Feb 2019 01:30:44 +0000 (19:30 -0600)] 
Adapt types from long to INTEGER_t

6 years agoMerge branch 'ydahhrk'
Alberto Leiva Popper [Wed, 30 Jan 2019 16:50:54 +0000 (10:50 -0600)] 
Merge branch 'ydahhrk'

6 years agoUnify Access Description management
Alberto Leiva Popper [Wed, 30 Jan 2019 16:45:16 +0000 (10:45 -0600)] 
Unify Access Description management

6 years agoStrengthen the TAL parser
Alberto Leiva Popper [Tue, 29 Jan 2019 22:16:28 +0000 (16:16 -0600)] 
Strengthen the TAL parser

Prevents segfaults when there's no blank line between the URI
section and the public key, as well as when the file is empty.

Fixes #1.

6 years agoAdd validation of IP vs Range selection
Alberto Leiva Popper [Tue, 29 Jan 2019 20:36:09 +0000 (14:36 -0600)] 
Add validation of IP vs Range selection

RFC 3779, section 2.2.3.7.
Also patch memory leaks during AIA handling and other small TODOs.

6 years agoAdd getopt to handle argc and argv
dhfelix [Sat, 26 Jan 2019 03:09:13 +0000 (21:09 -0600)] 
Add getopt to handle argc and argv

- Needs more tweaks

6 years agoMerge branch 'ydahhrk'
Alberto Leiva Popper [Fri, 25 Jan 2019 22:39:18 +0000 (16:39 -0600)] 
Merge branch 'ydahhrk'

6 years agoPostpone recursive traversal and validate Access Descriptions
Alberto Leiva Popper [Fri, 25 Jan 2019 22:28:16 +0000 (16:28 -0600)] 
Postpone recursive traversal and validate Access Descriptions

1. It was traversing through children before the current
   certificate's validation was done. It's fixed now.
2. Adds validation of CRL Distribution Points, AIA.caIssuers and
   SIA.signedObject.
   Man, those requirements looked deceively small. It was a
   freaking mess.
   I'm not actually sure this is the final version of this code,
   because several argument lists grew too much for my liking.

6 years agoReview of rsync.c code
dhfelix [Wed, 23 Jan 2019 18:04:28 +0000 (12:04 -0600)] 
Review of rsync.c code

6 years agoEngineer URIs a little
Alberto Leiva Popper [Tue, 22 Jan 2019 22:57:11 +0000 (16:57 -0600)] 
Engineer URIs a little

Should make URIs easier to use, and prevent the missing
null character bug from appearing again.

6 years agoMerge branch 'master' of github.com:ydahhrk/rpki-validator
Alberto Leiva Popper [Fri, 18 Jan 2019 20:28:40 +0000 (14:28 -0600)] 
Merge branch 'master' of github.com:ydahhrk/rpki-validator

6 years agoMore misc tweaks:
Alberto Leiva Popper [Fri, 18 Jan 2019 20:09:12 +0000 (14:09 -0600)] 
More misc tweaks:

- Validate more certificate extensions
- Ensure there is only one visible CRL and manifest per publication
  point.
- Validate ROA's max length more thoroughly.

6 years agoImprove of rsync.c code
dhfelix [Fri, 18 Jan 2019 18:46:42 +0000 (12:46 -0600)] 
Improve of rsync.c code

-add unit test for rsync.c
-TODO fix tal_tests

6 years agoImplement some postponed requirements
Alberto Leiva Popper [Tue, 15 Jan 2019 15:42:17 +0000 (09:42 -0600)] 
Implement some postponed requirements

At this point I'm filling in blanks and TODOs rather than focus on a
particular feature. Mainly, this commit adds

- Validate certificate extensions
- Improve the main loop so it stops on the TAL's first successful URI

6 years agoReview of rsync.c code
Alberto Leiva Popper [Fri, 21 Dec 2018 06:04:47 +0000 (00:04 -0600)] 
Review of rsync.c code

Still need to review the calling code and actually test it.

6 years agoMerge branch 'rsync'
Alberto Leiva Popper [Thu, 20 Dec 2018 19:10:20 +0000 (13:10 -0600)] 
Merge branch 'rsync'

6 years agoValidate signed object hashes
Alberto Leiva Popper [Thu, 20 Dec 2018 17:09:17 +0000 (11:09 -0600)] 
Validate signed object hashes

And address several other minor TODOs

6 years agoAdd validation of manifest hashes
Alberto Leiva Popper [Mon, 17 Dec 2018 23:26:42 +0000 (17:26 -0600)] 
Add validation of manifest hashes

It seems that the basic tree validation, at least as far as the
first iteration is concerned, is done.

Except I never managed to understand AS validation at all. It's
like there's nothing to do.

Of course, there's still a ways to go. I still have to add many
little ifs that the project needs to reach strict RFC compliance.
Also those 20-octet sequence manifest numbers. WTF.

6 years agoAdds:
Alberto Leiva Popper [Mon, 17 Dec 2018 19:01:35 +0000 (13:01 -0600)] 
Adds:

- Check that the TAL's public key matches the root cert's public key
- Validate EE certificates differently than CA certificates
- Reorder tree traversal. (I noticed that I was doing it wrong.)
- Polish many other validations by hunting TODOs

6 years agoAdd rsync command execution to download repositories
dhfelix [Fri, 14 Dec 2018 22:48:40 +0000 (16:48 -0600)] 
Add rsync command execution to download repositories

First version of the code, when executing the app, if a 4th arg is
detected, the app will not run rsync.

Maybe I need to replace the "system()" call with another function to
execute the "rsync command"

Also needs to read the "rsync command" from a user JSON configuration
file.

6 years agoRead the host address as a hostname
dhfelix [Fri, 14 Dec 2018 02:39:58 +0000 (20:39 -0600)] 
Read the host address as a hostname

Converts the hostname to its equivalent in IPv4 or IPv6

6 years agoRefactor: Send the validation state to thread local
Alberto Leiva Popper [Tue, 11 Dec 2018 17:18:31 +0000 (11:18 -0600)] 
Refactor: Send the validation state to thread local

Unclutters lots of argument lists.
Also delete the prefix*_contains functions. Weren't being used.

6 years agoAutomatically print offending files' names on errors
Alberto Leiva Popper [Tue, 11 Dec 2018 15:12:20 +0000 (09:12 -0600)] 
Automatically print offending files' names on errors

6 years agoAdds:
Alberto Leiva Popper [Sat, 8 Dec 2018 03:26:15 +0000 (21:26 -0600)] 
Adds:

- IP ranges
- Bunch of ROA validation
- Bunch of certificate validation

I clearly don't understand how EE certificates validate AS numbers.
They never seem to have the AS extension.
Back to reading...

6 years agoMore certificate validation
Alberto Leiva Popper [Thu, 29 Nov 2018 21:52:13 +0000 (15:52 -0600)] 
More certificate validation

Includes an implementation of RFC 3779.

There's a lot of diff pollution due to another log.c refactor.
I can't seem to nail the right implementation of that thing.

6 years agoAdd actual certificate tree validation and other misc tweaks
Alberto Leiva Popper [Thu, 15 Nov 2018 20:11:47 +0000 (14:11 -0600)] 
Add actual certificate tree validation and other misc tweaks

The tweaks are

1. Unified error message printing. Probably not the final version.
2. Add validation state object, meant to be passed around everywhere.
   Prevents global variables.
3. Add a sketch of the CRL code. WIP.

6 years agoAdd jansson reference as json parser
dhfelix [Fri, 9 Nov 2018 22:12:02 +0000 (16:12 -0600)] 
Add jansson reference as json parser

6 years agoImplement address block parsing (rfc3779, section 2.1)
Alberto Leiva Popper [Wed, 7 Nov 2018 16:14:20 +0000 (10:14 -0600)] 
Implement address block parsing (rfc3779, section 2.1)

Also, move the signed code decoding to its own module to prevent
duplicate code elsewhere

6 years agoImplement a bunch of global logic
Alberto Leiva Popper [Fri, 2 Nov 2018 19:18:05 +0000 (13:18 -0600)] 
Implement a bunch of global logic

The code traverses my repository clone, apparently in a correct
(although recursive) manner.

Not many validations are performed yet.

6 years agoImplement about 40% of RFC 6486 (Manifests)
Alberto Leiva Popper [Thu, 27 Sep 2018 21:56:50 +0000 (16:56 -0500)] 
Implement about 40% of RFC 6486 (Manifests)

6 years agoImplement about 80% of RFC 6482 (ROAs)
Alberto Leiva Popper [Wed, 26 Sep 2018 18:49:45 +0000 (13:49 -0500)] 
Implement about 80% of RFC 6482 (ROAs)

6 years agoAbout 80% of RFC 6488
Alberto Leiva Popper [Fri, 21 Sep 2018 22:42:58 +0000 (17:42 -0500)] 
About 80% of RFC 6488

6 years agoImplement RFC 7730 (TALs)
Alberto Leiva Popper [Tue, 4 Sep 2018 21:17:34 +0000 (16:17 -0500)] 
Implement RFC 7730 (TALs)

6 years agoInitial commit
Alberto Leiva Popper [Tue, 4 Sep 2018 21:08:55 +0000 (16:08 -0500)] 
Initial commit

6 years agoAdd unit testing framework
Alberto Leiva Popper [Wed, 29 Aug 2018 22:23:03 +0000 (17:23 -0500)] 
Add unit testing framework

And fix some bugs as a side effect.

6 years agoImprove the autotools config
Alberto Leiva Popper [Thu, 23 Aug 2018 22:38:53 +0000 (17:38 -0500)] 
Improve the autotools config

The idea is to make it debian-packaging friendly.
It should work out of the box if appended a minimalistic debian
directory now.

7 years agoAdd the traditional autoconf/automake mess
Alberto Leiva Popper [Thu, 23 Aug 2018 02:19:04 +0000 (21:19 -0500)] 
Add the traditional autoconf/automake mess

7 years agoAdd string parsing to RTR
Alberto Leiva Popper [Thu, 23 Aug 2018 02:14:21 +0000 (21:14 -0500)] 
Add string parsing to RTR

Rob Austein, author of RFCs 6810 and 8210, clarified that string
length unit is octets. Dumping according (still untested) code.

7 years agoAdd RTR socket draft
Alberto Leiva Popper [Thu, 16 Aug 2018 16:41:12 +0000 (11:41 -0500)] 
Add RTR socket draft

7 years agoInitial commit
Alberto Leiva Popper [Thu, 16 Aug 2018 16:23:32 +0000 (11:23 -0500)] 
Initial commit