pcarana [Tue, 3 Dec 2019 00:14:26 +0000 (18:14 -0600)]
Fix bug due to bad error handling on multithreading.
+Don't consider validation results if at least one TAL has an error fetching it's root certificate. The bug was: on TAL 'hard error' (whenever the root certificate couldn't be fetched), the error was minimized and the rest of the TAL validation results were considered to update DB; this can lead to a considerable number of withdrawal PDUs for the routers.
Update docs structure and content, merge with master.
-Bring the last updates from master (from commit 298c8f9ab0147159e70e47fb7f0766a5bc1b8b31).
-Fix background of some images (use white instead of none).
-Remove the 'doc' dir and move all its content to root folder, so that the whole documentation can be consulted from the root directory.
-Update the documentation index.
-Update docs layout references to match the new directory structure.
Fix bug, complete some unit tests, downgrade NID info logging.
-Bug fixed: Router Key PDUs overriding each others weren't removed due to a bad 'memcmp' use.
-Complete unit tests where Router Keys data can be tested.
-Downgrade NID registering log from info to debug on initialization.
+Each TAL will validate its own repositories without waiting for the others to terminate.
+Remove a TODO on configure.ac
+Update unit tests.
+Fix warning at base64 sanitizer, replace the function 'strchr' with a local one since the read buffer isn't necessarily a string.
pcarana [Wed, 21 Aug 2019 17:24:49 +0000 (12:24 -0500)]
Fix SLURM issues, and compile warning.
-SLURM filters weren't correctly applied when the filter had a prefix and an asn, only the asn was taken into account.
-Another error at filters, if a prefix X covered ROA prefix Y, the ROA prefix wasn't filtered; so apply the filter as specified in RFC 8416.
-Remove compile warning '_BSD_SOURCE and _SVID_SOURCE are deprecated', and set '_DEFAULT_SOURCE' at generated code by asn1c 'GeneralizedTime.c'.
pcarana [Wed, 14 Aug 2019 22:10:25 +0000 (17:10 -0500)]
Fix #14, remove SIGINT handler and adequate rsync return status.
-The SIGINT handler wasn't terminating the process as it should be, so let the signal be handled as default (like SIGTERM).
-Update the rsync (do_rsync) function to read the returned pid status and know how did the process was terminated; in case of interruption, use the returned value to terminate the validation cycle as well.
pcarana [Tue, 6 Aug 2019 16:28:24 +0000 (11:28 -0500)]
Assign ID to incidence, validate RTR port, fix slurm bug.
-Use an ID for the registered incidence.
-When loading multiple SLURM files, the validation from RFC 8416 section 4.2 wasn't considered. A context is used to perform such validation, since every prefix or asn (for bgpsec) must be validated according to its own context/file.
-Remove dead code (structs) from SLURM.
-Validate RTR port range since this isn't validated by getaddrinfo.
pcarana [Fri, 2 Aug 2019 16:51:11 +0000 (11:51 -0500)]
Fix minor issues and add some enhancements.
-Display a warning when a directory doesn't have files with the desired extension (used at TAL and SLURM configuration).
-Set the minimum allowed value of 'maximum-certificate-depth' to 5 to allow a normal operation.
-Validate ROA output file path at initialization instead of doing it when the whole validation process has terminated.
-Add a note to indicate 64-bit OS support.
-Print the real address where the RTR server will be bounded to.
-If there's an error loading the SLURM data, show the element that has the error.
-Fix X509_VERIFY_PARAM memory leak.
-Update doc reference to UINT_MAX definition.
-Fix bug: when a TAL couldn't be loaded its references where trying to be released, but such references didn't existed.
I was uncomfortable with the previous solution for two reasons:
- It wasn't deferring certificate revocation validation to libcrypto.
I am not sure if our implementation of it was sufficient, but
regardless, this operation should not be performed by Fort itself.
- It induced redundant CRL loading, which was a little unnecessarily
slow.
The root of the problem was that Fort was (originally) trying to
validate manifests' certificates using their grandparents' CRL (rather
than the parents'), which was incorrect and now fixed.
Fix some BGPsec issues and complete output printing.
-The SLURM BGPsec arrays were loading only 1 element, and the AS wasn't set when filtering router keys (programmer errors ¬¬).
-Validate SLURM routerPublicKey as a SubjectPublicKeyInfo struct, including the expected algorithms for BGPsec certificates.
-Print router key info as base64url encoded strings, and update headers.
Rename *bgpsec to *router_key, change SK data types, fix ERROR_PDU bug
-Use 'router_key' naming instead of bgpsec once the certificates had been validated and are stored at base or deltas.
-Use char arrays instead of pointers at SK (subject key) info, the DB hash table was detecting every validation run as an update for BGPsec certificates (pointers to sk_info's were always distinct).
-Remove structure 'sk_info' and its related functions, now its data is set at 'router_key' struct.
-Allow to receive larger error pdu messages. The maximum allowed length for PDUs received is 512 bytes, but the error messages couldn't be larger than 40 bytes (aprox).
-Add Router Key PDU constant length.
-Avoid needless comparisons at SLURM filters.
-Add functions to apply SLURM BGPsec filters and assertions.
-Remove length variables of SKI and SPKI on SLURM BGPsec structs.
-Send Router Key PDUs of base data (only PDUs from deltas were sent).
-Update outdated unit tests (bad calls, missing calls, impersonate functions).
-Complete filtering functions for BGPsec data.
Store BGPsec certs info, print at configured output
-Use struct 'router_key' to represent BGPsec certificates.
-Use reference count of Subject Key data (ID and public key) with 'sk_info' struct.
-Add router certificates info to local DB, as part of the refactor 'roa_table' was renamed to 'db_table'.
-Add configuration parameter 'output.bgpsec', the information is printed in hexadecimal representation (there's a TODO here: maybe encode and print as base64).
-Consider BGPsec keys in deltas.
-Use a constant for SKI length, since always is the same (20 bytes/octets).
Fix 11: validate certificates against its corresponding CRL.
The OpenSSL function 'X509_STORE_CTX_set0_crls' wasn't taking into consideration the CRL stack; the simple way to check revocation was doing it manually.
Pay special attention to manifests, the CRL stack that's received when its EE is validated, is grandparent's CRL; so, in this case, validate manifests on its own CRLDP.
-Prepare structs and functions to send RTRv1 router key PDUs.
-Basic preparation to store router keys, still needs more work.
-Validate BGPsec certificates based on RFCs 8209 and 8608.
-Configure RTRv1 intervals (refresh, retry, expire), more validations and logic are pending.
-Update sorted array to allow iterations on its elements.
libcmscodec's generated code is now git tracked by this repository. This
prevents lots of autotools and Debian package headaches, as well as
allowing us to prune large chunks of steps from the installation
recipes.
One of the reasons why we had the previous arrangement was because we
used to consider asn1c's output generated code, which meant we weren't
supposed to track it. However, the fact of the matter is that we'll
eventually need to tweak it manually, because we need to implement DER
parsing and better error message reporting, as well as improve the
quality of asn1c's code.
pcarana [Tue, 11 Jun 2019 23:08:45 +0000 (18:08 -0500)]
Update manual, unit tests, and add some fixes.
- Uncomment some unit tests and update them.
- Rename server.enabled flag to server.disabled, and update the flows affected by this update.
- Update version references to 0.0.1-beta.
- Update manual (man).
- Include automake as a Debian dependency.
- Validate PDU length received vs real bytes length received.
- Don't die if the PDU reader gets less bytes than what's expected.
- Remove 'crl_set' from rpp.c since the 'crl' is a pointer (the flag isn't necessary).
- Don't set SLURM comments as 'char const *', just as 'char *'.
- Print the ROAs to 'output.roa' after SLURM has been applied, or even when an error stopped validation (only the ROAs fetched to that point are printed).
- Patch `make distclean`.
test/'s distclean was attempting to clean stuff that src/'s
distclean had already removed, so it was aborting.
Fixed by moving needed .c's from test/Makefile.am to each
test .c file.
This prevents the unit tests from polluting src/.
- Simplify inclusion of unit tests during configure.
Rather than purposedly include them with --with-unit-tests,
they are now automatically included if Check is installed.
This also removes a lot of clutter from configure.ac.
pcarana [Wed, 5 Jun 2019 17:00:11 +0000 (12:00 -0500)]
Add server.enabled and output.roa arguments, update server.address docs
Now to perform a standalone validation, the server must be disabled (server.enabled = false).
The ROAs in CSV format can be: printed to console (output.roa = '-'), printed to a file (output.roa = '<file>'), not printed (output.roa isn't configured).
'server.address' docs specify the scenario when no value is set to that argument.
Code was trying to recover from critical/programming errors, but
most of the time they were being handled the same as validation
errors. This yielded often nonsensical results.
Critical errors now terminate the program. This is obviously
undesired, but is probably safer than doing something close to
undefined.
Remove the reset and merge validation handler callbacks
The only certificate that can invalidate the tree is the root one.
This is because other certificates are considered subtrees, and
therefore isolated problems.
RFC 7730 seems to agree:
> If the connection to the preferred URI fails, or the retrieved CA
> certificate public key does not match the TAL public key, the RP
> SHOULD retrieve the CA certificate from the next URI
(Neither of those reasons can be caused by a subtree.)
By the time the first ROA is handled, the root certificate is
already validated. This means that Fort will never find itself
needing to invalidate previously handled ROAs. Hence, there's no
need to "reset" a ROA table nor "merge" it with a global one after
success.
Not having to track both a global and a temporal table also reduces
RAM usage.
pcarana [Sat, 1 Jun 2019 01:01:09 +0000 (20:01 -0500)]
Relocate VRPs override function, and complete unit tests.
- The function that checks and removes VRPs that override eachother (before being sent by RTR), has been placed where VRPs functions are located.
- Fix the impersonator function that returns the minimum client serial.
- Add unit test to:
+ Check that deltas that won't be sent or used anymore, will be forgotten.
+ Check that a range of deltas that'll be sent by RTR, don't contain VRP announcements/withdrawals that override eachother.
+ Chech that a PDU with a wrong session ID is correctly handled.
projects / thirdparty / FORT-validator.git / log
