librpki

Oct 18, 2022

Changes in this version

type RPKICertificate

+ func (cert *RPKICertificate) GetRRDPGeneralName() string

+ func (cert *RPKICertificate) GetRsyncGeneralName() string

+ func (cert *RPKICertificate) HasRRDP() bool

Feb 18, 2022 GO-2022-0248

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

Nov 18, 2021 GO-2022-0248

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

Nov 18, 2021 GO-2022-0248

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

Oct 26, 2021 GO-2022-0248

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

Aug 19, 2021 GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Dec 8, 2020 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Nov 24, 2020 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Oct 29, 2020 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Changes in this version

+ var AuthorityInfoAccess = asn1.ObjectIdentifier

+ var CAIssuer = asn1.ObjectIdentifier

+ var CPS = asn1.ObjectIdentifier

+ var CertPolicy = asn1.ObjectIdentifier

+ var CertRRDP = asn1.ObjectIdentifier

+ var CertRepository = asn1.ObjectIdentifier

+ var ContentTypeOID = asn1.ObjectIdentifier

+ var DefaultDecoderConfig = &DecoderConfig

+ var ManifestOID = asn1.ObjectIdentifier

+ var OidSerialNumber = asn1.ObjectIdentifier

+ var OidSignatureSHA256WithRSA = asn1.ObjectIdentifier

+ var RSAOID = asn1.ObjectIdentifier

+ var ResourceCertPolicy = asn1.ObjectIdentifier

+ var RoaOID = asn1.ObjectIdentifier

+ var SHA256OID = asn1.ObjectIdentifier

+ var SIAManifest = asn1.ObjectIdentifier

+ var SignedDataOID = asn1.ObjectIdentifier

+ var SignedObject = asn1.ObjectIdentifier

+ var XMLOID = asn1.ObjectIdentifier

+ func BundleRSAPublicKey(key rsa.PublicKey) (asn1.BitString, error)

+ func CreateCRL(c *x509.Certificate, rand io.Reader, priv interface{}, ...) (crlBytes []byte, err error)

+ func EContentToEncap(econtent []byte) ([]byte, error)

+ func EContentToEncapBF(econtent []byte, skipbf bool) ([]byte, error)

+ func EncodeASN(nums []ASNCertificateInformation, rdi []ASNCertificateInformation) (*pkix.Extension, error)

+ func EncodeASNSeq(asns []ASNCertificateInformation) ([]asn1.RawValue, error)

+ func EncodeIPAddressBlock(ips []IPCertificateInformation) (*pkix.Extension, error)

+ func EncodeIPAddressBlockVersion(version byte, ips []IPCertificateInformation, safi byte, addSafi bool) ([]byte, error)

+ func EncodeInfoAccess(authority bool, path string) (*pkix.Extension, error)

+ func EncodePolicyInformation(cps string) (*pkix.Extension, error)

+ func EncodeSIA(sias []*SIA) (*pkix.Extension, error)

+ func EncodeTAL(tal *RPKITAL) ([]byte, error)

+ func EncodeTALSize(tal *RPKITAL, split int) ([]byte, error)

+ func EncryptSignatureRSA(rand io.Reader, signature []byte, privKey *rsa.PrivateKey) ([]byte, error)

+ func GroupEntries(entries []*ROAEntry) map[byte][]*ROAEntry

+ func GroupIPAddressBlock(ips []IPCertificateInformation) map[byte][]IPCertificateInformation

+ func HashPublicKey(key interface{}) ([]byte, error)

+ func HashRSAPublicKey(key rsa.PublicKey) ([]byte, error)

+ func IPNetToBitString(ipnet net.IPNet) asn1.BitString

+ func IPToBitString(ip net.IP) asn1.BitString

+ func ManifestToEncap(mft *Manifest) ([]byte, error)

+ func PrivateEncrypt(priv *rsa.PrivateKey, data []byte) (enc []byte, err error)

+ func ROAToEncap(roa *ROA) ([]byte, error)

+ func RSAPublicDecrypt(pubKey *rsa.PublicKey, data []byte) []byte

type ASN

+ func (a *ASN) ASN1() ([]byte, error)

type ASNCertificateInformation

+ ASN1 func() ([]byte, error)

type ASNRange

+ func (ar *ASNRange) ASN1() ([]byte, error)

type ASNull

+ func (an *ASNull) ASN1() ([]byte, error)

type CMS

+ func EncodeCMS(certificate []byte, encapContent interface{}, signingTime time.Time) (*CMS, error)

+ func (cms *CMS) AddCRLs(crls []byte) error

+ func (cms *CMS) CheckSignaturesMatch() (bool, error)

+ func (cms *CMS) Sign(rand io.Reader, ski []byte, encap []byte, priv interface{}, cert []byte) error

+ type CRLAuthKeyId struct

+ Id []byte

+ type DecoderConfig struct

+ ValidateStrict bool

+ func (cf *DecoderConfig) DecodeManifest(data []byte) (*RPKIManifest, error)

+ func (cf *DecoderConfig) DecodeROA(data []byte) (*RPKIROA, error)

+ type File struct

+ Hash asn1.BitString

+ Name string

+ func (f File) GetHash() []byte

type IPAddressNull

+ func (ipan *IPAddressNull) ASN1() ([]byte, error)

type IPAddressRange

+ func (ipr *IPAddressRange) ASN1() ([]byte, error)

type IPCertificateInformation

+ ASN1 func() ([]byte, error)

type IPNet

+ func (ipn *IPNet) ASN1() ([]byte, error)

type Manifest

+ func EncodeManifestContent(eContent ManifestContent) (*Manifest, error)

type ROA

+ func EncodeROAEntries(asn int, entries []*ROAEntry) (*ROA, error)

+ type ROAEntry struct

+ IPNet *net.IPNet

+ MaxLength int

+ func (entry *ROAEntry) Validate() error

+ type RPKICertificate struct

+ ASNRDI []ASNCertificateInformation

+ ASNums []ASNCertificateInformation

+ Certificate *x509.Certificate

+ IPAddresses []IPCertificateInformation

+ SubjectInformationAccess []SIA

+ func (cert *RPKICertificate) IsASRangeInCertificate(min int, max int) (bool, bool)

+ func (cert *RPKICertificate) IsIPRangeInCertificate(min net.IP, max net.IP) (bool, bool)

+ func (cert *RPKICertificate) String() string

+ func (cert *RPKICertificate) Validate(parent *RPKICertificate) error

+ func (cert *RPKICertificate) ValidateASNCertificate(parent *RPKICertificate) ([]ASNCertificateInformation, []ASNCertificateInformation, ...)

+ func (cert *RPKICertificate) ValidateIPCertificate(parent *RPKICertificate) ([]IPCertificateInformation, []IPCertificateInformation, ...)

+ func (cert *RPKICertificate) ValidateTime(comp time.Time) error

+ type RPKIManifest struct

+ BadFormat bool

+ Certificate *RPKICertificate

+ Content ManifestContent

+ InnerValid bool

+ InnerValidityError error

+ type RPKIROA struct

+ ASN int

+ BadFormat bool

+ Certificate *RPKICertificate

+ CheckParent []*ROAEntry

+ Entries []*ROAEntry

+ InnerValid bool

+ InnerValidityError error

+ Invalids []*ROAEntry

+ SigningTime time.Time

+ Valids []*ROAEntry

+ func (roa *RPKIROA) ValidateEntries() error

+ func (roa *RPKIROA) ValidateIPRoaCertificate(cert *RPKICertificate) ([]*ROAEntry, []*ROAEntry, []*ROAEntry)

+ func (roa *RPKIROA) ValidateTime(comp time.Time) error

+ type RPKITAL struct

+ Algorithm x509.PublicKeyAlgorithm

+ OID asn1.ObjectIdentifier

+ PublicKey interface{}

+ URI []string

+ func CreateTAL(uri []string, pubkey interface{}) (*RPKITAL, error)

+ func (tal *RPKITAL) CheckCertificate(cert *x509.Certificate) bool

+ func (tal *RPKITAL) GetRsyncURI() string

+ func (tal *RPKITAL) GetURI() string

+ func (tal *RPKITAL) HasRsync() bool

+ type RPKIXML struct

+ Certificate *RPKICertificate

+ Content []byte

+ InnerValid bool

+ InnerValidityError error

+ func DecodeXML(data []byte) (*RPKIXML, error)

type SignatureInner

+ Null asn1.RawValue

+ type XML struct

+ EContent asn1.RawValue

+ OID asn1.ObjectIdentifier

+ func EncodeXMLContent(content interface{}) (*XML, error)

+ func EncodeXMLData(message []byte) (*XML, error)

+ type XMLContent struct

+ Message interface{}

Jul 29, 2020 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Aug 6, 2019 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Apr 17, 2019 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Apr 16, 2019 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Apr 16, 2019 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Apr 12, 2019 GO-2022-0246GO-2022-0248GO-2022-0251GO-2022-0252GO-2022-0253

  GO-2022-0246: Insufficient validation in github.com/cloudflare/cfrpki

  GO-2022-0248: Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

  GO-2022-0251: Panic on NUL character in ROA in github.com/cloudflare/cfrpki

  GO-2022-0252: Panic on misconfigured IP address in github.com/cloudflare/cfrpki

  GO-2022-0253: Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

Changes in this version

+ var AuthorityKeyIdentifier = asn1.ObjectIdentifier

+ var AutonomousSysIds = asn1.ObjectIdentifier

+ var AutonomousSysIdsV2 = asn1.ObjectIdentifier

+ var IpAddrAndASIdent = asn1.ObjectIdentifier

+ var IpAddrBlock = asn1.ObjectIdentifier

+ var IpAddrBlockV2 = asn1.ObjectIdentifier

+ var MessageDigest = asn1.ObjectIdentifier

+ var RSA = asn1.ObjectIdentifier

+ var SigningTime = asn1.ObjectIdentifier

+ var SubjectInfoAccess = asn1.ObjectIdentifier

+ var SubjectKeyIdentifier = asn1.ObjectIdentifier

+ func BER2DER(ber []byte) ([]byte, error)

+ func BadFormatGroup(data []byte) ([]byte, bool, error)

+ func DecodeASN(data []byte) ([]ASNCertificateInformation, []ASNCertificateInformation, error)

+ func DecodeIP(addrfamily []byte, addr asn1.BitString) (*net.IPNet, error)

+ func DecodeIPMinMax(addrfamily []byte, addr asn1.BitString, max bool) (net.IP, error)

+ func DecodeKeyAuthority(data []byte) ([]byte, error)

+ func DecodeKeyIdentifier(data []byte) ([]byte, error)

+ func DecryptSignatureRSA(signature []byte, pubKey *rsa.PublicKey) ([]byte, error)

+ func DeleteLineEnd(line string) string

+ func GetRangeIP(ipnet *net.IPNet) (net.IP, net.IP)

+ func RSA_public_decrypt(pubKey *rsa.PublicKey, data []byte) []byte

+ func ValidateASNCertificateList(list []ASNCertificateInformation, parent *RPKI_Certificate) ([]ASNCertificateInformation, []ASNCertificateInformation, ...)

+ func ValidateIPCertificateList(list []IPCertificateInformation, parent *RPKI_Certificate) ([]IPCertificateInformation, []IPCertificateInformation, ...)

+ func ValidateIPRoaCertificateList(entries []*ROA_Entry, cert *RPKI_Certificate) ([]*ROA_Entry, []*ROA_Entry, []*ROA_Entry)

+ type ASN struct

+ ASN int

+ func (a *ASN) GetRange() (int, int, bool)

+ func (a *ASN) IsASNInRange(asn int) (bool, bool)

+ func (a *ASN) String() string

+ type ASNCertificateInformation interface

+ GetRange func() (int, int, bool)

+ IsASNInRange func(int) (bool, bool)

+ String func() string

+ func DecodeASIdentifier(data asn1.RawValue) ([]ASNCertificateInformation, error)

+ type ASNRange struct

+ Max int

+ Min int

+ func (ar *ASNRange) GetRange() (int, int, bool)

+ func (ar *ASNRange) IsASNInRange(asn int) (bool, bool)

+ func (ar *ASNRange) String() string

+ type ASNull struct

+ func (an *ASNull) GetRange() (int, int, bool)

+ func (an *ASNull) IsASNInRange(asn int) (bool, bool)

+ func (an *ASNull) String() string

+ type Attribute struct

+ AttrType asn1.ObjectIdentifier

+ AttrValue []asn1.RawValue

+ type CMS struct

+ OID asn1.ObjectIdentifier

+ SignedData CmsSignedData

+ func DecodeCMS(data []byte) (*CMS, error)

+ func (cms *CMS) GetRPKICertificate() (*RPKI_Certificate, error)

+ func (cms *CMS) GetSigningTime() (time.Time, error)

+ func (cms *CMS) Validate(encap []byte, cert *x509.Certificate) error

+ type CmsSignedData struct

+ CRLs asn1.RawValue

+ Certificates asn1.RawValue

+ DigestAlgorithms []asn1.RawValue

+ EncapContentInfo asn1.RawValue

+ SignerInfos []SignerInfo

+ Version int

+ type FileList struct

+ File string

+ Hash asn1.BitString

+ type IPAddressNull struct

+ Family uint8

+ func (ipan *IPAddressNull) GetAfi() uint8

+ func (ipan *IPAddressNull) GetRange() (net.IP, net.IP, bool)

+ func (ipan *IPAddressNull) IsIPInRange(ip net.IP) (bool, bool)

+ func (ipan *IPAddressNull) String() string

+ type IPAddressRange struct

+ Max net.IP

+ Min net.IP

+ func (ipr *IPAddressRange) GetAfi() uint8

+ func (ipr *IPAddressRange) GetRange() (net.IP, net.IP, bool)

+ func (ipr *IPAddressRange) IsIPInRange(ip net.IP) (bool, bool)

+ func (ipr *IPAddressRange) String() string

+ type IPCertificateInformation interface

+ GetAfi func() uint8

+ GetRange func() (net.IP, net.IP, bool)

+ IsIPInRange func(net.IP) (bool, bool)

+ String func() string

+ func DecodeIPAddressBlock(data []byte) ([]IPCertificateInformation, error)

+ type IPNet struct

+ IPNet *net.IPNet

+ func (ipn *IPNet) GetAfi() uint8

+ func (ipn *IPNet) GetRange() (net.IP, net.IP, bool)

+ func (ipn *IPNet) IsIPInRange(ip net.IP) (bool, bool)

+ func (ipn *IPNet) String() string

+ type Manifest struct

+ EContent asn1.RawValue

+ OID asn1.ObjectIdentifier

+ type ManifestContent struct

+ FileHashAlg asn1.ObjectIdentifier

+ FileList []FileList

+ ManifestNumber *big.Int

+ NextUpdate time.Time

+ ThisUpdate time.Time

+ type ROA struct

+ EContent asn1.RawValue

+ OID asn1.ObjectIdentifier

+ type ROAAddressFamily struct

+ AddressFamily []byte

+ Addresses []ROAIPAddresses

+ type ROAContent struct

+ ASID int

+ IpAddrBlocks []ROAAddressFamily

+ type ROAIPAddresses struct

+ Address asn1.BitString

+ MaxLength int

+ type ROA_Entry struct

+ IPNet *net.IPNet

+ MaxLength int

+ func ConvertROAEntries(roacontent ROAContent) ([]*ROA_Entry, int, error)

+ func (entry *ROA_Entry) Validate() error

+ type RPKI_Certificate struct

+ ASNRDI []ASNCertificateInformation

+ ASNums []ASNCertificateInformation

+ Certificate *x509.Certificate

+ IPAddresses []IPCertificateInformation

+ SubjectInformationAccess []SIA

+ func DecodeCertificate(data []byte) (*RPKI_Certificate, error)

+ func (cert *RPKI_Certificate) IsASRangeInCertificate(min int, max int) (bool, bool)

+ func (cert *RPKI_Certificate) IsIPRangeInCertificate(min net.IP, max net.IP) (bool, bool)

+ func (cert *RPKI_Certificate) String() string

+ func (cert *RPKI_Certificate) Validate(parent *RPKI_Certificate) error

+ func (cert *RPKI_Certificate) ValidateASNCertificate(parent *RPKI_Certificate) ([]ASNCertificateInformation, []ASNCertificateInformation, ...)

+ func (cert *RPKI_Certificate) ValidateIPCertificate(parent *RPKI_Certificate) ([]IPCertificateInformation, []IPCertificateInformation, ...)

+ func (cert *RPKI_Certificate) ValidateTime(comp time.Time) error

+ type RPKI_Manifest struct

+ BadFormat bool

+ Certificate *RPKI_Certificate

+ Content ManifestContent

+ InnerValid bool

+ InnerValidityError error

+ func DecodeManifest(data []byte) (*RPKI_Manifest, error)

+ type RPKI_ROA struct

+ ASN int

+ BadFormat bool

+ Certificate *RPKI_Certificate

+ CheckParent []*ROA_Entry

+ Entries []*ROA_Entry

+ InnerValid bool

+ InnerValidityError error

+ Invalids []*ROA_Entry

+ SigningTime time.Time

+ Valids []*ROA_Entry

+ func DecodeROA(data []byte) (*RPKI_ROA, error)

+ func (roa *RPKI_ROA) ValidateEntries() error

+ func (roa *RPKI_ROA) ValidateIPRoaCertificate(cert *RPKI_Certificate) ([]*ROA_Entry, []*ROA_Entry, []*ROA_Entry)

+ func (roa *RPKI_ROA) ValidateTime(comp time.Time) error

+ type RPKI_TAL struct

+ Algorithm x509.PublicKeyAlgorithm

+ OID asn1.ObjectIdentifier

+ PublicKey interface{}

+ URI string

+ func DecodeTAL(data []byte) (*RPKI_TAL, error)

+ func (tal *RPKI_TAL) CheckCertificate(cert *x509.Certificate) bool

+ type SIA struct

+ AccessMethod asn1.ObjectIdentifier

+ GeneralName []byte

+ func DecodeSubjectInformationAccess(data []byte) ([]SIA, error)

+ func (sia *SIA) String() string

+ type SignatureDecoded struct

+ Hash []byte

+ Inner SignatureInner

+ type SignatureInner struct

+ OID asn1.ObjectIdentifier

+ type SignedAttributesDigest struct

+ SignedAttrs []Attribute

+ type SignerInfo struct

+ DigestAlgorithms []asn1.RawValue

+ Sid asn1.RawValue

+ Signature []byte

+ SignatureAlgorithm asn1.RawValue

+ SignedAttrs []Attribute

+ UnsignedAttrs asn1.RawValue

+ Version int