Require files to be of a minimum size in the RRDP & RSYNC transports

Picked 100 bytes as a minimum, to accommodate future signature schemes
(such as the smaller P-256) and small files like empty CRLs.

With and OK claudio@ tb@

diff --git a/usr.sbin/rpki-client/extern.h b/usr.sbin/rpki-client/extern.h
index e33c0e1..571b2d8 100644 (file)
--- a/usr.sbin/rpki-client/extern.h
+++ b/usr.sbin/rpki-client/extern.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: extern.h,v 1.194 2023/11/16 11:10:59 tb Exp $ */
+/*     $OpenBSD: extern.h,v 1.195 2023/11/24 14:05:47 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -930,7 +930,8 @@ int mkpathat(int, const char *);
 /* Maximum acceptable URI length */
 #define MAX_URI_LENGTH         2048
 
-/* Maximum acceptable file size */
+/* Min/Max acceptable file size */
+#define MIN_FILE_SIZE          100
 #define MAX_FILE_SIZE          4000000
 
 /* Maximum number of FileNameAndHash entries per RSC checklist. */

diff --git a/usr.sbin/rpki-client/rrdp_util.c b/usr.sbin/rpki-client/rrdp_util.c
index 0565493..8486e41 100644 (file)
--- a/usr.sbin/rpki-client/rrdp_util.c
+++ b/usr.sbin/rpki-client/rrdp_util.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: rrdp_util.c,v 1.1 2021/11/24 15:24:16 claudio Exp $ */
+/*     $OpenBSD: rrdp_util.c,v 1.2 2023/11/24 14:05:47 job Exp $ */
 /*
  * Copyright (c) 2020 Nils Fisher <nils_fisher@hotmail.com>
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -107,10 +107,22 @@ publish_done(struct rrdp *s, struct publish_xml *pxml)
        unsigned char *data = NULL;
        size_t datasz = 0;
 
-       if (pxml->data_length > 0)
+       switch (pxml->type) {
+       case PUB_ADD:
+       case PUB_UPD:
+               if (base64_decode_len(pxml->data_length, &datasz) == -1)
+                       return -1;
+               if (datasz < MIN_FILE_SIZE)
+                       return -1;
                if ((base64_decode(pxml->data, pxml->data_length,
                    &data, &datasz)) == -1)
                        return -1;
+               break;
+       case PUB_DEL:
+               if (pxml->data_length != 0)
+                       return -1;
+               break;
+       }
 
        rrdp_publish_file(s, pxml, data, datasz);
 

diff --git a/usr.sbin/rpki-client/rsync.c b/usr.sbin/rpki-client/rsync.c
index 9b5710c..808a920 100644 (file)
--- a/usr.sbin/rpki-client/rsync.c
+++ b/usr.sbin/rpki-client/rsync.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: rsync.c,v 1.47 2023/11/23 13:01:15 job Exp $ */
+/*     $OpenBSD: rsync.c,v 1.48 2023/11/24 14:05:47 job Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -147,6 +147,7 @@ exec_rsync(const char *prog, const char *bind_addr, char *uri, char *dst,
                args[i++] = (char *)prog;
                args[i++] = "-rtO";
                args[i++] = "--no-motd";
+               args[i++] = "--min-size=" STRINGIFY(MIN_FILE_SIZE);
                args[i++] = "--max-size=" STRINGIFY(MAX_FILE_SIZE);
                args[i++] = "--contimeout=" STRINGIFY(MAX_CONN_TIMEOUT);
                args[i++] = "--timeout=" STRINGIFY(MAX_IO_TIMEOUT);