aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-11-29Fix confused handling of staleness flags.Rob Austein
svn path=/branches/tk705/; revision=6207
2015-11-29Simplify main object checking loop by moving loop over objectRob Austein
generations inside the loop over manifest entries. svn path=/branches/tk705/; revision=6206
2015-11-29Move more trivial tests from C to Python.Rob Austein
svn path=/branches/tk705/; revision=6205
2015-11-29rcynicng caught a bug in rpkid! Router certificates are forbiddenRob Austein
from having SIA extensions, unlike all other RPKI certificates which are required to have them. Start moving RPKI conformance checks which can be performed in Python out of POW.c, tag a bunch more for consideration. svn path=/branches/tk705/; revision=6204
2015-11-28yield when putting to task queue even though we expect the future toRob Austein
resolve immediately, just in case something throws an exception. Don't try to be clever about when to yield in main object checking loop: just trusting Tornado's scheduler to do the right thing seems to give better rsync throughput. svn path=/branches/tk705/; revision=6203
2015-11-28Clean up CheckTALTask.Rob Austein
svn path=/branches/tk705/; revision=6202
2015-11-28Handle staleness and staleness-tainting checks in Python.Rob Austein
svn path=/branches/tk705/; revision=6201
2015-11-28Record staleness tainting.Rob Austein
svn path=/branches/tk705/; revision=6200
2015-11-28Rework StatusCodeDB.normalize(). Apparently order of set operationsRob Austein
matters more when object has a __str__() method. svn path=/branches/tk705/; revision=6199
2015-11-27Simplify manifest walking code: we don't need to walk both current andRob Austein
backup manifests, we just need to walk the best manifest we can find, twice. svn path=/branches/tk705/; revision=6198
2015-11-27Don't dump core if check_aki() is called with an issuer certificateRob Austein
which hasn't previously had X509_check_ca() called on it. svn path=/branches/tk705/; revision=6197
2015-11-27Tweaks to bring rcynicng more into line with rcynic's behavior.Rob Austein
svn path=/branches/tk705/; revision=6196
2015-11-26Oops, RRDP now mandates HTTPS instead of HTTP.Rob Austein
svn path=/branches/tk705/; revision=6195
2015-11-25Starting to look like a validator. Still gets different somewhatRob Austein
results from the original rcynic, still some loose ends and unfinished bits, and no support for RRDP yet (which was sort of the ultimate point of the exercise), but approaching the point of being usable, and about an order of magnitude shorter than the C original. svn path=/branches/tk705/; revision=6194
2015-11-24Add stack forking. At this point the basic tasking structure looks complete.Rob Austein
svn path=/branches/tk705/; revision=6191
2015-11-23first pass on XML output. Incomplete, but enough to get a usefulRob Austein
summary from rcynic-text. svn path=/branches/tk705/; revision=6187
2015-11-23Sort out swamp of multiple generations of manifests and picking best CRL.Rob Austein
svn path=/branches/tk705/; revision=6186
2015-11-23Add CRL.isRevoked() method. General minor cleanup.Rob Austein
svn path=/branches/tk705/; revision=6185
2015-11-22Convert certificate tree walking code to use new tasking model.Rob Austein
Get full rsync code working, history cache and all. svn path=/branches/tk705/; revision=6184
2015-11-22Don't hand null pointer to OpenSSL if we can't find a plausibleRob Austein
issuer. Not sure we really need the complex issuer-finding code at all anymore, but dumping core is not an appropriate form of social criticism. svn path=/branches/tk705/; revision=6183
2015-11-20Checkpoint. Not useful yet, but starting to come together. Tornado is awesome.Rob Austein
svn path=/branches/tk705/; revision=6182
2015-11-20Simple function to add back symbolic names and error strings forRob Austein
OpenSSL certificate verification errors. svn path=/branches/tk705/; revision=6181
2015-11-18Move StatusCode out of POW.c. New API still needs work, but thisRob Austein
makes the C code considerably simpler. svn path=/branches/tk705/; revision=6180
2015-11-18First test of new validation code. No major surprises. Much testingRob Austein
left to do, still need to add in stuff that we pushed out to Python rather than trying to do in C (eg, a lot of the URI tests), but basics seem to work. Checkpointing before attempting a major simplification of the StatusCode mechanism. svn path=/branches/tk705/; revision=6179
2015-11-17First baby steps towards testing new rpki.POW extended validation code.Rob Austein
svn path=/branches/tk705/; revision=6178
2015-11-17Whack CRL.verify() into line with rest of the new code.Rob Austein
svn path=/branches/tk705/; revision=6177
2015-11-16X509Store class removed. X.509 verification moved fromRob Austein
X509Store.verify() to X509.verify(). Result seems to run properly with trivial modification to existing Python BPKI code. RPKI extended validation via this interface (the real point of this exercise) still not tested. svn path=/branches/tk705/; revision=6176
2015-11-16Checkpoint. Basic merge of rcynic.c detailed RPKI checks merged intoRob Austein
POW.c, still totally untested. X.509 certificate validation is in a transitional state, currently spiced with awful kludges so that we're still doing the right thing cryptographically, albeit in a completely disgusting way as far as the API is concerned. Serious cleanup needed, but wanted to get a post-merge version with CMS and X.509 working again after the merge into the repository for backup. svn path=/branches/tk705/; revision=6175
2015-11-14Checkpoint of RPKI-specific detailed certificate checking, based onRob Austein
rcynic.c. New functionality not yet tested, but doesn't seem to have broken break anything in the CA software. (Previous commit accidently included POW.c, oops, but no harm done.) svn path=/branches/tk705/; revision=6174
2015-11-14Comment nit.Rob Austein
svn path=/branches/tk705/; revision=6173
2015-11-13Clean up more gratuitous unused magic CRL autoregeneration.Rob Austein
Regenerate EE certificates along with everything else when activating a new CADetail (ie, when rolling a CA key). svn path=/branches/tk705/; revision=6172
2015-11-12Clean up silly automatic-CRL-and-MFT-regeneration-except-when-its-notRob Austein
hacks: in practice, we always bypassed it (except when we forgot...). Make sure we revoke and withdraw the old certs and objects for ROAs and Ghostbusters rather than the new ones during forced reissue. svn path=/branches/tk705/; revision=6171
2015-11-12Add .__repr__() methods to rpkidb models. RewriteRob Austein
.publish_world_now() to something a little less whacky. Consolidate fix for singleton URIs in SIA fields. svn path=/branches/tk705/; revision=6170
2015-11-12More useful log messages on PDU handling exceptions.Rob Austein
Tweak publication callback mechanism to use uri instead of tag. svn path=/branches/tk705/; revision=6169
2015-11-11Clean up yet another screwball constructor. Other minor cleanup.Rob Austein
svn path=/branches/tk705/; revision=6168
2015-11-11Oops, forgot to commit migration for latest schema change.Rob Austein
svn path=/branches/tk705/; revision=6167
2015-11-11Further simplify CRL and manifest code.Rob Austein
svn path=/branches/tk705/; revision=6166
2015-11-11Keywords.Rob Austein
svn path=/branches/tk705/; revision=6165
2015-11-11Refactor a few of the ridiculously long rpkidb model methods intoRob Austein
rpkid_task code. Combine and simplify CRL and manifest generation. svn path=/branches/tk705/; revision=6164
2015-11-11regenRob Austein
svn path=/branches/tk705/; revision=6163
2015-11-11Configure pylint to use the pylint-django plugin, which (mostly)Rob Austein
understands Django's exotic metaclasses, which in turn allows us to re-enable a number of pylint checks we had disabled. While we were at this, stripped out a bunch of old pylint pragmas, then added back the subset that were really needed. As usual with pylint, this turned up a few real bugs along with an awful lot of noise. svn path=/branches/tk705/; revision=6162
2015-11-10Use a lock to serialize rpkid tasks. Add temporary trace callRob Austein
sequence trace code to rpki.rpkidb.models to assist in simplifying some of the gratuitously complicated method call chains. Various trivial PyLint cleanups. svn path=/branches/tk705/; revision=6161
2015-11-10Add router certificate to test.Rob Austein
svn path=/branches/tk705/; revision=6160
2015-11-05Add StatusCode.__repr__(). Add glorp to pass status set objectRob Austein
through to X509 verification callback handler so it can record status properly. svn path=/branches/tk705/; revision=6159
2015-11-04Checkpoint some preliminary work along the way to doing full low-levelRob Austein
RPKI validation in POW.c. So far this is mostly notes and the support for the status code mechanism. svn path=/branches/tk705/; revision=6158
2015-10-28Now working with PostgreSQL.Rob Austein
svn path=/branches/tk705/; revision=6157
2015-10-27Reenable vile MySQL "latin1" workaround for now.Rob Austein
svn path=/branches/tk705/; revision=6156
2015-10-27Reimplement rpki.gui.models.IPAddressField as a subclass of CharFieldRob Austein
for portability. With this change, the GUI appears to work with SQLite3. svn path=/branches/tk705/; revision=6155
2015-10-26Add warning about CSRF issues when simulating multiple GUI instancesRob Austein
under yamltest. No obvious way to tell Django's CSRF protection to allow this, not entirely sure we'd want to do so even if we could. svn path=/branches/tk705/; revision=6154
2015-10-26Whack a few things stale imports and Django 1.6-isms to get GUIRob Austein
running with new code base. Now working with $ yamltest.py --sql mysql --gui smoketest.1.yaml svn path=/branches/tk705/; revision=6153
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-12 04:25:55 +0000