aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-03-11Debug rekey/revoke code, mostly SQL interface issues.Rob Austein
This fixes #218. I think. svn path=/trunk/; revision=4393
2012-03-09Move AKI checks to precede signature check, as AKI checks are cheaper.Rob Austein
svn path=/trunk/; revision=4392
2012-03-09Fix fencepost error in walk_ctx_loop_next(). This closes #219.Rob Austein
svn path=/trunk/; revision=4391
2012-03-09Use Python "shelve" module to avoid processing XML we've already seenRob Austein
in a previous run, which speeds this tediously slow script up by something close to an order of magnitude. svn path=/trunk/; revision=4390
2012-03-07Start collecting data on how long it takes to run the bits we careRob Austein
about on the relying party side (time to fetch, time to validate). svn path=/trunk/; revision=4389
2012-03-07Break mirroring out of torrent creation, as they may need to run onRob Austein
very different schedules. svn path=/trunk/; revision=4388
2012-03-06Change default host for transmission RPC connection from "localhost"Rob Austein
to "127.0.0.1". Feh. svn path=/trunk/; revision=4387
2012-03-02Add lockfile support, to let us serialize rcynic runs. AllowRob Austein
configuration of our idea of the unauthenticated directory independent of rcynic, to avoid interfering with chroot configuration. svn path=/trunk/; revision=4386
2012-03-02Add keep-lockfile, to simplify process queuing.Rob Austein
svn path=/trunk/; revision=4385
2012-03-02First smoke test of generation and upload code.Rob Austein
svn path=/trunk/; revision=4384
2012-03-01Add seed ratio tweak.Rob Austein
svn path=/trunk/; revision=4383
2012-03-01Record failure when we can't even parse a trust anchor, much lessRob Austein
check it (eg, recent AfriNIC incident). Fixes #187. svn path=/trunk/; revision=4382
2012-03-01Work around atomic-rename problem using OpenSSH-specific extension.Rob Austein
svn path=/trunk/; revision=4381
2012-03-01Ignore atomic installation issue for now. Maybe ask author ofRob Austein
paramiko about it some day. svn path=/trunk/; revision=4380
2012-03-01Generation of new torrents almost working, except that SFTP doesn'tRob Austein
support atomic rename without a protocol extension which paramiko doesn't support (yet?). Yeargh. svn path=/trunk/; revision=4379
2012-02-29CheckpointRob Austein
svn path=/trunk/; revision=4378
2012-02-29Whack rootd's silly handling of CRL numbers and subject certificateRob Austein
serial numbers, to avoid resetting these values when rootd reboots. rootd is such a kludge. This fixes #214. svn path=/trunk/; revision=4377
2012-02-29CheckpointRob Austein
svn path=/trunk/; revision=4376
2012-02-28CheckpointRob Austein
svn path=/trunk/; revision=4375
2012-02-28CheckpointRob Austein
svn path=/trunk/; revision=4374
2012-02-28IdRob Austein
svn path=/trunk/; revision=4373
2012-02-28Checkpoint of rcynic-over-BitTorrent hack, using transmission-daemonRob Austein
as the BitTorrent engine. This is a work in progress, and doesn't yet include the hacks either to generate torrents or to follow multiple torrents in parallel. svn path=/trunk/; revision=4372
2012-02-26Allow configuration of authenticated and unauthenticated directoriesRob Austein
from command line, to simplify use with alternate fetch mechanisms. svn path=/trunk/; revision=4371
2012-02-25.mnf -> .mft.Rob Austein
svn path=/trunk/; revision=4370
2012-02-21Another test configuration.Rob Austein
svn path=/trunk/; revision=4356
2012-02-20Include self_handle in up-down resource mismatch reports. Closes #14.Rob Austein
svn path=/trunk/; revision=4355
2012-02-17Revoke certificates and clean up published objects when processing aRob Austein
left-right destroy action. Clean up empty publication directories on withdrawal. Fix rootd's handling of CRLs and manifests. See #197. svn path=/trunk/; revision=4354
2012-02-17First cut at cleaning up litter left behind in repository if the UIRob Austein
just deletes the <self/> object. See #197. svn path=/trunk/; revision=4352
2012-02-17RegenRob Austein
svn path=/trunk/; revision=4347
2012-02-17Allow AS 0 in <roa_request/> objects. Closes #195.Rob Austein
svn path=/trunk/; revision=4346
2012-02-16Add --password hack to feed "override: password" lines to irr_rpsl_submit.Rob Austein
svn path=/trunk/; revision=4345
2012-02-15Factor XML generation code out of main(), and don't overwrite old XMLRob Austein
file when we can't run to completion, eg, when some other process is sitting on our lock file. This closes #184. svn path=/trunk/; revision=4335
2012-02-14Downgrade "AIA doesn't match issuer" to a warning. Closes #188.Rob Austein
svn path=/trunk/; revision=4334
2012-02-14Apparently an old version of the res-certs specification allowedRob Austein
1024-bit RSA keys for EE certificates, or so some of the implementors believe, so downgrade that error to a warning for now. This is configurable using the "allow-1024-bit-ee-key" option and defaults to allowing such keys with a warning for now, but that default is subject to change. svn path=/trunk/; revision=4331
2012-02-09add support to irbe_cli for ghostbusters in the publication protocol. ↵Michael Elkins
closes #185 svn path=/trunk/; revision=4320
2012-02-04Change line style to linespoints.Rob Austein
svn path=/trunk/; revision=4293
2012-02-04Extract latest rcynic.xml from mailbox.Rob Austein
svn path=/trunk/; revision=4292
2012-02-03Change manifest filename extension from .mnf to .mft, to comply withRob Austein
the soon-to-be RFC. Closes #37. svn path=/trunk/; revision=4288
2012-02-03Clean up exceptions in rpki.x509.CMS_object.verify().Rob Austein
Up-down specification explictly allows certificates and CRLs we consider extraneous to be included in CMS messages. I think that any verification model which relies on these is flawed, so I don't use them, in fact, nobody does, but I was unable to convince my co-authors to change the specification. Sigh. So the up-down code has to allow these. In theory, OpenSSL's verification code should have no problem picking the useful bits out of the garbage, since that's a normal part of OpenSSL's job when acting as a TLS client, so we just pass the mess along to OpenSSL and let OpenSSL sort it out. This closes #9. svn path=/trunk/; revision=4287
2012-02-03Clean up rcynic test data during "make clean".Rob Austein
svn path=/trunk/; revision=4286
2012-02-03"Multiple rsync URIs in extension" should be warning, not error.Rob Austein
svn path=/trunk/; revision=4284
2012-02-02Add --suppress_backup_whining: Suppress whining about bad backupRob Austein
objects when the current objects at the same URL are OK. Enabled (whining suppressed) by default, use the switch if you prefer the old behavior. See #177. svn path=/trunk/; revision=4281
2012-02-02Tweak AIA/SIA/CRLDP checking again: don't accidently reject just forRob Austein
having an alternate URI, do check the whole extension rather than stopping on first success. svn path=/trunk/; revision=4280
2012-02-01AKI checks still weren't quite right.Rob Austein
svn path=/trunk/; revision=4277
2012-01-31Refactor CMS checks, which have gotten complex enough to be worthRob Austein
attempting to share between different kinds of signed objects. This closes #82. svn path=/trunk/; revision=4276
2012-01-31AKI extension is optional for self-signed RPKI certificates.Rob Austein
svn path=/trunk/; revision=4275
2012-01-31Rewrite to avoid running out of memory. Painfully slow with threeRob Austein
month's worth of data, but at least it now runs again. svn path=/trunk/; revision=4273
2012-01-26Back out over-zealous change introduced as part of [4267] --Rob Austein
apparently ASID extensions are legal in EE certificates for ROAs, although given the other constraints I can't think of a sane reason why this is allowed when so much else is nailed down. svn path=/trunk/; revision=4269
2012-01-26Conformance: Check SKI value.Rob Austein
svn path=/trunk/; revision=4268
2012-01-26Conformance: Check CMS SID against EE SKI in ROAs.Rob Austein
Use ASN1_INTEGER_cmp() instead of ASN1_INTEGER_get(), the latter's behavior is too quirky. Add config variable allowing compatability with manifest EE certs that have no SIA extension, which is a technical violation of the spec, albeit a harmless one as far as I can tell; at present, the default for this variable allows these manifests, at some point the default will flip to disallow, as a first step towards phasing this out. svn path=/trunk/; revision=4267
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-30 16:10:22 +0000