aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-08-30Cleanup.Rob Austein
svn path=/trunk/; revision=5479
2013-08-30Refactor X.509 verification code to add "nested set" tree markings toRob Austein
SQL as we go; since the expensive part of the SQL marking algorithm is the tree traversal and we have to do the same tree walk anyway while checking certificates, we might as well do both tasks at once. svn path=/trunk/; revision=5478
2013-08-29Cleanup.Rob Austein
svn path=/trunk/; revision=5477
2013-08-29Cleanup.Rob Austein
svn path=/trunk/; revision=5476
2013-08-29Now that we have a Python interface to the OpenSSL certificateRob Austein
validation code, use it to sanitize our database. svn path=/trunk/; revision=5475
2013-08-28Checkpoint.Rob Austein
svn path=/trunk/; revision=5474
2013-08-28Pass Python exceptions from callback through to caller correctly.Rob Austein
svn path=/trunk/; revision=5473
2013-08-28Cleanup.Rob Austein
svn path=/trunk/; revision=5472
2013-08-28Rework the new certificate validation code to better encapsulate theRob Austein
underlying semantics in a Pythonic wrapper: X509Store.verify() now instantiates X509StoreCTX, and .verify_callback() is now an optional method supplied by the user via subclassing. svn path=/trunk/; revision=5471
2013-08-27X509StoreCTX.getCurrentCertificate() and X509StoreCTX.getChain().Rob Austein
svn path=/trunk/; revision=5470
2013-08-27X509StoreCTX.store property.Rob Austein
svn path=/trunk/; revision=5469
2013-08-27Doh, simpler.Rob Austein
svn path=/trunk/; revision=5468
2013-08-27CleanupRob Austein
svn path=/trunk/; revision=5467
2013-08-27Move most control operations from X509StoreCTX to X509Store.Rob Austein
svn path=/trunk/; revision=5466
2013-08-25Fix various things that required sequences to accept iterables. Fix aRob Austein
few incorrect error messages. svn path=/trunk/; revision=5465
2013-08-25Certificate verification code approaching something usable.Rob Austein
svn path=/trunk/; revision=5464
2013-08-24Basic certificate verification works. Needs a bunch of additionalRob Austein
methods, properties, and constants to be fully useful. svn path=/trunk/; revision=5463
2013-08-23Rip out PEM_converter class, as we no longer need to supportRob Austein
interoperation between three separate ASN.1 packages and our updated rpki.POW PEM functions use the OpenSSL libraries to handle corner cases that PEM_converter did not, like PKCS8. See #603. Fix log-rate-limiting in Auto_update DER objects to be time-based rather than counter based; reorder checks so that daemons will have some chance of recovering when the user does something strange with required .cer or .key files then repairs the error. See #602. svn path=/trunk/; revision=5462
2013-08-23Notes on future work to track OpenSSL's PKCS #1.5 -> PKCS #8 transition.Rob Austein
svn path=/trunk/; revision=5461
2013-08-22First cut at adding a .verify() method back to the X509Store class.Rob Austein
Not done yet, but does have the tricky bit (Python callback). svn path=/trunk/; revision=5460
2013-08-20Checkpoint.Rob Austein
svn path=/trunk/; revision=5459
2013-08-20Checkpoint.Rob Austein
svn path=/trunk/; revision=5458
2013-08-18CheckpointRob Austein
svn path=/trunk/; revision=5457
2013-08-17Checkpoint.Rob Austein
svn path=/trunk/; revision=5456
2013-08-14CheckpointRob Austein
svn path=/trunk/; revision=5455
2013-08-14Checkpoint. Nowhere near usable yet.Rob Austein
svn path=/trunk/; revision=5454
2013-08-09Notes on constraint file processing.Rob Austein
svn path=/trunk/; revision=5453
2013-08-09Allow query for NULL AKI or SKI. May not be all that useful, as ourRob Austein
data source is the unauthenticated/ tree, thus we still need to check against TALs, at which point we might as well just look up by URI. svn path=/trunk/; revision=5452
2013-08-08First steps towards parsing LTA YAML file. Add weakref object cache.Rob Austein
svn path=/trunk/; revision=5451
2013-08-06Wrap up database interface as a class.Rob Austein
svn path=/trunk/; revision=5450
2013-08-05Partial support for RFC 3779 inheritance.Rob Austein
svn path=/trunk/; revision=5449
2013-08-05Move GROUP BY to right place when restricting search by object type.Rob Austein
Consolidate simplified range search functions. More test cases. svn path=/trunk/; revision=5448
2013-08-05Add marker byte to be sure that IP addresses can't be confused withRob Austein
ASNs in our unified range table. Clean up unneeded debugging code. svn path=/trunk/; revision=5447
2013-08-05Checkpoint.Rob Austein
svn path=/trunk/; revision=5446
2013-07-30Log a warning if we accept an EE certificate whenRob Austein
allow_ee_without_signedObject is active. Fixes #591. svn path=/trunk/; revision=5445
2013-07-25Add a couple of harmless rules which should not be necessary but theRob Austein
absence of which seems to be confusing "make" for one user. See #586. svn path=/trunk/; revision=5444
2013-07-24Pickling support.Rob Austein
svn path=/trunk/; revision=5443
2013-07-23Apparently I never set svn:keywords for this file.Rob Austein
svn path=/trunk/; revision=5442
2013-07-19Push updated BPKI CRL into pubd at the same time as we're pushingRob Austein
updated BSCs into rpkid. svn path=/trunk/; revision=5441
2013-07-18Fix UTCTime printout for CMS signing time.Rob Austein
svn path=/trunk/; revision=5440
2013-07-18GCC warning.Rob Austein
svn path=/trunk/; revision=5439
2013-07-18Log stale BPKI CMS CRLs. See #294.Rob Austein
svn path=/trunk/; revision=5438
2013-07-17Drop rootd's manifest and CRL interval down to same interval used forRob Austein
regenerating the subject certificate, to avoid confusing GUI expiration checker when rcynic has rsync-early disabled. See #579. svn path=/trunk/; revision=5437
2013-07-17Bump default lifetime of RPKI certificate rootd issues to rpkid up toRob Austein
eight weeks, to play better with GUI's expiration timer. Closes #579. svn path=/trunk/; revision=5436
2013-07-17Add ability for auto_update DER objects to coast through transientRob Austein
failures like missing files. Closes #580. svn path=/trunk/; revision=5435
2013-07-17Sigh, RIPE's web page is confusing, going with what Tim said on theRob Austein
SIDR list, which suggests that they've collapsed down to a single TAL for both hosted and non-hosted pilot service. Closes #584. svn path=/trunk/; revision=5434
2013-07-17RIPE's hosted pilot (different from RIPE's non-hosted pilot, which isRob Austein
also different from RIPE's production service). Closes #584. svn path=/trunk/; revision=5433
2013-07-16Send exceptions in irdb_query() to the errback handler rather thanRob Austein
letting them propagate. See #580. svn path=/trunk/; revision=5432
2013-07-16Wrap ridiculously long lines.Rob Austein
svn path=/trunk/; revision=5431
2013-07-16Save rcynic-html for last in rcynic-cron, as it's less critical thanRob Austein
tasks like feeding the rpki-rtr engine. Treat failure to find rrdtool as a fatal error during ./configure, to avoid building a version of rcynic-html that can't generate graphs. Closes #583. svn path=/trunk/; revision=5430
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-06 09:35:07 +0000