aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-03-01Generation of new torrents almost working, except that SFTP doesn'tRob Austein
support atomic rename without a protocol extension which paramiko doesn't support (yet?). Yeargh. svn path=/trunk/; revision=4379
2012-02-29CheckpointRob Austein
svn path=/trunk/; revision=4378
2012-02-29Whack rootd's silly handling of CRL numbers and subject certificateRob Austein
serial numbers, to avoid resetting these values when rootd reboots. rootd is such a kludge. This fixes #214. svn path=/trunk/; revision=4377
2012-02-29CheckpointRob Austein
svn path=/trunk/; revision=4376
2012-02-28CheckpointRob Austein
svn path=/trunk/; revision=4375
2012-02-28CheckpointRob Austein
svn path=/trunk/; revision=4374
2012-02-28IdRob Austein
svn path=/trunk/; revision=4373
2012-02-28Checkpoint of rcynic-over-BitTorrent hack, using transmission-daemonRob Austein
as the BitTorrent engine. This is a work in progress, and doesn't yet include the hacks either to generate torrents or to follow multiple torrents in parallel. svn path=/trunk/; revision=4372
2012-02-26Allow configuration of authenticated and unauthenticated directoriesRob Austein
from command line, to simplify use with alternate fetch mechanisms. svn path=/trunk/; revision=4371
2012-02-25.mnf -> .mft.Rob Austein
svn path=/trunk/; revision=4370
2012-02-21Another test configuration.Rob Austein
svn path=/trunk/; revision=4356
2012-02-20Include self_handle in up-down resource mismatch reports. Closes #14.Rob Austein
svn path=/trunk/; revision=4355
2012-02-17Revoke certificates and clean up published objects when processing aRob Austein
left-right destroy action. Clean up empty publication directories on withdrawal. Fix rootd's handling of CRLs and manifests. See #197. svn path=/trunk/; revision=4354
2012-02-17First cut at cleaning up litter left behind in repository if the UIRob Austein
just deletes the <self/> object. See #197. svn path=/trunk/; revision=4352
2012-02-17RegenRob Austein
svn path=/trunk/; revision=4347
2012-02-17Allow AS 0 in <roa_request/> objects. Closes #195.Rob Austein
svn path=/trunk/; revision=4346
2012-02-16Add --password hack to feed "override: password" lines to irr_rpsl_submit.Rob Austein
svn path=/trunk/; revision=4345
2012-02-15Factor XML generation code out of main(), and don't overwrite old XMLRob Austein
file when we can't run to completion, eg, when some other process is sitting on our lock file. This closes #184. svn path=/trunk/; revision=4335
2012-02-14Downgrade "AIA doesn't match issuer" to a warning. Closes #188.Rob Austein
svn path=/trunk/; revision=4334
2012-02-14Apparently an old version of the res-certs specification allowedRob Austein
1024-bit RSA keys for EE certificates, or so some of the implementors believe, so downgrade that error to a warning for now. This is configurable using the "allow-1024-bit-ee-key" option and defaults to allowing such keys with a warning for now, but that default is subject to change. svn path=/trunk/; revision=4331
2012-02-09add support to irbe_cli for ghostbusters in the publication protocol. ↵Michael Elkins
closes #185 svn path=/trunk/; revision=4320
2012-02-04Change line style to linespoints.Rob Austein
svn path=/trunk/; revision=4293
2012-02-04Extract latest rcynic.xml from mailbox.Rob Austein
svn path=/trunk/; revision=4292
2012-02-03Change manifest filename extension from .mnf to .mft, to comply withRob Austein
the soon-to-be RFC. Closes #37. svn path=/trunk/; revision=4288
2012-02-03Clean up exceptions in rpki.x509.CMS_object.verify().Rob Austein
Up-down specification explictly allows certificates and CRLs we consider extraneous to be included in CMS messages. I think that any verification model which relies on these is flawed, so I don't use them, in fact, nobody does, but I was unable to convince my co-authors to change the specification. Sigh. So the up-down code has to allow these. In theory, OpenSSL's verification code should have no problem picking the useful bits out of the garbage, since that's a normal part of OpenSSL's job when acting as a TLS client, so we just pass the mess along to OpenSSL and let OpenSSL sort it out. This closes #9. svn path=/trunk/; revision=4287
2012-02-03Clean up rcynic test data during "make clean".Rob Austein
svn path=/trunk/; revision=4286
2012-02-03"Multiple rsync URIs in extension" should be warning, not error.Rob Austein
svn path=/trunk/; revision=4284
2012-02-02Add --suppress_backup_whining: Suppress whining about bad backupRob Austein
objects when the current objects at the same URL are OK. Enabled (whining suppressed) by default, use the switch if you prefer the old behavior. See #177. svn path=/trunk/; revision=4281
2012-02-02Tweak AIA/SIA/CRLDP checking again: don't accidently reject just forRob Austein
having an alternate URI, do check the whole extension rather than stopping on first success. svn path=/trunk/; revision=4280
2012-02-01AKI checks still weren't quite right.Rob Austein
svn path=/trunk/; revision=4277
2012-01-31Refactor CMS checks, which have gotten complex enough to be worthRob Austein
attempting to share between different kinds of signed objects. This closes #82. svn path=/trunk/; revision=4276
2012-01-31AKI extension is optional for self-signed RPKI certificates.Rob Austein
svn path=/trunk/; revision=4275
2012-01-31Rewrite to avoid running out of memory. Painfully slow with threeRob Austein
month's worth of data, but at least it now runs again. svn path=/trunk/; revision=4273
2012-01-26Back out over-zealous change introduced as part of [4267] --Rob Austein
apparently ASID extensions are legal in EE certificates for ROAs, although given the other constraints I can't think of a sane reason why this is allowed when so much else is nailed down. svn path=/trunk/; revision=4269
2012-01-26Conformance: Check SKI value.Rob Austein
svn path=/trunk/; revision=4268
2012-01-26Conformance: Check CMS SID against EE SKI in ROAs.Rob Austein
Use ASN1_INTEGER_cmp() instead of ASN1_INTEGER_get(), the latter's behavior is too quirky. Add config variable allowing compatability with manifest EE certs that have no SIA extension, which is a technical violation of the spec, albeit a harmless one as far as I can tell; at present, the default for this variable allows these manifests, at some point the default will flip to disallow, as a first step towards phasing this out. svn path=/trunk/; revision=4267
2012-01-26Manifest EE certificates were not including the SIA signedObject URI,Rob Austein
as required by the current manifest specification. svn path=/trunk/; revision=4266
2012-01-26Conformance tests: tighter checking of AIA and SIA extension values.Rob Austein
svn path=/trunk/; revision=4265
2012-01-25Conformance testing: negative serial numbers, wrong date encoding.Rob Austein
svn path=/trunk/; revision=4264
2012-01-25Conformance testing: Better checking of RSA keys.Rob Austein
svn path=/trunk/; revision=4263
2012-01-25Move a few tests out of the not-TA conditional.Rob Austein
svn path=/trunk/; revision=4262
2012-01-25Conformance: Rework checking of X509v3 extensions, add KeyUsageRob Austein
checks, RFC 3779 canonical form checks, other nits. Closes #172. svn path=/trunk/; revision=4261
2012-01-24Fix manifest digest length check. Move parse_cert() call etc intoRob Austein
check_ta() as first step towards fixing extension checks (closes #107, see #172). svn path=/trunk/; revision=4260
2012-01-24Conformance tests: duplicate extensions.Rob Austein
svn path=/trunk/; revision=4259
2012-01-24Conformance tests: digest lengths.Rob Austein
svn path=/trunk/; revision=4258
2012-01-23Conformance tests: pedantic checks of key and signature algorithms.Rob Austein
svn path=/trunk/; revision=4257
2012-01-23Conformance tests: pedantic checks of CRL timestamps.Rob Austein
svn path=/trunk/; revision=4256
2012-01-23Conformance tests: pedantic checks on CRL issuer name, add optionRob Austein
(defaults off) to make nonconformant issuer and subject names fatal. svn path=/trunk/; revision=4255
2012-01-06Lab test of rpki-rtr over TLS using stunnel and s_clientRob Austein
svn path=/trunk/; revision=4143
2012-01-05OpenSSL 1.0.0fRob Austein
svn path=/trunk/; revision=4141
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-05 13:26:44 +0000