aboutsummaryrefslogtreecommitdiff
path: root/ext
AgeCommit message (Collapse)Author
2016-04-08OpenSSL 1.1 compatability, part 1.Rob Austein
OpenSSL 1.1 will include some backwards-compatible API changes. In some cases, the new API won't be available until OpenSSL 1.1, but a lot of the new API already exists in OpenSSL 1.0.2. This commit switches the parts that can be switched with OpenSSL 1.0. Other changes deferred until OpenSSL 1.1 public release. svn path=/branches/tk705/; revision=6351
2016-02-09Handle OpenSSL verification codes that aren't present in older OpenSSL branches.Rob Austein
svn path=/branches/tk705/; revision=6242
2015-12-08Rewrite questionable address length check in check_roa().Rob Austein
svn path=/branches/tk705/; revision=6216
2015-12-07Finish prying RPKI conformance checks apart from object verification.Rob Austein
svn path=/branches/tk705/; revision=6214
2015-12-07Start decoupling RPKI profile conformance checks from objectRob Austein
verification per se. Clean up nasty mess in profile conformance checks for router certificates. svn path=/branches/tk705/; revision=6211
2015-12-07Move validation callback to Python.Rob Austein
svn path=/branches/tk705/; revision=6210
2015-12-06Clean up RPKI conformance checking of X.509v3 extensions and elliptic curve ↵Rob Austein
keys. svn path=/branches/tk705/; revision=6209
2015-12-06Fix rcynicng directory rotation code. Checkpoint along the way toRob Austein
cleanup of POW.c RPKI conformance checking code. svn path=/branches/tk705/; revision=6208
2015-11-29Fix confused handling of staleness flags.Rob Austein
svn path=/branches/tk705/; revision=6207
2015-11-29Move more trivial tests from C to Python.Rob Austein
svn path=/branches/tk705/; revision=6205
2015-11-29rcynicng caught a bug in rpkid! Router certificates are forbiddenRob Austein
from having SIA extensions, unlike all other RPKI certificates which are required to have them. Start moving RPKI conformance checks which can be performed in Python out of POW.c, tag a bunch more for consideration. svn path=/branches/tk705/; revision=6204
2015-11-27Don't dump core if check_aki() is called with an issuer certificateRob Austein
which hasn't previously had X509_check_ca() called on it. svn path=/branches/tk705/; revision=6197
2015-11-23Add CRL.isRevoked() method. General minor cleanup.Rob Austein
svn path=/branches/tk705/; revision=6185
2015-11-22Don't hand null pointer to OpenSSL if we can't find a plausibleRob Austein
issuer. Not sure we really need the complex issuer-finding code at all anymore, but dumping core is not an appropriate form of social criticism. svn path=/branches/tk705/; revision=6183
2015-11-20Simple function to add back symbolic names and error strings forRob Austein
OpenSSL certificate verification errors. svn path=/branches/tk705/; revision=6181
2015-11-18Move StatusCode out of POW.c. New API still needs work, but thisRob Austein
makes the C code considerably simpler. svn path=/branches/tk705/; revision=6180
2015-11-18First test of new validation code. No major surprises. Much testingRob Austein
left to do, still need to add in stuff that we pushed out to Python rather than trying to do in C (eg, a lot of the URI tests), but basics seem to work. Checkpointing before attempting a major simplification of the StatusCode mechanism. svn path=/branches/tk705/; revision=6179
2015-11-17First baby steps towards testing new rpki.POW extended validation code.Rob Austein
svn path=/branches/tk705/; revision=6178
2015-11-17Whack CRL.verify() into line with rest of the new code.Rob Austein
svn path=/branches/tk705/; revision=6177
2015-11-16X509Store class removed. X.509 verification moved fromRob Austein
X509Store.verify() to X509.verify(). Result seems to run properly with trivial modification to existing Python BPKI code. RPKI extended validation via this interface (the real point of this exercise) still not tested. svn path=/branches/tk705/; revision=6176
2015-11-16Checkpoint. Basic merge of rcynic.c detailed RPKI checks merged intoRob Austein
POW.c, still totally untested. X.509 certificate validation is in a transitional state, currently spiced with awful kludges so that we're still doing the right thing cryptographically, albeit in a completely disgusting way as far as the API is concerned. Serious cleanup needed, but wanted to get a post-merge version with CMS and X.509 working again after the merge into the repository for backup. svn path=/branches/tk705/; revision=6175
2015-11-14Checkpoint of RPKI-specific detailed certificate checking, based onRob Austein
rcynic.c. New functionality not yet tested, but doesn't seem to have broken break anything in the CA software. (Previous commit accidently included POW.c, oops, but no harm done.) svn path=/branches/tk705/; revision=6174
2015-11-14Comment nit.Rob Austein
svn path=/branches/tk705/; revision=6173
2015-11-11Configure pylint to use the pylint-django plugin, which (mostly)Rob Austein
understands Django's exotic metaclasses, which in turn allows us to re-enable a number of pylint checks we had disabled. While we were at this, stripped out a bunch of old pylint pragmas, then added back the subset that were really needed. As usual with pylint, this turned up a few real bugs along with an awful lot of noise. svn path=/branches/tk705/; revision=6162
2015-11-05Add StatusCode.__repr__(). Add glorp to pass status set objectRob Austein
through to X509 verification callback handler so it can record status properly. svn path=/branches/tk705/; revision=6159
2015-11-04Checkpoint some preliminary work along the way to doing full low-levelRob Austein
RPKI validation in POW.c. So far this is mostly notes and the support for the status code mechanism. svn path=/branches/tk705/; revision=6158
2014-11-12Initial (awful kludge) version of adding RRDP URIs to SIA extension.Rob Austein
This needs rewriting, but doing it properly requires a minor database schema change, and I'm trying to get a test case running by tomorrow morning. svn path=/branches/tk705/; revision=6015
2014-05-30Clang found an unused variable.Rob Austein
svn path=/trunk/; revision=5846
2014-05-29PyLintRob Austein
svn path=/trunk/; revision=5845
2014-05-10Proper idiom.Rob Austein
svn path=/trunk/; revision=5828
2014-05-09RFC 5480 requires that PKIX EC keys be in namedCurve format, notRob Austein
specificCurve format. OpenSSL's documentation claims that namedCurve is the default, but the code generates specificCurve unless one sets the key's asn1_flag field to OPENSSL_EC_NAMED_CURVE. In the immortal words of the late John Brunner: "It's Supposed To Be Automatic But Actually You Have To Press This Button." svn path=/trunk/; revision=5827
2014-04-12rpki.POW internal doc cleanup. See #691.Rob Austein
svn path=/trunk/; revision=5791
2014-04-12Add .extractWithoutVerifying() methods to CMS and derived classes.Rob Austein
This is just a more readable and slightly more efficient (no X509Store object required) idiom for what some code was already doing using the .verify() methods with flag settings to disable verification. Big warnings not to do this with unverified data, but programs intended to post-process data which has already been verified shouldn't have to be unreadable just to rub the programmer's nose in the verification API. svn path=/trunk/; revision=5788
2014-04-07Add .get{Subject,Issuer}Hash() methods.Rob Austein
svn path=/branches/tk685/; revision=5764
2014-04-05Source tree reorg, phase 1. Almost everything moved, no file contents changed.Rob Austein
svn path=/branches/tk685/; revision=5757
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-10 23:30:45 +0000