aboutsummaryrefslogtreecommitdiff
path: root/rcynic/rcynic.c
AgeCommit message (Collapse)Author
2011-10-06Move fcntl(F_SETFL, O_NONBLOCK) to after fork().Rob Austein
svn path=/rcynic/rcynic.c; revision=4017
2011-10-05Check manifest generation before whining about missing backup objects. This ↵Rob Austein
closes #93. svn path=/rcynic/rcynic.c; revision=4013
2011-10-04More explicit certificate expiration checks in CMS verify (see #94).Rob Austein
svn path=/rcynic/rcynic.c; revision=4012
2011-10-03Fixes #93. New config parameter allow-digest-mismatch, default isRob Austein
warn and allow. Digest mismatch is now a warning message only. Missing object that's listed in manifest is now logged as a serious problem. At the moment, we do this for missing objects in both current and backup generations. I'm not sure that's right, might make more sense to log this only for current generation, but let's try running this way for a little while to see what patterns show up. svn path=/rcynic/README; revision=4007
2011-09-29Tweak logging levels for what's debugging vs what's mergely verboseRob Austein
when logging stuff related to rsync subprocesses. svn path=/rcynic/rcynic.c; revision=4004
2011-09-29Remove gratuitous and incorrect assertion unmasked by [4002].Rob Austein
This fixes #91. svn path=/rcynic/rcynic.c; revision=4003
2011-09-29Add rsync_state_closed: pipe from rsync has closed, but rsync hasn'tRob Austein
exited yet. Dunno why this happens, but it does. Apply upper bound to how long rcynic goes to sleep for any one select(); pity kqueue() isn't portable, that'd be a better solution. This closes #87. svn path=/rcynic/rcynic.c; revision=4002
2011-09-23Compiler warningRob Austein
svn path=/rcynic/rcynic.c; revision=3999
2011-09-23Handle multiple CRLs from same issuer properly, or as properly as IRob Austein
know how to manage. Cache values we use on every call to check_x509() in the walk_ctx_t. This closes #83. svn path=/rcynic/rcynic.c; revision=3997
2011-09-21Still more #83: rework CRL digest check to allow local policy, addRob Austein
check (warning only) of CRLDPs in other objects against manifest EE certificate CRLDP. svn path=/rcynic/README; revision=3995
2011-09-20Further #83: rework check_manifest() to compare manifest numbers,Rob Austein
postpone CRL digest check until we've picked the manifest. svn path=/rcynic/rcynic.c; revision=3993
2011-09-19Progress (not complete) on #83: check CRL numbers rather than justRob Austein
blindly accepting current when both exist, further nit-picky checks (AKI, CRL extensions, CRL and certificate versions). svn path=/rcynic/rcynic.c; revision=3992
2011-09-16Rework CMS checking to use check_x509(). (#82)Rob Austein
Start cleaning up tangled mess of interlocked checks between CRL and manifests. (#83) svn path=/rcynic/README; revision=3991
2011-09-15Consolidate and rationalize validation status codes. (#81)Rob Austein
svn path=/rcynic/rcynic.c; revision=3988
2011-09-15Check TAL URI properly. (#80)Rob Austein
Clean up a bit of dead code. svn path=/rcynic/rcynic.c; revision=3987
2011-09-15Merge rcynic-ng/ back into rcynic/. Used svn merge --ignore-ancestryRob Austein
to minimize problems for people mirroring the repository. svn path=/configure; revision=3985
2011-06-27Construct file:// URI to name local trust anchorsRob Austein
svn path=/rcynic-ng/rcynic.c; revision=3901
2011-06-17Log validation status of trust anchors tooRob Austein
svn path=/rcynic/rcynic.c; revision=3886
2011-06-12Preserve timestamps when copying files.Rob Austein
svn path=/rcynic-ng/rcynic.c; revision=3864
2011-06-07First kill() the subprocess, *then* wait for it to exit. Doh.Rob Austein
svn path=/rcynic/rcynic.c; revision=3855
2011-05-09First cut at scanning both manifest and directory. Disabled byRob Austein
default, because not really right yet: doesn't pay close enough attention to manifest staleness, and doesn't handle directory with multiple manifests gracefully. svn path=/rcynic/rcynic.c; revision=3809
2011-05-07Clean up URI cache checks; fix bug introduced in previous editRob Austein
(walk_cert_1() call that should have been walk_cert_2()). svn path=/rcynic/rcynic.c; revision=3805
2011-05-07Tighten up various checksRob Austein
svn path=/rcynic/rcynic.c; revision=3803
2011-04-13Don't allow EKU extension in CA certs.Rob Austein
svn path=/rcynic/rcynic.c; revision=3771
2011-04-13First cut at restricting X.509v3 extensions to only those allowed by profile.Rob Austein
svn path=/rcynic/rcynic.c; revision=3770
2011-03-22First cut at Ghostbuster record support. Doesn't (yet?) checkRob Austein
anything about the VCard itself. CMS checking code could stand refactoring if I can figure out a sane way to do it while still postponing expensive signature checks until after the cheaper checks. svn path=/rcynic/Makefile.in; revision=3734
2010-12-31"Indirect Trust Anchor" -> "Trust Anchor Locator"Rob Austein
svn path=/rcynic/README; revision=3594
2010-12-29Autoconf now knows how to build rcynic and utils against either ourRob Austein
private OpenSSL or system OpenSSL. Not (yet) hacked for POW and pywrap, nor tested (yet) on any other platform. Mechanism we're using to find our private OpenSSL directory now is kind of icky, may need to switch to some kind of double indirection scheme using AC_SUBST_FILE to hide the nasty bits. svn path=/configure; revision=3580
2010-10-08Mismatch between format string and argument count in error message.Rob Austein
svn path=/rcynic/rcynic.c; revision=3470
2010-08-06More informative title for <hostname/> field.Rob Austein
svn path=/rcynic/rcynic.c; revision=3422
2010-05-26Paranoia: Clean up trust anchor BIOs properly. Almost certainlyRob Austein
doesn't matter unless one has an implausibly large number of trust anchors, but let's keep things tidy. svn path=/rcynic/rcynic.c; revision=3262
2010-05-26indirect-trust-anchorRob Austein
svn path=/rcynic/README; revision=3261
2010-05-05Add classification of the ten zillion codes to XML output, use that toRob Austein
do a bit more color coding. svn path=/rcynic/rcynic.c; revision=3238
2010-05-04Add per-URI validation status to XML output.Rob Austein
svn path=/rcynic/rcynic.c; revision=3235
2010-05-04Suppress all but the first whine about a particular manifest or CRLRob Austein
being stale. svn path=/rcynic/rcynic.c; revision=3234
2010-04-30Rewrite many logging invocation messages in an attempt to impose someRob Austein
consistancy. All concious decisions to reject an object now say so explictly. Well, that's the intent, anyway. svn path=/rcynic/rcynic.c; revision=3233
2010-04-30Better error message for validation failures.Rob Austein
svn path=/rcynic/rcynic.c; revision=3232
2010-03-27Failure to retrieve or disect a remote trust anchor is a data error,Rob Austein
not a local config error, so attempt to keep going if this happens. Not (yet) sure whether this should cause non-zero exit status. Need to do something to highlight Very Bad Things, questions are whether this is worse than other remote data errors and whether this is the right way to highlight. svn path=/rcynic/rcynic.c; revision=3142
2009-11-18Update to new OpenSSL snapshot, to track TLS negotiation protocolRob Austein
bugfixes. While we're at this, switch to 1.0.0-stable snapshot series, with goal of eventually converging on OpenSSL 1.0.0. This included a few changes to track OpenSSL: - The "STRING" type used in the OpenSSL stack macros became "OPENSSL_STRING". - OpenSSL has deprecated the MD2 digest algorithm, so POW code can't refer to it unconditionally (perhaps I should remove support for it from POW entirely, but for now I just honor the compile-time conditional). - OpenSSL's configuration script was whining that I should run "make depend", so I do that now as part of the OpenSSL library build. svn path=/openssl/Makefile; revision=2883
2009-06-30getopt() arguments were stale (thanks, Martin).Rob Austein
svn path=/rcynic/rcynic.c; revision=2552
2009-05-29Silence a gcc warningRob Austein
svn path=/rcynic/rcynic.c; revision=2470
2009-05-28Handle ROAs containing nested prefixes.Rob Austein
svn path=/rcynic/rcynic.c; revision=2458
2009-05-27Update copyright notices in files edited this yearRob Austein
svn path=/rcynic/rcynic.c; revision=2452
2009-04-25Clean up a few warnings that show up on recent Ubuntu systems with gccRob Austein
4.2 and later. svn path=/rcynic/rcynic.c; revision=2357
2009-02-28OpenSSL's ASN.1 template macros confuse the bleep out of Doxygen.Rob Austein
svn path=/rcynic/Doxyfile; revision=2279
2008-12-07Clean up lock fileRob Austein
svn path=/rcynic/rcynic.c; revision=2035
2008-10-25Remove "//" checkRob Austein
svn path=/rcynic/rcynic.c; revision=2029
2008-10-25Add logging and MIB counters for various URI-related failuresRob Austein
svn path=/rcynic/rcynic.c; revision=2028
2008-10-24Better handling of mainfest CRLDP failures.Rob Austein
svn path=/rcynic/rcynic.c; revision=2026
2008-10-10Update to new OpenSSL snapshot. This required code changes to trackRob Austein
new type-safety features in the OpenSSL "stack" metatype. svn path=/openssl/Makefile; revision=2012
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-03 07:36:58 +0000