aboutsummaryrefslogtreecommitdiff
path: root/rcynic/rcynic.c
AgeCommit message (Collapse)Author
2012-06-26Certificate UID fields forbidden by RPKI profile.Rob Austein
svn path=/trunk/; revision=4560
2012-06-24RFC 6485 contradicts RFCs 2630 and 3370, which make rsaEncryption theRob Austein
mandatory-to-support CMS signatureAlgorithm OID. All known existing RPKI engines and validators use CMS engines which follow the base CMS specifications, so this is almost certainly an error in RFC 6485. Allow either rsaEncryption or sha256WithRSAEncryption, pending resolution of this issue by the IETF SIDR WG. svn path=/trunk/; revision=4554
2012-06-23Check OID in CMS SignerInfo contentType attribute (conformance).Rob Austein
svn path=/trunk/; revision=4553
2012-06-22More CMS conformance checks, and fix a couple I got wrong yesterday.Rob Austein
svn path=/trunk/; revision=4551
2012-06-22Check CMS SignerInfo algorithm OIDs (conformance).Rob Austein
svn path=/trunk/; revision=4550
2012-06-22Check CMS for presence of CRLs (conformance).Rob Austein
svn path=/trunk/; revision=4549
2012-06-21Check for duplicate names in manifest (conformance).Rob Austein
svn path=/trunk/; revision=4548
2012-06-21Tighter checking of integer values in input data (conformance).Rob Austein
svn path=/trunk/; revision=4547
2012-06-15Handle all "partial transfer" (rsync code 23) errors the same way.Rob Austein
svn path=/trunk/; revision=4542
2012-06-13Missing directory at repository site is not a transfer failure.Rob Austein
svn path=/trunk/; revision=4538
2012-03-21Shut up about skipped rsync connections when rsync is disabled.Rob Austein
svn path=/trunk/; revision=4407
2012-03-09Move AKI checks to precede signature check, as AKI checks are cheaper.Rob Austein
svn path=/trunk/; revision=4392
2012-03-09Fix fencepost error in walk_ctx_loop_next(). This closes #219.Rob Austein
svn path=/trunk/; revision=4391
2012-03-02Add keep-lockfile, to simplify process queuing.Rob Austein
svn path=/trunk/; revision=4385
2012-03-01Record failure when we can't even parse a trust anchor, much lessRob Austein
check it (eg, recent AfriNIC incident). Fixes #187. svn path=/trunk/; revision=4382
2012-02-26Allow configuration of authenticated and unauthenticated directoriesRob Austein
from command line, to simplify use with alternate fetch mechanisms. svn path=/trunk/; revision=4371
2012-02-15Factor XML generation code out of main(), and don't overwrite old XMLRob Austein
file when we can't run to completion, eg, when some other process is sitting on our lock file. This closes #184. svn path=/trunk/; revision=4335
2012-02-14Downgrade "AIA doesn't match issuer" to a warning. Closes #188.Rob Austein
svn path=/trunk/; revision=4334
2012-02-14Apparently an old version of the res-certs specification allowedRob Austein
1024-bit RSA keys for EE certificates, or so some of the implementors believe, so downgrade that error to a warning for now. This is configurable using the "allow-1024-bit-ee-key" option and defaults to allowing such keys with a warning for now, but that default is subject to change. svn path=/trunk/; revision=4331
2012-02-03"Multiple rsync URIs in extension" should be warning, not error.Rob Austein
svn path=/trunk/; revision=4284
2012-02-02Tweak AIA/SIA/CRLDP checking again: don't accidently reject just forRob Austein
having an alternate URI, do check the whole extension rather than stopping on first success. svn path=/trunk/; revision=4280
2012-02-01AKI checks still weren't quite right.Rob Austein
svn path=/trunk/; revision=4277
2012-01-31Refactor CMS checks, which have gotten complex enough to be worthRob Austein
attempting to share between different kinds of signed objects. This closes #82. svn path=/trunk/; revision=4276
2012-01-31AKI extension is optional for self-signed RPKI certificates.Rob Austein
svn path=/trunk/; revision=4275
2012-01-26Back out over-zealous change introduced as part of [4267] --Rob Austein
apparently ASID extensions are legal in EE certificates for ROAs, although given the other constraints I can't think of a sane reason why this is allowed when so much else is nailed down. svn path=/trunk/; revision=4269
2012-01-26Conformance: Check SKI value.Rob Austein
svn path=/trunk/; revision=4268
2012-01-26Conformance: Check CMS SID against EE SKI in ROAs.Rob Austein
Use ASN1_INTEGER_cmp() instead of ASN1_INTEGER_get(), the latter's behavior is too quirky. Add config variable allowing compatability with manifest EE certs that have no SIA extension, which is a technical violation of the spec, albeit a harmless one as far as I can tell; at present, the default for this variable allows these manifests, at some point the default will flip to disallow, as a first step towards phasing this out. svn path=/trunk/; revision=4267
2012-01-26Conformance tests: tighter checking of AIA and SIA extension values.Rob Austein
svn path=/trunk/; revision=4265
2012-01-25Conformance testing: negative serial numbers, wrong date encoding.Rob Austein
svn path=/trunk/; revision=4264
2012-01-25Conformance testing: Better checking of RSA keys.Rob Austein
svn path=/trunk/; revision=4263
2012-01-25Move a few tests out of the not-TA conditional.Rob Austein
svn path=/trunk/; revision=4262
2012-01-25Conformance: Rework checking of X509v3 extensions, add KeyUsageRob Austein
checks, RFC 3779 canonical form checks, other nits. Closes #172. svn path=/trunk/; revision=4261
2012-01-24Fix manifest digest length check. Move parse_cert() call etc intoRob Austein
check_ta() as first step towards fixing extension checks (closes #107, see #172). svn path=/trunk/; revision=4260
2012-01-24Conformance tests: duplicate extensions.Rob Austein
svn path=/trunk/; revision=4259
2012-01-24Conformance tests: digest lengths.Rob Austein
svn path=/trunk/; revision=4258
2012-01-23Conformance tests: pedantic checks of key and signature algorithms.Rob Austein
svn path=/trunk/; revision=4257
2012-01-23Conformance tests: pedantic checks of CRL timestamps.Rob Austein
svn path=/trunk/; revision=4256
2012-01-23Conformance tests: pedantic checks on CRL issuer name, add optionRob Austein
(defaults off) to make nonconformant issuer and subject names fatal. svn path=/trunk/; revision=4255
2011-11-10Handle traversal of empty backup directory with no manifest correctly,Rob Austein
now that this bug isn't masked by the one I fixed earlier today. svn path=/trunk/; revision=4081
2011-11-10Andrew's torture tests detected a mis-ordering problem inRob Austein
walk_ctx_loop_init(): need to bump walk state -before- looking for files not in manifest. svn path=/trunk/; revision=4079
2011-10-27Back out [4066], as it didn't fix the problem and now appearsRob Austein
unnecessary. Add missing assertion. See #112. svn path=/trunk/; revision=4068
2011-10-27Doh, rc->validation_status isn't just for XML anymore.Rob Austein
svn path=/trunk/; revision=4067
2011-10-27Only recheck an object once. This isn't perfect, as there might beRob Austein
three or more paths to a given object in pathological cases, but doing better would require us to record the parent URI for every check and recheck, which doesn't seem worth it for the expected usage. So we don't choose the freshest object in really sick cases. Tough noogies. svn path=/trunk/; revision=4066
2011-10-21Clean up messy timestamp-printing code.Rob Austein
svn path=/trunk/; revision=4060
2011-10-21Add <rsync_history/> elements to XML output (see #110).Rob Austein
svn path=/trunk/; revision=4059
2011-10-21Major cleanup of internal databases:Rob Austein
rc->rsync_cache and rc->dead_host_cache have merged, acquired timestamps, and been renamed rc->rsync_history. Revised code is simpler, even. This is most of #110, but addition of connection data to XML output still needs to be done. rc->backup_cache is gone, as the information it held was a subset of what we were already keeping in rc->validation_status. This was most of the groundwork for #109, but code still needs tweaking to perform this sort of check for objects other than certificates. svn path=/trunk/; revision=4058
2011-10-16rsync_succeeded => rsync_transfer_succeeded for consistency with otherRob Austein
event codes. svn path=/trunk/; revision=4047
2011-10-14Log "object_accepted" when we decide we are happy with a TA certificate.Rob Austein
svn path=/trunk/; revision=4044
2011-10-14Add authenticated.old symlink for convenience of programs attemptingRob Austein
to understand rcynic's output. svn path=/trunk/; revision=4043
2011-10-14Preserve node creation order in validation status XML output.Rob Austein
svn path=/trunk/; revision=4042
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-02 21:34:57 +0000