aboutsummaryrefslogtreecommitdiff
path: root/rcynic
AgeCommit message (Collapse)Author
2012-01-31Refactor CMS checks, which have gotten complex enough to be worthRob Austein
attempting to share between different kinds of signed objects. This closes #82. svn path=/trunk/; revision=4276
2012-01-31AKI extension is optional for self-signed RPKI certificates.Rob Austein
svn path=/trunk/; revision=4275
2012-01-26Back out over-zealous change introduced as part of [4267] --Rob Austein
apparently ASID extensions are legal in EE certificates for ROAs, although given the other constraints I can't think of a sane reason why this is allowed when so much else is nailed down. svn path=/trunk/; revision=4269
2012-01-26Conformance: Check SKI value.Rob Austein
svn path=/trunk/; revision=4268
2012-01-26Conformance: Check CMS SID against EE SKI in ROAs.Rob Austein
Use ASN1_INTEGER_cmp() instead of ASN1_INTEGER_get(), the latter's behavior is too quirky. Add config variable allowing compatability with manifest EE certs that have no SIA extension, which is a technical violation of the spec, albeit a harmless one as far as I can tell; at present, the default for this variable allows these manifests, at some point the default will flip to disallow, as a first step towards phasing this out. svn path=/trunk/; revision=4267
2012-01-26Conformance tests: tighter checking of AIA and SIA extension values.Rob Austein
svn path=/trunk/; revision=4265
2012-01-25Conformance testing: negative serial numbers, wrong date encoding.Rob Austein
svn path=/trunk/; revision=4264
2012-01-25Conformance testing: Better checking of RSA keys.Rob Austein
svn path=/trunk/; revision=4263
2012-01-25Move a few tests out of the not-TA conditional.Rob Austein
svn path=/trunk/; revision=4262
2012-01-25Conformance: Rework checking of X509v3 extensions, add KeyUsageRob Austein
checks, RFC 3779 canonical form checks, other nits. Closes #172. svn path=/trunk/; revision=4261
2012-01-24Fix manifest digest length check. Move parse_cert() call etc intoRob Austein
check_ta() as first step towards fixing extension checks (closes #107, see #172). svn path=/trunk/; revision=4260
2012-01-24Conformance tests: duplicate extensions.Rob Austein
svn path=/trunk/; revision=4259
2012-01-24Conformance tests: digest lengths.Rob Austein
svn path=/trunk/; revision=4258
2012-01-23Conformance tests: pedantic checks of key and signature algorithms.Rob Austein
svn path=/trunk/; revision=4257
2012-01-23Conformance tests: pedantic checks of CRL timestamps.Rob Austein
svn path=/trunk/; revision=4256
2012-01-23Conformance tests: pedantic checks on CRL issuer name, add optionRob Austein
(defaults off) to make nonconformant issuer and subject names fatal. svn path=/trunk/; revision=4255
2011-11-10Handle traversal of empty backup directory with no manifest correctly,Rob Austein
now that this bug isn't masked by the one I fixed earlier today. svn path=/trunk/; revision=4081
2011-11-10Prettyprinter for validation_status.Rob Austein
svn path=/trunk/; revision=4080
2011-11-10Andrew's torture tests detected a mis-ordering problem inRob Austein
walk_ctx_loop_init(): need to bump walk state -before- looking for files not in manifest. svn path=/trunk/; revision=4079
2011-11-03RIPE pilot program Trust Anchor LocatorRob Austein
svn path=/trunk/; revision=4074
2011-10-30CleanupRob Austein
svn path=/trunk/; revision=4072
2011-10-30TAL for ARIN pilot, supplied by Alex Band (thanks!)Rob Austein
svn path=/trunk/; revision=4070
2011-10-30Hacks to ease including portions of script's output in presentations.Rob Austein
svn path=/trunk/; revision=4069
2011-10-27Back out [4066], as it didn't fix the problem and now appearsRob Austein
unnecessary. Add missing assertion. See #112. svn path=/trunk/; revision=4068
2011-10-27Doh, rc->validation_status isn't just for XML anymore.Rob Austein
svn path=/trunk/; revision=4067
2011-10-27Only recheck an object once. This isn't perfect, as there might beRob Austein
three or more paths to a given object in pathological cases, but doing better would require us to record the parent URI for every check and recheck, which doesn't seem worth it for the expected usage. So we don't choose the freshest object in really sick cases. Tough noogies. svn path=/trunk/; revision=4066
2011-10-21Clean up messy timestamp-printing code.Rob Austein
svn path=/trunk/; revision=4060
2011-10-21Add <rsync_history/> elements to XML output (see #110).Rob Austein
svn path=/trunk/; revision=4059
2011-10-21Major cleanup of internal databases:Rob Austein
rc->rsync_cache and rc->dead_host_cache have merged, acquired timestamps, and been renamed rc->rsync_history. Revised code is simpler, even. This is most of #110, but addition of connection data to XML output still needs to be done. rc->backup_cache is gone, as the information it held was a subset of what we were already keeping in rc->validation_status. This was most of the groundwork for #109, but code still needs tweaking to perform this sort of check for objects other than certificates. svn path=/trunk/; revision=4058
2011-10-18More cleanup, add command line parsing, etc. This closes #64.Rob Austein
svn path=/trunk/; revision=4050
2011-10-18First pass cleanup. See #64.Rob Austein
svn path=/trunk/; revision=4049
2011-10-18First cut at Python reimplementation of rcynic.xsl. Still very rough,Rob Austein
needs much cleanup, but already runs an order of magnitude faster than the XSL version. svn path=/trunk/; revision=4048
2011-10-16rsync_succeeded => rsync_transfer_succeeded for consistency with otherRob Austein
event codes. svn path=/trunk/; revision=4047
2011-10-14Log "object_accepted" when we decide we are happy with a TA certificate.Rob Austein
svn path=/trunk/; revision=4044
2011-10-14Add authenticated.old symlink for convenience of programs attemptingRob Austein
to understand rcynic's output. svn path=/trunk/; revision=4043
2011-10-14Preserve node creation order in validation status XML output.Rob Austein
svn path=/trunk/; revision=4042
2011-10-06Rework loop in rsync_mgr() that checks for tasks that have becomeRob Austein
runnable. [4018] changed rsync_run()'s behavior slightly, needed to compensate for that to avoid skipping the next entry in the queue when rsync_run() detects a cache hit. See #98 for the original problem. svn path=/rcynic/rcynic.c; revision=4019
2011-10-06Recheck cache just before starting rsync, in case another rsyncRob Austein
retrieved the data we want while this rsync was queued. Fixes #98. svn path=/rcynic/rcynic.c; revision=4018
2011-10-06Move fcntl(F_SETFL, O_NONBLOCK) to after fork().Rob Austein
svn path=/rcynic/rcynic.c; revision=4017
2011-10-05Check manifest generation before whining about missing backup objects. This ↵Rob Austein
closes #93. svn path=/rcynic/rcynic.c; revision=4013
2011-10-04More explicit certificate expiration checks in CMS verify (see #94).Rob Austein
svn path=/rcynic/rcynic.c; revision=4012
2011-10-03Fixes #93. New config parameter allow-digest-mismatch, default isRob Austein
warn and allow. Digest mismatch is now a warning message only. Missing object that's listed in manifest is now logged as a serious problem. At the moment, we do this for missing objects in both current and backup generations. I'm not sure that's right, might make more sense to log this only for current generation, but let's try running this way for a little while to see what patterns show up. svn path=/rcynic/README; revision=4007
2011-09-29Tweak logging levels for what's debugging vs what's mergely verboseRob Austein
when logging stuff related to rsync subprocesses. svn path=/rcynic/rcynic.c; revision=4004
2011-09-29Remove gratuitous and incorrect assertion unmasked by [4002].Rob Austein
This fixes #91. svn path=/rcynic/rcynic.c; revision=4003
2011-09-29Add rsync_state_closed: pipe from rsync has closed, but rsync hasn'tRob Austein
exited yet. Dunno why this happens, but it does. Apply upper bound to how long rcynic goes to sleep for any one select(); pity kqueue() isn't portable, that'd be a better solution. This closes #87. svn path=/rcynic/rcynic.c; revision=4002
2011-09-24CleanupRob Austein
svn path=/rcynic/bio_f_linebreak.c; revision=4000
2011-09-23Compiler warningRob Austein
svn path=/rcynic/rcynic.c; revision=3999
2011-09-23Minor doc edit, needed to be done, but real purpose of this changesetRob Austein
is to see whether this commit closes #83 properly. svn path=/rcynic/README; revision=3998
2011-09-23Handle multiple CRLs from same issuer properly, or as properly as IRob Austein
know how to manage. Cache values we use on every call to check_x509() in the walk_ctx_t. This closes #83. svn path=/rcynic/rcynic.c; revision=3997
2011-09-21rcynic is now more than one file.Rob Austein
svn path=/rcynic/Doxyfile; revision=3996
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-07 00:26:37 +0000