Tobias Brunner
1589f2d9ae
constraints: Add support for IP address nameConstraints
2023-11-13 12:23:33 +01:00
Tobias Brunner
7ea431cf70
constraints: Fix build with DEBUG_LEVEL < 1
2023-05-08 14:07:18 +02:00
Tobias Brunner
1f870ae189
cert-validator: Use a separate method for online revocation checking
...
This avoids having to repeat offline checks after basic trust chain
validation.
2022-10-03 10:48:46 +02:00
Tobias Brunner
19ef2aec15
Update copyright headers after acquisition by secunet
2022-06-28 10:22:56 +02:00
Martin Willi
7e80995c59
constraints: Use a more specific FQDN/email name constraint matching
...
While RFC 5280 is not very specific about the matching rules of subjectAltNames,
it has some examples how to match email and FQDN constraints. We try to follow
these examples, and restrict DNS names to subdomain matching and email to
full email, host or domain matching.
2014-10-30 11:40:47 +01:00
Martin Willi
69232e2d3d
constraints: Don't reject certificates with invalid certificate policies
...
Instead of rejecting the certificate completely if a certificate has a policy
OID that is actually not allowed by the issuer CA, we accept it. However, the
certificate policy itself is still considered invalid, and is not returned
in the auth config resulting from trust chain operations.
A user must make sure to rely on the returned auth config certificate policies
instead of the policies contained in the certificate; even if the certificate
is valid, the policy OID itself in the certificate are not to be trusted
anymore.
2014-10-30 11:32:19 +01:00
Martin Willi
4163421f91
plugins: Don't link with -rdynamic on Windows
2014-06-04 15:53:02 +02:00
Martin Willi
4d7a762871
credmgr: introduce a hook function to catch trust chain validation errors
2013-07-18 16:00:30 +02:00
Martin Willi
19cb07b890
automake: replace INCLUDES by AM_CPPFLAGS
...
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
2013-07-18 14:59:19 +02:00
Tobias Brunner
c172a92bfb
constraints: Use plugin features with soft dependency on X.509 decoding
2013-06-11 11:18:18 +02:00
Tobias Brunner
f05b427265
Moved debug.[ch] to utils folder
2012-10-24 16:00:51 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Martin Willi
c55818ebb0
Added a (not yet implemented) plugin_t method to reload plugin configuration
2011-04-15 10:07:13 +02:00
Martin Willi
787b5884aa
Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t
2011-04-15 10:07:12 +02:00
Andreas Steffen
d390b3b901
[hopefully] fixed pathlen problem on ARM platforms
2011-02-10 15:51:18 +01:00
Martin Willi
c5f213cc0f
Check inhibitAnyPolicy in constraints plugin
2011-01-05 16:46:05 +01:00
Martin Willi
b3d359e58f
Use a generic getter for all numerical X.509 constraints
2011-01-05 16:46:05 +01:00
Martin Willi
b1703d6cb3
Check inhibitPolicyMapping in constraints plugin
2011-01-05 16:46:05 +01:00
Martin Willi
927120a128
Check requireExplicitPolicy in constraints plugin
2011-01-05 16:46:04 +01:00
Martin Willi
6aba6ff061
Pass an additional anchor flag to validate() hook if we reach the root CA
2011-01-05 16:46:04 +01:00
Martin Willi
09e319d419
Always pass auth info to validate(), use pathlen to check for user certificate
2011-01-05 16:46:04 +01:00
Martin Willi
6c547631c0
Respect policy mappings in certificatePolicy validation
2011-01-05 16:46:03 +01:00
Martin Willi
5595d2bcff
Validate simple certificatePolicy inheritance
2011-01-05 16:46:03 +01:00
Martin Willi
5dba5852fc
Slightly renamed X509_NO_PATH_LEN_CONSTRAINT to use it for PolicyConstraints, too
2011-01-05 16:46:02 +01:00
Martin Willi
a2b340764f
Implemented NameConstraint matching in constraints plugin
2011-01-05 16:46:00 +01:00
Martin Willi
be8858e9b6
Moved X509 pathlen constraint checking to constraints plugin
2011-01-05 16:46:00 +01:00
Martin Willi
01d3038137
Added plugin stub for advanced X509 constraint checking
2011-01-05 16:46:00 +01:00
Tobias Brunner