Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• 5b0e6c593a Added option to use a different key when rebuilding AUTH Martin Willi 2010-12-23 15:40:09 +01:00
• 7721fc6695 Do not print empty DN identities as invalid Martin Willi 2010-12-23 15:22:32 +01:00
• 3fd3f8dea8 Added support for empty subjects DNs to pki --issue Martin Willi 2010-12-23 15:21:52 +01:00
• 97d30f0010 Added support for OCSP responder URIs to conftest Martin Willi 2010-12-23 15:00:34 +01:00
• 7b3740d958 Added support for delta CRL checking to revocation plugin Martin Willi 2010-12-23 14:51:00 +01:00
• 0110c26a04 Use incremented serial of base CRL when signing delta CRL Martin Willi 2010-12-23 14:50:04 +01:00
• 2e90006f96 Show base CRL of delta CRLs in listcrls Martin Willi 2010-12-23 14:40:37 +01:00
• 76cfaf13c1 Verify trustchain for each candidate certificate only once Martin Willi 2010-12-23 14:36:20 +01:00
• 3a89b3c52f Provide CRLs received in CERT payloads to trustchain verification Martin Willi 2010-12-23 12:18:15 +01:00
• 1a79d76abc Added an AUTH_HELPER for revocation certificates Martin Willi 2010-12-23 12:17:49 +01:00
• 968e5e665b Added support for CDPs to conftest Martin Willi 2010-12-23 11:54:17 +01:00
• 85b9e9be99 Added CDP support to mem_cred Martin Willi 2010-12-23 11:54:01 +01:00
• d3a18dade1 Check for issuer only if we actually got a CRL Martin Willi 2010-12-23 11:44:36 +01:00
• 06e6535151 Updated conftest README Martin Willi 2010-12-22 18:00:11 +01:00
• dbec133eb8 Added support for custom file loggers, loglevel settings Martin Willi 2010-12-22 17:19:28 +01:00
• c5f213cc0f Check inhibitAnyPolicy in constraints plugin Martin Willi 2010-12-22 16:08:20 +01:00
• b088fd4a76 Slightly renamed different policyConstraints to distinguish them better Martin Willi 2010-12-22 15:58:00 +01:00
• 6a339fffc7 Added inhibitAnyPolicy constraint support to pki tool Martin Willi 2010-12-22 15:52:19 +01:00
• 07eee80401 Added support for inhibitAnyPolicy constraint to x509 plugin Martin Willi 2010-12-22 15:52:02 +01:00
• b3d359e58f Use a generic getter for all numerical X.509 constraints Martin Willi 2010-12-22 15:10:03 +01:00
• b1703d6cb3 Check inhibitPolicyMapping in constraints plugin Martin Willi 2010-12-22 14:53:46 +01:00
• 927120a128 Check requireExplicitPolicy in constraints plugin Martin Willi 2010-12-22 10:38:06 +01:00
• 8469625fdc Include subject cert to temporary auth info before completing trustchain Martin Willi 2010-12-22 11:49:16 +01:00
• 5eae41c6d8 Fail silently when trying to convert IPv6 address to v4 family host Martin Willi 2010-12-22 11:42:44 +01:00
• 6aba6ff061 Pass an additional anchor flag to validate() hook if we reach the root CA Martin Willi 2010-12-22 10:43:06 +01:00
• 09e319d419 Always pass auth info to validate(), use pathlen to check for user certificate Martin Willi 2010-12-22 10:34:58 +01:00
• 98ef286580 Merge test config into suite config, instead of having two distinct configs Martin Willi 2010-12-20 15:49:00 +01:00
• de8521f6f2 Added support for delta CRLs to pki tool Martin Willi 2010-12-17 17:00:32 +01:00
• 55e4d8982f Added support for delta CRLs to x509 plugin Martin Willi 2010-12-17 16:53:00 +01:00
• 1019cad161 Moved CRL distribution point building to an exportable function Martin Willi 2010-12-17 16:52:04 +01:00
• a6478a0402 Simplified format of x509 CRL URI parsing/enumerator Martin Willi 2010-12-17 15:52:15 +01:00
• e24a02a28f Fail on critical extensions in openssl CRLs Martin Willi 2010-12-17 11:40:01 +01:00
• 51b7e9ce72 Respect enforce_critical setting in x509 plugin CRLs Martin Willi 2010-12-17 11:38:04 +01:00
• d14d3b31b8 Parse CRL extensions in a switch statement Martin Willi 2010-12-17 11:36:15 +01:00
• 6c547631c0 Respect policy mappings in certificatePolicy validation Martin Willi 2010-12-16 16:44:33 +01:00
• 58be32e88e Added a cert_policy option to conftest configurations Martin Willi 2010-12-16 16:18:11 +01:00
• 5595d2bcff Validate simple certificatePolicy inheritance Martin Willi 2010-12-16 11:24:52 +01:00
• 77a288e960 Added a certificate policy OID auth_cfg constraint Martin Willi 2010-12-16 11:25:32 +01:00
• a864eb37b1 Added policyConstraints support to pki tool Martin Willi 2010-12-15 17:46:04 +01:00
• a742d97fb8 Added support for policyConstraints to x509 plugin Martin Willi 2010-12-15 17:45:32 +01:00
• 5dba5852fc Slightly renamed X509_NO_PATH_LEN_CONSTRAINT to use it for PolicyConstraints, too Martin Willi 2010-12-15 16:42:30 +01:00
• 3ffc9d9a88 Added policyMappings support to pki tool Martin Willi 2010-12-15 14:30:09 +00:00
• 5a0caa4b3a Added policyMappings support to x509 plugin Martin Willi 2010-12-15 14:29:25 +00:00
• 5122fa1e02 Added policyMappings OID identifier Martin Willi 2010-12-15 14:28:31 +00:00
• 6c3ac04478 Added certificatePolicy options to pki tool Martin Willi 2010-12-15 14:31:04 +01:00
• 20bd78106e Added certificatePolicy support to x509 plugin Martin Willi 2010-12-15 14:08:20 +01:00
• 1038d9fee5 Added a null-safe strdup variant Martin Willi 2010-12-15 12:15:12 +01:00
• b0892d094c Fail when parsing unsupported critical extensions in openssl_x509 Martin Willi 2010-12-14 17:34:34 +01:00
• 2d3ae93832 Added CertificatePolicy OID identifier Martin Willi 2010-12-14 17:34:02 +01:00
• 7240e2266c Added command line tool for OID to DER conversion function Martin Willi 2010-12-14 14:49:17 +01:00
• feac4a8162 Added conversion functions between string OIDs and its DER encoding Martin Willi 2010-12-14 14:47:44 +01:00
• a6850b8499 Do not parse certificates with invalid version in openssl plugin Martin Willi 2010-12-13 14:22:00 +01:00
• a2b340764f Implemented NameConstraint matching in constraints plugin Martin Willi 2010-12-09 16:39:07 +01:00
• e6fbe5933b pki --issue/self support permitted/excluded NameConstraints Martin Willi 2010-12-09 16:29:22 +01:00
• 64bcaae203 pki --print prints NameConstraints Martin Willi 2010-12-09 13:34:17 +01:00
• 7eeb37dea9 Added support for generating NameConstraints in x509 plugin Martin Willi 2010-12-09 13:33:43 +01:00
• 7c325cee5c Added support for parsing NameConstraints in x509 plugin Martin Willi 2010-12-09 13:33:07 +01:00
• dbfbbec368 Added name constraint enumerator to x509 interface Martin Willi 2010-12-09 11:50:50 +01:00
• a199ef15e6 Migrated x509_cert_t to INIT/METHOD macros Martin Willi 2010-12-09 11:44:31 +01:00
• be8858e9b6 Moved X509 pathlen constraint checking to constraints plugin Martin Willi 2010-12-09 10:46:48 +01:00
• 01d3038137 Added plugin stub for advanced X509 constraint checking Martin Willi 2010-12-09 09:41:54 +00:00
• 0beb1d6fbb Added a hook to reset ESP sequence numbers Martin Willi 2010-12-10 18:18:24 +01:00
• 48ef001133 Accept a suffix to differentiate x509, crl, ecdsa and rsa files Martin Willi 2010-12-10 14:33:28 +01:00
• c7f7a0ba06 Use strncaseeq instead of strncasecmp Martin Willi 2010-12-10 14:25:19 +01:00
• 7a3e0a6321 Added a strncaseeq variant to the string comparison macros Martin Willi 2010-12-10 14:22:18 +01:00
• 04a1279f91 Added tfc_padding option, changes signature to master changes Martin Willi 2010-12-10 11:29:39 +01:00
• 6840a6fb98 CRL/OCSP validation stores trustchain information in auth_cfg Martin Willi 2010-12-07 17:53:13 +01:00
• 473d5aa868 Key strength checking stores all key sizes in auth_cfg, verifies all in complies() Martin Willi 2010-12-07 17:48:23 +01:00
• 37b3fad782 Install "ipsec" script with tools or conftest Martin Willi 2010-12-06 10:36:51 +01:00
• 6ffd9f88ce Use subject, not issuer, of CRL issuing certificate Martin Willi 2010-12-03 14:29:03 +01:00
• dffb176f2b CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation Martin Willi 2010-12-03 13:51:51 +01:00
• ece5ac2271 Parse and encode crlSign keyUsage flag in x509 plugin Martin Willi 2010-12-03 13:26:38 +01:00
• bb0cda2fa9 pki tool shows and builds crlSign keyUsage Martin Willi 2010-12-03 13:25:45 +01:00
• 6807c0ca2c Added a flag for X509 CRLSign keyUsage Martin Willi 2010-12-03 13:24:49 +01:00
• e49bd37b5d Remove x509_flag_names, flags do not work with ENUM() Martin Willi 2010-12-03 13:23:59 +01:00
• 7d7beaa1fa Use certificate CRLIssuer information to look up cacched CRLs or CDPs Martin Willi 2010-12-02 15:38:44 +01:00
• 630d58724a Added --crlissuer option to pki --issue Martin Willi 2010-12-02 15:37:28 +01:00
• 4e508517d7 Added support for CRL Issuers to x509 and OpenSSL plugins Martin Willi 2010-12-03 09:28:46 +00:00
• 9992cb1c10 Generate payload to rebuild_auth, works with injected unknown payloads Martin Willi 2010-12-01 14:56:26 +01:00
• 5c95bf7b93 Move rebuild_auth functionality to a standalone hook Martin Willi 2010-12-01 14:33:57 +01:00
• a73e040cd5 Added key strength constraints support to conftest Martin Willi 2010-11-25 15:27:31 +01:00
• 963b4d9477 Added key strength constraints for RSA or ECDSA trustchains Martin Willi 2010-11-25 15:26:51 +01:00
• 586070d2ce Implemented hook to log traffic selectors Martin Willi 2010-11-25 13:54:31 +01:00
• 6bd3a1c220 The set_reserved() hook rebuilds AUTH if it mangles ID payload fields Martin Willi 2010-11-25 12:32:41 +01:00
• 5f15faebc8 Include the used reserved bytes from ID payloads in AUTH calculation Martin Willi 2010-11-25 11:35:43 +01:00
• 502edf425f Migrated psk/pubkey_authenticators to INIT/METHOD macros Martin Willi 2010-11-25 11:13:04 +01:00
• b5bbc9506c Extended set_reserved hook to mangle sa_payload substructures Martin Willi 2010-11-25 10:55:29 +01:00
• 54f2bdd656 Added substructure enumerators to sa_payload, proposal_substructure Martin Willi 2010-11-25 10:55:08 +01:00
• 9ca5d0280e Moved check if packet already encoded to ike_sa, avoids message() hook invocation twice Martin Willi 2010-11-24 18:09:06 +01:00
• a6da3795d6 The set_ike_version hook supports version flag mangling Martin Willi 2010-11-24 17:45:39 +01:00
• 2813be18f5 Added a message method to set the "higher version supported" flag Martin Willi 2010-11-24 17:45:12 +01:00
• 357e960e40 Implemented hook to toggle initiator flag in IKE header Martin Willi 2010-11-24 17:22:16 +01:00
• 446a4537e5 Implemented a hook to set reserved bits Martin Willi 2010-11-24 14:42:08 +00:00
• 166a2a45d9 Added reserved bit mangling wrapper functions to message Martin Willi 2010-11-24 16:56:46 +01:00
• 15a612efb2 Use payload_get_field() to look up payload fields Martin Willi 2010-11-24 17:07:45 +01:00
• e662d62a76 Implemented a generic payload field lookup function Martin Willi 2010-11-24 16:52:49 +01:00
• bf029696c6 Reserved field get parsed/generated like any other bit/byte field Martin Willi 2010-11-24 16:44:48 +01:00
• c93c7a7560 Added member fields for reserved bits and bytes in all payloads Martin Willi 2010-11-24 16:34:16 +01:00
• 1b671248c2 Migrated vendor_id_payload to INIT/METHOD macros Martin Willi 2010-11-24 14:42:22 +01:00
• 102adb9bfd Migrated ts_payload to INIT/METHOD macros Martin Willi 2010-11-24 14:36:47 +01:00