summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* trust: Simplify the check for the magicDaiki Ueno2017-05-183-12/+17
| | | | | Instead of reusing the CKA_X_GENERATED attribute, check the file contents directly in the caller side.
* trust: Check magic comment in persist file for modifiablityDaiki Ueno2017-05-183-2/+14
| | | | | | | A persistent file written by the trust module starts with the line "# This file has been auto-generated and written by p11-kit". This can be used as a magic word to determine whether the objects read from a .p11-kit file are read-only.
* Revert "trust: Honor "modifiable" setting in persist file"Daiki Ueno2017-05-183-11/+1
| | | | | This reverts commit 8eed1e60b0921d05872e2f43eee9088cef038d7e, which broke "trust anchor --remove".
* remote: Fix typo when writing a credential byteDaiki Ueno2017-03-091-1/+1
| | | | | out_fd is not always 1 when p11_kit_remote_serve_module() is used for writing a custom server.
* correct text for --user-config optionDaniel Black2017-03-061-1/+1
|
* Release 0.23.5Daiki Ueno2017-03-022-1/+6
|
* build: Remove systemd unit files for nowDaiki Ueno2017-03-013-39/+0
| | | | | | | | | Given that the remote proxy service shall be only used by NetworkManager and not generally useful, revert commit a4fb2bb587fb1a0146cf97f039b671d3258488f9 for now. Once the necessary command that runs the proxy module is implemented in p11-kit, maybe NetworkManager itself could install those files.
* systemd: Fix location of p11-kit-remoteDaiki Ueno2017-02-274-2/+11
| | | | | The p11-kit-remote executable is now located under $libexecdir, but we should use the p11-kit command to launch the subcommand.
* fixed license in unix peer fileNikos Mavrogiannopoulos2017-02-271-12/+27
|
* build: add missing includes for FreeBSDRoman Bogorodskiy2017-02-241-0/+1
| | | | Include signal.h for kill(2) and SIGKILL on FreeBSD.
* build: check for getpeereidRoman Bogorodskiy2017-02-241-0/+1
| | | | | | In common/unix-peer.c, we are checking if HAVE_GETPEEREID is defined, however, we never actually check if getpeereid() is available, so fix that by checking this function using AC_CHECK_FUNCS().
* Release 0.23.4Daiki Ueno2017-02-222-3/+20
|
* uri: Support vendor query attributesDaiki Ueno2017-02-214-2/+146
| | | | | | | | If an unknown attribute is present in the query part of the PKCS#11 URI, the parser treated it as unrecognized and subsequent matches failed. Instead, keep track of such attributes and provide a set of API to deal with them.
* rpc: Make it less verbose about connection failureDaiki Ueno2017-02-211-1/+1
| | | | | The connection failure here is not fatal. Use p11_debug() instead of p11_message().
* rpc: Try $XDG_CACHE_HOME before ~/.cacheMantas Mikulėnas2017-02-211-0/+11
| | | | | This is unset on most systems, but might as well follow the Base Directory spec properly.
* trust: Honor "modifiable" setting in persist fileDaiki Ueno2017-02-203-1/+11
| | | | | | | | | Previously, all objects read from p11-kit persist files are marked as modifiable when parsing, regardless of the explicit "modifiable: false" setting in the file. Reported by Kai Engert in: https://bugs.freedesktop.org/show_bug.cgi?id=99797
* rpc: Add PKCS#11 module that connects to socketDaiki Ueno2017-02-1712-71/+543
| | | | | | | | | | | | | | | This patch adds a PKCS#11 module that connects to the p11-kit server exposed on the filesystem. The filename of the socket is determined in the following order: - $P11_KIT_SERVER_ADDRESS, if the envvar is available - $XDG_RUNTIME_DIR/p11-kit/pkcs11, if the envvar is available - /run/$(id -u)/p11-kit/pkcs11, if /run/$(id -u) exists - /var/run/$(id -u)/p11-kit/pkcs11, if /var/run/$(id -u) exists - ~/.cache/p11-kit/pkcs11. Note that the program loading this module may have called setuid() and secure_getenv() which we use for fetching envvars could return NULL.
* remote: Add API to serve a tokenDaiki Ueno2017-02-173-0/+43
|
* remote, server: Recognize PKCS#11 URIDaiki Ueno2017-02-171-8/+69
|
* p11-kit: Add 'p11-kit server' commandNikos Mavrogiannopoulos2017-02-173-0/+595
| | | | | | | | This adds a new tool to the p11-kit command called 'server', which allows us to access a PKCS#11 module over a Unix domain socket. Internally, it is implemented as a wrapper around 'p11-kit remote'. Upon connection it executes 'p11-kit remote' in a forked process.
* common: New p11_get_upeer_id() functionNikos Mavrogiannopoulos2017-02-173-0/+132
|
* rpc: New rpc_unix transport based on Unix socketNikos Mavrogiannopoulos2017-02-162-0/+207
|
* common: Add path encoding functionsDaiki Ueno2017-02-163-0/+59
| | | | | | | | | This adds p11_path_{encode,decode}(), following the escaping rule described in: https://dbus.freedesktop.org/doc/dbus-specification.html#addresses Although they are merely a wrapper around p11_url_{decode,encode}(), having dedicated functions hides the implementation details.
* travis: Enable mingw64 cross buildDaiki Ueno2017-02-161-5/+11
|
* trust: Fix uninitialized value in anchor commandDaiki Ueno2017-02-161-1/+1
|
* library: Initialize p11_virtual_mutex for WindowsDaiki Ueno2017-02-161-0/+2
|
* test: Fix modules test for WindowsDaiki Ueno2017-02-162-4/+4
| | | | | Synchronize the fixture module to the non-Unix one and enable "/modules/test_filename".
* trust: Fix saving trust file on WindowsDaiki Ueno2017-02-161-6/+9
|
* test: Fix Windows test case for p11_path_expandDaiki Ueno2017-02-161-1/+1
|
* rpc: Port exec transport to WindowsDaiki Ueno2017-02-161-30/+245
| | | | | | | On Windows, use _spawnv() to create a subprocess and two unidirectional pipe created with _pipe() to communicate with it. If we can assume WinSock, it might be simpler to use a socketpair() replacement from: https://github.com/ncm/selectable-socketpair.
* build: Adjust executable/module names for WindowsDaiki Ueno2017-02-163-3/+10
| | | | Append EXEEXT or SHLEXT to the filename if needed.
* build: Avoid undefined reference to rpc_exec_initDaiki Ueno2017-02-161-2/+3
|
* build: Include <unistd.h> for execvDaiki Ueno2017-02-161-0/+1
|
* build: Check *asprintf on all platformsDaiki Ueno2017-02-161-3/+4
|
* argv: Fix misinterpretation of backslash in quotesDaiki Ueno2017-02-163-1/+119
| | | | | Don't append the backslash character twice to the output. It is interpolated a few lines below, if it is really required.
* compat: Fix character generation in mk{s,d}temp()Daiki Ueno2017-02-161-1/+1
|
* Fix a typo in "x-cetrificate-value", see also ↵Kai Engert2017-02-161-1/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=99600
* Support loading new NSS attribute CKA_NSS_MOZILLA_CA_POLICY from .p11-kit files.Kai Engert2017-02-164-0/+4
| | | | | See also NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=1334976 and p11-kit bug https://bugs.freedesktop.org/show_bug.cgi?id=99453
* library: Deinit p11_virtual_mutexDaiki Ueno2017-02-161-0/+1
| | | | | Follow-up fix for commit 4d228aa0, which forgot to clear p11_virtual_mutex on library finalization.
* virtual: Move mutex into p11_library_init()Daiki Ueno2017-02-145-30/+11
| | | | | | | | | We used to provide p11_virtual_fixed_{,un}init() to only initialize a mutex used in virtual.c. That required all the tests calling virtual functions to call p11_virtual_fixed_{,un}init() in main(). For simplicity, move the mutex variable initialization into p11_library_init().
* trust: Revert to the original 'extract' behaviorDaiki Ueno2017-02-141-0/+1
| | | | | | | | Since commit f4384a40, due to a missing ex->flags setting, the 'trust extract' command didn't retrieve correlation between related objects and that was causing assertion failure when writing PEM files. https://bugs.freedesktop.org/show_bug.cgi?id=99795
* filter: New virtual wrapper for access controlDaiki Ueno2017-02-085-0/+624
|
* iter: Enable iteration over slots/tokens/modulesDaiki Ueno2017-02-084-27/+297
| | | | | | | | | While PKCS#11 URI can identify slots/tokens/modules, P11KitIter is only capable of iterating over objects. This patch adds new behaviors to P11KitIter to support iterations over slots/tokens/modules, using the C coroutine trick as described in: http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
* uri: Relax pin-* parsing for compatibilityDaiki Ueno2017-02-021-5/+26
| | | | | | | | | | | | While 'pin-source' and 'pin-value' are defined as query atttribute, they were defined as path attribute in earlier drafts, and some implementations still stick to it. For backward compatibility, accept those in path attributes when parsing (but not when formatting). Reported by Andreas Metzler in: https://lists.freedesktop.org/archives/p11-glue/2017-January/000637.html
* trust: Implement a 'trust dump' commandStef Walter2017-01-315-0/+276
| | | | | | | | | | | This dumps all the PKCS#11 objects in the internal .p11-kit persistence format. This is part of the trust command and tooling, even though at some point it could go in the p11-kit command. The reason for this is that the code related to the internal .p11-kit objects is in the trust code, and consumed solely by the trust related modules.
* trust: Don't encode spaces when writing .p11-kit formatStef Walter2017-01-311-1/+1
| | | | | These should not be encoded by default for readability in strings.
* trust: Add an "all" filter option for trust commandsStef Walter2017-01-311-0/+3
|
* trust: Make extraction and correlation of certificate info optionalStef Walter2017-01-317-19/+30
| | | | | This is so that the code can be shared by the upcoming 'trust dump' command where correlation between related objects is not desired.
* trust: Load all attributes for each object when enumeratingStef Walter2017-01-311-17/+21
| | | | | We load all known attributes for each object we're enumerating over in the 'trust list' and 'trust extract' commands.
* virtual: Make virtual-fixed internal API cleanerDaiki Ueno2017-01-254-11/+16
| | | | | Add proper inclusion guard to virtual-fixed.h and move the declarations of the (un)initialization functions there.
generated by cgit v1.1 at 2024-10-07 02:25:34 +0000