summaryrefslogtreecommitdiff
path: root/trust/tests/test-parser.c
Commit message (Collapse)AuthorAgeFilesLines
* Move to non-recursive Makefile for building bins and libsStef Walter2014-08-151-569/+0
| | | | Still use recursive for documentation and translation.
* trust: Parse TRUSTED CERTIFICATE openssl format even without CertAuxStef Walter2014-08-081-0/+105
| | | | | | | | openssl sometimes outputs TRUSTED CERTIFICATE PEM files without the additional CertAux (ie: trust fields) information. It simply leaves that block out. This happens with a command like: $ openssl x509 -in my-cert.pem -out output -trustout
* Avoid multiple stat() calls for same fileStef Walter2013-08-281-10/+10
| | | | | | As a side effect we can also not use the dirent.d_type field https://bugs.freedesktop.org/show_bug.cgi?id=68525
* trust: Explicitly specify which formats parser should parseStef Walter2013-07-081-0/+10
|
* trust: Support using the parser without an asn1_cacheStef Walter2013-07-081-0/+22
|
* trust: Port to use CKA_PUBLIC_KEY_INFO and updated trust store specStef Walter2013-07-041-8/+22
| | | | | | | | | | * Use the concepts and PKCS#11 objects described in the recently updated (still work in progress) storing trust spec. * Define our own CKA_X_PUBLIC_KEY_INFO define for now, since the the CKA_PUBLIC_KEY_INFO isn't defined yet. * Most notably, the association between certificates and stapled extensions is by public key. * Rework some of the tests to take into account the above.
* trust: Initial support for writing out token objectsStef Walter2013-07-031-1/+0
| | | | | * The objects are written out in the p11-kit persist format * Parser marks files in p11-kit persist format as modifiable
* trust: Implement reloading of token dataStef Walter2013-07-031-152/+32
| | | | | | | | | | | | | | | * Reload token data whenever a new session is opened. * Only reload files/directories that have changed. * Move duplicate anchor/blacklist detection logic into the extract code. This is in line with the approach being discussed on the mailing lists and spec document. * New internal attribute CKA_X_ORIGIN set on all objects so we can track where an object came from, and replace it when reloaded. In general this is a prerequisite for modification of objects reload before modify is necessary to prevent multiple callers clobbering each other's changes.
* Our own unit testing frameworkStef Walter2013-05-211-138/+81
| | | | | | | | * Support the TAP protocol * Much cleaner without having to carry around state * First class support for setup/teardown * Port the common tests * Wait on porting other tests until we've merged outstanding code
* Separate library init from message codeStef Walter2013-04-031-2/+1
| | | | | | | | | | | Put library init/uninit code its into their own statically linked library so that they don't get linked into the p11-kit executable. Refactor the message code so that the library initialization can plug in its per thread message buffer. https://bugs.freedesktop.org/show_bug.cgi?id=63046
* trust: Predictable behavior with duplicate certificates in tokenStef Walter2013-03-201-0/+127
| | | | | | | | If duplicate certificates are present in a token, we warn about this, and don't really recommend it. However we have predictable behavior where blacklist is prefered to anchor is preferred to unknown trust. https://bugs.freedesktop.org/show_bug.cgi?id=62548
* trust: Rework index to be faster and more usableStef Walter2013-03-201-3/+3
| | | | | | | | | The index now uses a sort of cross between a hash table and a bloom filter internally to select matching items. This is needed for the massive amount of lookups we want to do during loading. In addition make p11_index_find() and p11_index_replace() easier to use.
* hash: Add the murmur2 hash and start using itStef Walter2013-03-201-2/+1
| | | | | | | | | | | Add implementation of the murmur2 hash function, and start using it for our dictionaries. Our implementation is incremental like our other hash functions. Also remove p11_oid_hash() which wasn't being used. In addition fix several tests whose success was based on the way that the dictionary hashed. This was a hidden testing bug.
* trust: Support a p11-kit specific serialization formatStef Walter2013-03-151-0/+32
| | | | | | | This is documented in doc/internals/ subdirectory Add tests for the format as well. https://bugs.freedesktop.org/show_bug.cgi?id=62156
* trust: Use a SHA-1 hash of subjectPublicKeyInfo as CKA_ID by defaultStef Walter2013-03-151-0/+31
| | | | | | | This is what's recommended by the spec, and allows stapled extensions to hang off a predictable CKA_ID. https://bugs.freedesktop.org/show_bug.cgi?id=62329
* trust: Add a builder which builds objects out of parsed dataStef Walter2013-03-151-546/+120
| | | | | | | | | | | The builder completes the objects from the parsed data and takes over the responsibilities that the parser and adapter previously shared. This is necessary to prepare for arbitrary data coming from the p11-kit specific input files. https://bugs.freedesktop.org/show_bug.cgi?id=62329
* trust: Use the new NSS PKCS#11 extension codesStef Walter2013-03-081-11/+11
| | | | | NSS had subtly changed the values of the distrust CK_TRUST codes so update them to stay in sync.
* Initialize modules correctly in testsStef Walter2013-03-031-0/+1
| | | | This fixes hangs when running tests on windows
* Use putenv() instead of setenv()Stef Walter2013-03-031-1/+1
| | | | Since older operating systems don't support setenv()
* Use the CN, OU or O of certificates to generate a labelStef Walter2013-02-051-11/+11
| | | | | * This is in cases where the certificate information does not already have a friendly name or alias.
* Implement trust assertion PKCS#11 objectsStef Walter2013-02-051-35/+317
| | | | | | * Implement trust assertions for anchored and distrusted certs * Pinned certificate trust assertions are not implemented yet * Add an internal tool for pulling apart bits of certificates
* Refactor how parsing of ASN.1 data and certificate extensions workStef Walter2013-02-051-103/+0
|
* Fill in certificate authority and trust data correctlyStef Walter2013-02-051-55/+191
| | | | | | | | | | | | * Fill in CKA_CERTIFICATE_CATEGORY properly for authorities based on the presence of BasicConstraints and/or v1 certificates * Fill in CKA_TRUSTED and CKA_X_DISTRUSTED based on whether the parser is running for anchors or blacklist * In addition support the concept of blacklisted certificates mixed in with the anchors (without any purposes) since that's what exists in the real world. * We do this after the various hooks have had a chance to mess with the certificate extensions and such.
* Implement stapled certificate extensions internallyStef Walter2013-02-051-25/+134
| | | | | | | | | | | | * Use stapled certificate extensions to represent loaded trust policy * Build NSS trust objects from stapled certificate extensions * Add further attribute debugging for NSS trust objects * Use a custom certificate extension for the OpenSSL reject purpose data * Use SubjectKeyIdentifier for OpenSSL keyid data * Use ExtendedKeyUsage for OpenSSL trust purpose data * Implement simple way to handle binary DER OIDs, using the DER TLV length. DER OIDs are used in the CKA_OBJECT_ID value, and elsewhere. * Split out the building of NSS trust objects from the main parser
* Better debugging and checks for attribute valuesStef Walter2013-02-051-5/+6
|
* Test a TRUSTED CERTIFICATE without any trust OIDsStef Walter2013-02-051-0/+15
|
* Add support for openssl TRUSTED CERTIFICATE PEM filesStef Walter2013-02-051-0/+52
|
* Add support for parsing PEM filesStef Walter2013-02-051-0/+26
|
* Add basic trust moduleStef Walter2013-02-051-0/+315
This is based off the roots-store from gnome-keyring and loads certificates from a root directory and exposes them as PKCS#11 objects.
generated by cgit v1.1 at 2024-10-19 07:39:09 +0000