summaryrefslogtreecommitdiff
path: root/trust
Commit message (Collapse)AuthorAgeFilesLines
* trust: Rework input path treatmentStef Walter2013-03-1515-54/+253
| | | | | | | | | | | | | | | | | | | | | * Accept a single --with-trust-paths argument to ./configure which cotnains all the input paths. * The --with-system-anchors and --with-system-certificates ./configure arguments are no longer supported. Since they were only present briefly, no provision is made for backwards compatibility. * Each input file is treated as containing anchors by default unless an input certificate contains detailed trust information. * The files in each input directory are not automatically treated as anchors unless a certificate contains detailed trust information. * The files in anchors/ subdirectory of each input directory are automatically marked as anchors. * The files in the blacklist/ subdirectory of each input directory are automatically marked as blacklisted. * Update tests and move around test certificates so we can test these changes. https://bugs.freedesktop.org/show_bug.cgi?id=62327
* pem: Fix a bug decoding some PEM filesStef Walter2013-03-151-0/+25
| | | | | When bringing over the BSD base64 code, there was a regression. In addition add some tests for the base64 stuff.
* trust: add a simple frob-nss-token tool to dump distrustStef Walter2013-03-082-0/+109
| | | | | Add a simple tool to dump NSS style distrust attributes from a module.
* trust: Use the new NSS PKCS#11 extension codesStef Walter2013-03-084-27/+27
| | | | | NSS had subtly changed the values of the distrust CK_TRUST codes so update them to stay in sync.
* Hard code distrust temporarily.Stef Walter2013-03-081-1/+149
| | | | | This is because we have no way to load this data into the trust module. Working on a real solution.
* trust: Refactor how we load builtin objectsStef Walter2013-03-081-11/+13
|
* Build with the libtasn1 CFLAGS properlyStef Walter2013-03-041-0/+1
| | | | | | Tweaks by: Roman Bogorodskiy <bogorodskiy@gmail.com> https://bugs.freedesktop.org/show_bug.cgi?id=61739
* Initialize modules correctly in testsStef Walter2013-03-034-1/+4
| | | | This fixes hangs when running tests on windows
* Fix syntax errors in OS_WIN32 ifdefsStef Walter2013-03-032-2/+6
|
* Abstract mmap() into a compat APIStef Walter2013-03-031-21/+7
| | | | | The Win32 for mmap() is very different from Unix, so abstract this into our own p11_mmap_xxx() functions.
* Use putenv() instead of setenv()Stef Walter2013-03-034-4/+4
| | | | Since older operating systems don't support setenv()
* Only do shared object and DLL initialization in librariesStef Walter2013-02-201-0/+55
| | | | | | Don't do library initialization on shared object load when not running in a library. We'll want to plug into this and do different things per library in the future.
* Use the CN, OU or O of certificates to generate a labelStef Walter2013-02-052-32/+41
| | | | | * This is in cases where the certificate information does not already have a friendly name or alias.
* Move the X.509 extension parsing code in common/Stef Walter2013-02-052-121/+80
| | | | * So it can be used by other code, in addition to the trust stuff
* Implement trust assertion PKCS#11 objectsStef Walter2013-02-057-43/+783
| | | | | | * Implement trust assertions for anchored and distrusted certs * Pinned certificate trust assertions are not implemented yet * Add an internal tool for pulling apart bits of certificates
* Refactor how parsing of ASN.1 data and certificate extensions workStef Walter2013-02-055-664/+58
|
* Fill in certificate authority and trust data correctlyStef Walter2013-02-057-163/+548
| | | | | | | | | | | | * Fill in CKA_CERTIFICATE_CATEGORY properly for authorities based on the presence of BasicConstraints and/or v1 certificates * Fill in CKA_TRUSTED and CKA_X_DISTRUSTED based on whether the parser is running for anchors or blacklist * In addition support the concept of blacklisted certificates mixed in with the anchors (without any purposes) since that's what exists in the real world. * We do this after the various hooks have had a chance to mess with the certificate extensions and such.
* Implement stapled certificate extensions internallyStef Walter2013-02-058-366/+894
| | | | | | | | | | | | * Use stapled certificate extensions to represent loaded trust policy * Build NSS trust objects from stapled certificate extensions * Add further attribute debugging for NSS trust objects * Use a custom certificate extension for the OpenSSL reject purpose data * Use SubjectKeyIdentifier for OpenSSL keyid data * Use ExtendedKeyUsage for OpenSSL trust purpose data * Implement simple way to handle binary DER OIDs, using the DER TLV length. DER OIDs are used in the CKA_OBJECT_ID value, and elsewhere. * Split out the building of NSS trust objects from the main parser
* Better debugging and checks for attribute valuesStef Walter2013-02-054-86/+124
|
* Add tool for testing how fast the token loadsStef Walter2013-02-052-0/+65
|
* Some debug info about which files are being loadedStef Walter2013-02-051-2/+15
|
* Test a TRUSTED CERTIFICATE without any trust OIDsStef Walter2013-02-052-0/+38
|
* Add the builtin roots NSS specific objectStef Walter2013-02-053-4/+57
| | | | This tells NSS that this is a source of anchors.
* Add support for openssl TRUSTED CERTIFICATE PEM filesStef Walter2013-02-053-40/+299
|
* Add support for parsing PEM filesStef Walter2013-02-054-1/+108
|
* Add basic trust moduleStef Walter2013-02-0527-0/+4724
This is based off the roots-store from gnome-keyring and loads certificates from a root directory and exposes them as PKCS#11 objects.
generated by cgit v1.1 at 2024-12-27 06:06:52 +0000