source: heimdal/trunk/lib/hx509/ChangeLog

Last change on this file was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 71.1 KB
Line 
12008-07-14 Love Hörnquist Å
2strand <lha@kth.se>
3
4 * hxtool.c: Break out print_eval_types().
5
62008-06-21 Love Hörnquist Å
7strand <lha@kth.se>
8
9 * ks_p12.c: pass in time_now to unevelope
10
11 * cms.c: Pass in time_now to unevelope, us verify context time in
12 verify_signed.
13
142008-05-23 Love Hörnquist Å
15strand <lha@kth.se>
16
17 * hx_locl.h: Include <limits.h> for TYPE_MAX defines.
18
192008-04-29 Love Hörnquist Å
20strand <lha@it.su.se>
21
22 * sel-lex.l: Use _hx509_sel_yyerror() instead of error_message().
23
242008-04-20 Love Hörnquist Å
25strand <lha@it.su.se>
26
27 * sel-lex.l: Include <config.h>
28
292008-04-17 Love Hörnquist Å
30strand <lha@it.su.se>
31
32 * Makefile.am: Update make-proto usage.
33
342008-04-15 Love Hörnquist Å
35strand <lha@it.su.se>
36
37 * ca.c: BasicConstraints.pathLenConstraint unsigned int.
38
39 * sel-lex.l: Prefix sel_error with _hx509_ since its global on
40 platforms w/o symbol versioning.
41
42 * sel.h: rename yyerror to sel_yyerror in the whole library, not
43 just the lexer
44
45 * sel-lex.l: rename yyerror to sel_yyerror in the whole library,
46 not just the lexer
47
482008-04-14 Love Hörnquist Å
49strand <lha@it.su.se>
50
51 * sel-lex.l: Rename yyerror to sel_yyerror and make it static.
52
532008-04-08 Love Hörnquist Å
54strand <lha@it.su.se>
55
56 * hx509.h: Make self-standing by including missing files.
57
582008-04-07 Love Hörnquist Å
59strand <lha@it.su.se>
60
61 * ks_p11.c: Use unsigned where appropriate.
62
63 * softp11.c: call va_start before using vsnprintf.
64
65 * crypto.c: make refcount slightly more sane.
66
67 * keyset.c: make refcount slightly more sane.
68
69 * cert.c: make refcount slightly more sane.
70
712008-03-19 Love Hörnquist Å
72strand <lha@it.su.se>
73
74 * test_nist2.in: Try to find unzip.
75
762008-03-16 Love Hörnquist Å
77strand <lha@it.su.se>
78
79 * version-script.map: add missing symbols
80
81 * spnego: Make delegated credentials delegated directly, Oleg
82 Sharoiko pointed out that it always didnt work with the old
83 code. Also add som missing cred and context pass-thou functions in
84 the SPNEGO layer.
85
862008-03-14 Love Hörnquist Å
87strand <lha@it.su.se>
88
89 * rename to be more consistent, export for teting
90
91 * Add language to support querying certificates to find a
92 match. Support constructs like "1.3.6.1.5.2.3.5" IN
93 %{certificate.eku} AND %{certificate.subject} TAILMATCH "C=SE".
94
952008-02-26 Love Hörnquist Å
96strand <lha@it.su.se>
97
98 * version-script.map: add hx509_pem_read
99
100 * hxtool-commands.in: Add --pem to cms-verify-sd.
101
102 * test_cms.in: Test verifying PEM signature files.
103
104 * hxtool.c: Support verifying PEM signature files.
105
1062008-02-25 Love Hörnquist Å
107strand <lha@it.su.se>
108
109 * Makefile.am: libhx509_la_OBJECTS depends on hx_locl.h
110
1112008-02-11 Love Hörnquist Å
112strand <lha@it.su.se>
113
114 * Use ldap-prep (with libwind) to compare names
115
1162008-01-27 Love Hörnquist Å
117strand <lha@it.su.se>
118
119 * cert.c (hx509_query_match_eku): update to support the NULL
120 eku (reset), clearify the old behaivor with regards repetitive
121 calls.
122
123 * Add matching on EKU, validate EKUs, add hxtool matching glue,
124 add check. Adapted from pach from Tim Miller of Mitre
125
1262008-01-21 Love Hörnquist Å
127strand <lha@it.su.se>
128
129 * test_soft_pkcs11.c: use func for more C_ functions.
130
1312008-01-18 Love Hörnquist Å
132strand <lha@it.su.se>
133
134 * version-script.map: Export hx509_free_error_string().
135
1362008-01-17 Love Hörnquist Å
137strand <lha@it.su.se>
138
139 * version-script.map: only export C_GetFunctionList
140
141 * test_soft_pkcs11.c: use C_GetFunctionList
142
143 * softp11.c: fix comment, remove label.
144
145 * softp11.c: Add option app-fatal to control if softtoken should
146 abort() on erroneous input from applications.
147
1482008-01-16 Love Hörnquist Å
149strand <lha@it.su.se>
150
151 * test_pkcs11.in: Test password less certificates too
152
153 * keyset.c: document HX509_CERTS_UNPROTECT_ALL
154
155 * ks_file.c: Support HX509_CERTS_UNPROTECT_ALL.
156
157 * hx509.h: Add HX509_CERTS_UNPROTECT_ALL.
158
159 * test_soft_pkcs11.c: Only log in if needed.
160
1612008-01-15 Love Hörnquist Å
162strand <lha@it.su.se>
163
164 * softp11.c: Support PINs to login to the store.
165
166 * Makefile.am: add java pkcs11 test
167
168 * test_java_pkcs11.in: first version of disable java test
169
170 * softp11.c: Drop unused stuff.
171
172 * cert.c: Spelling, Add hx509_cert_get_SPKI_AlgorithmIdentifier,
173 remove unused stuff, add hx509_context to some functions.
174
175 * softp11.c: Add more glue to figure out what keytype this
176 certificate is using.
177
1782008-01-14 Love Hörnquist Å
179strand <lha@it.su.se>
180
181 * test_pkcs11.in: test debug
182
183 * Add a PKCS11 provider supporting signing and verifing sigatures.
184
1852008-01-13 Love Hörnquist Å
186strand <lha@it.su.se>
187
188 * version-script.map: Replace hx509_name_to_der_name with
189 hx509_name_binary.
190
191 * print.c: make print_func static
192
1932007-12-26 Love Hörnquist Å
194strand <lha@it.su.se>
195
196 * print.c: doxygen
197
198 * env.c: doxygen
199
200 * doxygen.c: add more groups
201
202 * ca.c: doxygen.
203
2042007-12-17 Love Hörnquist Å
205strand <lha@it.su.se>
206
207 * ca.c: doxygen
208
2092007-12-16 Love Hörnquist Å
210strand <lha@it.su.se>
211
212 * error.c: doxygen
213
2142007-12-15 Love Hörnquist Å
215strand <lha@it.su.se>
216
217 * More documentation
218
219 * lock.c: Add page referance
220
221 * keyset.c: some more documentation.
222
223 * cms.c: Doxygen documentation.
224
2252007-12-11 Love Hörnquist Å
226strand <lha@it.su.se>
227
228 * *.[ch]: More documentation
229
2302007-12-09 Love Hörnquist Å
231strand <lha@it.su.se>
232
233 * handle refcount on NULL.
234
235 * test_nist_pkcs12.in: drop echo -n, doesn't work with posix sh
236
2372007-12-08 Love Hörnquist Å
238strand <lha@it.su.se>
239
240 * test_nist2.in: Print that this is version 2 of the tests
241
242 * test_nist.in: Drop printing of $id.
243
244 * hx509.h: Add HX509_VHN_F_ALLOW_NO_MATCH.
245
246 * name.c: spelling.
247
248 * cert.c: make work the doxygen.
249
250 * name.c: fix doxygen compiling.
251
252 * Makefile.am: add doxygen.c
253
254 * doxygen.c: Add doxygen main page.
255
256 * cert.c: Add doxygen.
257
258 * revoke.c (_hx509_revoke_ref): new function.
259
2602007-11-16 Love Hörnquist Å
261strand <lha@it.su.se>
262
263 * ks_keychain.c: Check if SecKeyGetCSPHandle needs prototype.
264
2652007-08-16 Love Hörnquist Å
266strand <lha@it.su.se>
267
268 * data/nist-data: Make work on case senstive filesystems too.
269
2702007-08-09 Love Hörnquist Å
271strand <lha@it.su.se>
272
273 * cert.c: match rfc822 contrains better, provide better error
274 strings.
275
2762007-08-08 Love Hörnquist Å
277strand <lha@it.su.se>
278
279 * cert.c: "self-signed doesn't count" doesn't apply to trust
280 anchor certificate. make trust anchor check consistant.
281
282 * revoke.c: make compile.
283
284 * revoke.c (verify_crl): set error strings.
285
286 * revoke.c (verify_crl): handle with the signer is the
287 CRLsigner (shortcut).
288
289 * cert.c: Fix NC, comment on how to use _hx509_check_key_usage.
290
2912007-08-03 Love Hörnquist Å
292strand <lha@it.su.se>
293
294 * test_nist2.in, Makefile, test/nist*: Add nist pkits tests.
295
296 * revoke.c: Update to use CERT_REVOKED error, shortcut out of OCSP
297 checking when OCSP reply is a revocation reply.
298
299 * hx509_err.et: Make CERT_REVOKED error OCSP/CRL agnostic.
300
301 * name.c (_hx509_Name_to_string): make printableString handle
302 space (0x20) diffrences as required by rfc3280.
303
304 * revoke.c: Search for the right issuer when looking for the
305 issuer of the CRL signer.
306
3072007-08-02 Love Hörnquist Å
308strand <lha@it.su.se>
309
310 * revoke.c: Handle CRL signing certificate better, try to not
311 revalidate invalid CRLs over and over.
312
3132007-08-01 Love Hörnquist Å
314strand <lha@it.su.se>
315
316 * cms.c: remove stale comment.
317
318 * test_nist.in: Unpack PKITS_data.zip and run tests.
319
320 * test_nist_cert.in: Adapt to new nist pkits framework.
321
322 * test_nist_pkcs12.in: Adapt to new nist pkits framework.
323
324 * Makefile.am: clean PKITS_data
325
3262007-07-16 Love Hörnquist Å
327strand <lha@it.su.se>
328
329 * Makefile.am: Add version-script.map to EXTRA_DIST
330
3312007-07-12 Love Hörnquist Å
332strand <lha@it.su.se>
333
334 * Makefile.am: Add depenency on asn1_compile for asn1 built files.
335
3362007-07-10 Love Hörnquist Å
337strand <lha@it.su.se>
338
339 * peer.c: update (c), indent.
340
341 * Makefile.am: New library version.
342
3432007-06-28 Love Hörnquist Å
344strand <lha@it.su.se>
345
346 * ks_p11.c: Add sha2 types.
347
348 * ref/pkcs11.h: Sync with scute.
349
350 * ref/pkcs11.h: Add sha2 CKM's.
351
352 * print.c: Print authorityInfoAccess.
353
354 * cert.c: Rename proxyCertInfo oid.
355
356 * ca.c: Rename proxyCertInfo oid.
357
358 * print.c: Rename proxyCertInfo oid.
359
3602007-06-26 Love Hörnquist Å
361strand <lha@it.su.se>
362
363 * test_ca.in: Adapt to new request handling.
364
365 * req.c: Allow export some of the request parameters.
366
367 * hxtool-commands.in: Adapt to new request handling.
368
369 * hxtool.c: Adapt to new request handling.
370
371 * test_req.in: Adapt to new request handling.
372
373 * version-script.map: Add initialize_hx_error_table_r.
374
375 * req.c: Move _hx509_request_print here.
376
377 * hxtool.c: use _hx509_request_print
378
379 * version-script.map: Export more crap^W semiprivate functions.
380
381 * hxtool.c: don't _hx509_abort
382
383 * version-script.map: add missing ;
384
3852007-06-25 Love Hörnquist Å
386strand <lha@it.su.se>
387
388 * cms.c: Use hx509_crypto_random_iv.
389
390 * crypto.c: Split out the iv creation from hx509_crypto_encrypt
391 since _hx509_pbe_encrypt needs to use the iv from the s2k
392 function.
393
394 * test_cert.in: Test PEM and DER FILE writing functionallity.
395
396 * ks_file.c: Add writing DER certificates.
397
398 * hxtool.c: Update to new hx509_pem_write().
399
400 * test_cms.in: test creation of PEM signeddata.
401
402 * hx509.h: PEM struct/function declarations.
403
404 * ks_file.c: Use PEM encoding/decoding functions.
405
406 * file.c: PEM encode/decoding functions.
407
408 * ks_file.c: Use hx509_pem_write.
409
410 * version-script.map: Export some semi-private functions.
411
412 * hxtool.c: Enable writing out signed data as a pem attachment.
413
414 * hxtool-commands.in (cms-create-signed): add --pem
415
416 * file.c (hx509_pem_write): Add.
417
418 * test_ca.in: Issue and test null subject cert.
419
420 * cert.c: Match is first component is in a CN=.
421
422 * test_ca.in: Test hostname if first CN.
423
424 * Makefile.am: Add version script.
425
426 * version-script.map: Limited exported symbols.
427
428 * test_ca.in: test --hostname.
429
430 * test_chain.in: test max-depth
431
432 * hx509.h: fixate HX509_HN_HOSTNAME at 0.
433
434 * hxtool-commands.in: add --hostname add --max-depth
435
436 * cert.c: Verify hostname and max-depth.
437
438 * hxtool.c: Verify hostname and test max-depth.
439
4402007-06-24 Love Hörnquist Å
441strand <lha@it.su.se>
442
443 * test_cms.in: Test --id-by-name.
444
445 * hxtool-commands.in: add cms-create-sd --id-by-name
446
447 * hxtool.c: Use HX509_CMS_SIGATURE_ID_NAME.
448
449 * cms.c: Implement and use HX509_CMS_SIGATURE_ID_NAME.
450
451 * hx509.h: Add HX509_CMS_SIGATURE_ID_NAME, use subject name for
452 CMS.Identifier. hx509_hostname_type: add hostname type for
453 matching.
454
455 * cert.c (match_general_name): more strict rfc822Name matching.
456 (hx509_verify_hostname): add hostname type for matching.
457
4582007-06-19 Love Hörnquist Å
459strand <lha@it.su.se>
460
461 * hxtool.c: Make compile again.
462
463 * hxtool.c: Added peap-server for to make windows peap clients
464 happy.
465
466 * hxtool.c: Unify parse_oid code.
467
468 * hxtool.c: Implement --content-type.
469
470 * hxtool-commands.in: Add content-type.
471
472 * test_cert.in: more cert and keyset tests.
473
4742007-06-18 Love Hörnquist Å
475strand <lha@it.su.se>
476
477 * revoke.c: Avoid stomping on NULL.
478
479 * revoke.c: Avoid reusing i.
480
481 * cert.c: Provide __attribute__ for _hx509_abort.
482
483 * ks_file.c: Fail if not finding iv.
484
485 * keyset.c: Avoid useing freed memory.
486
487 * crypto.c: Free memory in failure case.
488
489 * crypto.c: Free memory in failure case.
490
4912007-06-12 Love Hörnquist Å
492strand <lha@it.su.se>
493
494 * *.c: Add hx509_cert_init_data and use everywhere
495
496 * hx_locl.h: Now that KEYCHAIN:system-anchors is fast again, use
497 that.
498
499 * ks_keychain.c: Implement trust anchor support with
500 SecTrustCopyAnchorCertificates.
501
502 * keyset.c: Set ref to 1 for the new object.
503
504 * cert.c: Fix logic for allow_default_trust_anchors
505
506 * keyset.c: Add refcounting to keystores.
507
508 * cert.c: Change logic for default trust anchors, make it be
509 either default trust anchor, the user supplied, or non at all.
510
5112007-06-08 Love Hörnquist Å
512strand <lha@it.su.se>
513
514 * Makefile.am: Add data/j.pem.
515
516 * Makefile.am: Add test_windows.in.
517
5182007-06-06 Love Hörnquist Å
519strand <lha@it.su.se>
520
521 * ks_keychain.c: rename functions, leaks less memory and more
522 paranoia.
523
524 * test_cms.in: Test cms peer-alg.
525
526 * crypto.c (rsa_create_signature): make oid_id_pkcs1_rsaEncryption
527 mean rsa-with-sha1 but oid oid_id_pkcs1_rsaEncryption in algorithm
528 field. XXX should probably use another algorithmIdentifier for
529 this.
530
531 * peer.c: Make free function return void.
532
533 * cms.c (hx509_cms_create_signed_1): Use hx509_peer_info to select
534 the signature algorithm too.
535
536 * hxtool-commands.in: Add cms-create-sd --peer-alg.
537
538 * req.c: Use _hx509_crypto_default_sig_alg.
539
540 * test_windows.in: Create crl, because everyone needs one.
541
542 * Makefile.am: add wcrl.crl
543
5442007-06-05 Love Hörnquist Å
545strand <lha@it.su.se>
546
547 * hx_locl.h: Disable KEYCHAIN for now, its slow.
548
549 * cms.c: When we are not using pkcs7-data, avoid seing
550 signedAttributes since some clients get upset by that (pkcs7 based
551 or just plain broken).
552
553 * ks_keychain.c: Provide rsa signatures.
554
555 * ks_keychain.c: Limit the searches to the selected keychain.
556
557 * ks_keychain.c: include -framework Security specific header files
558 after #ifdef
559
560 * ks_keychain.c: Find and attach private key (does not provide
561 operations yet though).
562
563 * ks_p11.c: Prefix rsa method with p11_
564
565 * ks_keychain.c: Allow opening a specific chain, making "system"
566 special and be the system X509Anchors file. By not specifing any
567 keychain ("KEYCHAIN:"), all keychains are probed.
568
5692007-06-04 Love Hörnquist Å
570strand <lha@it.su.se>
571
572 * hxtool.c (verify): Friendlier error message.
573
574 * cert.c: Read in and use default trust anchors if they exists.
575
576 * hx_locl.h: Add concept of default_trust_anchors.
577
578 * ks_keychain.c: Remove err(), remove extra empty comment, fix
579 _iter function.
580
581 * error.c (hx509_get_error_string): if the error code is not the
582 one we expect, punt and use the default com_err/strerror string
583 instead.
584
585 * keyset.c (hx509_certs_merge): its ok to merge in the NULL set of
586 certs.
587
588 * test_windows.in: Fix status string.
589
590 * ks_p12.c (store_func): free whole CertBag, not just the data
591 part.
592
593 * print.c: Check that the self-signed cert is really self-signed.
594
595 * print.c: Use selfsigned for CRL DP whine, tell if its a
596 self-signed.
597
598 * print.c: Whine if its a non CA/proxy and doesn't have CRL DP.
599
600 * ca.c: Add cRLSign to CA certs.
601
602 * cert.c: Register NULL and KEYCHAIN.
603
604 * ks_null.c: register the NULL keystore.
605
606 * Makefile.am: Add ks_keychain.c and related libs.
607
608 * test_crypto.in: Print certificate with utf8.
609
610 * print.c: Leak less memory.
611
612 * hxtool.c: Leak less memory.
613
614 * print.c: Leak less memory, use functions that does same but
615 more.
616
617 * name.c (quote_string): don't sign extend the (signed) char to
618 avoid printing too much, add an assert to check that we didn't
619 overrun the buffer.
620
621 * name.c: Use right element out of the CHOICE for printableString
622 and utf8String
623
624 * ks_keychain.c: Certificate only KeyChain backend.
625
626 * name.c: Reset name before parsing it.
627
6282007-06-03 Love Hörnquist Å
629strand <lha@it.su.se>
630
631 * revoke.c (hx509_crl_*): fix sizeof() mistakes to fix memory
632 corruption.
633
634 * hxtool.c: Add lifetime to crls.
635
636 * hxtool-commands.in: Add lifetime to crls.
637
638 * revoke.c: Add lifetime to crls.
639
640 * test_ca.in: More crl checks.
641
642 * revoke.c: Add revoking certs.
643
644 * hxtool-commands.in: argument is certificates.. for crl-sign
645
646 * hxtool.c (certificate_copy): free lock
647
648 * revoke.c: Fix hx509_set_error_string calls, add
649 hx509_crl_add_revoked_certs(), implement hx509_crl_{alloc,free}.
650
651 * hxtool.c (crl_sign): free lock
652
653 * cert.c (hx509_context_free): free querystat
654
6552007-06-02 Love Hörnquist Å
656strand <lha@it.su.se>
657
658 * test_chain.in: test ocsp-verify
659
660 * revoke.c (hx509_ocsp_verify): explain what its useful for and
661 provide sane error message.
662
663 * hx509_err.et: New error code, CERT_NOT_IN_OCSP
664
665 * hxtool.c: New command ocsp-verify, check if ocsp contains all
666 certs and are valid (exist and non expired).
667
668 * hxtool-commands.in: New command ocsp-verify.
669
6702007-06-01 Love Hörnquist Å
671strand <lha@it.su.se>
672
673 * test_ca.in: Create crl and verify that is works.
674
675 * hxtool.c: Sign CRL command.
676
677 * hx509.h: Add hx509_crl.
678
679 * hxtool-commands.in: Add crl-sign commands.
680
681 * revoke.c: Support to generate an empty CRL.
682
683 * tst-crypto-select2: Switched default types.
684
685 * tst-crypto-select1: Switched default types.
686
687 * ca.c: Use default AlgorithmIdentifier.
688
689 * cms.c: Use default AlgorithmIdentifier.
690
691 * crypto.c: Provide default AlgorithmIdentifier and use them.
692
693 * hx_locl.h: Provide default AlgorithmIdentifier.
694
695 * keyset.c (hx509_certs_find): collects stats for queries.
696
697 * cert.c: Sort and print more info.
698
699 * hx_locl.h: Add querystat to hx509_context.
700
701 * test_*.in: sprinle stat saveing
702
703 * Makefile.am: Add stat and objdir.
704
705 * collector.c (_hx509_collector_alloc): return error code instead
706 of pointer.
707
708 * hxtool.c: Add statistic hook.
709
710 * ks_file.c: Update _hx509_collector_alloc prototype.
711
712 * ks_p12.c: Update _hx509_collector_alloc prototype.
713
714 * ks_p11.c: Update _hx509_collector_alloc prototype.
715
716 * hxtool-commands.in: Add statistics hook.
717
718 * cert.c: Statistics printing.
719
720 * ks_p12.c: plug memory leak
721
722 * ca.c (hx509_ca_tbs_add_crl_dp_uri): plug memory leak
723
7242007-05-31 Love Hörnquist Å
725strand <lha@it.su.se>
726
727 * print.c: print utf8 type SAN's
728
729 * Makefile.am: Fix windows client cert name.
730
731 * test_windows.in: Add crl-uri for the ee certs.
732
733 * print.c: Printf formating.
734
735 * ca.c: Add glue for adding CRL dps.
736
737 * test_ca.in: Readd the crl adding code, it works (somewhat) now.
738
739 * print.c: Fix printing of CRL DPnames (I hate IMPLICIT encoded
740 structures).
741
742 * hxtool-commands.in: make ca and alias of certificate-sign
743
7442007-05-30 Love Hörnquist Å
745strand <lha@it.su.se>
746
747 * crypto.c (hx509_crypto_select): copy AI to the right place.
748
749 * hxtool-commands.in: Add ca --ms-upn.
750
751 * hxtool.c: add --ms-upn and add more EKU's for pk-init client.
752
753 * ca.c: Add hx509_ca_tbs_add_san_ms_upn and refactor code.
754
755 * test_crypto.in: Resurect killed e.
756
757 * test_crypto.in: check for aes256-cbc
758
759 * tst-crypto-select7: check for aes256-cbc
760
761 * test_windows.in: test windows stuff
762
763 * hxtool.c: add ca --domain-controller option, add secret key
764 option to avaible.
765
766 * ca.c: Add hx509_ca_tbs_set_domaincontroller.
767
768 * hxtool-commands.in: add ca --domain-controller
769
770 * hxtool.c: hook for testing secrety key algs
771
772 * crypto.c: Add selection code for secret key crypto.
773
774 * hx509.h: Add HX509_SELECT_SECRET_ENC.
775
7762007-05-13 Love Hörnquist Å
777strand <lha@it.su.se>
778
779 * ks_p11.c: add more mechtypes
780
7812007-05-10 Love Hörnquist Å
782strand <lha@it.su.se>
783
784 * print.c: Indent.
785
786 * hxtool-commands.in: add test-crypto command
787
788 * hxtool.c: test crypto command
789
790 * cms.c (hx509_cms_create_signed_1): if no eContentType is given,
791 use pkcs7-data.
792
793 * print.c: add Netscape cert comment
794
795 * crypto.c: Try both the empty password and the NULL
796 password (nothing vs the octet string \x00\x00).
797
798 * print.c: Add some US Fed PKI oids.
799
800 * ks_p11.c: Add some more hashes.
801
8022007-04-24 Love Hörnquist Å
803strand <lha@it.su.se>
804
805 * hxtool.c (crypto_select): stop memory leak
806
8072007-04-19 Love Hörnquist Å
808strand <lha@it.su.se>
809
810 * peer.c (hx509_peer_info_free): free memory used too
811
812 * hxtool.c (crypto_select): only free peer if it was used.
813
8142007-04-18 Love Hörnquist Å
815strand <lha@it.su.se>
816
817 * hxtool.c: free template
818
819 * ks_mem.c (mem_free): free key array too
820
821 * hxtool.c: free private key and tbs
822
823 * hxtool.c (hxtool_ca): free signer
824
825 * hxtool.c (crypto_available): free peer too.
826
827 * ca.c (get_AuthorityKeyIdentifier): leak less memory
828
829 * hxtool.c (hxtool_ca): free SPKI
830
831 * hxtool.c (hxtool_ca): free cert
832
833 * ks_mem.c (mem_getkeys): allocate one more the we have elements
834 so its possible to store the NULL pointer at the end.
835
8362007-04-16 Love Hörnquist Å
837strand <lha@it.su.se>
838
839 * Makefile.am: CLEANFILES += cert-null.pem cert-sub-ca2.pem
840
8412007-02-05 Love Hörnquist Å
842strand <lha@it.su.se>
843
844 * ca.c: Disable CRLDistributionPoints for now, its IMPLICIT code
845 in the asn1 parser.
846
847 * print.c: Add some more \n's.
848
8492007-02-03 Love Hörnquist Å
850strand <lha@it.su.se>
851
852 * file.c: Allow mapping using heim_octet_string.
853
854 * hxtool.c: Add options to generate detached signatures.
855
856 * cms.c: Add flags to generate detached signatures.
857
858 * hx509.h: Flag to generate detached signatures.
859
860 * test_cms.in: Support detached sigatures.
861
862 * name.c (hx509_general_name_unparse): unparse the other
863 GeneralName nametypes.
864
865 * print.c: Use less printf. Use hx509_general_name_unparse.
866
867 * cert.c: Fix printing and plug leak-on-error.
868
8692007-01-31 Love Hörnquist Å
870strand <lha@it.su.se>
871
872 * test_ca.in: Add test for ca --crl-uri.
873
874 * hxtool.c: Add ca --crl-uri.
875
876 * hxtool-commands.in: add ca --crl-uri
877
878 * ca.c: Code to set CRLDistributionPoints in certificates.
879
880 * print.c: Check CRLDistributionPointNames.
881
882 * name.c (hx509_general_name_unparse): function for unparsing
883 GeneralName, only supports GeneralName.URI
884
885 * cert.c (is_proxy_cert): free info if we wont return it.
886
8872007-01-30 Love Hörnquist Å
888strand <lha@it.su.se>
889
890 * hxtool.c: Try to help how to use this command.
891
8922007-01-21 Love Hörnquist Å
893strand <lha@it.su.se>
894
895 * switch to sha256 as default digest for signing
896
8972007-01-20 Love Hörnquist Å
898strand <lha@it.su.se>
899
900 * test_ca.in: Really test sub-ca code, add basic constraints tests
901
9022007-01-17 Love Hörnquist Å
903strand <lha@it.su.se>
904
905 * Makefile.am: Fix makefile problem.
906
9072007-01-16 Love Hörnquist Å
908strand <lha@it.su.se>
909
910 * hxtool.c: Set num of bits before we generate the key.
911
9122007-01-15 Love Hörnquist Å
913strand <lha@it.su.se>
914
915 * cms.c (hx509_cms_create_signed_1): use hx509_cert_binary
916
917 * ks_p12.c (store_func): use hx509_cert_binary
918
919 * ks_file.c (store_func): use hx509_cert_binary
920
921 * cert.c (hx509_cert_binary): return binary encoded
922 certificate (DER format)
923
9242007-01-14 Love Hörnquist Å
925strand <lha@it.su.se>
926
927 * ca.c (hx509_ca_tbs_subject_expand): new function.
928
929 * name.c (hx509_name_expand): if env is NULL, return directly
930
931 * test_ca.in: test template handling
932
933 * hx509.h: Add template flags.
934
935 * Makefile.am: clean out new files
936
937 * hxtool.c: Add certificate template processing, fix hx509_err
938 usage.
939
940 * hxtool-commands.in: Add certificate template processing.
941
942 * ca.c: Add certificate template processing. Fix return messages
943 from hx509_ca_tbs_add_eku.
944
945 * cert.c: Export more stuff from certificate.
946
9472007-01-13 Love Hörnquist Å
948strand <lha@it.su.se>
949
950 * ca.c: update (c)
951
952 * ca.c: (hx509_ca_tbs_add_eku): filter out dups.
953
954 * hxtool.c: Add type email and add email eku when using option
955 --email.
956
957 * Makefile.am: add env.c
958
959 * name.c: Remove abort, add error handling.
960
961 * test_name.c: test name expansion
962
963 * name.c: add hx509_name_expand
964
965 * env.c: key-value pair help functions
966
9672007-01-12 Love Hörnquist Å
968strand <lha@it.su.se>
969
970 * ca.c: Don't issue certs with subject DN that is NULL and have no
971 SANs
972
973 * print.c: Fix previous test.
974
975 * print.c: Check there is a SAN if subject DN is NULL.
976
977 * test_ca.in: test email, null subject dn
978
979 * hxtool.c: Allow setting parameters to private key generation.
980
981 * hx_locl.h: Allow setting parameters to private key generation.
982
983 * crypto.c: Allow setting parameters to private key generation.
984
985 * hxtool.c (eval_types): add jid if user gave one
986
987 * hxtool-commands.in (certificate-sign): add --jid
988
989 * ca.c (hx509_ca_tbs_add_san_jid): Allow adding
990 id-pkix-on-xmppAddr OtherName.
991
992 * print.c: Print id-pkix-on-xmppAddr OtherName.
993
9942007-01-11 Love Hörnquist Å
995strand <lha@it.su.se>
996
997 * no random, no RSA/DH tests
998
999 * hxtool.c (info): print status of random generator
1000
1001 * Makefile.am: remove files created by tests
1002
1003 * error.c: constify
1004
1005 * name.c: constify
1006
1007 * revoke.c: constify
1008
1009 * hx_locl.h: constify
1010
1011 * keyset.c: constify
1012
1013 * ks_p11.c: constify
1014
1015 * hx_locl.h: make printinfo char * argument const.
1016
1017 * cms.c: move _hx509_set_digest_alg from cms.c to crypto.c since
1018 its only used there.
1019
1020 * crypto.c: remove no longer used stuff, move set_digest_alg here
1021 from cms.c since its only used here.
1022
1023 * Makefile.am: add data/test-nopw.p12 to EXTRA_DIST
1024
10252007-01-10 Love Hörnquist Å
1026strand <lha@it.su.se>
1027
1028 * print.c: BasicConstraints vs criticality bit is complicated and
1029 not really possible to evaluate on its own, silly RFC3280.
1030
1031 * ca.c: Make basicConstraints critical if this is a CA.
1032
1033 * print.c: fix the version vs extension test
1034
1035 * print.c: More validation checks.
1036
1037 * name.c (hx509_name_cmp): add
1038
10392007-01-09 Love Hörnquist Å
1040strand <lha@it.su.se>
1041
1042 * ks_p11.c (collect_private_key): Missing CKA_MODULUS is ok
1043 too (XXX why should these be fetched given they are not used).
1044
1045 * test_ca.in: rename all files to PEM files, since that is what
1046 they are.
1047
1048 * hxtool.c: copy out the key with the self signed CA cert
1049
1050 * Factor out private key operation out of the signing, operations,
1051 support import, export, and generation of private keys. Add
1052 support for writing PEM and PKCS12 files with private keys in them.
1053
1054 * data/gen-req.sh: Generate a no password pkcs12 file.
1055
10562007-01-08 Love Hörnquist Å
1057strand <lha@it.su.se>
1058
1059 * cms.c: Check for internal ASN1 encoder error.
1060
10612007-01-05 Love Hörnquist Å
1062strand <lha@it.su.se>
1063
1064 * Makefile.am: Drop most of the pkcs11 files.
1065
1066 * test_ca.in: test reissueing ca certificate (xxx time
1067 validAfter).
1068
1069 * hxtool.c: Allow setting serialNumber (needed for reissuing
1070 certificates) Change --key argument to --out-key.
1071
1072 * hxtool-commands.in (issue-certificate): Allow setting
1073 serialNumber (needed for reissuing certificates), Change --key
1074 argument to --out-key.
1075
1076 * ref: Replace with Marcus Brinkmann of g10 Code GmbH pkcs11
1077 headerfile that is compatible with GPL (file taken from scute)
1078
10792007-01-04 Love Hörnquist Å
1080strand <lha@it.su.se>
1081
1082 * test_ca.in: Test to generate key and use them.
1083
1084 * hxtool.c: handle other keys the pkcs10 requested keys
1085
1086 * hxtool-commands.in: add generate key commands
1087
1088 * req.c (_hx509_request_to_pkcs10): PKCS10 needs to have a subject
1089
1090 * hxtool-commands.in: Spelling.
1091
1092 * ca.c (hx509_ca_tbs_set_proxy): allow negative pathLenConstraint
1093 to signal no limit
1094
1095 * ks_file.c: Try all formats on the binary file before giving up,
1096 this way we can handle binary rsa keys too.
1097
1098 * data/key2.der: new test key
1099
11002007-01-04 David Love <fx@gnu.org>
1101
1102 * Makefile.am (hxtool_LDADD): Add libasn1.la
1103
1104 * hxtool.c (pcert_verify): Fix format string.
1105
11062006-12-31 Love Hörnquist Å
1107strand <lha@it.su.se>
1108
1109 * hxtool.c: Allow setting path length
1110
1111 * cert.c: Fix test for proxy certs chain length, it was too
1112 restrictive.
1113
1114 * data: regen
1115
1116 * data/openssl.cnf: (proxy_cert) make length 0
1117
1118 * test_ca.in: Issue a long living cert.
1119
1120 * hxtool.c: add --lifetime to ca command.
1121
1122 * hxtool-commands.in: add --lifetime to ca command.
1123
1124 * ca.c: allow setting notBefore and notAfter.
1125
1126 * test_ca.in: Test generation of proxy certificates.
1127
1128 * ca.c: Allow generation of proxy certificates, always include
1129 BasicConstraints, fix error codes.
1130
1131 * hxtool.c: Allow generation of proxy certificates.
1132
1133 * test_name.c: make hx509_parse_name take a hx509_context.
1134
1135 * name.c: Split building RDN to a separate function.
1136
11372006-12-30 Love Hörnquist Å
1138strand <lha@it.su.se>
1139
1140 * Makefile.am: clean test_ca files.
1141
1142 * test_ca.in: test issuing self-signed and CA certificates.
1143
1144 * hxtool.c: Add bits to allow issuing self-signed and CA
1145 certificates.
1146
1147 * hxtool-commands.in: Add bits to allow issuing self-signed and CA
1148 certificates.
1149
1150 * ca.c: Add bits to allow issuing CA certificates.
1151
1152 * revoke.c: use new OCSPSigning.
1153
1154 * ca.c: Add Subject Key Identifier.
1155
1156 * ca.c: Add Authority Key Identifier.
1157
1158 * cert.c: Locally export _hx509_find_extension_subject_key_id.
1159 Handle AuthorityKeyIdentifier where only authorityCertSerialNumber
1160 and authorityCertSerialNumber is set.
1161
1162 * hxtool-commands.in: Add dnsname and rfc822 SANs.
1163
1164 * test_ca.in: Test dnsname and rfc822 SANs.
1165
1166 * ca.c: Add dnsname and rfc822 SANs.
1167
1168 * hxtool.c: Add dnsname and rfc822 SANs.
1169
1170 * test_ca.in: test adding eku, ku and san to the
1171 certificate (https and pk-init)
1172
1173 * hxtool.c: Add eku, ku and san to the certificate.
1174
1175 * ca.c: Add eku, ku and san to the certificate.
1176
1177 * hxtool-commands.in: Add --type and --pk-init-principal
1178
1179 * ocsp.asn1: remove id-kp-OCSPSigning, its in rfc2459.asn1 now
1180
11812006-12-29 Love Hörnquist Å
1182strand <lha@it.su.se>
1183
1184 * ca.c: Add KeyUsage extension.
1185
1186 * Makefile.am: add ca.c, add sign-certificate tests.
1187
1188 * crypto.c: Add _hx509_create_signature_bitstring.
1189
1190 * hxtool-commands.in: Add the sign-certificate tool.
1191
1192 * hxtool.c: Add the sign-certificate tool.
1193
1194 * cert.c: Add HX509_QUERY_OPTION_KU_KEYCERTSIGN.
1195
1196 * hx509.h: Add hx509_ca_tbs and HX509_QUERY_OPTION_KU_KEYCERTSIGN.
1197
1198 * test_ca.in: Basic test of generating a pkcs10 request, signing
1199 it and verifying the chain.
1200
1201 * ca.c: Naive certificate signer.
1202
12032006-12-28 Love Hörnquist Å
1204strand <lha@it.su.se>
1205
1206 * hxtool.c: add hxtool_hex
1207
12082006-12-22 Love Hörnquist Å
1209strand <lha@it.su.se>
1210
1211 * Makefile.am: use top_builddir for libasn1.la
1212
12132006-12-11 Love Hörnquist Å
1214strand <lha@it.su.se>
1215
1216 * hxtool.c (print_certificate): print serial number.
1217
1218 * name.c (no): add S=stateOrProvinceName
1219
12202006-12-09 Love Hörnquist Å
1221strand <lha@it.su.se>
1222
1223 * crypto.c (_hx509_private_key_assign_rsa): set a default sig alg
1224
1225 * ks_file.c (try_decrypt): pass down AlgorithmIdentifier that key
1226 uses to do sigatures so there is no need to hardcode RSA into this
1227 function.
1228
12292006-12-08 Love Hörnquist Å
1230strand <lha@it.su.se>
1231
1232 * ks_file.c: Pass filename to the parse functions and use it in
1233 the error messages
1234
1235 * test_chain.in: test proxy cert (third level)
1236
1237 * hx509_err.et: fix errorstring for PROXY_CERT_NAME_WRONG
1238
1239 * data: regen
1240
1241 * Makefile.am: EXTRA_DIST: add
1242 data/proxy10-child-child-test.{key,crt}
1243
1244 * data/gen-req.sh: Fix names and restrictions on the proxy
1245 certificates
1246
1247 * cert.c: Clairfy and make proxy cert handling work for multiple
1248 levels, before it was too restrictive. More helpful error message.
1249
12502006-12-07 Love Hörnquist Å
1251strand <lha@it.su.se>
1252
1253 * cert.c (check_key_usage): tell what keyusages are missing
1254
1255 * print.c: Split OtherName printing code to a oid lookup and print
1256 function.
1257
1258 * print.c (Time2string): print hour as hour not min
1259
1260 * Makefile.am: CLEANFILES += test
1261
12622006-12-06 Love Hörnquist Å
1263strand <lha@it.su.se>
1264
1265 * Makefile.am (EXTRA_DIST): add data/pkinit-proxy* files
1266
1267 * Makefile.am (EXTRA_DIST): add tst-crypto* files
1268
1269 * cert.c (hx509_query_match_issuer_serial): make a copy of the
1270 data
1271
1272 * cert.c (hx509_query_match_issuer_serial): allow matching on
1273 issuer and serial num
1274
1275 * cert.c (_hx509_calculate_path): add flag to allow leaving out
1276 trust anchor
1277
1278 * cms.c (hx509_cms_create_signed_1): when building the path, omit
1279 the trust anchors.
1280
1281 * crypto.c (rsa_create_signature): Abort when signature is longer,
1282 not shorter.
1283
1284 * cms.c: Provide time to _hx509_calculate_path so we don't send no
1285 longer valid certs to our peer.
1286
1287 * cert.c (find_parent): when checking for certs and its not a
1288 trust anchor, require time be in range.
1289 (_hx509_query_match_cert): Add time validity-testing to query mask
1290
1291 * hx_locl.h: add time validity-testing to query mask
1292
1293 * test_cms.in: Tests for CMS SignedData with incomplete chain from
1294 the signer.
1295
12962006-11-28 Love Hörnquist Å
1297strand <lha@it.su.se>
1298
1299 * cms.c (hx509_cms_verify_signed): specify what signature we
1300 failed to verify
1301
1302 * Makefile.am: Depend on LIB_com_err for AIX.
1303
1304 * keyset.c: Remove anther strndup that causes AIX to fall over.
1305
1306 * cert.c: Don't check the trust anchors expiration time since they
1307 are transported out of band, from RFC3820.
1308
1309 * cms.c: sprinkle more error strings
1310
1311 * crypto.c: sprinkle more error strings
1312
1313 * hxtool.c: use unsigned int as counter to fit better with the
1314 asn1 compiler
1315
1316 * crypto.c: use unsigned int as counter to fit better with the
1317 asn1 compiler
1318
13192006-11-27 Love Hörnquist Å
1320strand <lha@it.su.se>
1321
1322 * cms.c: Remove trailing white space.
1323
1324 * crypto.c: rewrite comment to make more sense
1325
1326 * crypto.c (hx509_crypto_select): check sig_algs[j]->key_oid
1327
1328 * hxtool-commands.in (crypto-available): add --type
1329
1330 * crypto.c (hx509_crypto_available): let alg pass if its keyless
1331
1332 * hxtool-commands.in: Expand crypto-select
1333
1334 * cms.c: Rename hx509_select to hx509_crypto_select.
1335
1336 * hxtool-commands.in: Add crypto-select and crypto-available.
1337
1338 * hxtool.c: Add crypto-select and crypto-available.
1339
1340 * crypto.c (hx509_crypto_available): use right index.
1341 (hx509_crypto_free_algs): new function
1342
1343 * crypto.c (hx509_crypto_select): improve
1344 (hx509_crypto_available): new function
1345
13462006-11-26 Love Hörnquist Å
1347strand <lha@it.su.se>
1348
1349 * cert.c: Sprinkle more error string and hx509_contexts.
1350
1351 * cms.c: Sprinkle more error strings.
1352
1353 * crypto.c: Sprinkle error string and hx509_contexts.
1354
1355 * crypto.c: Add some more comments about how this works.
1356
1357 * crypto.c (hx509_select): new function.
1358
1359 * Makefile.am: add peer.c
1360
1361 * hxtool.c: Update hx509_cms_create_signed_1.
1362
1363 * hx_locl.h: add struct hx509_peer_info
1364
1365 * peer.c: Allow selection of digest/sig-alg
1366
1367 * cms.c: Allow selection of a better digest using hx509_peer_info.
1368
1369 * revoke.c: Handle that _hx509_verify_signature takes a context.
1370
1371 * cert.c: Handle that _hx509_verify_signature takes a context.
1372
13732006-11-25 Love Hörnquist Å
1374strand <lha@it.su.se>
1375
1376 * cms.c: Sprinkle error strings.
1377
1378 * crypto.c: Sprinkle context and error strings.
1379
13802006-11-24 Love Hörnquist Å
1381strand <lha@it.su.se>
1382
1383 * name.c: Handle printing and parsing raw oids in name.
1384
13852006-11-23 Love Hörnquist Å
1386strand <lha@it.su.se>
1387
1388 * cert.c (_hx509_calculate_path): allow to calculate optimistic
1389 path when we don't know the trust anchors, just follow the chain
1390 upward until we no longer find a parent or we hit the max limit.
1391
1392 * cms.c (hx509_cms_create_signed_1): provide a best effort path to
1393 the trust anchors to be stored in the SignedData packet, if find
1394 parents until trust anchor or max length.
1395
1396 * data: regen
1397
1398 * data/gen-req.sh: Build pk-init proxy cert.
1399
14002006-11-16 Love Hörnquist Å
1401strand <lha@it.su.se>
1402
1403 * error.c (hx509_get_error_string): Put ", " between strings in
1404 error message.
1405
14062006-11-13 Love Hörnquist Å
1407strand <lha@it.su.se>
1408
1409 * data/openssl.cnf: Change realm to TEST.H5L.SE
1410
14112006-11-07 Love Hörnquist Å
1412strand <lha@it.su.se>
1413
1414 * revoke.c: Sprinkle error strings.
1415
14162006-11-04 Love Hörnquist Å
1417strand <lha@it.su.se>
1418
1419 * hx_locl.h: add context variable to cmp function.
1420
1421 * cert.c (hx509_query_match_cmp_func): allow setting the match
1422 function.
1423
14242006-10-24 Love Hörnquist Å
1425strand <lha@it.su.se>
1426
1427 * ks_p11.c: Return less EINVAL.
1428
1429 * hx509_err.et: add more pkcs11 errors
1430
1431 * hx509_err.et: more error-codes
1432
1433 * revoke.c: Return less EINVAL.
1434
1435 * ks_dir.c: sprinkel more hx509_set_error_string
1436
1437 * ks_file.c: Return less EINVAL.
1438
1439 * hxtool.c: Pass in context to _hx509_parse_private_key.
1440
1441 * ks_file.c: Sprinkle more hx509_context so we can return propper
1442 errors.
1443
1444 * hx509_err.et: add HX509_PARSING_KEY_FAILED
1445
1446 * crypto.c: Sprinkle more hx509_context so we can return propper
1447 errors.
1448
1449 * collector.c: No more EINVAL.
1450
1451 * hx509_err.et: add HX509_LOCAL_ATTRIBUTE_MISSING
1452
1453 * cert.c (hx509_cert_get_base_subject): one less EINVAL
1454 (_hx509_cert_private_decrypt): one less EINVAL
1455
14562006-10-22 Love Hörnquist Å
1457strand <lha@it.su.se>
1458
1459 * collector.c: indent
1460
1461 * hxtool.c: Try to not leak memory.
1462
1463 * req.c: clean memory before free
1464
1465 * crypto.c (_hx509_private_key2SPKI): indent
1466
1467 * req.c: Try to not leak memory.
1468
14692006-10-21 Love Hörnquist Å
1470strand <lha@it.su.se>
1471
1472 * test_crypto.in: Read 50 kilobyte random data
1473
1474 * revoke.c: Try to not leak memory.
1475
1476 * hxtool.c: Try to not leak memory.
1477
1478 * crypto.c (hx509_crypto_destroy): free oid.
1479
1480 * error.c: Clean error string on failure just to make sure.
1481
1482 * cms.c: Try to not leak memory (again).
1483
1484 * hxtool.c: use a sensable content type
1485
1486 * cms.c: Try harder to free certificate.
1487
14882006-10-20 Love Hörnquist Å
1489strand <lha@it.su.se>
1490
1491 * Makefile.am: Add make check data.
1492
14932006-10-19 Love Hörnquist Å
1494strand <lha@it.su.se>
1495
1496 * ks_p11.c (p11_list_keys): make element of search_data[0]
1497 constants and set them later
1498
1499 * Makefile.am: Add more files.
1500
15012006-10-17 Love Hörnquist Å
1502strand <lha@it.su.se>
1503
1504 * ks_file.c: set ret, remember to free ivdata
1505
15062006-10-16 Love Hörnquist Å
1507strand <lha@it.su.se>
1508
1509 * hx_locl.h: Include <parse_bytes.h>.
1510
1511 * test_crypto.in: Test random-data.
1512
1513 * hxtool.c: RAND_bytes() return 1 for cryptographic strong data,
1514 check for that.
1515
1516 * Makefile.am: clean random-data
1517
1518 * hxtool.c: Add random-data command, use sl_slc_help.
1519
1520 * hxtool-commands.in: Add random-data.
1521
1522 * ks_p12.c: Remember to release certs.
1523
1524 * ks_p11.c: Remember to release certs.
1525
15262006-10-14 Love Hörnquist Å
1527strand <lha@it.su.se>
1528
1529 * prefix der primitives with der_
1530
1531 * lock.c: Match the prompt type PROMPT exact.
1532
1533 * hx_locl.h: Drop heim_any.h
1534
15352006-10-11 Love Hörnquist Å
1536strand <lha@it.su.se>
1537
1538 * ks_p11.c (p11_release_module): j needs to be used as inter loop
1539 index. From Douglas Engert.
1540
1541 * ks_file.c (parse_rsa_private_key): try all passwords and
1542 prompter.
1543
15442006-10-10 Love Hörnquist Å
1545strand <lha@it.su.se>
1546
1547 * test_*.in: Parameterise the invocation of hxtool, so we can make
1548 it run under TESTS_ENVIRONMENT. From Andrew Bartlett
1549
15502006-10-08 Love Hörnquist Å
1551strand <lha@it.su.se>
1552
1553 * test_crypto.in: Put all test stuck at 2006-09-25 since all their
1554 chains where valied then.
1555
1556 * hxtool.c: Implement --time= option.
1557
1558 * hxtool-commands.in: Add option time.
1559
1560 * Makefile.am: test_name is a PROGRAM_TESTS
1561
1562 * ks_p11.c: Return HX509_PKCS11_NO_SLOT when there are no slots
1563 and HX509_PKCS11_NO_TOKEN when there are no token. For use in PAM
1564 modules that want to detect when to use smartcard login and when
1565 not to. Patched based on code from Douglas Engert.
1566
1567 * hx509_err.et: Add new pkcs11 related errors in a new section:
1568 keystore related error. Patched based on code from Douglas
1569 Engert.
1570
15712006-10-07 Love Hörnquist Å
1572strand <lha@it.su.se>
1573
1574 * Makefile.am: Make depenency for slc built files just like
1575 everywhere else.
1576
1577 * cert.c: Add all openssl algs and init asn1 et
1578
15792006-10-06 Love Hörnquist Å
1580strand <lha@it.su.se>
1581
1582 * ks_file.c (parse_rsa_private_key): free type earlier.
1583
1584 * ks_file.c (parse_rsa_private_key): free type after use
1585
1586 * name.c (_hx509_Name_to_string): remove dup const
1587
15882006-10-02 Love Hörnquist Å
1589strand <lha@it.su.se>
1590
1591 * Makefile.am: Add more libs to libhx509
1592
15932006-10-01 Love Hörnquist Å
1594strand <lha@it.su.se>
1595
1596 * ks_p11.c: Fix double free's, NULL ptr de-reference, and conform
1597 better to pkcs11. From Douglas Engert.
1598
1599 * ref: remove ^M, it breaks solaris 10s cc. From Harald Barth
1600
16012006-09-19 Love Hörnquist Å
1602strand <lha@it.su.se>
1603
1604 * test_crypto.in: Bleichenbacher bad cert from Ralf-Philipp
1605 Weinmann and Andrew Pyshkin, pad right.
1606
1607 * data: starfield test root cert and Ralf-Philipp and Andreis
1608 correctly padded bad cert
1609
16102006-09-15 Love Hörnquist Å
1611strand <lha@it.su.se>
1612
1613 * test_crypto.in: Add test for yutaka certs.
1614
1615 * cert.c: Add a strict rfc3280 verification flag. rfc3280 requires
1616 certificates to have KeyUsage.keyCertSign if they are to be used
1617 for signing of certificates, but the step in the verifiation is
1618 optional.
1619
1620 * hxtool.c: Improve printing and error reporting.
1621
16222006-09-13 Love Hörnquist Å
1623strand <lha@it.su.se>
1624
1625 * test_crypto.in,Makefile.am,data/bleichenbacher-{bad,good}.pem:
1626 test bleichenbacher from eay
1627
16282006-09-12 Love Hörnquist Å
1629strand <lha@it.su.se>
1630
1631 * hxtool.c: Make common function for all getarg_strings and
1632 hx509_certs_append commonly used.
1633
1634 * cms.c: HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT is a negative
1635 flag, treat it was such.
1636
16372006-09-11 Love Hörnquist Å
1638strand <lha@it.su.se>
1639
1640 * req.c: Use the new add_GeneralNames function.
1641
1642 * hx509.h: Add HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT.
1643
1644 * ks_p12.c: Adapt to new signature of hx509_cms_unenvelope.
1645
1646 * hxtool.c: Adapt to new signature of hx509_cms_unenvelope.
1647
1648 * cms.c: Allow passing in encryptedContent and flag. Add new flag
1649 HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT.
1650
16512006-09-08 Love Hörnquist Å
1652strand <lha@it.su.se>
1653
1654 * ks_p11.c: cast void * to char * when using it for %s formating
1655 in printf.
1656
1657 * name.c: New function _hx509_Name_to_string.
1658
16592006-09-07 Love Hörnquist Å
1660strand <lha@it.su.se>
1661
1662 * ks_file.c: Sprinkle error messages.
1663
1664 * cms.c: Sprinkle even more error messages.
1665
1666 * cms.c: Sprinkle some error messages.
1667
1668 * cms.c (find_CMSIdentifier): only free string when we allocated
1669 one.
1670
1671 * ks_p11.c: Don't build most of the pkcs11 module if there are no
1672 dlopen().
1673
16742006-09-06 Love Hörnquist Å
1675strand <lha@it.su.se>
1676
1677 * cms.c (hx509_cms_unenvelope): try to save the error string from
1678 find_CMSIdentifier so we have one more bit of information what
1679 went wrong.
1680
1681 * hxtool.c: More pretty printing, make verify_signed return the
1682 error string from the library.
1683
1684 * cms.c: Try returning what certificates failed to parse or be
1685 found.
1686
1687 * ks_p11.c (p11_list_keys): fetch CKA_LABEL and use it to set the
1688 friendlyname for the certificate.
1689
16902006-09-05 Love Hörnquist Å
1691strand <lha@it.su.se>
1692
1693 * crypto.c: check that there are no extra bytes in the checksum
1694 and that the parameters are NULL or the NULL-type. All to avoid
1695 having excess data that can be used to fake the signature.
1696
1697 * hxtool.c: print keyusage
1698
1699 * print.c: add hx509_cert_keyusage_print, simplify oid printing
1700
1701 * cert.c: add _hx509_cert_get_keyusage
1702
1703 * ks_p11.c: keep one session around for the whole life of the keyset
1704
1705 * test_query.in: tests more selection
1706
1707 * hxtool.c: improve pretty printing in print and query
1708
1709 * hxtool{.c,-commands.in}: add selection on KU and printing to query
1710
1711 * test_cms.in: Add cms test for digitalSignature and
1712 keyEncipherment certs.
1713
1714 * name.c (no): Add serialNumber
1715
1716 * ks_p11.c (p11_get_session): return better error messages
1717
17182006-09-04 Love Hörnquist Å
1719strand <lha@it.su.se>
1720
1721 * ref: update to pkcs11 reference files 2.20
1722
1723 * ks_p11.c: add more mechflags
1724
1725 * name.c (no): add OU and sort
1726
1727 * revoke.c: pass context to _hx509_create_signature
1728
1729 * ks_p11.c (p11_printinfo): print proper plural s
1730
1731 * ks_p11.c: save the mechs supported when initing the token, print
1732 them in printinfo.
1733
1734 * hx_locl.h: Include <parse_units.h>.
1735
1736 * cms.c: pass context to _hx509_create_signature
1737
1738 * req.c: pass context to _hx509_create_signature
1739
1740 * keyset.c (hx509_certs_info): print information about the keyset.
1741
1742 * hxtool.c (pcert_print) print keystore info when --info flag is
1743 given.
1744
1745 * hxtool-commands.in: Add hxtool print --info.
1746
1747 * test_query.in: Test hxtool print --info.
1748
1749 * hx_locl.h (hx509_keyset_ops): add printinfo
1750
1751 * crypto.c: Start to hang the private key operations of the
1752 private key, pass hx509_context to create_checksum.
1753
17542006-05-29 Love Hörnquist Å
1755strand <lha@it.su.se>
1756
1757 * ks_p11.c: Iterate over all slots, not just the first/selected
1758 one.
1759
17602006-05-27 Love Hörnquist Å
1761strand <lha@it.su.se>
1762
1763 * cert.c: Add release function for certifiates so backend knowns
1764 when its no longer used.
1765
1766 * ks_p11.c: Add reference counting on certifiates, push out
1767 CK_SESSION_HANDLE from slot.
1768
1769 * cms.c: sprinkle more hx509_clear_error_string
1770
17712006-05-22 Love Hörnquist Å
1772strand <lha@it.su.se>
1773
1774 * ks_p11.c: Sprinkle some hx509_set_error_strings
1775
17762006-05-13 Love Hörnquist Å
1777strand <lha@it.su.se>
1778
1779 * hxtool.c: Avoid shadowing.
1780
1781 * revoke.c: Avoid shadowing.
1782
1783 * ks_file.c: Avoid shadowing.
1784
1785 * cert.c: Avoid shadowing.
1786
17872006-05-12 Love Hörnquist Å
1788strand <lha@it.su.se>
1789
1790 * lock.c (hx509_prompt_hidden): reshuffle to avoid gcc warning
1791
1792 * hx509.h: Reshuffle the prompter types, remove the hidden field.
1793
1794 * lock.c (hx509_prompt_hidden): return if the prompt should be
1795 hidden or not
1796
1797 * revoke.c (hx509_revoke_free): allow free of NULL.
1798
17992006-05-11 Love Hörnquist Å
1800strand <lha@it.su.se>
1801
1802 * ks_file.c (file_init): Avoid shadowing ret (and thus avoiding
1803 crashing).
1804
1805 * ks_dir.c: Implement DIR: caches useing FILE: caches.
1806
1807 * ks_p11.c: Catch more errors.
1808
18092006-05-08 Love Hörnquist Å
1810strand <lha@it.su.se>
1811
1812 * crypto.c (hx509_crypto_encrypt): free correctly in error
1813 path. From Andrew Bartlett.
1814
1815 * crypto.c: If RAND_bytes fails, then we will attempt to
1816 double-free crypt->key.data. From Andrew Bartlett.
1817
18182006-05-05 Love Hörnquist Å
1819strand <lha@it.su.se>
1820
1821 * name.c: Rename u_intXX_t to uintXX_t
1822
18232006-05-03 Love Hörnquist Å
1824strand <lha@it.su.se>
1825
1826 * TODO: More to do about the about the PKCS11 code.
1827
1828 * ks_p11.c: Use the prompter from the lock function.
1829
1830 * lock.c: Deal with that hx509_prompt.reply is no longer a
1831 pointer.
1832
1833 * hx509.h: Make hx509_prompt.reply not a pointer.
1834
18352006-05-02 Love Hörnquist Å
1836strand <lha@it.su.se>
1837
1838 * keyset.c: Sprinkle setting error strings.
1839
1840 * crypto.c: Sprinkle setting error strings.
1841
1842 * collector.c: Sprinkle setting error strings.
1843
1844 * cms.c: Sprinkle setting error strings.
1845
18462006-05-01 Love Hörnquist Å
1847strand <lha@it.su.se>
1848
1849 * test_name.c: renamed one error code
1850
1851 * name.c: renamed one error code
1852
1853 * ks_p11.c: _hx509_set_cert_attribute changed signature
1854
1855 * hxtool.c (pcert_print): use hx509_err so I can test it
1856
1857 * error.c (hx509_set_error_stringv): clear errors on malloc
1858 failure
1859
1860 * hx509_err.et: Add some more errors
1861
1862 * cert.c: Sprinkle setting error strings.
1863
1864 * cms.c: _hx509_path_append changed signature.
1865
1866 * revoke.c: changed signature of _hx509_check_key_usage
1867
1868 * keyset.c: changed signature of _hx509_query_match_cert
1869
1870 * hx509.h: Add support for error strings.
1871
1872 * cms.c: changed signature of _hx509_check_key_usage
1873
1874 * Makefile.am: ibhx509_la_files += error.c
1875
1876 * ks_file.c: Sprinkel setting error strings.
1877
1878 * cert.c: Sprinkel setting error strings.
1879
1880 * hx_locl.h: Add support for error strings.
1881
1882 * error.c: Add string error handling functions.
1883
1884 * keyset.c (hx509_certs_init): pass the right error code back
1885
18862006-04-30 Love Hörnquist Å
1887strand <lha@it.su.se>
1888
1889 * revoke.c: Revert previous patch.
1890 (hx509_ocsp_verify): new function that returns the expiration of
1891 certificate in ocsp data-blob
1892
1893 * cert.c: Reverse previous patch, lets do it another way.
1894
1895 * cert.c (hx509_revoke_verify): update usage
1896
1897 * revoke.c: Make compile.
1898
1899 * revoke.c: Add the expiration time the crl/ocsp info expire
1900
1901 * name.c: Add hx509_name_is_null_p
1902
1903 * cert.c: remove _hx509_cert_private_sigature
1904
19052006-04-29 Love Hörnquist Å
1906strand <lha@it.su.se>
1907
1908 * name.c: Expose more of Name.
1909
1910 * hxtool.c (main): add missing argument to printf
1911
1912 * data/openssl.cnf: Add EKU for the KDC certificate
1913
1914 * cert.c (hx509_cert_get_base_subject): reject un-canon proxy
1915 certs, not the reverse
1916 (add_to_list): constify and fix argument order to
1917 copy_octet_string
1918 (hx509_cert_find_subjectAltName_otherName): make work
1919
19202006-04-28 Love Hörnquist Å
1921strand <lha@it.su.se>
1922
1923 * data/{pkinit,kdc}.{crt,key}: pkinit certificates
1924
1925 * data/gen-req.sh: Generate pkinit certificates.
1926
1927 * data/openssl.cnf: Add pkinit glue.
1928
1929 * cert.c (hx509_verify_hostname): implement stub function
1930
19312006-04-27 Love Hörnquist Å
1932strand <lha@it.su.se>
1933
1934 * TODO: CRL delta support
1935
19362006-04-26 Love Hörnquist Å
1937strand <lha@it.su.se>
1938
1939 * data/.cvsignore: ignore leftover from OpenSSL cert generation
1940
1941 * hx509_err.et: Add name malformated error
1942
1943 * name.c (hx509_parse_name): don't abort on error, rather return
1944 error
1945
1946 * test_name.c: Test failure parsing name.
1947
1948 * cert.c: When verifying certificates, store subject basename for
1949 later consumption.
1950
1951 * test_name.c: test to parse and print name and check that they
1952 are the same.
1953
1954 * name.c (hx509_parse_name): fix length argument to printf string
1955
1956 * name.c (hx509_parse_name): fix length argument to stringtooid, 1
1957 too short.
1958
1959 * cert.c: remove debug printf's
1960
1961 * name.c (hx509_parse_name): make compile pre c99
1962
1963 * data/gen-req.sh: OpenSSL have a serious issue of user confusion
1964 -subj in -ca takes the arguments in LDAP order. -subj for x509
1965 takes it in x509 order.
1966
1967 * cert.c (hx509_verify_path): handle the case where the where two
1968 proxy certs in a chain.
1969
1970 * test_chain.in: enable two proxy certificates in a chain test
1971
1972 * test_chain.in: tests proxy certificates
1973
1974 * data: re-gen
1975
1976 * data/gen-req.sh: build proxy certificates
1977
1978 * data/openssl.cnf: add def for proxy10_cert
1979
1980 * hx509_err.et: Add another proxy certificate error.
1981
1982 * cert.c (hx509_verify_path): Need to mangle name to remove the CN
1983 of the subject, copying issuer only works for one level but is
1984 better then doing no checking at all.
1985
1986 * hxtool.c: Add verify --allow-proxy-certificate.
1987
1988 * hxtool-commands.in: add verify --allow-proxy-certificate
1989
1990 * hx509_err.et: Add proxy certificate errors.
1991
1992 * cert.c: Fix comment about subject name of proxy certificate.
1993
1994 * test_chain.in: tests for proxy certs
1995
1996 * data/gen-req.sh: gen proxy and non-proxy tests certificates
1997
1998 * data/openssl.cnf: Add definition for proxy certs
1999
2000 * data/*proxy-test.*: Add proxy certificates
2001
2002 * cert.c (hx509_verify_path): verify proxy certificate have no san
2003 or ian
2004
2005 * cert.c (hx509_verify_set_proxy_certificate): Add
2006 (*): rename policy cert to proxy cert
2007
2008 * cert.c: Initial support for proxy certificates.
2009
20102006-04-24 Love Hörnquist Å
2011strand <lha@it.su.se>
2012
2013 * hxtool.c: some error checking
2014
2015 * name.c: Switch over to asn1 generaed oids.
2016
2017 * TODO: merge with old todo file
2018
20192006-04-23 Love Hörnquist Å
2020strand <lha@it.su.se>
2021
2022 * test_query.in: make quiet
2023
2024 * test_req.in: SKIP test if there is no RSA support.
2025
2026 * hxtool.c: print dh method too
2027
2028 * test_chain.in: SKIP test if there is no RSA support.
2029
2030 * test_cms.in: SKIP test if there is no RSA support.
2031
2032 * test_nist.in: SKIP test if there is no RSA support.
2033
20342006-04-22 Love Hörnquist Å
2035strand <lha@it.su.se>
2036
2037 * hxtool-commands.in: Allow passing in pool and anchor to
2038 signedData
2039
2040 * hxtool.c: Allow passing in pool and anchor to signedData
2041
2042 * test_cms.in: Test that certs in signed data is picked up.
2043
2044 * hx_locl.h: Expose the path building function to internal
2045 functions.
2046
2047 * cert.c: Expose the path building function to internal functions.
2048
2049 * hxtool-commands.in: cms-envelope: Add support for choosing the
2050 encryption type
2051
2052 * hxtool.c (cms_create_enveloped): Add support for choosing the
2053 encryption type
2054
2055 * test_cms.in: Test generating des-ede3 aes-128 aes-256 enveloped
2056 data
2057
2058 * crypto.c: Add names to cipher types.
2059
2060 * cert.c (hx509_query_match_friendly_name): fix return value
2061
2062 * data/gen-req.sh: generate tests for enveloped data using
2063 des-ede3 and aes256
2064
2065 * test_cms.in: add tests for enveloped data using des-ede3 and
2066 aes256
2067
2068 * cert.c (hx509_query_match_friendly_name): New function.
2069
20702006-04-21 Love Hörnquist Å
2071strand <lha@it.su.se>
2072
2073 * ks_p11.c: Add support for parsing slot-number.
2074
2075 * crypto.c (oid_private_rc2_40): simply
2076
2077 * crypto.c: Use oids from asn1 generator.
2078
2079 * ks_file.c (file_init): reset length when done with a part
2080
2081 * test_cms.in: check with test.combined.crt.
2082
2083 * data/gen-req.sh: Create test.combined.crt.
2084
2085 * test_cms.in: Test signed data using keyfile that is encrypted.
2086
2087 * ks_file.c: Remove (commented out) debug printf
2088
2089 * ks_file.c (parse_rsa_private_key): use EVP_get_cipherbyname
2090
2091 * ks_file.c (parse_rsa_private_key): make working for one
2092 password.
2093
2094 * ks_file.c (parse_rsa_private_key): Implement enought for
2095 testing.
2096
2097 * hx_locl.h: Add <ctype.h>
2098
2099 * ks_file.c: Add glue code for PEM encrypted password files.
2100
2101 * test_cms.in: Add commeted out password protected PEM file,
2102 remove password for those tests that doesn't need it.
2103
2104 * test_cms.in: adapt test now that we can use any certificate and
2105 trust anchor
2106
2107 * collector.c: handle PEM RSA PRIVATE KEY files
2108
2109 * cert.c: Remove unused function.
2110
2111 * ks_dir.c: move code here from ks_file.c now that its no longer
2112 used.
2113
2114 * ks_file.c: Add support for parsing unencrypted RSA PRIVATE KEY
2115
2116 * crypto.c: Handle rsa private keys better.
2117
21182006-04-20 Love Hörnquist Å
2119strand <lha@it.su.se>
2120
2121 * hxtool.c: Use hx509_cms_{,un}wrap_ContentInfo
2122
2123 * cms.c: Make hx509_cms_{,un}wrap_ContentInfo usable in asn1
2124 un-aware code.
2125
2126 * cert.c (hx509_verify_path): if trust anchor is not self signed,
2127 don't check sig From Douglas Engert.
2128
2129 * test_chain.in: test "sub-cert -> sub-ca"
2130
2131 * crypto.c: Use the right length for the sha256 checksums.
2132
21332006-04-15 Love Hörnquist Å
2134strand <lha@it.su.se>
2135
2136 * crypto.c: Fix breakage from sha256 code.
2137
2138 * crypto.c: Add SHA256 support, and symbols for the other new
2139 SHA-2 types.
2140
21412006-04-14 Love Hörnquist Å
2142strand <lha@it.su.se>
2143
2144 * test_cms.in: test rc2-40 rc2-64 rc2-128 enveloped data
2145
2146 * data/test-enveloped-rc2-{40,64,128}: add tests cases for rc2
2147
2148 * cms.c: Update prototypes changes for hx509_crypto_[gs]et_params.
2149
2150 * crypto.c: Break out the parameter handling code for encrypting
2151 data to handle RC2. Needed for Windows 2k pk-init support.
2152
21532006-04-04 Love Hörnquist Å
2154strand <lha@it.su.se>
2155
2156 * Makefile.am: Split libhx509_la_SOURCES into build file and
2157 distributed files so we can avoid building prototypes for
2158 build-files.
2159
21602006-04-03 Love Hörnquist Å
2161strand <lha@it.su.se>
2162
2163 * TODO: split certificate request into pkcs10 and CRMF
2164
2165 * hxtool-commands.in: Add nonce flag to ocsp-fetch
2166
2167 * hxtool.c: control sending nonce
2168
2169 * hxtool.c (request_create): store the request in a file, no in
2170 bitbucket.
2171
2172 * cert.c: expose print_cert_subject internally
2173
2174 * hxtool.c: Add ocsp_print.
2175
2176 * hxtool-commands.in: New command "ocsp-print".
2177
2178 * hx_locl.h: Include <hex.h>.
2179
2180 * revoke.c (verify_ocsp): require issuer to match too.
2181 (free_ocsp): new function
2182 (hx509_revoke_ocsp_print): new function, print ocsp reply
2183
2184 * Makefile.am: build CRMF files
2185
2186 * data/key.der: needed for cert request test
2187
2188 * test_req.in: adapt to rename of pkcs10-create to request-create
2189
2190 * hxtool.c: adapt to rename of pkcs10-create to request-create
2191
2192 * hxtool-commands.in: Rename pkcs10-create to request-create
2193
2194 * crypto.c: (_hx509_parse_private_key): Avoid crashing on bad input.
2195
2196 * hxtool.c (pkcs10_create): use opt->subject_string
2197
2198 * hxtool-commands.in: Add pkcs10-create --subject
2199
2200 * Makefile.am: Add test_req to tests.
2201
2202 * test_req.in: Test for pkcs10 commands.
2203
2204 * name.c (hx509_parse_name): new function.
2205
2206 * hxtool.c (pkcs10_create): implement
2207
2208 * hxtool-commands.in (pkcs10-create): Add arguments
2209
2210 * crypto.c: Add _hx509_private_key2SPKI and support
2211 functions (only support RSA for now).
2212
22132006-04-02 Love Hörnquist Å
2214strand <lha@it.su.se>
2215
2216 * hxtool-commands.in: Add pkcs10-create command.
2217
2218 * hx509.h: Add hx509_request.
2219
2220 * TODO: more stuff
2221
2222 * Makefile.am: Add req.c
2223
2224 * req.c: Create certificate requests, prototype converts the
2225 request in a pkcs10 packet.
2226
2227 * hxtool.c: Add pkcs10_create
2228
2229 * name.c (hx509_name_copy): new function.
2230
22312006-04-01 Love Hörnquist Å
2232strand <lha@it.su.se>
2233
2234 * TODO: fill out what do
2235
2236 * hxtool-commands.in: add pkcs10-print
2237
2238 * hx_locl.h: Include <pkcs10_asn1.h>.
2239
2240 * pkcs10.asn1: PKCS#10
2241
2242 * hxtool.c (pkcs10_print): new function.
2243
2244 * test_chain.in: test ocsp keyhash
2245
2246 * data: generate ocsp keyhash version too
2247
2248 * revoke.c (load_ocsp): test that we got back a BasicReponse
2249
2250 * ocsp.asn1: Add asn1_id_pkix_ocsp*.
2251
2252 * Makefile.am: Add asn1_id_pkix_ocsp*.
2253
2254 * cert.c: Add HX509_QUERY_MATCH_KEY_HASH_SHA1
2255
2256 * hx_locl.h: Add HX509_QUERY_MATCH_KEY_HASH_SHA1
2257
2258 * revoke.c: Support OCSPResponderID.byKey, indent.
2259
2260 * revoke.c (hx509_ocsp_request): Add nonce to ocsp request.
2261
2262 * hxtool.c: Add nonce to ocsp request.
2263
2264 * test_chain.in: Added crl tests
2265
2266 * data/nist-data: rename missing-crl to missing-revoke
2267
2268 * data: make ca use openssl ca command so we can add ocsp tests,
2269 and regen certs
2270
2271 * test_chain.in: Add revoked ocsp cert test
2272
2273 * cert.c: rename missing-crl to missing-revoke
2274
2275 * revoke.c: refactor code, fix a un-init-ed variable
2276
2277 * test_chain.in: rename missing-crl to missing-revoke add ocsp
2278 tests
2279
2280 * test_cms.in: rename missing-crl to missing-revoke
2281
2282 * hxtool.c: rename missing-crl to missing-revoke
2283
2284 * hxtool-commands.in: rename missing-crl to missing-revoke
2285
2286 * revoke.c: Plug one memory leak.
2287
2288 * revoke.c: Renamed generic CRL related errors.
2289
2290 * hx509_err.et: Comments and renamed generic CRL related errors
2291
2292 * revoke.c: Add ocsp checker.
2293
2294 * ocsp.asn1: Add id-kp-OCSPSigning
2295
2296 * hxtool-commands.in: add url-path argument to ocsp-fetch
2297
2298 * hxtool.c: implement ocsp-fetch
2299
2300 * cert.c: Use HX509_DEFAULT_OCSP_TIME_DIFF.
2301
2302 * hx_locl.h: Add ocsp_time_diff to hx509_context
2303
2304 * crypto.c (_hx509_verify_signature_bitstring): new function,
2305 commonly use when checking certificates
2306
2307 * cms.c (hx509_cms_envelope_1): check for internal ASN.1 encoder
2308 error
2309
2310 * cert.c: Add ocsp glue, use new
2311 _hx509_verify_signature_bitstring, add eku checking function.
2312
23132006-03-31 Love Hörnquist Å
2314strand <lha@it.su.se>
2315
2316 * Makefile.am: add id_kp_OCSPSigning.x
2317
2318 * revoke.c: Pick out certs in ocsp response
2319
2320 * TODO: list of stuff to verify
2321
2322 * revoke.c: Add code to load OCSPBasicOCSPResponse files, reload
2323 crl when its changed on disk.
2324
2325 * cert.c: Update for ocsp merge. handle building path w/o
2326 subject (using subject key id)
2327
2328 * ks_p12.c: _hx509_map_file changed prototype.
2329
2330 * file.c: _hx509_map_file changed prototype, returns struct stat
2331 if requested.
2332
2333 * ks_file.c: _hx509_map_file changed prototype.
2334
2335 * hxtool.c: Add stub for ocsp-fetch, _hx509_map_file changed
2336 prototype, add ocsp parsing to verify command.
2337
2338 * hx_locl.h: rename HX509_CTX_CRL_MISSING_OK to
2339 HX509_CTX_VERIFY_MISSING_OK now that we have OCSP glue
2340
23412006-03-30 Love Hörnquist Å
2342strand <lha@it.su.se>
2343
2344 * hx_locl.h: Add <krb5-types.h> to make it compile on Solaris,
2345 from Alex V. Labuta.
2346
23472006-03-28 Love Hörnquist Å
2348strand <lha@it.su.se>
2349
2350 * crypto.c (_hx509_pbe_decrypt): try all passwords, not just the
2351 first one.
2352
23532006-03-27 Love Hörnquist Å
2354strand <lha@it.su.se>
2355
2356 * print.c (check_altName): Print the othername oid.
2357
2358 * crypto.c: Manual page claims RSA_public_decrypt will return -1
2359 on error, lets check for that
2360
2361 * crypto.c (_hx509_pbe_decrypt): also try the empty password
2362
2363 * collector.c (match_localkeyid): no need to add back the cert to
2364 the cert pool, its already there.
2365
2366 * crypto.c: Add REQUIRE_SIGNER
2367
2368 * cert.c (hx509_cert_free): ok to free NULL
2369
2370 * hx509_err.et: Add new error code SIGNATURE_WITHOUT_SIGNER.
2371
2372 * name.c (_hx509_name_ds_cmp): make DirectoryString case
2373 insenstive
2374 (hx509_name_to_string): less spacing
2375
2376 * cms.c: Check for signature error, check consitency of error
2377
23782006-03-26 Love Hörnquist Å
2379strand <lha@it.su.se>
2380
2381 * collector.c (_hx509_collector_alloc): handle errors
2382
2383 * cert.c (hx509_query_alloc): allocate slight more more then a
2384 sizeof(pointer)
2385
2386 * crypto.c (_hx509_private_key_assign_key_file): ask for password
2387 if nothing matches.
2388
2389 * cert.c: Expose more of the hx509_query interface.
2390
2391 * collector.c: hx509_certs_find is now exposed.
2392
2393 * cms.c: hx509_certs_find is now exposed.
2394
2395 * revoke.c: hx509_certs_find is now exposed.
2396
2397 * keyset.c (hx509_certs_free): allow free-ing NULL
2398 (hx509_certs_find): expose
2399 (hx509_get_one_cert): new function
2400
2401 * hxtool.c: hx509_certs_find is now exposed.
2402
2403 * hx_locl.h: Remove hx509_query, its exposed now.
2404
2405 * hx509.h: Add hx509_query.
2406
24072006-02-22 Love Hörnquist Å
2408strand <lha@it.su.se>
2409
2410 * cert.c: Add exceptions for null (empty) subjectNames
2411
2412 * data/nist-data: Add some more name constraints tests.
2413
2414 * data/nist-data: Add some of the test from 4.13 Name Constraints.
2415
2416 * cert.c: Name constraits needs to be evaluated in block as they
2417 appear in the certificates, they can not be joined to one
2418 list. One example of this is:
2419
2420 - cert is cn=foo,dc=bar,dc=baz
2421 - subca is dc=foo,dc=baz with name restriction dc=kaka,dc=baz
2422 - ca is dc=baz with name restriction dc=baz
2423
2424 If the name restrictions are merged to a list, the certificate
2425 will pass this test.
2426
24272006-02-14 Love Hörnquist Å
2428strand <lha@it.su.se>
2429
2430 * cert.c: Handle more name constraints cases.
2431
2432 * crypto.c (dsa_verify_signature): if test if malloc failed
2433
24342006-01-31 Love Hörnquist Å
2435strand <lha@it.su.se>
2436
2437 * cms.c: Drop partial pkcs12 string2key implementation.
2438
24392006-01-20 Love Hörnquist Å
2440strand <lha@it.su.se>
2441
2442 * data/nist-data: Add commited out DSA tests (they fail).
2443
2444 * data/nist-data: Add 4.2 Validity Periods.
2445
2446 * test_nist.in: Make less verbose to use.
2447
2448 * Makefile.am: Add test_nist_cert.
2449
2450 * data/nist-data: Add some more CRL-tests.
2451
2452 * test_nist.in: Print $id instead of . when running the tests.
2453
2454 * test_nist.in: Drop verifying certifiates, its done in another
2455 test now.
2456
2457 * data/nist-data: fixup kill-rectangle leftovers
2458
2459 * data/nist-data: Drop verifying certifiates, its done in another
2460 test now. Add more crl tests. comment out all unused tests.
2461
2462 * test_nist_cert.in: test parse all nist certs
2463
24642006-01-19 Love Hörnquist Å
2465strand <lha@it.su.se>
2466
2467 * hx509_err.et: Add HX509_CRL_UNKNOWN_EXTENSION.
2468
2469 * revoke.c: Check for unknown extentions in CRLs and CRLEntries.
2470
2471 * test_nist.in: Parse new format to handle CRL info.
2472
2473 * test_chain.in: Add --missing-crl.
2474
2475 * name.c (hx509_unparse_der_name): Rename from hx509_parse_name.
2476 (_hx509_unparse_Name): Add.
2477
2478 * hxtool-commands.in: Add --missing-crl to verify commands.
2479
2480 * hx509_err.et: Add CRL errors.
2481
2482 * cert.c (hx509_context_set_missing_crl): new function Add CRL
2483 handling.
2484
2485 * hx_locl.h: Add HX509_CTX_CRL_MISSING_OK.
2486
2487 * revoke.c: Parse and verify CRLs (simplistic).
2488
2489 * hxtool.c: Parse CRL info.
2490
2491 * data/nist-data: Change format so we can deal with CRLs, also
2492 note the test-id from PKITS.
2493
2494 * data: regenerate test
2495
2496 * data/gen-req.sh: use static-file to generate tests
2497
2498 * data/static-file: new file to use for commited tests
2499
2500 * test_cms.in: Use static file, add --missing-crl.
2501
25022006-01-18 Love Hörnquist Å
2503strand <lha@it.su.se>
2504
2505 * print.c: Its cRLReason, not cRLReasons.
2506
2507 * hxtool.c: Attach revoke context to verify context.
2508
2509 * data/nist-data: change syntax to make match better with crl
2510 checks
2511
2512 * cert.c: Verify no certificates has been revoked with the new
2513 revoke interface.
2514
2515 * Makefile.am: libhx509_la_SOURCES += revoke.c
2516
2517 * revoke.c: Add framework for handling CRLs.
2518
2519 * hx509.h: Add hx509_revoke_ctx.
2520
25212006-01-13 Love Hörnquist Å
2522strand <lha@it.su.se>
2523
2524 * delete crypto_headers.h, use global file instead.
2525
2526 * crypto.c (PBE_string2key): libdes now supports PKCS12_key_gen
2527
25282006-01-12 Love Hörnquist Å
2529strand <lha@it.su.se>
2530
2531 * crypto_headers.h: Need BN_is_negative too.
2532
25332006-01-11 Love Hörnquist Å
2534strand <lha@it.su.se>
2535
2536 * ks_p11.c (p11_rsa_public_decrypt): since is wrong, don't provide
2537 it. PKCS11 can't do public_decrypt, it support verify though. All
2538 this doesn't matter, since the code never go though this path.
2539
2540 * crypto_headers.h: Provide glue to compile with less warnings
2541 with OpenSSL
2542
25432006-01-08 Love Hörnquist Å
2544strand <lha@it.su.se>
2545
2546 * Makefile.am: Depend on LIB_des
2547
2548 * lock.c: Use "crypto_headers.h".
2549
2550 * crypto_headers.h: Include the two diffrent implementation of
2551 crypto headers.
2552
2553 * cert.c: Use "crypto-headers.h". Load ENGINE configuration.
2554
2555 * crypto.c: Make compile with both OpenSSL and heimdal libdes.
2556
2557 * ks_p11.c: Add code for public key decryption (not supported yet)
2558 and use "crypto-headers.h".
2559
2560
25612006-01-04 Love Hörnquist Å
2562strand <lha@it.su.se>
2563
2564 * add a hx509_context where we can store configuration
2565
2566 * p11.c,Makefile.am: pkcs11 is now supported by library, remove
2567 old files.
2568
2569 * ks_p11.c: more paranoid on refcount, set refcounter ealier,
2570 reset pointers after free
2571
2572 * collector.c (struct private_key): remove temporary key data
2573 storage, convert directly to a key
2574 (match_localkeyid): match certificate and key using localkeyid
2575 (match_keys): match certificate and key using _hx509_match_keys
2576 (_hx509_collector_collect): rewrite to use match_keys and
2577 match_localkeyid
2578
2579 * crypto.c (_hx509_match_keys): function that determins if a
2580 private key matches a certificate, used when there is no
2581 localkeyid.
2582 (*) reset free pointer
2583
2584 * ks_file.c: Rewrite to use collector and mapping support
2585 function.
2586
2587 * ks_p11.c (rsa_pkcs1_method): constify
2588
2589 * ks_p11.c: drop extra wrapping of p11_init
2590
2591 * crypto.c (_hx509_private_key_assign_key_file): use function to
2592 extact rsa key
2593
2594 * cert.c: Revert previous, refcounter is unsigned, so it can never
2595 be negative.
2596
2597 * cert.c (hx509_cert_ref): more refcount paranoia
2598
2599 * ks_p11.c: Implement rsa_private_decrypt and add stubs for public
2600 ditto.
2601
2602 * ks_p11.c: Less printf, less memory leaks.
2603
2604 * ks_p11.c: Implement signing using pkcs11.
2605
2606 * ks_p11.c: Partly assign private key, enough to complete
2607 collection, but not any crypto functionallity.
2608
2609 * collector.c: Use hx509_private_key to assign private keys.
2610
2611 * crypto.c: Remove most of the EVP_PKEY code, and use RSA
2612 directly, this temporary removes DSA support.
2613
2614 * hxtool.c (print_f): print if there is a friendly name and if
2615 there is a private key
2616
26172006-01-03 Love Hörnquist Å
2618strand <lha@it.su.se>
2619
2620 * name.c: Avoid warning from missing __attribute__((noreturn))
2621
2622 * lock.c (_hx509_lock_unlock_certs): return unlock certificates
2623
2624 * crypto.c (_hx509_private_key_assign_ptr): new function, exposes
2625 EVP_PKEY
2626 (_hx509_private_key_assign_key_file): remember to free private key
2627 if there is one.
2628
2629 * cert.c (_hx509_abort): add newline to output and flush stdout
2630
2631 * Makefile.am: libhx509_la_SOURCES += collector.c
2632
2633 * hx_locl.h: forward type declaration of struct hx509_collector.
2634
2635 * collector.c: Support functions to collect certificates and
2636 private keys and then match them.
2637
2638 * ks_p12.c: Use the new hx509_collector support functions.
2639
2640 * ks_p11.c: Add enough glue to support certificate iteration.
2641
2642 * test_nist_pkcs12.in: Less verbose.
2643
2644 * cert.c (hx509_cert_free): if there is a private key assosited
2645 with this cert, free it
2646
2647 * print.c: Use _hx509_abort.
2648
2649 * ks_p12.c: Use _hx509_abort.
2650
2651 * hxtool.c: Use _hx509_abort.
2652
2653 * crypto.c: Use _hx509_abort.
2654
2655 * cms.c: Use _hx509_abort.
2656
2657 * cert.c: Use _hx509_abort.
2658
2659 * name.c: use _hx509_abort
2660
26612006-01-02 Love Hörnquist Å
2662strand <lha@it.su.se>
2663
2664 * name.c (hx509_name_to_string): don't cut bmpString in half.
2665
2666 * name.c (hx509_name_to_string): don't overwrite with 1 byte with
2667 bmpString.
2668
2669 * ks_file.c (parse_certificate): avoid stomping before array
2670
2671 * name.c (oidtostring): avoid leaking memory
2672
2673 * keyset.c: Add _hx509_ks_dir_register.
2674
2675 * Makefile.am (libhx509_la_SOURCES): += ks_dir.c
2676
2677 * hxtool-commands.in: Remove pkcs11.
2678
2679 * hxtool.c: Remove pcert_pkcs11.
2680
2681 * ks_file.c: Factor out certificate parsing code.
2682
2683 * ks_dir.c: Add new keystore that treats all files in a directory
2684 a keystore, useful for regression tests.
2685
26862005-12-12 Love Hörnquist Å
2687strand <lha@it.su.se>
2688
2689 * test_nist_pkcs12.in: Test parse PKCS12 files from NIST.
2690
2691 * data/nist-data: Can handle DSA certificate.
2692
2693 * hxtool.c: Print error code on failure.
2694
26952005-10-29 Love Hörnquist Å
2696strand <lha@it.su.se>
2697
2698 * crypto.c: Support DSA signature operations.
2699
27002005-10-04 Love Hörnquist Å
2701strand <lha@it.su.se>
2702
2703 * print.c: Validate that issuerAltName and subjectAltName isn't
2704 empty.
2705
27062005-09-14 Love Hörnquist Å
2707strand <lha@it.su.se>
2708
2709 * p11.c: Cast to unsigned char to avoid warning.
2710
2711 * keyset.c: Register pkcs11 module.
2712
2713 * Makefile.am: Add ks_p11.c, install hxtool.
2714
2715 * ks_p11.c: Starting point of a pkcs11 module.
2716
27172005-09-04 Love Hörnquist Å
2718strand <lha@it.su.se>
2719
2720 * lock.c: Implement prompter.
2721
2722 * hxtool-commands.in: add --content to print
2723
2724 * hxtool.c: Split verify and print.
2725
2726 * cms.c: _hx509_pbe_decrypt now takes a hx509_lock.
2727
2728 * crypto.c: Make _hx509_pbe_decrypt take a hx509_lock, workaround
2729 for empty password.
2730
2731 * name.c: Add DC, handle all Directory strings, fix signless
2732 problems.
2733
27342005-09-03 Love Hörnquist Å
2735strand <lha@it.su.se>
2736
2737 * test_query.in: Pass in --pass to all commands.
2738
2739 * hxtool.c: Use option --pass.
2740
2741 * hxtool-commands.in: Add --pass to all commands.
2742
2743 * hx509_err.et: add UNKNOWN_LOCK_COMMAND and CRYPTO_NO_PROMPTER
2744
2745 * test_cms.in: pass in password to cms-create-sd
2746
2747 * crypto.c: Abstract out PBE_string2key so I can add PBE2 s2k
2748 later. Avoid signess warnings with OpenSSL.
2749
2750 * cms.c: Use void * instead of char * for to avoid signedness
2751 issues
2752
2753 * cert.c (hx509_cert_get_attribute): remove const, its not
2754
2755 * ks_p12.c: Cast size_t to unsigned long when print.
2756
2757 * name.c: Fix signedness warning.
2758
2759 * test_query.in: Use echo, the function check isn't defined here.
2760
27612005-08-11 Love Hörnquist Å
2762strand <lha@it.su.se>
2763
2764 * hxtool-commands.in: Add more options that was missing.
2765
27662005-07-28 Love Hörnquist Å
2767strand <lha@it.su.se>
2768
2769 * test_cms.in: Use --certificate= for enveloped/unenvelope.
2770
2771 * hxtool.c: Use --certificate= for enveloped/unenvelope. Clean
2772 up.
2773
2774 * test_cms.in: add EnvelopeData tests
2775
2776 * hxtool.c: use id-envelopedData for ContentInfo
2777
2778 * hxtool-commands.in: add contentinfo wrapping for create/unwrap
2779 enveloped data
2780
2781 * hxtool.c: add contentinfo wrapping for create/unwrap enveloped
2782 data
2783
2784 * data/gen-req.sh: add enveloped data (aes128)
2785
2786 * crypto.c: add "new" RC2 oid
2787
27882005-07-27 Love Hörnquist Å
2789strand <lha@it.su.se>
2790
2791 * hx_locl.h, cert.c: Add HX509_QUERY_MATCH_FUNCTION that allows
2792 caller to match by function, note that this doesn't not work
2793 directly for backends that implements ->query, they must do their
2794 own processing. (I'm running out of flags, only 12 left now)
2795
2796 * test_cms.in: verify ContentInfo wrapping code in hxtool
2797
2798 * hxtool-commands.in (cms_create_sd): support wrapping in content
2799 info spelling
2800
2801 * hxtool.c (cms_create_sd): support wrapping in content info
2802
2803 * test_cms.in: test more cms signeddata messages
2804
2805 * data/gen-req.sh: generate SignedData
2806
2807 * hxtool.c (cms_create_sd): support certificate store, add support
2808 to unwrap a ContentInfo the SignedData inside.
2809
2810 * crypto.c: sprinkel rk_UNCONST
2811
2812 * crypto.c: add DER NULL to the digest oid's
2813
2814 * hxtool-commands.in: add --content-info to cms-verify-sd
2815
2816 * cms.c (hx509_cms_create_signed_1): pass in a full
2817 AlgorithmIdentifier instead of heim_oid for digest_alg
2818
2819 * crypto.c: make digest_alg a digest_oid, it's not needed right
2820 now
2821
2822 * hx509_err.et: add CERT_NOT_FOUND
2823
2824 * keyset.c (_hx509_certs_find): add error code for cert not
2825 found
2826
2827 * cms.c (hx509_cms_verify_signed): add external store of
2828 certificates, use the right digest algorithm identifier.
2829
2830 * cert.c: fix const warning
2831
2832 * ks_p12.c: slightly less verbose
2833
2834 * cert.c: add hx509_cert_find_subjectAltName_otherName, add
2835 HX509_QUERY_MATCH_FRIENDLY_NAME
2836
2837 * hx509.h: add hx509_octet_string_list, remove bad comment
2838
2839 * hx_locl.h: add HX509_QUERY_MATCH_FRIENDLY_NAME
2840
2841 * keyset.c (hx509_certs_append): needs a hx509_lock, add one
2842
2843 * Makefile.am: add test cases tempfiles to CLEANFILES
2844
2845 * Makefile.am: add test_query to TESTS, fix dependency on hxtool
2846 sources on hxtool-commands.h
2847
2848 * hxtool-commands.in: explain what signer is for create-sd
2849
2850 * hxtool.c: add query, add more options to verify-sd and create-sd
2851
2852 * test_cms.in: add more cms tests
2853
2854 * hxtool-commands.in: add query, add more options to verify-sd
2855
2856 * test_query.in: test query interface
2857
2858 * data: fix filenames for ds/ke files, add pkcs12 files, regen
2859
2860 * hxtool.c,Makefile.am,hxtool-commands.in: switch to slc
2861
28622005-07-26 Love Hörnquist Å
2863strand <lha@it.su.se>
2864
2865 * cert.c (hx509_verify_destroy_ctx): add
2866
2867 * hxtool.c: free hx509_verify_ctx
2868
2869 * name.c (_hx509_name_ds_cmp): make sure all strings are not equal
2870
28712005-07-25 Love Hörnquist Å
2872strand <lha@it.su.se>
2873
2874 * hxtool.c: return error
2875
2876 * keyset.c: return errors from iterations
2877
2878 * test_chain.in: clean up checks
2879
2880 * ks_file.c (parse_certificate): return errno's not 1 in case of
2881 error
2882
2883 * ks_file.c (file_iter): make sure endpointer is NULL
2884
2885 * ks_mem.c (mem_iter): follow conversion and return NULL when we
2886 get to the end, not ENOENT.
2887
2888 * Makefile.am: test_chain depends on hxtool
2889
2890 * data: test certs that lasts 10 years
2891
2892 * data/gen-req.sh: script to generate test certs
2893
2894 * Makefile.am: Add regression tests.
2895
2896 * data: test certificate and keys
2897
2898 * test_chain.in: test chain
2899
2900 * hxtool.c (cms_create_sd): add KU digitalSigature as a
2901 requirement to the query
2902
2903 * hx_locl.h: add KeyUsage query bits
2904
2905 * hx509_err.et: add KeyUsage error
2906
2907 * cms.c: add checks for KeyUsage
2908
2909 * cert.c: more checks on KeyUsage, allow to query on them too
2910
29112005-07-24 Love Hörnquist Å
2912strand <lha@it.su.se>
2913
2914 * cms.c: Add missing break.
2915
2916 * hx_locl.h,cms.c,cert.c: allow matching on SubjectKeyId
2917
2918 * hxtool.c: Use _hx509_map_file, _hx509_unmap_file and
2919 _hx509_write_file.
2920
2921 * file.c (_hx509_write_file): in case of write error, return errno
2922
2923 * file.c (_hx509_write_file): add a function that write a data
2924 blob to disk too
2925
2926 * Fix id-tags
2927
2928 * Import mostly complete X.509 and CMS library. Handles, PEM, DER,
2929 PKCS12 encoded certicates. Verificate RSA chains and handled
2930 CMS's SignedData, and EnvelopedData.
2931
2932
Note: See TracBrowser for help on using the repository browser.