diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 17:20:00 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 17:20:00 +0000 |
commit | 8daa83a594a2e98f39d764422bfbdbc62c9efd44 (patch) | |
tree | 4099e8021376c7d8c05bdf8503093d80e9c7bad0 /third_party/heimdal/lib/hx509/ChangeLog | |
parent | Initial commit. (diff) | |
download | samba-8daa83a594a2e98f39d764422bfbdbc62c9efd44.tar.xz samba-8daa83a594a2e98f39d764422bfbdbc62c9efd44.zip |
Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'third_party/heimdal/lib/hx509/ChangeLog')
-rw-r--r-- | third_party/heimdal/lib/hx509/ChangeLog | 2749 |
1 files changed, 2749 insertions, 0 deletions
diff --git a/third_party/heimdal/lib/hx509/ChangeLog b/third_party/heimdal/lib/hx509/ChangeLog new file mode 100644 index 0000000..d00f1f3 --- /dev/null +++ b/third_party/heimdal/lib/hx509/ChangeLog @@ -0,0 +1,2749 @@ +2008-07-14 Love Hörnquist Åstrand <lha@kth.se> + + * hxtool.c: Break out print_eval_types(). + +2008-06-21 Love Hörnquist Åstrand <lha@kth.se> + + * ks_p12.c: pass in time_now to unevelope + + * cms.c: Pass in time_now to unevelope, us verify context time in + verify_signed. + +2008-05-23 Love Hörnquist Åstrand <lha@kth.se> + + * hx_locl.h: Include <limits.h> for TYPE_MAX defines. + +2008-04-29 Love Hörnquist Åstrand <lha@it.su.se> + + * sel-lex.l: Use _hx509_sel_yyerror() instead of error_message(). + +2008-04-20 Love Hörnquist Åstrand <lha@it.su.se> + + * sel-lex.l: Include <config.h> + +2008-04-17 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Update make-proto usage. + +2008-04-15 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c: BasicConstraints.pathLenConstraint unsigned int. + + * sel-lex.l: Prefix sel_error with _hx509_ since its global on + platforms w/o symbol versioning. + + * sel.h: rename yyerror to sel_yyerror in the whole library, not + just the lexer + + * sel-lex.l: rename yyerror to sel_yyerror in the whole library, + not just the lexer + +2008-04-14 Love Hörnquist Åstrand <lha@it.su.se> + + * sel-lex.l: Rename yyerror to sel_yyerror and make it static. + +2008-04-08 Love Hörnquist Åstrand <lha@it.su.se> + + * hx509.h: Make self-standing by including missing files. + +2008-04-07 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Use unsigned where appropriate. + + * softp11.c: call va_start before using vsnprintf. + + * crypto.c: make refcount slightly more sane. + + * keyset.c: make refcount slightly more sane. + + * cert.c: make refcount slightly more sane. + +2008-03-19 Love Hörnquist Åstrand <lha@it.su.se> + + * test_nist2.in: Try to find unzip. + +2008-03-16 Love Hörnquist Åstrand <lha@it.su.se> + + * version-script.map: add missing symbols + + * spnego: Make delegated credentials delegated directly, Oleg + Sharoiko pointed out that it always didnt work with the old + code. Also add som missing cred and context pass-thou functions in + the SPNEGO layer. + +2008-03-14 Love Hörnquist Åstrand <lha@it.su.se> + + * rename to be more consistent, export for teting + + * Add language to support querying certificates to find a + match. Support constructs like "1.3.6.1.5.2.3.5" IN + %{certificate.eku} AND %{certificate.subject} TAILMATCH "C=SE". + +2008-02-26 Love Hörnquist Åstrand <lha@it.su.se> + + * version-script.map: add hx509_pem_read + + * hxtool-commands.in: Add --pem to cms-verify-sd. + + * test_cms.in: Test verifying PEM signature files. + + * hxtool.c: Support verifying PEM signature files. + +2008-02-25 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: libhx509_la_OBJECTS depends on hx_locl.h + +2008-02-11 Love Hörnquist Åstrand <lha@it.su.se> + + * Use ldap-prep (with libwind) to compare names + +2008-01-27 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c (hx509_query_match_eku): update to support the NULL + eku (reset), clearify the old behaivor with regards repetitive + calls. + + * Add matching on EKU, validate EKUs, add hxtool matching glue, + add check. Adapted from pach from Tim Miller of Mitre + +2008-01-21 Love Hörnquist Åstrand <lha@it.su.se> + + * test_soft_pkcs11.c: use func for more C_ functions. + +2008-01-18 Love Hörnquist Åstrand <lha@it.su.se> + + * version-script.map: Export hx509_free_error_string(). + +2008-01-17 Love Hörnquist Åstrand <lha@it.su.se> + + * version-script.map: only export C_GetFunctionList + + * test_soft_pkcs11.c: use C_GetFunctionList + + * softp11.c: fix comment, remove label. + + * softp11.c: Add option app-fatal to control if softtoken should + abort() on erroneous input from applications. + +2008-01-16 Love Hörnquist Åstrand <lha@it.su.se> + + * test_pkcs11.in: Test password less certificates too + + * keyset.c: document HX509_CERTS_UNPROTECT_ALL + + * ks_file.c: Support HX509_CERTS_UNPROTECT_ALL. + + * hx509.h: Add HX509_CERTS_UNPROTECT_ALL. + + * test_soft_pkcs11.c: Only log in if needed. + +2008-01-15 Love Hörnquist Åstrand <lha@it.su.se> + + * softp11.c: Support PINs to login to the store. + + * Makefile.am: add java pkcs11 test + + * test_java_pkcs11.in: first version of disable java test + + * softp11.c: Drop unused stuff. + + * cert.c: Spelling, Add hx509_cert_get_SPKI_AlgorithmIdentifier, + remove unused stuff, add hx509_context to some functions. + + * softp11.c: Add more glue to figure out what keytype this + certificate is using. + +2008-01-14 Love Hörnquist Åstrand <lha@it.su.se> + + * test_pkcs11.in: test debug + + * Add a PKCS11 provider supporting signing and verifing sigatures. + +2008-01-13 Love Hörnquist Åstrand <lha@it.su.se> + + * version-script.map: Replace hx509_name_to_der_name with + hx509_name_binary. + + * print.c: make print_func static + +2007-12-26 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c: doxygen + + * env.c: doxygen + + * doxygen.c: add more groups + + * ca.c: doxygen. + +2007-12-17 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c: doxygen + +2007-12-16 Love Hörnquist Åstrand <lha@it.su.se> + + * error.c: doxygen + +2007-12-15 Love Hörnquist Åstrand <lha@it.su.se> + + * More documentation + + * lock.c: Add page referance + + * keyset.c: some more documentation. + + * cms.c: Doxygen documentation. + +2007-12-11 Love Hörnquist Åstrand <lha@it.su.se> + + * *.[ch]: More documentation + +2007-12-09 Love Hörnquist Åstrand <lha@it.su.se> + + * handle refcount on NULL. + + * test_nist_pkcs12.in: drop echo -n, doesn't work with posix sh + +2007-12-08 Love Hörnquist Åstrand <lha@it.su.se> + + * test_nist2.in: Print that this is version 2 of the tests + + * test_nist.in: Drop printing of $id. + + * hx509.h: Add HX509_VHN_F_ALLOW_NO_MATCH. + + * name.c: spelling. + + * cert.c: make work the doxygen. + + * name.c: fix doxygen compiling. + + * Makefile.am: add doxygen.c + + * doxygen.c: Add doxygen main page. + + * cert.c: Add doxygen. + + * revoke.c (_hx509_revoke_ref): new function. + +2007-11-16 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_keychain.c: Check if SecKeyGetCSPHandle needs prototype. + +2007-08-16 Love Hörnquist Åstrand <lha@it.su.se> + + * data/nist-data: Make work on case senstive filesystems too. + +2007-08-09 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c: match rfc822 contrains better, provide better error + strings. + +2007-08-08 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c: "self-signed doesn't count" doesn't apply to trust + anchor certificate. make trust anchor check consistant. + + * revoke.c: make compile. + + * revoke.c (verify_crl): set error strings. + + * revoke.c (verify_crl): handle with the signer is the + CRLsigner (shortcut). + + * cert.c: Fix NC, comment on how to use _hx509_check_key_usage. + +2007-08-03 Love Hörnquist Åstrand <lha@it.su.se> + + * test_nist2.in, Makefile, test/nist*: Add nist pkits tests. + + * revoke.c: Update to use CERT_REVOKED error, shortcut out of OCSP + checking when OCSP reply is a revocation reply. + + * hx509_err.et: Make CERT_REVOKED error OCSP/CRL agnostic. + + * name.c (_hx509_Name_to_string): make printableString handle + space (0x20) diffrences as required by rfc3280. + + * revoke.c: Search for the right issuer when looking for the + issuer of the CRL signer. + +2007-08-02 Love Hörnquist Åstrand <lha@it.su.se> + + * revoke.c: Handle CRL signing certificate better, try to not + revalidate invalid CRLs over and over. + +2007-08-01 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: remove stale comment. + + * test_nist.in: Unpack PKITS_data.zip and run tests. + + * test_nist_cert.in: Adapt to new nist pkits framework. + + * test_nist_pkcs12.in: Adapt to new nist pkits framework. + + * Makefile.am: clean PKITS_data + +2007-07-16 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Add version-script.map to EXTRA_DIST + +2007-07-12 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Add depenency on asn1_compile for asn1 built files. + +2007-07-10 Love Hörnquist Åstrand <lha@it.su.se> + + * peer.c: update (c), indent. + + * Makefile.am: New library version. + +2007-06-28 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Add sha2 types. + + * ref/pkcs11.h: Sync with scute. + + * ref/pkcs11.h: Add sha2 CKM's. + + * print.c: Print authorityInfoAccess. + + * cert.c: Rename proxyCertInfo oid. + + * ca.c: Rename proxyCertInfo oid. + + * print.c: Rename proxyCertInfo oid. + +2007-06-26 Love Hörnquist Åstrand <lha@it.su.se> + + * test_ca.in: Adapt to new request handling. + + * req.c: Allow export some of the request parameters. + + * hxtool-commands.in: Adapt to new request handling. + + * hxtool.c: Adapt to new request handling. + + * test_req.in: Adapt to new request handling. + + * version-script.map: Add initialize_hx_error_table_r. + + * req.c: Move _hx509_request_print here. + + * hxtool.c: use _hx509_request_print + + * version-script.map: Export more crap^W semiprivate functions. + + * hxtool.c: don't _hx509_abort + + * version-script.map: add missing ; + +2007-06-25 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: Use hx509_crypto_random_iv. + + * crypto.c: Split out the iv creation from hx509_crypto_encrypt + since _hx509_pbe_encrypt needs to use the iv from the s2k + function. + + * test_cert.in: Test PEM and DER FILE writing functionallity. + + * ks_file.c: Add writing DER certificates. + + * hxtool.c: Update to new hx509_pem_write(). + + * test_cms.in: test creation of PEM signeddata. + + * hx509.h: PEM struct/function declarations. + + * ks_file.c: Use PEM encoding/decoding functions. + + * file.c: PEM encode/decoding functions. + + * ks_file.c: Use hx509_pem_write. + + * version-script.map: Export some semi-private functions. + + * hxtool.c: Enable writing out signed data as a pem attachment. + + * hxtool-commands.in (cms-create-signed): add --pem + + * file.c (hx509_pem_write): Add. + + * test_ca.in: Issue and test null subject cert. + + * cert.c: Match is first component is in a CN=. + + * test_ca.in: Test hostname if first CN. + + * Makefile.am: Add version script. + + * version-script.map: Limited exported symbols. + + * test_ca.in: test --hostname. + + * test_chain.in: test max-depth + + * hx509.h: fixate HX509_HN_HOSTNAME at 0. + + * hxtool-commands.in: add --hostname add --max-depth + + * cert.c: Verify hostname and max-depth. + + * hxtool.c: Verify hostname and test max-depth. + +2007-06-24 Love Hörnquist Åstrand <lha@it.su.se> + + * test_cms.in: Test --id-by-name. + + * hxtool-commands.in: add cms-create-sd --id-by-name + + * hxtool.c: Use HX509_CMS_SIGATURE_ID_NAME. + + * cms.c: Implement and use HX509_CMS_SIGATURE_ID_NAME. + + * hx509.h: Add HX509_CMS_SIGATURE_ID_NAME, use subject name for + CMS.Identifier. hx509_hostname_type: add hostname type for + matching. + + * cert.c (match_general_name): more strict rfc822Name matching. + (hx509_verify_hostname): add hostname type for matching. + +2007-06-19 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Make compile again. + + * hxtool.c: Added peap-server for to make windows peap clients + happy. + + * hxtool.c: Unify parse_oid code. + + * hxtool.c: Implement --content-type. + + * hxtool-commands.in: Add content-type. + + * test_cert.in: more cert and keyset tests. + +2007-06-18 Love Hörnquist Åstrand <lha@it.su.se> + + * revoke.c: Avoid stomping on NULL. + + * revoke.c: Avoid reusing i. + + * cert.c: Provide __attribute__ for _hx509_abort. + + * ks_file.c: Fail if not finding iv. + + * keyset.c: Avoid useing freed memory. + + * crypto.c: Free memory in failure case. + + * crypto.c: Free memory in failure case. + +2007-06-12 Love Hörnquist Åstrand <lha@it.su.se> + + * *.c: Add hx509_cert_init_data and use everywhere + + * hx_locl.h: Now that KEYCHAIN:system-anchors is fast again, use + that. + + * ks_keychain.c: Implement trust anchor support with + SecTrustCopyAnchorCertificates. + + * keyset.c: Set ref to 1 for the new object. + + * cert.c: Fix logic for allow_default_trust_anchors + + * keyset.c: Add refcounting to keystores. + + * cert.c: Change logic for default trust anchors, make it be + either default trust anchor, the user supplied, or non at all. + +2007-06-08 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Add data/j.pem. + + * Makefile.am: Add test_windows.in. + +2007-06-06 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_keychain.c: rename functions, leaks less memory and more + paranoia. + + * test_cms.in: Test cms peer-alg. + + * crypto.c (rsa_create_signature): make oid_id_pkcs1_rsaEncryption + mean rsa-with-sha1 but oid oid_id_pkcs1_rsaEncryption in algorithm + field. XXX should probably use another algorithmIdentifier for + this. + + * peer.c: Make free function return void. + + * cms.c (hx509_cms_create_signed_1): Use hx509_peer_info to select + the signature algorithm too. + + * hxtool-commands.in: Add cms-create-sd --peer-alg. + + * req.c: Use _hx509_crypto_default_sig_alg. + + * test_windows.in: Create crl, because everyone needs one. + + * Makefile.am: add wcrl.crl + +2007-06-05 Love Hörnquist Åstrand <lha@it.su.se> + + * hx_locl.h: Disable KEYCHAIN for now, its slow. + + * cms.c: When we are not using pkcs7-data, avoid seing + signedAttributes since some clients get upset by that (pkcs7 based + or just plain broken). + + * ks_keychain.c: Provide rsa signatures. + + * ks_keychain.c: Limit the searches to the selected keychain. + + * ks_keychain.c: include -framework Security specific header files + after #ifdef + + * ks_keychain.c: Find and attach private key (does not provide + operations yet though). + + * ks_p11.c: Prefix rsa method with p11_ + + * ks_keychain.c: Allow opening a specific chain, making "system" + special and be the system X509Anchors file. By not specifing any + keychain ("KEYCHAIN:"), all keychains are probed. + +2007-06-04 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c (verify): Friendlier error message. + + * cert.c: Read in and use default trust anchors if they exists. + + * hx_locl.h: Add concept of default_trust_anchors. + + * ks_keychain.c: Remove err(), remove extra empty comment, fix + _iter function. + + * error.c (hx509_get_error_string): if the error code is not the + one we expect, punt and use the default com_err/strerror string + instead. + + * keyset.c (hx509_certs_merge): its ok to merge in the NULL set of + certs. + + * test_windows.in: Fix status string. + + * ks_p12.c (store_func): free whole CertBag, not just the data + part. + + * print.c: Check that the self-signed cert is really self-signed. + + * print.c: Use selfsigned for CRL DP whine, tell if its a + self-signed. + + * print.c: Whine if its a non CA/proxy and doesn't have CRL DP. + + * ca.c: Add cRLSign to CA certs. + + * cert.c: Register NULL and KEYCHAIN. + + * ks_null.c: register the NULL keystore. + + * Makefile.am: Add ks_keychain.c and related libs. + + * test_crypto.in: Print certificate with utf8. + + * print.c: Leak less memory. + + * hxtool.c: Leak less memory. + + * print.c: Leak less memory, use functions that does same but + more. + + * name.c (quote_string): don't sign extend the (signed) char to + avoid printing too much, add an assert to check that we didn't + overrun the buffer. + + * name.c: Use right element out of the CHOICE for printableString + and utf8String + + * ks_keychain.c: Certificate only KeyChain backend. + + * name.c: Reset name before parsing it. + +2007-06-03 Love Hörnquist Åstrand <lha@it.su.se> + + * revoke.c (hx509_crl_*): fix sizeof() mistakes to fix memory + corruption. + + * hxtool.c: Add lifetime to crls. + + * hxtool-commands.in: Add lifetime to crls. + + * revoke.c: Add lifetime to crls. + + * test_ca.in: More crl checks. + + * revoke.c: Add revoking certs. + + * hxtool-commands.in: argument is certificates.. for crl-sign + + * hxtool.c (certificate_copy): free lock + + * revoke.c: Fix hx509_set_error_string calls, add + hx509_crl_add_revoked_certs(), implement hx509_crl_{alloc,free}. + + * hxtool.c (crl_sign): free lock + + * cert.c (hx509_context_free): free querystat + +2007-06-02 Love Hörnquist Åstrand <lha@it.su.se> + + * test_chain.in: test ocsp-verify + + * revoke.c (hx509_ocsp_verify): explain what its useful for and + provide sane error message. + + * hx509_err.et: New error code, CERT_NOT_IN_OCSP + + * hxtool.c: New command ocsp-verify, check if ocsp contains all + certs and are valid (exist and non expired). + + * hxtool-commands.in: New command ocsp-verify. + +2007-06-01 Love Hörnquist Åstrand <lha@it.su.se> + + * test_ca.in: Create crl and verify that is works. + + * hxtool.c: Sign CRL command. + + * hx509.h: Add hx509_crl. + + * hxtool-commands.in: Add crl-sign commands. + + * revoke.c: Support to generate an empty CRL. + + * tst-crypto-select2: Switched default types. + + * tst-crypto-select1: Switched default types. + + * ca.c: Use default AlgorithmIdentifier. + + * cms.c: Use default AlgorithmIdentifier. + + * crypto.c: Provide default AlgorithmIdentifier and use them. + + * hx_locl.h: Provide default AlgorithmIdentifier. + + * keyset.c (hx509_certs_find): collects stats for queries. + + * cert.c: Sort and print more info. + + * hx_locl.h: Add querystat to hx509_context. + + * test_*.in: sprinle stat saveing + + * Makefile.am: Add stat and objdir. + + * collector.c (_hx509_collector_alloc): return error code instead + of pointer. + + * hxtool.c: Add statistic hook. + + * ks_file.c: Update _hx509_collector_alloc prototype. + + * ks_p12.c: Update _hx509_collector_alloc prototype. + + * ks_p11.c: Update _hx509_collector_alloc prototype. + + * hxtool-commands.in: Add statistics hook. + + * cert.c: Statistics printing. + + * ks_p12.c: plug memory leak + + * ca.c (hx509_ca_tbs_add_crl_dp_uri): plug memory leak + +2007-05-31 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c: print utf8 type SAN's + + * Makefile.am: Fix windows client cert name. + + * test_windows.in: Add crl-uri for the ee certs. + + * print.c: Printf formating. + + * ca.c: Add glue for adding CRL dps. + + * test_ca.in: Readd the crl adding code, it works (somewhat) now. + + * print.c: Fix printing of CRL DPnames (I hate IMPLICIT encoded + structures). + + * hxtool-commands.in: make ca and alias of certificate-sign + +2007-05-30 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c (hx509_crypto_select): copy AI to the right place. + + * hxtool-commands.in: Add ca --ms-upn. + + * hxtool.c: add --ms-upn and add more EKU's for pk-init client. + + * ca.c: Add hx509_ca_tbs_add_san_ms_upn and refactor code. + + * test_crypto.in: Resurect killed e. + + * test_crypto.in: check for aes256-cbc + + * tst-crypto-select7: check for aes256-cbc + + * test_windows.in: test windows stuff + + * hxtool.c: add ca --domain-controller option, add secret key + option to avaible. + + * ca.c: Add hx509_ca_tbs_set_domaincontroller. + + * hxtool-commands.in: add ca --domain-controller + + * hxtool.c: hook for testing secrety key algs + + * crypto.c: Add selection code for secret key crypto. + + * hx509.h: Add HX509_SELECT_SECRET_ENC. + +2007-05-13 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: add more mechtypes + +2007-05-10 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c: Indent. + + * hxtool-commands.in: add test-crypto command + + * hxtool.c: test crypto command + + * cms.c (hx509_cms_create_signed_1): if no eContentType is given, + use pkcs7-data. + + * print.c: add Netscape cert comment + + * crypto.c: Try both the empty password and the NULL + password (nothing vs the octet string \x00\x00). + + * print.c: Add some US Fed PKI oids. + + * ks_p11.c: Add some more hashes. + +2007-04-24 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c (crypto_select): stop memory leak + +2007-04-19 Love Hörnquist Åstrand <lha@it.su.se> + + * peer.c (hx509_peer_info_free): free memory used too + + * hxtool.c (crypto_select): only free peer if it was used. + +2007-04-18 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: free template + + * ks_mem.c (mem_free): free key array too + + * hxtool.c: free private key and tbs + + * hxtool.c (hxtool_ca): free signer + + * hxtool.c (crypto_available): free peer too. + + * ca.c (get_AuthorityKeyIdentifier): leak less memory + + * hxtool.c (hxtool_ca): free SPKI + + * hxtool.c (hxtool_ca): free cert + + * ks_mem.c (mem_getkeys): allocate one more the we have elements + so its possible to store the NULL pointer at the end. + +2007-04-16 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: CLEANFILES += cert-null.pem cert-sub-ca2.pem + +2007-02-05 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c: Disable CRLDistributionPoints for now, its IMPLICIT code + in the asn1 parser. + + * print.c: Add some more \n's. + +2007-02-03 Love Hörnquist Åstrand <lha@it.su.se> + + * file.c: Allow mapping using heim_octet_string. + + * hxtool.c: Add options to generate detached signatures. + + * cms.c: Add flags to generate detached signatures. + + * hx509.h: Flag to generate detached signatures. + + * test_cms.in: Support detached sigatures. + + * name.c (hx509_general_name_unparse): unparse the other + GeneralName nametypes. + + * print.c: Use less printf. Use hx509_general_name_unparse. + + * cert.c: Fix printing and plug leak-on-error. + +2007-01-31 Love Hörnquist Åstrand <lha@it.su.se> + + * test_ca.in: Add test for ca --crl-uri. + + * hxtool.c: Add ca --crl-uri. + + * hxtool-commands.in: add ca --crl-uri + + * ca.c: Code to set CRLDistributionPoints in certificates. + + * print.c: Check CRLDistributionPointNames. + + * name.c (hx509_general_name_unparse): function for unparsing + GeneralName, only supports GeneralName.URI + + * cert.c (is_proxy_cert): free info if we wont return it. + +2007-01-30 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Try to help how to use this command. + +2007-01-21 Love Hörnquist Åstrand <lha@it.su.se> + + * switch to sha256 as default digest for signing + +2007-01-20 Love Hörnquist Åstrand <lha@it.su.se> + + * test_ca.in: Really test sub-ca code, add basic constraints tests + +2007-01-17 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Fix makefile problem. + +2007-01-16 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Set num of bits before we generate the key. + +2007-01-15 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c (hx509_cms_create_signed_1): use hx509_cert_binary + + * ks_p12.c (store_func): use hx509_cert_binary + + * ks_file.c (store_func): use hx509_cert_binary + + * cert.c (hx509_cert_binary): return binary encoded + certificate (DER format) + +2007-01-14 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c (hx509_ca_tbs_subject_expand): new function. + + * name.c (hx509_name_expand): if env is NULL, return directly + + * test_ca.in: test template handling + + * hx509.h: Add template flags. + + * Makefile.am: clean out new files + + * hxtool.c: Add certificate template processing, fix hx509_err + usage. + + * hxtool-commands.in: Add certificate template processing. + + * ca.c: Add certificate template processing. Fix return messages + from hx509_ca_tbs_add_eku. + + * cert.c: Export more stuff from certificate. + +2007-01-13 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c: update (c) + + * ca.c: (hx509_ca_tbs_add_eku): filter out dups. + + * hxtool.c: Add type email and add email eku when using option + --email. + + * Makefile.am: add env.c + + * name.c: Remove abort, add error handling. + + * test_name.c: test name expansion + + * name.c: add hx509_name_expand + + * env.c: key-value pair help functions + +2007-01-12 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c: Don't issue certs with subject DN that is NULL and have no + SANs + + * print.c: Fix previous test. + + * print.c: Check there is a SAN if subject DN is NULL. + + * test_ca.in: test email, null subject dn + + * hxtool.c: Allow setting parameters to private key generation. + + * hx_locl.h: Allow setting parameters to private key generation. + + * crypto.c: Allow setting parameters to private key generation. + + * hxtool.c (eval_types): add jid if user gave one + + * hxtool-commands.in (certificate-sign): add --jid + + * ca.c (hx509_ca_tbs_add_san_jid): Allow adding + id-pkix-on-xmppAddr OtherName. + + * print.c: Print id-pkix-on-xmppAddr OtherName. + +2007-01-11 Love Hörnquist Åstrand <lha@it.su.se> + + * no random, no RSA/DH tests + + * hxtool.c (info): print status of random generator + + * Makefile.am: remove files created by tests + + * error.c: constify + + * name.c: constify + + * revoke.c: constify + + * hx_locl.h: constify + + * keyset.c: constify + + * ks_p11.c: constify + + * hx_locl.h: make printinfo char * argument const. + + * cms.c: move _hx509_set_digest_alg from cms.c to crypto.c since + its only used there. + + * crypto.c: remove no longer used stuff, move set_digest_alg here + from cms.c since its only used here. + + * Makefile.am: add data/test-nopw.p12 to EXTRA_DIST + +2007-01-10 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c: BasicConstraints vs criticality bit is complicated and + not really possible to evaluate on its own, silly RFC3280. + + * ca.c: Make basicConstraints critical if this is a CA. + + * print.c: fix the version vs extension test + + * print.c: More validation checks. + + * name.c (hx509_name_cmp): add + +2007-01-09 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c (collect_private_key): Missing CKA_MODULUS is ok + too (XXX why should these be fetched given they are not used). + + * test_ca.in: rename all files to PEM files, since that is what + they are. + + * hxtool.c: copy out the key with the self signed CA cert + + * Factor out private key operation out of the signing, operations, + support import, export, and generation of private keys. Add + support for writing PEM and PKCS12 files with private keys in them. + + * data/gen-req.sh: Generate a no password pkcs12 file. + +2007-01-08 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: Check for internal ASN1 encoder error. + +2007-01-05 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Drop most of the pkcs11 files. + + * test_ca.in: test reissueing ca certificate (xxx time + validAfter). + + * hxtool.c: Allow setting serialNumber (needed for reissuing + certificates) Change --key argument to --out-key. + + * hxtool-commands.in (issue-certificate): Allow setting + serialNumber (needed for reissuing certificates), Change --key + argument to --out-key. + + * ref: Replace with Marcus Brinkmann of g10 Code GmbH pkcs11 + headerfile that is compatible with GPL (file taken from scute) + +2007-01-04 Love Hörnquist Åstrand <lha@it.su.se> + + * test_ca.in: Test to generate key and use them. + + * hxtool.c: handle other keys the pkcs10 requested keys + + * hxtool-commands.in: add generate key commands + + * req.c (_hx509_request_to_pkcs10): PKCS10 needs to have a subject + + * hxtool-commands.in: Spelling. + + * ca.c (hx509_ca_tbs_set_proxy): allow negative pathLenConstraint + to signal no limit + + * ks_file.c: Try all formats on the binary file before giving up, + this way we can handle binary rsa keys too. + + * data/key2.der: new test key + +2007-01-04 David Love <fx@gnu.org> + + * Makefile.am (hxtool_LDADD): Add libasn1.la + + * hxtool.c (pcert_verify): Fix format string. + +2006-12-31 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Allow setting path length + + * cert.c: Fix test for proxy certs chain length, it was too + restrictive. + + * data: regen + + * data/openssl.cnf: (proxy_cert) make length 0 + + * test_ca.in: Issue a long living cert. + + * hxtool.c: add --lifetime to ca command. + + * hxtool-commands.in: add --lifetime to ca command. + + * ca.c: allow setting notBefore and notAfter. + + * test_ca.in: Test generation of proxy certificates. + + * ca.c: Allow generation of proxy certificates, always include + BasicConstraints, fix error codes. + + * hxtool.c: Allow generation of proxy certificates. + + * test_name.c: make hx509_parse_name take a hx509_context. + + * name.c: Split building RDN to a separate function. + +2006-12-30 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: clean test_ca files. + + * test_ca.in: test issuing self-signed and CA certificates. + + * hxtool.c: Add bits to allow issuing self-signed and CA + certificates. + + * hxtool-commands.in: Add bits to allow issuing self-signed and CA + certificates. + + * ca.c: Add bits to allow issuing CA certificates. + + * revoke.c: use new OCSPSigning. + + * ca.c: Add Subject Key Identifier. + + * ca.c: Add Authority Key Identifier. + + * cert.c: Locally export _hx509_find_extension_subject_key_id. + Handle AuthorityKeyIdentifier where only authorityCertSerialNumber + and authorityCertSerialNumber is set. + + * hxtool-commands.in: Add dnsname and rfc822 SANs. + + * test_ca.in: Test dnsname and rfc822 SANs. + + * ca.c: Add dnsname and rfc822 SANs. + + * hxtool.c: Add dnsname and rfc822 SANs. + + * test_ca.in: test adding eku, ku and san to the + certificate (https and pk-init) + + * hxtool.c: Add eku, ku and san to the certificate. + + * ca.c: Add eku, ku and san to the certificate. + + * hxtool-commands.in: Add --type and --pk-init-principal + + * ocsp.asn1: remove id-kp-OCSPSigning, its in rfc2459.asn1 now + +2006-12-29 Love Hörnquist Åstrand <lha@it.su.se> + + * ca.c: Add KeyUsage extension. + + * Makefile.am: add ca.c, add sign-certificate tests. + + * crypto.c: Add _hx509_create_signature_bitstring. + + * hxtool-commands.in: Add the sign-certificate tool. + + * hxtool.c: Add the sign-certificate tool. + + * cert.c: Add HX509_QUERY_OPTION_KU_KEYCERTSIGN. + + * hx509.h: Add hx509_ca_tbs and HX509_QUERY_OPTION_KU_KEYCERTSIGN. + + * test_ca.in: Basic test of generating a pkcs10 request, signing + it and verifying the chain. + + * ca.c: Naive certificate signer. + +2006-12-28 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: add hxtool_hex + +2006-12-22 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: use top_builddir for libasn1.la + +2006-12-11 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c (print_certificate): print serial number. + + * name.c (no): add S=stateOrProvinceName + +2006-12-09 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c (_hx509_private_key_assign_rsa): set a default sig alg + + * ks_file.c (try_decrypt): pass down AlgorithmIdentifier that key + uses to do sigatures so there is no need to hardcode RSA into this + function. + +2006-12-08 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_file.c: Pass filename to the parse functions and use it in + the error messages + + * test_chain.in: test proxy cert (third level) + + * hx509_err.et: fix errorstring for PROXY_CERT_NAME_WRONG + + * data: regen + + * Makefile.am: EXTRA_DIST: add + data/proxy10-child-child-test.{key,crt} + + * data/gen-req.sh: Fix names and restrictions on the proxy + certificates + + * cert.c: Clairfy and make proxy cert handling work for multiple + levels, before it was too restrictive. More helpful error message. + +2006-12-07 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c (check_key_usage): tell what keyusages are missing + + * print.c: Split OtherName printing code to a oid lookup and print + function. + + * print.c (Time2string): print hour as hour not min + + * Makefile.am: CLEANFILES += test + +2006-12-06 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am (EXTRA_DIST): add data/pkinit-proxy* files + + * Makefile.am (EXTRA_DIST): add tst-crypto* files + + * cert.c (hx509_query_match_issuer_serial): make a copy of the + data + + * cert.c (hx509_query_match_issuer_serial): allow matching on + issuer and serial num + + * cert.c (_hx509_calculate_path): add flag to allow leaving out + trust anchor + + * cms.c (hx509_cms_create_signed_1): when building the path, omit + the trust anchors. + + * crypto.c (rsa_create_signature): Abort when signature is longer, + not shorter. + + * cms.c: Provide time to _hx509_calculate_path so we don't send no + longer valid certs to our peer. + + * cert.c (find_parent): when checking for certs and its not a + trust anchor, require time be in range. + (_hx509_query_match_cert): Add time validity-testing to query mask + + * hx_locl.h: add time validity-testing to query mask + + * test_cms.in: Tests for CMS SignedData with incomplete chain from + the signer. + +2006-11-28 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c (hx509_cms_verify_signed): specify what signature we + failed to verify + + * Makefile.am: Depend on LIB_com_err for AIX. + + * keyset.c: Remove anther strndup that causes AIX to fall over. + + * cert.c: Don't check the trust anchors expiration time since they + are transported out of band, from RFC3820. + + * cms.c: sprinkle more error strings + + * crypto.c: sprinkle more error strings + + * hxtool.c: use unsigned int as counter to fit better with the + asn1 compiler + + * crypto.c: use unsigned int as counter to fit better with the + asn1 compiler + +2006-11-27 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: Remove trailing white space. + + * crypto.c: rewrite comment to make more sense + + * crypto.c (hx509_crypto_select): check sig_algs[j]->key_oid + + * hxtool-commands.in (crypto-available): add --type + + * crypto.c (hx509_crypto_available): let alg pass if its keyless + + * hxtool-commands.in: Expand crypto-select + + * cms.c: Rename hx509_select to hx509_crypto_select. + + * hxtool-commands.in: Add crypto-select and crypto-available. + + * hxtool.c: Add crypto-select and crypto-available. + + * crypto.c (hx509_crypto_available): use right index. + (hx509_crypto_free_algs): new function + + * crypto.c (hx509_crypto_select): improve + (hx509_crypto_available): new function + +2006-11-26 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c: Sprinkle more error string and hx509_contexts. + + * cms.c: Sprinkle more error strings. + + * crypto.c: Sprinkle error string and hx509_contexts. + + * crypto.c: Add some more comments about how this works. + + * crypto.c (hx509_select): new function. + + * Makefile.am: add peer.c + + * hxtool.c: Update hx509_cms_create_signed_1. + + * hx_locl.h: add struct hx509_peer_info + + * peer.c: Allow selection of digest/sig-alg + + * cms.c: Allow selection of a better digest using hx509_peer_info. + + * revoke.c: Handle that _hx509_verify_signature takes a context. + + * cert.c: Handle that _hx509_verify_signature takes a context. + +2006-11-25 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: Sprinkle error strings. + + * crypto.c: Sprinkle context and error strings. + +2006-11-24 Love Hörnquist Åstrand <lha@it.su.se> + + * name.c: Handle printing and parsing raw oids in name. + +2006-11-23 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c (_hx509_calculate_path): allow to calculate optimistic + path when we don't know the trust anchors, just follow the chain + upward until we no longer find a parent or we hit the max limit. + + * cms.c (hx509_cms_create_signed_1): provide a best effort path to + the trust anchors to be stored in the SignedData packet, if find + parents until trust anchor or max length. + + * data: regen + + * data/gen-req.sh: Build pk-init proxy cert. + +2006-11-16 Love Hörnquist Åstrand <lha@it.su.se> + + * error.c (hx509_get_error_string): Put ", " between strings in + error message. + +2006-11-13 Love Hörnquist Åstrand <lha@it.su.se> + + * data/openssl.cnf: Change realm to TEST.H5L.SE + +2006-11-07 Love Hörnquist Åstrand <lha@it.su.se> + + * revoke.c: Sprinkle error strings. + +2006-11-04 Love Hörnquist Åstrand <lha@it.su.se> + + * hx_locl.h: add context variable to cmp function. + + * cert.c (hx509_query_match_cmp_func): allow setting the match + function. + +2006-10-24 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Return less EINVAL. + + * hx509_err.et: add more pkcs11 errors + + * hx509_err.et: more error-codes + + * revoke.c: Return less EINVAL. + + * ks_dir.c: sprinkel more hx509_set_error_string + + * ks_file.c: Return less EINVAL. + + * hxtool.c: Pass in context to _hx509_parse_private_key. + + * ks_file.c: Sprinkle more hx509_context so we can return propper + errors. + + * hx509_err.et: add HX509_PARSING_KEY_FAILED + + * crypto.c: Sprinkle more hx509_context so we can return propper + errors. + + * collector.c: No more EINVAL. + + * hx509_err.et: add HX509_LOCAL_ATTRIBUTE_MISSING + + * cert.c (hx509_cert_get_base_subject): one less EINVAL + (_hx509_cert_private_decrypt): one less EINVAL + +2006-10-22 Love Hörnquist Åstrand <lha@it.su.se> + + * collector.c: indent + + * hxtool.c: Try to not leak memory. + + * req.c: clean memory before free + + * crypto.c (_hx509_private_key2SPKI): indent + + * req.c: Try to not leak memory. + +2006-10-21 Love Hörnquist Åstrand <lha@it.su.se> + + * test_crypto.in: Read 50 kilobyte random data + + * revoke.c: Try to not leak memory. + + * hxtool.c: Try to not leak memory. + + * crypto.c (hx509_crypto_destroy): free oid. + + * error.c: Clean error string on failure just to make sure. + + * cms.c: Try to not leak memory (again). + + * hxtool.c: use a sensable content type + + * cms.c: Try harder to free certificate. + +2006-10-20 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Add make check data. + +2006-10-19 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c (p11_list_keys): make element of search_data[0] + constants and set them later + + * Makefile.am: Add more files. + +2006-10-17 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_file.c: set ret, remember to free ivdata + +2006-10-16 Love Hörnquist Åstrand <lha@it.su.se> + + * hx_locl.h: Include <parse_bytes.h>. + + * test_crypto.in: Test random-data. + + * hxtool.c: RAND_bytes() return 1 for cryptographic strong data, + check for that. + + * Makefile.am: clean random-data + + * hxtool.c: Add random-data command, use sl_slc_help. + + * hxtool-commands.in: Add random-data. + + * ks_p12.c: Remember to release certs. + + * ks_p11.c: Remember to release certs. + +2006-10-14 Love Hörnquist Åstrand <lha@it.su.se> + + * prefix der primitives with der_ + + * lock.c: Match the prompt type PROMPT exact. + + * hx_locl.h: Drop heim_any.h + +2006-10-11 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c (p11_release_module): j needs to be used as inter loop + index. From Douglas Engert. + + * ks_file.c (parse_rsa_private_key): try all passwords and + prompter. + +2006-10-10 Love Hörnquist Åstrand <lha@it.su.se> + + * test_*.in: Parameterise the invocation of hxtool, so we can make + it run under TESTS_ENVIRONMENT. From Andrew Bartlett + +2006-10-08 Love Hörnquist Åstrand <lha@it.su.se> + + * test_crypto.in: Put all test stuck at 2006-09-25 since all their + chains where valied then. + + * hxtool.c: Implement --time= option. + + * hxtool-commands.in: Add option time. + + * Makefile.am: test_name is a PROGRAM_TESTS + + * ks_p11.c: Return HX509_PKCS11_NO_SLOT when there are no slots + and HX509_PKCS11_NO_TOKEN when there are no token. For use in PAM + modules that want to detect when to use smartcard login and when + not to. Patched based on code from Douglas Engert. + + * hx509_err.et: Add new pkcs11 related errors in a new section: + keystore related error. Patched based on code from Douglas + Engert. + +2006-10-07 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Make depenency for slc built files just like + everywhere else. + + * cert.c: Add all openssl algs and init asn1 et + +2006-10-06 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_file.c (parse_rsa_private_key): free type earlier. + + * ks_file.c (parse_rsa_private_key): free type after use + + * name.c (_hx509_Name_to_string): remove dup const + +2006-10-02 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Add more libs to libhx509 + +2006-10-01 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Fix double free's, NULL ptr de-reference, and conform + better to pkcs11. From Douglas Engert. + + * ref: remove ^M, it breaks solaris 10s cc. From Harald Barth + +2006-09-19 Love Hörnquist Åstrand <lha@it.su.se> + + * test_crypto.in: Bleichenbacher bad cert from Ralf-Philipp + Weinmann and Andrew Pyshkin, pad right. + + * data: starfield test root cert and Ralf-Philipp and Andreis + correctly padded bad cert + +2006-09-15 Love Hörnquist Åstrand <lha@it.su.se> + + * test_crypto.in: Add test for yutaka certs. + + * cert.c: Add a strict rfc3280 verification flag. rfc3280 requires + certificates to have KeyUsage.keyCertSign if they are to be used + for signing of certificates, but the step in the verifiation is + optional. + + * hxtool.c: Improve printing and error reporting. + +2006-09-13 Love Hörnquist Åstrand <lha@it.su.se> + + * test_crypto.in,Makefile.am,data/bleichenbacher-{bad,good}.pem: + test bleichenbacher from eay + +2006-09-12 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Make common function for all getarg_strings and + hx509_certs_append commonly used. + + * cms.c: HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT is a negative + flag, treat it was such. + +2006-09-11 Love Hörnquist Åstrand <lha@it.su.se> + + * req.c: Use the new add_GeneralNames function. + + * hx509.h: Add HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT. + + * ks_p12.c: Adapt to new signature of hx509_cms_unenvelope. + + * hxtool.c: Adapt to new signature of hx509_cms_unenvelope. + + * cms.c: Allow passing in encryptedContent and flag. Add new flag + HX509_CMS_UE_DONT_REQUIRE_KU_ENCIPHERMENT. + +2006-09-08 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: cast void * to char * when using it for %s formating + in printf. + + * name.c: New function _hx509_Name_to_string. + +2006-09-07 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_file.c: Sprinkle error messages. + + * cms.c: Sprinkle even more error messages. + + * cms.c: Sprinkle some error messages. + + * cms.c (find_CMSIdentifier): only free string when we allocated + one. + + * ks_p11.c: Don't build most of the pkcs11 module if there are no + dlopen(). + +2006-09-06 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c (hx509_cms_unenvelope): try to save the error string from + find_CMSIdentifier so we have one more bit of information what + went wrong. + + * hxtool.c: More pretty printing, make verify_signed return the + error string from the library. + + * cms.c: Try returning what certificates failed to parse or be + found. + + * ks_p11.c (p11_list_keys): fetch CKA_LABEL and use it to set the + friendlyname for the certificate. + +2006-09-05 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c: check that there are no extra bytes in the checksum + and that the parameters are NULL or the NULL-type. All to avoid + having excess data that can be used to fake the signature. + + * hxtool.c: print keyusage + + * print.c: add hx509_cert_keyusage_print, simplify oid printing + + * cert.c: add _hx509_cert_get_keyusage + + * ks_p11.c: keep one session around for the whole life of the keyset + + * test_query.in: tests more selection + + * hxtool.c: improve pretty printing in print and query + + * hxtool{.c,-commands.in}: add selection on KU and printing to query + + * test_cms.in: Add cms test for digitalSignature and + keyEncipherment certs. + + * name.c (no): Add serialNumber + + * ks_p11.c (p11_get_session): return better error messages + +2006-09-04 Love Hörnquist Åstrand <lha@it.su.se> + + * ref: update to pkcs11 reference files 2.20 + + * ks_p11.c: add more mechflags + + * name.c (no): add OU and sort + + * revoke.c: pass context to _hx509_create_signature + + * ks_p11.c (p11_printinfo): print proper plural s + + * ks_p11.c: save the mechs supported when initing the token, print + them in printinfo. + + * hx_locl.h: Include <parse_units.h>. + + * cms.c: pass context to _hx509_create_signature + + * req.c: pass context to _hx509_create_signature + + * keyset.c (hx509_certs_info): print information about the keyset. + + * hxtool.c (pcert_print) print keystore info when --info flag is + given. + + * hxtool-commands.in: Add hxtool print --info. + + * test_query.in: Test hxtool print --info. + + * hx_locl.h (hx509_keyset_ops): add printinfo + + * crypto.c: Start to hang the private key operations of the + private key, pass hx509_context to create_checksum. + +2006-05-29 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Iterate over all slots, not just the first/selected + one. + +2006-05-27 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c: Add release function for certifiates so backend knowns + when its no longer used. + + * ks_p11.c: Add reference counting on certifiates, push out + CK_SESSION_HANDLE from slot. + + * cms.c: sprinkle more hx509_clear_error_string + +2006-05-22 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Sprinkle some hx509_set_error_strings + +2006-05-13 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Avoid shadowing. + + * revoke.c: Avoid shadowing. + + * ks_file.c: Avoid shadowing. + + * cert.c: Avoid shadowing. + +2006-05-12 Love Hörnquist Åstrand <lha@it.su.se> + + * lock.c (hx509_prompt_hidden): reshuffle to avoid gcc warning + + * hx509.h: Reshuffle the prompter types, remove the hidden field. + + * lock.c (hx509_prompt_hidden): return if the prompt should be + hidden or not + + * revoke.c (hx509_revoke_free): allow free of NULL. + +2006-05-11 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_file.c (file_init): Avoid shadowing ret (and thus avoiding + crashing). + + * ks_dir.c: Implement DIR: caches useing FILE: caches. + + * ks_p11.c: Catch more errors. + +2006-05-08 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c (hx509_crypto_encrypt): free correctly in error + path. From Andrew Bartlett. + + * crypto.c: If RAND_bytes fails, then we will attempt to + double-free crypt->key.data. From Andrew Bartlett. + +2006-05-05 Love Hörnquist Åstrand <lha@it.su.se> + + * name.c: Rename u_intXX_t to uintXX_t + +2006-05-03 Love Hörnquist Åstrand <lha@it.su.se> + + * TODO: More to do about the about the PKCS11 code. + + * ks_p11.c: Use the prompter from the lock function. + + * lock.c: Deal with that hx509_prompt.reply is no longer a + pointer. + + * hx509.h: Make hx509_prompt.reply not a pointer. + +2006-05-02 Love Hörnquist Åstrand <lha@it.su.se> + + * keyset.c: Sprinkle setting error strings. + + * crypto.c: Sprinkle setting error strings. + + * collector.c: Sprinkle setting error strings. + + * cms.c: Sprinkle setting error strings. + +2006-05-01 Love Hörnquist Åstrand <lha@it.su.se> + + * test_name.c: renamed one error code + + * name.c: renamed one error code + + * ks_p11.c: _hx509_set_cert_attribute changed signature + + * hxtool.c (pcert_print): use hx509_err so I can test it + + * error.c (hx509_set_error_stringv): clear errors on malloc + failure + + * hx509_err.et: Add some more errors + + * cert.c: Sprinkle setting error strings. + + * cms.c: _hx509_path_append changed signature. + + * revoke.c: changed signature of _hx509_check_key_usage + + * keyset.c: changed signature of _hx509_query_match_cert + + * hx509.h: Add support for error strings. + + * cms.c: changed signature of _hx509_check_key_usage + + * Makefile.am: ibhx509_la_files += error.c + + * ks_file.c: Sprinkel setting error strings. + + * cert.c: Sprinkel setting error strings. + + * hx_locl.h: Add support for error strings. + + * error.c: Add string error handling functions. + + * keyset.c (hx509_certs_init): pass the right error code back + +2006-04-30 Love Hörnquist Åstrand <lha@it.su.se> + + * revoke.c: Revert previous patch. + (hx509_ocsp_verify): new function that returns the expiration of + certificate in ocsp data-blob + + * cert.c: Reverse previous patch, lets do it another way. + + * cert.c (hx509_revoke_verify): update usage + + * revoke.c: Make compile. + + * revoke.c: Add the expiration time the crl/ocsp info expire + + * name.c: Add hx509_name_is_null_p + + * cert.c: remove _hx509_cert_private_sigature + +2006-04-29 Love Hörnquist Åstrand <lha@it.su.se> + + * name.c: Expose more of Name. + + * hxtool.c (main): add missing argument to printf + + * data/openssl.cnf: Add EKU for the KDC certificate + + * cert.c (hx509_cert_get_base_subject): reject un-canon proxy + certs, not the reverse + (add_to_list): constify and fix argument order to + copy_octet_string + (hx509_cert_find_subjectAltName_otherName): make work + +2006-04-28 Love Hörnquist Åstrand <lha@it.su.se> + + * data/{pkinit,kdc}.{crt,key}: pkinit certificates + + * data/gen-req.sh: Generate pkinit certificates. + + * data/openssl.cnf: Add pkinit glue. + + * cert.c (hx509_verify_hostname): implement stub function + +2006-04-27 Love Hörnquist Åstrand <lha@it.su.se> + + * TODO: CRL delta support + +2006-04-26 Love Hörnquist Åstrand <lha@it.su.se> + + * data/.cvsignore: ignore leftover from OpenSSL cert generation + + * hx509_err.et: Add name malformated error + + * name.c (hx509_parse_name): don't abort on error, rather return + error + + * test_name.c: Test failure parsing name. + + * cert.c: When verifying certificates, store subject basename for + later consumption. + + * test_name.c: test to parse and print name and check that they + are the same. + + * name.c (hx509_parse_name): fix length argument to printf string + + * name.c (hx509_parse_name): fix length argument to stringtooid, 1 + too short. + + * cert.c: remove debug printf's + + * name.c (hx509_parse_name): make compile pre c99 + + * data/gen-req.sh: OpenSSL have a serious issue of user confusion + -subj in -ca takes the arguments in LDAP order. -subj for x509 + takes it in x509 order. + + * cert.c (hx509_verify_path): handle the case where the where two + proxy certs in a chain. + + * test_chain.in: enable two proxy certificates in a chain test + + * test_chain.in: tests proxy certificates + + * data: re-gen + + * data/gen-req.sh: build proxy certificates + + * data/openssl.cnf: add def for proxy10_cert + + * hx509_err.et: Add another proxy certificate error. + + * cert.c (hx509_verify_path): Need to mangle name to remove the CN + of the subject, copying issuer only works for one level but is + better then doing no checking at all. + + * hxtool.c: Add verify --allow-proxy-certificate. + + * hxtool-commands.in: add verify --allow-proxy-certificate + + * hx509_err.et: Add proxy certificate errors. + + * cert.c: Fix comment about subject name of proxy certificate. + + * test_chain.in: tests for proxy certs + + * data/gen-req.sh: gen proxy and non-proxy tests certificates + + * data/openssl.cnf: Add definition for proxy certs + + * data/*proxy-test.*: Add proxy certificates + + * cert.c (hx509_verify_path): verify proxy certificate have no san + or ian + + * cert.c (hx509_verify_set_proxy_certificate): Add + (*): rename policy cert to proxy cert + + * cert.c: Initial support for proxy certificates. + +2006-04-24 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: some error checking + + * name.c: Switch over to asn1 generaed oids. + + * TODO: merge with old todo file + +2006-04-23 Love Hörnquist Åstrand <lha@it.su.se> + + * test_query.in: make quiet + + * test_req.in: SKIP test if there is no RSA support. + + * hxtool.c: print dh method too + + * test_chain.in: SKIP test if there is no RSA support. + + * test_cms.in: SKIP test if there is no RSA support. + + * test_nist.in: SKIP test if there is no RSA support. + +2006-04-22 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool-commands.in: Allow passing in pool and anchor to + signedData + + * hxtool.c: Allow passing in pool and anchor to signedData + + * test_cms.in: Test that certs in signed data is picked up. + + * hx_locl.h: Expose the path building function to internal + functions. + + * cert.c: Expose the path building function to internal functions. + + * hxtool-commands.in: cms-envelope: Add support for choosing the + encryption type + + * hxtool.c (cms_create_enveloped): Add support for choosing the + encryption type + + * test_cms.in: Test generating des-ede3 aes-128 aes-256 enveloped + data + + * crypto.c: Add names to cipher types. + + * cert.c (hx509_query_match_friendly_name): fix return value + + * data/gen-req.sh: generate tests for enveloped data using + des-ede3 and aes256 + + * test_cms.in: add tests for enveloped data using des-ede3 and + aes256 + + * cert.c (hx509_query_match_friendly_name): New function. + +2006-04-21 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c: Add support for parsing slot-number. + + * crypto.c (oid_private_rc2_40): simply + + * crypto.c: Use oids from asn1 generator. + + * ks_file.c (file_init): reset length when done with a part + + * test_cms.in: check with test.combined.crt. + + * data/gen-req.sh: Create test.combined.crt. + + * test_cms.in: Test signed data using keyfile that is encrypted. + + * ks_file.c: Remove (commented out) debug printf + + * ks_file.c (parse_rsa_private_key): use EVP_get_cipherbyname + + * ks_file.c (parse_rsa_private_key): make working for one + password. + + * ks_file.c (parse_rsa_private_key): Implement enought for + testing. + + * hx_locl.h: Add <ctype.h> + + * ks_file.c: Add glue code for PEM encrypted password files. + + * test_cms.in: Add commeted out password protected PEM file, + remove password for those tests that doesn't need it. + + * test_cms.in: adapt test now that we can use any certificate and + trust anchor + + * collector.c: handle PEM RSA PRIVATE KEY files + + * cert.c: Remove unused function. + + * ks_dir.c: move code here from ks_file.c now that its no longer + used. + + * ks_file.c: Add support for parsing unencrypted RSA PRIVATE KEY + + * crypto.c: Handle rsa private keys better. + +2006-04-20 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: Use hx509_cms_{,un}wrap_ContentInfo + + * cms.c: Make hx509_cms_{,un}wrap_ContentInfo usable in asn1 + un-aware code. + + * cert.c (hx509_verify_path): if trust anchor is not self signed, + don't check sig From Douglas Engert. + + * test_chain.in: test "sub-cert -> sub-ca" + + * crypto.c: Use the right length for the sha256 checksums. + +2006-04-15 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c: Fix breakage from sha256 code. + + * crypto.c: Add SHA256 support, and symbols for the other new + SHA-2 types. + +2006-04-14 Love Hörnquist Åstrand <lha@it.su.se> + + * test_cms.in: test rc2-40 rc2-64 rc2-128 enveloped data + + * data/test-enveloped-rc2-{40,64,128}: add tests cases for rc2 + + * cms.c: Update prototypes changes for hx509_crypto_[gs]et_params. + + * crypto.c: Break out the parameter handling code for encrypting + data to handle RC2. Needed for Windows 2k pk-init support. + +2006-04-04 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Split libhx509_la_SOURCES into build file and + distributed files so we can avoid building prototypes for + build-files. + +2006-04-03 Love Hörnquist Åstrand <lha@it.su.se> + + * TODO: split certificate request into pkcs10 and CRMF + + * hxtool-commands.in: Add nonce flag to ocsp-fetch + + * hxtool.c: control sending nonce + + * hxtool.c (request_create): store the request in a file, no in + bitbucket. + + * cert.c: expose print_cert_subject internally + + * hxtool.c: Add ocsp_print. + + * hxtool-commands.in: New command "ocsp-print". + + * hx_locl.h: Include <hex.h>. + + * revoke.c (verify_ocsp): require issuer to match too. + (free_ocsp): new function + (hx509_revoke_ocsp_print): new function, print ocsp reply + + * Makefile.am: build CRMF files + + * data/key.der: needed for cert request test + + * test_req.in: adapt to rename of pkcs10-create to request-create + + * hxtool.c: adapt to rename of pkcs10-create to request-create + + * hxtool-commands.in: Rename pkcs10-create to request-create + + * crypto.c: (_hx509_parse_private_key): Avoid crashing on bad input. + + * hxtool.c (pkcs10_create): use opt->subject_string + + * hxtool-commands.in: Add pkcs10-create --subject + + * Makefile.am: Add test_req to tests. + + * test_req.in: Test for pkcs10 commands. + + * name.c (hx509_parse_name): new function. + + * hxtool.c (pkcs10_create): implement + + * hxtool-commands.in (pkcs10-create): Add arguments + + * crypto.c: Add _hx509_private_key2SPKI and support + functions (only support RSA for now). + +2006-04-02 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool-commands.in: Add pkcs10-create command. + + * hx509.h: Add hx509_request. + + * TODO: more stuff + + * Makefile.am: Add req.c + + * req.c: Create certificate requests, prototype converts the + request in a pkcs10 packet. + + * hxtool.c: Add pkcs10_create + + * name.c (hx509_name_copy): new function. + +2006-04-01 Love Hörnquist Åstrand <lha@it.su.se> + + * TODO: fill out what do + + * hxtool-commands.in: add pkcs10-print + + * hx_locl.h: Include <pkcs10_asn1.h>. + + * pkcs10.asn1: PKCS#10 + + * hxtool.c (pkcs10_print): new function. + + * test_chain.in: test ocsp keyhash + + * data: generate ocsp keyhash version too + + * revoke.c (load_ocsp): test that we got back a BasicReponse + + * ocsp.asn1: Add asn1_id_pkix_ocsp*. + + * Makefile.am: Add asn1_id_pkix_ocsp*. + + * cert.c: Add HX509_QUERY_MATCH_KEY_HASH_SHA1 + + * hx_locl.h: Add HX509_QUERY_MATCH_KEY_HASH_SHA1 + + * revoke.c: Support OCSPResponderID.byKey, indent. + + * revoke.c (hx509_ocsp_request): Add nonce to ocsp request. + + * hxtool.c: Add nonce to ocsp request. + + * test_chain.in: Added crl tests + + * data/nist-data: rename missing-crl to missing-revoke + + * data: make ca use openssl ca command so we can add ocsp tests, + and regen certs + + * test_chain.in: Add revoked ocsp cert test + + * cert.c: rename missing-crl to missing-revoke + + * revoke.c: refactor code, fix a un-init-ed variable + + * test_chain.in: rename missing-crl to missing-revoke add ocsp + tests + + * test_cms.in: rename missing-crl to missing-revoke + + * hxtool.c: rename missing-crl to missing-revoke + + * hxtool-commands.in: rename missing-crl to missing-revoke + + * revoke.c: Plug one memory leak. + + * revoke.c: Renamed generic CRL related errors. + + * hx509_err.et: Comments and renamed generic CRL related errors + + * revoke.c: Add ocsp checker. + + * ocsp.asn1: Add id-kp-OCSPSigning + + * hxtool-commands.in: add url-path argument to ocsp-fetch + + * hxtool.c: implement ocsp-fetch + + * cert.c: Use HX509_DEFAULT_OCSP_TIME_DIFF. + + * hx_locl.h: Add ocsp_time_diff to hx509_context + + * crypto.c (_hx509_verify_signature_bitstring): new function, + commonly use when checking certificates + + * cms.c (hx509_cms_envelope_1): check for internal ASN.1 encoder + error + + * cert.c: Add ocsp glue, use new + _hx509_verify_signature_bitstring, add eku checking function. + +2006-03-31 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: add id_kp_OCSPSigning.x + + * revoke.c: Pick out certs in ocsp response + + * TODO: list of stuff to verify + + * revoke.c: Add code to load OCSPBasicOCSPResponse files, reload + crl when its changed on disk. + + * cert.c: Update for ocsp merge. handle building path w/o + subject (using subject key id) + + * ks_p12.c: _hx509_map_file changed prototype. + + * file.c: _hx509_map_file changed prototype, returns struct stat + if requested. + + * ks_file.c: _hx509_map_file changed prototype. + + * hxtool.c: Add stub for ocsp-fetch, _hx509_map_file changed + prototype, add ocsp parsing to verify command. + + * hx_locl.h: rename HX509_CTX_CRL_MISSING_OK to + HX509_CTX_VERIFY_MISSING_OK now that we have OCSP glue + +2006-03-30 Love Hörnquist Åstrand <lha@it.su.se> + + * hx_locl.h: Add <krb5-types.h> to make it compile on Solaris, + from Alex V. Labuta. + +2006-03-28 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c (_hx509_pbe_decrypt): try all passwords, not just the + first one. + +2006-03-27 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c (check_altName): Print the othername oid. + + * crypto.c: Manual page claims RSA_public_decrypt will return -1 + on error, lets check for that + + * crypto.c (_hx509_pbe_decrypt): also try the empty password + + * collector.c (match_localkeyid): no need to add back the cert to + the cert pool, its already there. + + * crypto.c: Add REQUIRE_SIGNER + + * cert.c (hx509_cert_free): ok to free NULL + + * hx509_err.et: Add new error code SIGNATURE_WITHOUT_SIGNER. + + * name.c (_hx509_name_ds_cmp): make DirectoryString case + insenstive + (hx509_name_to_string): less spacing + + * cms.c: Check for signature error, check consitency of error + +2006-03-26 Love Hörnquist Åstrand <lha@it.su.se> + + * collector.c (_hx509_collector_alloc): handle errors + + * cert.c (hx509_query_alloc): allocate slight more more then a + sizeof(pointer) + + * crypto.c (_hx509_private_key_assign_key_file): ask for password + if nothing matches. + + * cert.c: Expose more of the hx509_query interface. + + * collector.c: hx509_certs_find is now exposed. + + * cms.c: hx509_certs_find is now exposed. + + * revoke.c: hx509_certs_find is now exposed. + + * keyset.c (hx509_certs_free): allow free-ing NULL + (hx509_certs_find): expose + (hx509_get_one_cert): new function + + * hxtool.c: hx509_certs_find is now exposed. + + * hx_locl.h: Remove hx509_query, its exposed now. + + * hx509.h: Add hx509_query. + +2006-02-22 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c: Add exceptions for null (empty) subjectNames + + * data/nist-data: Add some more name constraints tests. + + * data/nist-data: Add some of the test from 4.13 Name Constraints. + + * cert.c: Name constraits needs to be evaluated in block as they + appear in the certificates, they can not be joined to one + list. One example of this is: + + - cert is cn=foo,dc=bar,dc=baz + - subca is dc=foo,dc=baz with name restriction dc=kaka,dc=baz + - ca is dc=baz with name restriction dc=baz + + If the name restrictions are merged to a list, the certificate + will pass this test. + +2006-02-14 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c: Handle more name constraints cases. + + * crypto.c (dsa_verify_signature): if test if malloc failed + +2006-01-31 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: Drop partial pkcs12 string2key implementation. + +2006-01-20 Love Hörnquist Åstrand <lha@it.su.se> + + * data/nist-data: Add commited out DSA tests (they fail). + + * data/nist-data: Add 4.2 Validity Periods. + + * test_nist.in: Make less verbose to use. + + * Makefile.am: Add test_nist_cert. + + * data/nist-data: Add some more CRL-tests. + + * test_nist.in: Print $id instead of . when running the tests. + + * test_nist.in: Drop verifying certifiates, its done in another + test now. + + * data/nist-data: fixup kill-rectangle leftovers + + * data/nist-data: Drop verifying certifiates, its done in another + test now. Add more crl tests. comment out all unused tests. + + * test_nist_cert.in: test parse all nist certs + +2006-01-19 Love Hörnquist Åstrand <lha@it.su.se> + + * hx509_err.et: Add HX509_CRL_UNKNOWN_EXTENSION. + + * revoke.c: Check for unknown extentions in CRLs and CRLEntries. + + * test_nist.in: Parse new format to handle CRL info. + + * test_chain.in: Add --missing-crl. + + * name.c (hx509_unparse_der_name): Rename from hx509_parse_name. + (_hx509_unparse_Name): Add. + + * hxtool-commands.in: Add --missing-crl to verify commands. + + * hx509_err.et: Add CRL errors. + + * cert.c (hx509_context_set_missing_crl): new function Add CRL + handling. + + * hx_locl.h: Add HX509_CTX_CRL_MISSING_OK. + + * revoke.c: Parse and verify CRLs (simplistic). + + * hxtool.c: Parse CRL info. + + * data/nist-data: Change format so we can deal with CRLs, also + note the test-id from PKITS. + + * data: regenerate test + + * data/gen-req.sh: use static-file to generate tests + + * data/static-file: new file to use for commited tests + + * test_cms.in: Use static file, add --missing-crl. + +2006-01-18 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c: Its cRLReason, not cRLReasons. + + * hxtool.c: Attach revoke context to verify context. + + * data/nist-data: change syntax to make match better with crl + checks + + * cert.c: Verify no certificates has been revoked with the new + revoke interface. + + * Makefile.am: libhx509_la_SOURCES += revoke.c + + * revoke.c: Add framework for handling CRLs. + + * hx509.h: Add hx509_revoke_ctx. + +2006-01-13 Love Hörnquist Åstrand <lha@it.su.se> + + * delete crypto_headers.h, use global file instead. + + * crypto.c (PBE_string2key): libdes now supports PKCS12_key_gen + +2006-01-12 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto_headers.h: Need BN_is_negative too. + +2006-01-11 Love Hörnquist Åstrand <lha@it.su.se> + + * ks_p11.c (p11_rsa_public_decrypt): since is wrong, don't provide + it. PKCS11 can't do public_decrypt, it support verify though. All + this doesn't matter, since the code never go though this path. + + * crypto_headers.h: Provide glue to compile with less warnings + with OpenSSL + +2006-01-08 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: Depend on LIB_des + + * lock.c: Use "crypto_headers.h". + + * crypto_headers.h: Include the two diffrent implementation of + crypto headers. + + * cert.c: Use "crypto-headers.h". Load ENGINE configuration. + + * crypto.c: Make compile with both OpenSSL and heimdal libdes. + + * ks_p11.c: Add code for public key decryption (not supported yet) + and use "crypto-headers.h". + + +2006-01-04 Love Hörnquist Åstrand <lha@it.su.se> + + * add a hx509_context where we can store configuration + + * p11.c,Makefile.am: pkcs11 is now supported by library, remove + old files. + + * ks_p11.c: more paranoid on refcount, set refcounter ealier, + reset pointers after free + + * collector.c (struct private_key): remove temporary key data + storage, convert directly to a key + (match_localkeyid): match certificate and key using localkeyid + (match_keys): match certificate and key using _hx509_match_keys + (_hx509_collector_collect): rewrite to use match_keys and + match_localkeyid + + * crypto.c (_hx509_match_keys): function that determins if a + private key matches a certificate, used when there is no + localkeyid. + (*) reset free pointer + + * ks_file.c: Rewrite to use collector and mapping support + function. + + * ks_p11.c (rsa_pkcs1_method): constify + + * ks_p11.c: drop extra wrapping of p11_init + + * crypto.c (_hx509_private_key_assign_key_file): use function to + extact rsa key + + * cert.c: Revert previous, refcounter is unsigned, so it can never + be negative. + + * cert.c (hx509_cert_ref): more refcount paranoia + + * ks_p11.c: Implement rsa_private_decrypt and add stubs for public + ditto. + + * ks_p11.c: Less printf, less memory leaks. + + * ks_p11.c: Implement signing using pkcs11. + + * ks_p11.c: Partly assign private key, enough to complete + collection, but not any crypto functionallity. + + * collector.c: Use hx509_private_key to assign private keys. + + * crypto.c: Remove most of the EVP_PKEY code, and use RSA + directly, this temporary removes DSA support. + + * hxtool.c (print_f): print if there is a friendly name and if + there is a private key + +2006-01-03 Love Hörnquist Åstrand <lha@it.su.se> + + * name.c: Avoid warning from missing __attribute__((noreturn)) + + * lock.c (_hx509_lock_unlock_certs): return unlock certificates + + * crypto.c (_hx509_private_key_assign_ptr): new function, exposes + EVP_PKEY + (_hx509_private_key_assign_key_file): remember to free private key + if there is one. + + * cert.c (_hx509_abort): add newline to output and flush stdout + + * Makefile.am: libhx509_la_SOURCES += collector.c + + * hx_locl.h: forward type declaration of struct hx509_collector. + + * collector.c: Support functions to collect certificates and + private keys and then match them. + + * ks_p12.c: Use the new hx509_collector support functions. + + * ks_p11.c: Add enough glue to support certificate iteration. + + * test_nist_pkcs12.in: Less verbose. + + * cert.c (hx509_cert_free): if there is a private key assosited + with this cert, free it + + * print.c: Use _hx509_abort. + + * ks_p12.c: Use _hx509_abort. + + * hxtool.c: Use _hx509_abort. + + * crypto.c: Use _hx509_abort. + + * cms.c: Use _hx509_abort. + + * cert.c: Use _hx509_abort. + + * name.c: use _hx509_abort + +2006-01-02 Love Hörnquist Åstrand <lha@it.su.se> + + * name.c (hx509_name_to_string): don't cut bmpString in half. + + * name.c (hx509_name_to_string): don't overwrite with 1 byte with + bmpString. + + * ks_file.c (parse_certificate): avoid stomping before array + + * name.c (oidtostring): avoid leaking memory + + * keyset.c: Add _hx509_ks_dir_register. + + * Makefile.am (libhx509_la_SOURCES): += ks_dir.c + + * hxtool-commands.in: Remove pkcs11. + + * hxtool.c: Remove pcert_pkcs11. + + * ks_file.c: Factor out certificate parsing code. + + * ks_dir.c: Add new keystore that treats all files in a directory + a keystore, useful for regression tests. + +2005-12-12 Love Hörnquist Åstrand <lha@it.su.se> + + * test_nist_pkcs12.in: Test parse PKCS12 files from NIST. + + * data/nist-data: Can handle DSA certificate. + + * hxtool.c: Print error code on failure. + +2005-10-29 Love Hörnquist Åstrand <lha@it.su.se> + + * crypto.c: Support DSA signature operations. + +2005-10-04 Love Hörnquist Åstrand <lha@it.su.se> + + * print.c: Validate that issuerAltName and subjectAltName isn't + empty. + +2005-09-14 Love Hörnquist Åstrand <lha@it.su.se> + + * p11.c: Cast to unsigned char to avoid warning. + + * keyset.c: Register pkcs11 module. + + * Makefile.am: Add ks_p11.c, install hxtool. + + * ks_p11.c: Starting point of a pkcs11 module. + +2005-09-04 Love Hörnquist Åstrand <lha@it.su.se> + + * lock.c: Implement prompter. + + * hxtool-commands.in: add --content to print + + * hxtool.c: Split verify and print. + + * cms.c: _hx509_pbe_decrypt now takes a hx509_lock. + + * crypto.c: Make _hx509_pbe_decrypt take a hx509_lock, workaround + for empty password. + + * name.c: Add DC, handle all Directory strings, fix signless + problems. + +2005-09-03 Love Hörnquist Åstrand <lha@it.su.se> + + * test_query.in: Pass in --pass to all commands. + + * hxtool.c: Use option --pass. + + * hxtool-commands.in: Add --pass to all commands. + + * hx509_err.et: add UNKNOWN_LOCK_COMMAND and CRYPTO_NO_PROMPTER + + * test_cms.in: pass in password to cms-create-sd + + * crypto.c: Abstract out PBE_string2key so I can add PBE2 s2k + later. Avoid signess warnings with OpenSSL. + + * cms.c: Use void * instead of char * for to avoid signedness + issues + + * cert.c (hx509_cert_get_attribute): remove const, its not + + * ks_p12.c: Cast size_t to unsigned long when print. + + * name.c: Fix signedness warning. + + * test_query.in: Use echo, the function check isn't defined here. + +2005-08-11 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool-commands.in: Add more options that was missing. + +2005-07-28 Love Hörnquist Åstrand <lha@it.su.se> + + * test_cms.in: Use --certificate= for enveloped/unenvelope. + + * hxtool.c: Use --certificate= for enveloped/unenvelope. Clean + up. + + * test_cms.in: add EnvelopeData tests + + * hxtool.c: use id-envelopedData for ContentInfo + + * hxtool-commands.in: add contentinfo wrapping for create/unwrap + enveloped data + + * hxtool.c: add contentinfo wrapping for create/unwrap enveloped + data + + * data/gen-req.sh: add enveloped data (aes128) + + * crypto.c: add "new" RC2 oid + +2005-07-27 Love Hörnquist Åstrand <lha@it.su.se> + + * hx_locl.h, cert.c: Add HX509_QUERY_MATCH_FUNCTION that allows + caller to match by function, note that this doesn't not work + directly for backends that implements ->query, they must do their + own processing. (I'm running out of flags, only 12 left now) + + * test_cms.in: verify ContentInfo wrapping code in hxtool + + * hxtool-commands.in (cms_create_sd): support wrapping in content + info spelling + + * hxtool.c (cms_create_sd): support wrapping in content info + + * test_cms.in: test more cms signeddata messages + + * data/gen-req.sh: generate SignedData + + * hxtool.c (cms_create_sd): support certificate store, add support + to unwrap a ContentInfo the SignedData inside. + + * crypto.c: sprinkel rk_UNCONST + + * crypto.c: add DER NULL to the digest oid's + + * hxtool-commands.in: add --content-info to cms-verify-sd + + * cms.c (hx509_cms_create_signed_1): pass in a full + AlgorithmIdentifier instead of heim_oid for digest_alg + + * crypto.c: make digest_alg a digest_oid, it's not needed right + now + + * hx509_err.et: add CERT_NOT_FOUND + + * keyset.c (_hx509_certs_find): add error code for cert not + found + + * cms.c (hx509_cms_verify_signed): add external store of + certificates, use the right digest algorithm identifier. + + * cert.c: fix const warning + + * ks_p12.c: slightly less verbose + + * cert.c: add hx509_cert_find_subjectAltName_otherName, add + HX509_QUERY_MATCH_FRIENDLY_NAME + + * hx509.h: add hx509_octet_string_list, remove bad comment + + * hx_locl.h: add HX509_QUERY_MATCH_FRIENDLY_NAME + + * keyset.c (hx509_certs_append): needs a hx509_lock, add one + + * Makefile.am: add test cases tempfiles to CLEANFILES + + * Makefile.am: add test_query to TESTS, fix dependency on hxtool + sources on hxtool-commands.h + + * hxtool-commands.in: explain what signer is for create-sd + + * hxtool.c: add query, add more options to verify-sd and create-sd + + * test_cms.in: add more cms tests + + * hxtool-commands.in: add query, add more options to verify-sd + + * test_query.in: test query interface + + * data: fix filenames for ds/ke files, add pkcs12 files, regen + + * hxtool.c,Makefile.am,hxtool-commands.in: switch to slc + +2005-07-26 Love Hörnquist Åstrand <lha@it.su.se> + + * cert.c (hx509_verify_destroy_ctx): add + + * hxtool.c: free hx509_verify_ctx + + * name.c (_hx509_name_ds_cmp): make sure all strings are not equal + +2005-07-25 Love Hörnquist Åstrand <lha@it.su.se> + + * hxtool.c: return error + + * keyset.c: return errors from iterations + + * test_chain.in: clean up checks + + * ks_file.c (parse_certificate): return errno's not 1 in case of + error + + * ks_file.c (file_iter): make sure endpointer is NULL + + * ks_mem.c (mem_iter): follow conversion and return NULL when we + get to the end, not ENOENT. + + * Makefile.am: test_chain depends on hxtool + + * data: test certs that lasts 10 years + + * data/gen-req.sh: script to generate test certs + + * Makefile.am: Add regression tests. + + * data: test certificate and keys + + * test_chain.in: test chain + + * hxtool.c (cms_create_sd): add KU digitalSigature as a + requirement to the query + + * hx_locl.h: add KeyUsage query bits + + * hx509_err.et: add KeyUsage error + + * cms.c: add checks for KeyUsage + + * cert.c: more checks on KeyUsage, allow to query on them too + +2005-07-24 Love Hörnquist Åstrand <lha@it.su.se> + + * cms.c: Add missing break. + + * hx_locl.h,cms.c,cert.c: allow matching on SubjectKeyId + + * hxtool.c: Use _hx509_map_file, _hx509_unmap_file and + _hx509_write_file. + + * file.c (_hx509_write_file): in case of write error, return errno + + * file.c (_hx509_write_file): add a function that write a data + blob to disk too + + * Fix id-tags + + * Import mostly complete X.509 and CMS library. Handles, PEM, DER, + PKCS12 encoded certicates. Verificate RSA chains and handled + CMS's SignedData, and EnvelopedData. + + |