sssd.git/src/util/cert, branch sssctl

libsss_certmap: Accept certificate with data before header

2017-04-03T08:43:07+00:00

According to RFC 7468 parser must not fail when some data are present
before the encapsulation boundary. sss_cert_pem_to_der didn't respect
this and refused valid input. Changing it's code to first locate
the certificate header fixes the issue.

Resolves:
https://pagure.io/SSSD/sssd/issue/3354

Reviewed-by: Sumit Bose 
Reviewed-by: Fabiano Fidêncio

sss_cert_derb64_to_ldap_filter: add sss_certmap support

2017-03-23T16:19:14+00:00

Use certificate mapping library if available to lookup a user by
certificate in LDAP.

Related to https://pagure.io/SSSD/sssd/issue/3050

Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

UTIL: Fix implicit declaration of function 'htobe32'

2016-11-25T09:31:33+00:00

Include internal wrapper header file for endian related functions.
The "util/sss_endian.h" include available header file on different
platform or it provides compatible macros in the worst case.

Breakage noticed when building SSSD on FreeBSD

  CC       src/util/cert/nss/libsss_cert_la-cert.lo
src/util/cert/nss/cert.c: In function 'cert_to_ssh_key':
src/util/cert/nss/cert.c:358: error: implicit declaration of function 'htobe32'
gmake[2]: *** [Makefile:12421: src/util/cert/nss/libsss_cert_la-cert.lo] Error 1
gmake[2]: Leaving directory '/root/sssd_from_git'
gmake[1]: *** [Makefile:20050: all-recursive] Error 1
gmake[1]: Leaving directory '/root/sssd_from_git'
gmake: *** [Makefile:7116: all] Error 2

Reviewed-by: Fabiano Fidêncio

crypto: Port libcrypto code to openssl-1.1

2016-10-20T12:51:42+00:00

EVP_MD_CTX and EVP_CIPHER_CTX are opaque in openssl-1.1

Reviewed-by: Tomas Mraz

cert_to_ssh_key: properly add leading 0 to bignums

2016-07-07T16:13:32+00:00

In the ssh keys a leading 0 is added to the bignums of the RSA modulus
and exponent if the leading bit is set to avoid the interpretation as a
negative number.

Reviewed-by: Jakub Hrozek

p11: add OCSP default responder options

2016-06-09T09:58:17+00:00

Reviewed-by: Jakub Hrozek

p11: add no_verification option

2016-06-09T09:58:12+00:00

Reviewed-by: Jakub Hrozek

p11: enable ocsp checks

2015-11-26T15:39:49+00:00

This patch enables the Online Certificate Status Protocol in NSS and
adds an option to disable it if needed. To make further tuning of
certificate verification more easy it is not an option on its own but an
option to the new certificate_verification configuration option.

Resolves https://fedorahosted.org/sssd/ticket/2812

Reviewed-by: Jakub Hrozek

ssh: generate public keys from certificate

2015-07-31T07:52:06+00:00

Resolves: https://fedorahosted.org/sssd/ticket/2711

Reviewed-by: Jakub Hrozek

utils: add NSS version of cert utils

2015-07-31T07:51:35+00:00

Reviewed-by: Jakub Hrozek