9056bbf887
fix(build): compilation on macos
...
After some commits on the master branch compilation
for macos was not working. This PR restores macos
to a building state.
Co-authored-by: Jón Bjarni Bjarnason <jon@centroid.is >
2025-03-18 14:58:00 +01:00
43e0ce49fe
fix(plugin): Removed architecture dependency from the mbedtls plugin
2025-03-10 15:33:25 +01:00
a7b21ca96b
fix(plugins): Fix generation of wrong private key format for MbedTLS
...
- Re-order case statements to match order in other code
- Use derived compile-time constant to avoid duplication
(cherry picked from commit ee8083a9a2
2025-03-04 15:15:39 +00:00
c9bb7e5e87
fix(plugin): Remove duplicate file
2025-03-04 15:15:39 +00:00
748f39ad5e
Merge remote-tracking branch 'origin/master' into merge_14_master_25
2025-01-25 19:07:12 +01:00
3bec159cb9
Merge remote-tracking branch 'origin/1.4' into merge_14_master_25
2025-01-25 19:06:56 +01:00
59eff2c2b0
refactor(plugin): Move the file handling definitions to the arch folder
2025-01-24 22:35:58 +01:00
0e62e11afb
Merge remote-tracking branch 'origin/master' into merge_14_master_25
2025-01-20 16:09:35 +01:00
403f4628c4
fix(plugin): Convert PEM to DER for rsa policies
2025-01-20 16:02:26 +01:00
373986fbf1
fix(plugin): Reset only the specified part of the trust list when setting it
2025-01-15 14:15:29 +01:00
f29a7f3f30
fix(plugin): Extend CertificateUtils to support CRL for the thumbprint and subject name functions
2025-01-15 14:15:29 +01:00
931cc824f7
fix(plugins): Rename dirent.h to tr_dirent.h
2025-01-14 22:50:18 +01:00
06d0d3ff86
fix(plugins): Add include guard to ua_filestore_common.h
2025-01-14 22:50:18 +01:00
0cde335fa7
fix(plugin): Initialize memory to prevent uninitialized memory error
2025-01-14 22:49:30 +01:00
2076a9c87f
feat(plugin): Add filestore Windows implementation ( #7006 )
...
* feat(plugin): Add filestore Windows implementation
* Define UA_DT_REG and UA_DT_DIR
* Remove build flag and use __linux__ or UA_ARCHITECTURE_WIN32 in places which used to check only for __linux__
2025-01-10 14:28:37 +01:00
25584c3ccf
fix(plugin): Monitor 'trusted' subdirectory in PKI
...
inotify doesn't work recursively, subdirectories need to be monitored separately. As a result adding certificate to 'trusted' directory directly didn't refresh the trustlist.
2024-12-11 11:52:36 +01:00
b6c113012a
refactor(plugins): Parse the certificate subject alt name using the new mbedTLS API in mbedtls/certificategroup.c
2024-12-10 08:28:30 +01:00
41f7dc4f87
refactor(plugins): Improve the logging of mismatching ApplicationURI in openssl/certificategroup.c
2024-12-10 08:28:30 +01:00
9f6b89b4cb
feat(plugins): Use the application's logger in UA_CertificateUtils_verifyApplicationURI
2024-12-10 08:28:30 +01:00
9e17e1b4f9
fix(plugins): Don't use the server log category for generic certificategroup functionality
2024-12-10 08:28:30 +01:00
5e7f04b71b
Merge remote-tracking branch 'origin/1.4' into merge_14_master_25
2024-12-07 22:55:41 +01:00
ee8083a9a2
fix(plugins): Fix generation of wrong private key format for MbedTLS
...
- Re-order case statements to match order in other code
- Use derived compile-time constant to avoid duplication
2024-12-04 19:49:42 +01:00
fa512db883
fix(plugins): Fix issue with invalid signature on the generated CSR ( #6934 )
...
Private key associated with a security policy is used for multipule
purposes:
- asymmetric encryption/decryption
- asymmetric signing/verification
- certificate/CSR signing
The schemes used for each of the above operations differ in various
policies. However, for certificate/CSR signing, for all RSA-based
policies, the used scheme is always RSASSA-PKCS1-v1_5
(MBEDTLS_RSA_PKCS_V15).
Before generating a CSR, enforce using the RSASSA-PKCS1-v1_5 by setting
the corresponding private key context.
This fixes a bug that in some edge cases, the private key context left
after the previous usage of RSA module (e.g. if the last usage was to
decrypt the user password) had the scheme set to RSAES-OAEP
(MBEDTLS_RSA_PKCS_V21). This resulted in an invalid signature over the
CSR.
Co-authored-by: Julius Pfrommer <jpfr@users.noreply.github.com >
2024-12-04 16:06:18 +01:00
3031e8cae5
refactor(plugins): Simplify struct definition in ua_certificategroup_filestore.c
2024-11-29 21:51:08 +01:00
a5344503dd
fix(plugins): Certificate verification must not depend on an absolute memory location of the CertificateGroup
2024-11-29 21:50:05 +01:00
3785ed5c4d
Merge remote-tracking branch 'origin/1.4' into merge_14_master_24
2024-11-29 21:50:04 +01:00
9e59f1abe2
refactor(plugins): Remove comparison of authorityKeyIdentifier / subjectKeyIdentifier not supported by CTT
...
The CTT example Security User X509/001.js expects that an issuer is
selected where the authorityKeyIdentifier / subjectKeyIdentifier do not
match. No longer use X509_check_issued, but rather manually check if the
issuer name and subject name match -- with no other checks beyond that.
2024-11-25 18:48:59 +01:00
b6961b23ae
Merge remote-tracking branch 'origin/1.3' into merge_13_14_21
2024-11-24 23:45:19 +01:00
68142484a3
feat(plugins): Disable revocation lists checks in ua_pki_openssl.c if zero crl are loaded
...
Avoid breakage for users of the 1.3 release family but still log a warning.
2024-11-23 21:57:36 +01:00
efbaac086e
feat(plugins): Disable revocation lists checks in ua_pki_mbedtls.c if zero crl are loaded
...
Avoid breakage for users of the 1.3 release family but still log a warning.
2024-11-23 21:57:36 +01:00
80bbdd4170
fix(plugins): Return detailed status codes for revocation checks in ua_pki_openssl.c
2024-11-23 21:57:36 +01:00
486a65ee10
fix(plugins): Also consider the trustlist to find issuers in ua_pki_openssl.c
2024-11-23 21:57:36 +01:00
2e516fd7bd
fix(plugins): Return detailed status codes for revocation checks in ua_pki_mbedtls.c
2024-11-23 21:57:36 +01:00
3ebc92e66a
fix(plugins): Also consider the trustlist to find issuers in ua_pki_mbedtls.c
2024-11-23 21:57:36 +01:00
ff7dc78d2d
refactor(plugins): Small cleanups in ua_pki_mbedtls.c
2024-11-23 21:57:36 +01:00
cd9088a079
refactor(plugins): Refactor out mbedtlsSameBuf to compare mbedTLS buffers
2024-11-23 21:57:36 +01:00
b46087274f
fix(plugin): cert_gen mbedTLS fix header file include and add to build
...
Co-authored-by: Christian von Arnim <christian.von-arnim@isw.uni-stuttgart.de >
Signed-off-by: Goetz Goerisch <g.goerisch@vdw.de >
2024-11-21 23:20:40 +01:00
e0c31d83cb
feat(plugins): Support certificate generation with mbedTLS. ( #6145 )
...
(cherry picked from commit 1f19a8e484
2024-11-21 23:20:40 +01:00
2b445aecf6
Merge remote-tracking branch 'origin/1.4' into merge_14_master_23
2024-11-05 17:19:45 +01:00
805c1ab17a
fix(plugins): Reenable writing rejected certificates to a reject folder
2024-11-05 00:38:08 +01:00
ffb74325c2
refactor(plugin): improvement of memory management in ECC policy
...
* Place UA_ByteString on the stack instead of heap
* Use UA_calloc to automatically initialize memory with zero
* Additional minor improvements based on PR feedback
2024-11-04 12:44:46 +01:00
308d8e2759
feat(plugin): add OpenSSL plugin for ECC P-256
...
Add http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256
policy support in OpenSSL plugin.
2024-11-04 12:44:46 +01:00
d92c4221c2
refactor(plugin): reuse bio in decoding of DER/PEM
2024-10-31 16:39:49 +01:00
380c58f109
refactor(plugin): avoid magic numbers in detection of DER encoding
...
Replace the detection of DER encoding using magic numbers by
OpenSSL functions trying to decode the input as DER first and if
not successful as PEM afterwards. This approach is less error
prone and more flexible, as it supports Elliptic Curve keys and
certificates as well.
2024-10-31 16:39:49 +01:00
5553172bed
fix(plugins): Read existing PKI folder during creation of file-based certificate group
2024-10-29 01:17:05 +01:00
4a7168817a
feat(plugins): Add CertificateUtils function to validate if a certificate is a CA certificate
2024-10-29 01:17:05 +01:00
584f40bfa4
refactor(plugins): Simplify CertificateGroup utilities functions
2024-10-29 01:17:05 +01:00
5f1a600c46
fix(plugins): Fix typo in the name of a certificate utility function
2024-10-29 01:17:05 +01:00
d625185eba
refactor(arch): Rename the eventloop_ folders to just the architecture
2024-10-26 17:42:12 +02:00
a75fed6389
Merge remote-tracking branch 'origin/1.3' into merge_13_14_20
2024-10-22 23:53:01 +02:00
Ómar Högni Guðmarsson