Create ovpn file with "ca", "cert" and "key"
Additionally put all intermediate CAs (if any)
tagged as "extra-certs".
"tls-auth" "OpenVPN Static key V1" not supported (yet)
Extend export-test by OpenVPN test case
When opening the database Find legacy encrypted keys and:
- update them automatically when encrypted with the
database password or
- inform the user about a required action when encrypted with an
individual passphrase
Related issues #458#511#503#500#494#484#482#475
Remember a complete transformation of all keys
in the Settings["legacy-keys-updated"]
to avoid analyzing all keys each tim a database is opened.
With 2.5.0 support for decrypting pre 2.0.0 keys was dropped.
However, the database update in 2.0.0 and later did not convert the
keys.
Related issues #458#511#503#500#494#484#482#475
Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
According to the documentation EVP_PKEY_check() may
return -2 if the algorithm is not supported.
This has been observed with OpenSSL-1.1.1
See also b96951fdfd
The proposed "addAction()" with the KeySequence as 2nd argument
is only available soince Qt6.3 and not compatible with QT5
Change the call in a compatible way and set the shortcut afterwards.
For interoprability reason.
To enforce it, set "#define OPENSSL_NO_STDIO 1"
All file access is done by reading/writing from/to BioByteArray()
which is filled by QFile:readAll()
Drop CRYPTO_malloc_debug / CRYPTO_mem_leaks
which is unused and disabled since many years.
Collect all export formats in pki_export.
Each export format has assigned acouple of flags, indicating,
whether they are text, concatenateable, encrypted, usable for
multiple selections or only for a single item.
The generic XcaProgress object is used, which dynamically
creates a Cmdline progress object.
The Mainwindow replaces it by a GUI object, which integrates
into the status bar.
Support loading OpenSSH ED25519 private key
Improve private key verification in general.
ED25519 does not support EVP_PKEY_sign(), so use
EVP_DigestSign(), which in turn only works since OpenSSL 1.1.1
resulting in a backward compatibility quirk in openssl_compat.
- Export SSH2 Public key
- Detect whether ED25519 key is private key
- Support ED25519 in the KeyDetails dialog
o Display public key
o Curve name
o Fingerprints
o Availability of private key
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
If Loading the item results in an openssl error,
even if the item is not empty, discard it.
Otherwise loading it from the database later on will fail.
Improve "autoIntName()"
