summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* doc updateNikos Mavrogiannopoulos2017-03-061-0/+1
|
* .gitlab-ci.yml: execute initialization stage unconditionallyNikos Mavrogiannopoulos2017-03-061-6/+4
| | | | | | This step is required both in tags and commit runs. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* bumped versionNikos Mavrogiannopoulos2017-03-063-3/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* _gnutls_set_strdatum: always return an allocated string on successNikos Mavrogiannopoulos2017-03-051-2/+4
| | | | | | That prevents returning NULL to functions which require a string. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-03-051-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Enforce the max packet length for OpenPGP subpackets as wellAlex Gaynor2017-03-053-3/+9
| | | | | | | This addresses: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=392 Signed-off-by: Alex Gaynor <alex.gaynor@gmail.com>
* doc: corrected typo [ci skip]Nikos Mavrogiannopoulos2017-03-051-2/+2
| | | | | | It was pointed out by morozov@eags.ru. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* NEWS: added links to GNUTLS-SA-2017-3Nikos Mavrogiannopoulos2017-03-041-2/+2
|
* .gitlab-ci.yml: run tests under a FIPS140 mode simulationgnutls_3_5_x-backport-fips-mode-changesNikos Mavrogiannopoulos2017-03-021-2/+4
| | | | | | | | | That is, in FIPS140-2/Fedora/x86_64 build, run tests under a normal run (when library is compiled with FIPS140-2 support but not enabled on run time), and also run tests under a run-time that simulates FIPS140-2 support. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* crypto-self-tests: modified exported functions to work under fips140-2 modeNikos Mavrogiannopoulos2017-03-021-4/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: skip tests which cannot be run in FIPS140-2 modeNikos Mavrogiannopoulos2017-03-024-4/+22
| | | | | | This allows the test suite to be run in FIPS140-2 mode. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_pk_params_copy: copy the provable algorithm usedNikos Mavrogiannopoulos2017-03-021-0/+1
| | | | | | | This is affected utilization of generated RSA keys under FIPS140-2 mode which utilizes provable generation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: priorities: skip test in FIPS140-2 modeNikos Mavrogiannopoulos2017-03-021-2/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_session_ticket_key_generate: fixed operation under FIPS140-2 modeNikos Mavrogiannopoulos2017-03-011-1/+21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-011-4/+13
|
* tests: added test cases with invalid openpgp certsNikos Mavrogiannopoulos2017-03-014-2/+3
| | | | | | | | | These certificates contain invalid secret key sub-packets. These trigger invalid memory accesses: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=360 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=354 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* opencdk: do not parse any secret keys in packet when reading a certificateNikos Mavrogiannopoulos2017-03-018-17/+28
| | | | | | | | | | | | This reduces the attack surface on the parsers, and prevents any bugs in the secret key parser to be exploitable by inserting secret key sub-packets into an openpgp certificate. This addresses: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=354 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=360 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* x509/output: Cleanup in IDNA name printingNikos Mavrogiannopoulos2017-02-281-34/+34
| | | | | | | That also removes the incorrect mapping to IDNA punycode when the input is not printable. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: increased buffer for reading from userNikos Mavrogiannopoulos2017-02-281-5/+6
| | | | | | | | | This allows reading longer than 128-byte fields interactively. The new limit is 512-bytes. Relates #179 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: store critical extensions even if no other extension are presentNikos Mavrogiannopoulos2017-02-271-1/+2
| | | | | | | That is, fix a bug which prevented critical extensions to be stored if no other free-form extensions were specified. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-241-0/+10
|
* gnutls_ocsp_resp_verify_direct, gnutls_ocsp_resp_verify: defined flags argumentNikos Mavrogiannopoulos2017-02-241-5/+5
| | | | | | | | That was defined to be gnutls_certificate_verify_flags, and it allows passing verification flags, such as flags to allow broken algorithms. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* is_level_acceptable: no longer checks for broken algorithmsNikos Mavrogiannopoulos2017-02-241-1/+1
| | | | | | | | This is done at is_broken_allowed(), and in fact checking them in is_level_acceptable() creates a conflict when overrides like flag GNUTLS_VERIFY_ALLOW_BROKEN is used. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_store_commitment: introduced flag GNUTLS_SCOMMIT_FLAG_ALLOW_BROKENNikos Mavrogiannopoulos2017-02-242-2/+6
| | | | | | This flag allows operation of the function even with broken algorithms. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* verify: is_broken_allowed: account for "new" flag GNUTLS_VERIFY_ALLOW_BROKENNikos Mavrogiannopoulos2017-02-241-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-231-2/+7
|
* tests: added test case with invalid openpgp certNikos Mavrogiannopoulos2017-02-233-2/+4
| | | | | | | This triggers an invalid memory access: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* opencdk: read_attribute: account buffer sizeNikos Mavrogiannopoulos2017-02-231-1/+1
| | | | | | | | | | | That ensures that there is no read past the end of buffer. Resolves the oss-fuzz found bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391 Relates: #159 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-cli-debug: fixed protocol to port discoveryNikos Mavrogiannopoulos2017-02-231-1/+2
| | | | | | | That is, if --starttls-proto is provided the default port selected will be converted to host byte order as expected. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* NEWS: fix typo [ci skip]Nikos Mavrogiannopoulos2017-02-231-1/+1
|
* tests: split starttls.sh into multiple scriptsNikos Mavrogiannopoulos2017-02-2311-145/+352
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-02-231-0/+3
|
* tests: updated to include the pin-sha256 in outputNikos Mavrogiannopoulos2017-02-2312-0/+24
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: updated to take into account the pin-sha256 oneline outputNikos Mavrogiannopoulos2017-02-231-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/output: print key PIN on oneline outputNikos Mavrogiannopoulos2017-02-231-4/+4
| | | | | | | That is, instead of the public key ID. The key PIN due to HPKP is now more widely used than hex-based key IDs. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/output: print the public key PIN of a certificateNikos Mavrogiannopoulos2017-02-233-0/+27
| | | | | | | That is, print the value used by the HPKP protocol as per RFC7469. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: pkcs11-import-with-pin: removed invalid conditional macroNikos Mavrogiannopoulos2017-02-231-4/+0
|
* tests: added PKCS#11 test for pin inputNikos Mavrogiannopoulos2017-02-232-1/+199
| | | | | | | This introduces a test on PIN input to retrieve an object using pin-value and pin-source (file). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: ubsan build: fixed artifacts pathNikos Mavrogiannopoulos2017-02-231-4/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: don't warn when 'uri' is specified on templateNikos Mavrogiannopoulos2017-02-231-0/+1
| | | | | | | Reported at: https://bugzilla.redhat.com/show_bug.cgi?id=1425884 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle/pk: corrected memcpy of Q in DSA paramsNikos Mavrogiannopoulos2017-02-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: backported from master branchNikos Mavrogiannopoulos2017-02-211-116/+182
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* configure: no longer use -Wframe-larger-thanNikos Mavrogiannopoulos2017-02-211-1/+0
| | | | | | | | We do not require a specific stack size, and there is legacy code which utilizes large stack sizes. As such remove the warnings to allow for a warning free compilation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: avoid calling memcpy will null optionsNikos Mavrogiannopoulos2017-02-211-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs7: corrected error checking in write_signer_idNikos Mavrogiannopoulos2017-02-211-6/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* make_printable_string: allow operation with null inputNikos Mavrogiannopoulos2017-02-211-0/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_int.h: include assert.hNikos Mavrogiannopoulos2017-02-211-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-201-0/+3
|
* tests: added test case with invalid openpgp certNikos Mavrogiannopoulos2017-02-203-2/+4
| | | | | | | That triggers a heap buffer overflow: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* opencdk/read-packet.c: corrected typo in type castNikos Mavrogiannopoulos2017-02-201-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status