summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* KTLS: APIktls_apiFrantisek Krenzelok2021-11-3013-214/+269
| | | | | | | ktls is enabled by default, we can check if inicialization was succesfull with gnutls_transport_is_ktls_enabled Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* Merge branch 'wip/dueno/config-allowlisting' into 'master'Daiki Ueno2021-11-2922-148/+1690
|\ | | | | | | | | | | | | priority: support allowlisting in configuration file Closes #1172 See merge request gnutls/gnutls!1427
| * priority: support allowlisting in configuration fileDaiki Ueno2021-11-2922-201/+1548
| | | | | | | | | | | | | | | | | | | | | | | | This adds a new mode of interpreting the [overrides] section. If "override-mode" is set to "allowlisting" in the [global] section, all the algorithms (hashes, signature algorithms, curves, and versions) are initially marked as insecure/disabled. Then the user can enable them by specifying allowlisting keywords such as "secure-hash" in the [overrides] section. Signed-off-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Alexander Sosedkin <asosedkin@redhat.com>
| * priority: refactor config file parsingDaiki Ueno2021-11-246-57/+252
| | | | | | | | | | | | | | | | | | | | | | | | This adds the following refactoring: - avoid side-effects during parsing the config file, by separating application phase; the parsed configuration can be applied globally with cfg_apply, after validation - make _gnutls_*_mark_{disabled,insecure} take an ID instead of the name Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'wip/dueno/valgrind-tests' into 'master'Daiki Ueno2021-11-274-7/+14
|\ \ | | | | | | | | | | | | | | | | | | build: update to use the latest valgrind-tests module from Gnulib Closes #1253 See merge request gnutls/gnutls!1488
| * | build: update to use the latest valgrind-tests module from GnulibDaiki Ueno2021-11-274-7/+14
| |/ | | | | | | | | | | | | | | | | | | | | | | This adjust the existing valgrind invocations in the test suite with: https://www.gnu.org/software/gnulib/manual/html_node/Valgrind-options.html - make --suppressions option to per directory, using AM_VALGRINDFLAGS - use LOG_VALGRIND for LOG_COMPILER - quote '$(LOG_VALGRIND)' in TESTS_ENVIRONMENT - move gl_VALGRIND_TESTS_DEFAULT_NO call before gl_INIT Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'fix_non_vla_02' into 'master'Daiki Ueno2021-11-261-3/+8
|\ \ | |/ |/| | | | | sockets: fixed building for Windows with compilers without VLA support (alternative version) See merge request gnutls/gnutls!1490
| * sockets: fixed compiler warning on Windows x32Evgeny Grin2021-11-261-0/+2
| | | | | | | | Signed-off-by: Evgeny Grin <k2k@narod.ru>
| * sockets: fixed building for Windows with compilers without VLA supportEvgeny Grin2021-11-261-3/+6
|/ | | | Signed-off-by: Evgeny Grin <k2k@narod.ru>
* Merge branch 'wip/dueno/thr' into 'master'Daiki Ueno2021-11-2213-290/+300
|\ | | | | | | | | locks: couple of improvements using Gnulib glthread See merge request gnutls/gnutls!1485
| * locks: deprecate gnutls_global_set_mutexDaiki Ueno2021-11-171-15/+6
| | | | | | | | | | | | | | As the library now uses static mutexes, rwlocks, and onces, it doesn't make much sense to only replace dynamic mutex usage. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * locks: use once execution for on-demand initialization of globalsDaiki Ueno2021-11-178-31/+90
| | | | | | | | | | | | | | | | | | | | This makes sure that the global variables are initialized only once. Most of those variables are initialized at ELF constructor, though a couple of occasions they are initialized on-demand: the global keylog file pointer and TPM2 TCTI context. To properly protect the initialization this patch uses gl_once provided by Gnulib. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * locks: rework rwlock primitivesDaiki Ueno2021-11-173-79/+142
| | | | | | | | | | | | | | Remove GNUTLS_STATIC_RWLOCK_*LOCK macros and respect return values of rwlock primitives. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * pkcs11: switch to using static mutexDaiki Ueno2021-11-172-12/+3
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * verify-tofu: switch to using static mutex for lockingDaiki Ueno2021-11-172-12/+4
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * locks: replace custom mutex wrappers with "glthread/lock.h"Daiki Ueno2021-11-176-144/+58
|/ | | | | | | As Gnulib provides portability wrappers of mutex implementations, we don't need to provide similar wrappers by ourselves. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/tpm2' into 'master'Daiki Ueno2021-11-1417-11/+1710
|\ | | | | | | | | | | | | Port openconnect TPM2 code Closes #594 See merge request gnutls/gnutls!1460
| * Port openconnect TPM2 codeNikos Mavrogiannopoulos2021-11-1317-11/+1710
| | | | | | | | | | | | | | | | | | | | This introduces transparent loading of TPM2 keys which are in PEM form by gnutls_privkey_import_x509_raw() and higher level functions which wrap it. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Co-authored-by: David Woodhouse <dwmw2@infradead.org> Co-authored-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'abs-top-builddir-fix' into 'master'Daiki Ueno2021-11-114-0/+4
|\ \ | |/ |/| | | | | tests: pass $abs_top_builddir more consistently See merge request gnutls/gnutls!1484
| * tests: set $abs_top_builddir in more placesAlexander Sosedkin2021-11-104-0/+4
|/ | | | | | | | | `$abs_top_builddir` has been used all across tests' subdirectories (through tests/scripts/common.sh) but has only been defined for tests/suite/ ones. Defining it in other Makefiles where `top_builddir` is being passed. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* Merge branch 'wip/dueno/system_wide_priority_strings_init' into 'master'Daiki Ueno2021-11-054-108/+134
|\ | | | | | | | | priority: rework config reloading logic and locking See merge request gnutls/gnutls!1483
| * priority: rework config reloading logic and lockingDaiki Ueno2021-11-054-106/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous reloading logic relied on the existence of [priority] section (in the initial loading) as an indicator whether the file is loaded. This didn't work well in the following cases: - when the section didn't exist initially and then is added later - when the section existed initially and then is removed later To handle these cases, this change adds a new flag system_priority_file_loaded which can be used together with the mtime check. This also adds an rwlock to protect global configuration. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * Revert "priority: fix potential race in reloading system-wide config"Daiki Ueno2021-11-031-15/+6
|/ | | | | | | | This reverts commit 890c6937a3cfb4a0704bc815324221ec4cb89840. Considering the entire logic around reloading the config file, the fix was suboptimal. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/abi-dump-release' into 'master'Daiki Ueno2021-10-303-22/+46
|\ | | | | | | | | devel: update release procedure taking into account of abi-dump See merge request gnutls/gnutls!1481
| * devel: update release procedure taking into account of abi-dumpDaiki Ueno2021-10-263-22/+46
| | | | | | | | | | | | | | As the *.abi files have been moved into a separate repository, we need an extra step to update the repository for new release. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'wip/dueno/priority-race' into 'master'Daiki Ueno2021-10-301-6/+15
|\ \ | | | | | | | | | | | | priority: fix potential race in reloading system-wide config See merge request gnutls/gnutls!1482
| * | priority: fix potential race in reloading system-wide configDaiki Ueno2021-10-301-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | _gnutls_update_system_priorities is called from gnutls_priority_set* functions every time when the SYSTEM keyword is used and updates a global variable system_wide_priority_strings if the configuration changes. Although the critical path is protected with mtime check, it should also hold a lock to avoid occasional race condition in multi-thread programs. This also clears system_wide_priority_strings_init upon unloading and before reloading the config file (thanks to Alexander Sosedkin). Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | | Merge branch 'wip/asosedki/gitlab-ci-speed-up-cppcheck' into 'master'Daiki Ueno2021-10-281-2/+6
|\ \ \ | |/ / |/| | | | | | | | .gitlab-ci.yml: add caching to cppcheck See merge request gnutls/gnutls!1480
| * | .gitlab-ci.yml: add caching to cppcheckAlexander Sosedkin2021-10-271-2/+6
|/ / | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* | Merge branch 'wip/asosedki/hash-filters-prf' into 'master'Daiki Ueno2021-10-214-14/+122
|\ \ | |/ |/| | | | | make insecure-hash filter out ciphersuites on ->prf as well See merge request gnutls/gnutls!1479
| * NEWS: add a notice of insecure-hash filtering ciphersuites on PRFAlexander Sosedkin2021-10-211-0/+3
| | | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
| * tests: add system-override-hash-influences-prfAlexander Sosedkin2021-10-212-1/+90
| | | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
| * priority: filter out ciphersuites with prf blocked by insecure-hashAlexander Sosedkin2021-10-211-0/+13
| | | | | | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
| * priority: refactor ciphersuite filteringAlexander Sosedkin2021-10-211-13/+16
|/ | | | Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
* Merge branch 'ktls' into 'master'Daiki Ueno2021-10-2012-25/+812
|\ | | | | | | | | ktls: basic implementation of SW mode See merge request gnutls/gnutls!1451
| * ktls: basic implementation of SW modeHedgehog50402021-10-1912-25/+812
|/ | | | | | | | | | | | | | | | | ktls enables us to offload encryption/decryption to the kernel prerequisites: - configured with `--enable-ktls` - tls module `modprobe tls` check with 'lsmod | grep tls' - per connection: gnutls_transport_set_int{2} must be set When prerequisities are met then ktls is used by default. If GnuTLS encounters a error during KTLS initialization, it will not use ktls and fallback to userspace. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* Merge branch 'wip/dueno/abi-dump' into 'master'František Krenželok2021-10-1910-64734/+11
|\ | | | | | | | | devel: move .abi files into a separate repository See merge request gnutls/gnutls!1478
| * devel: make use of abidw --drop-private-typesDaiki Ueno2021-10-182-1/+1
| | | | | | | | | | | | This will produce more compact abixml output. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * devel: move .abi files into a separate repositoryDaiki Ueno2021-10-1810-64733/+10
|/ | | | | | | | Changes to the .abi files are a bit too noisy to track in the main repository. This moves the files out of this repository and embed it as a git submodule. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'mingw64-detection' into 'master'Daiki Ueno2021-09-241-1/+1
|\ | | | | | | | | fix mingw64 detection See merge request gnutls/gnutls!1476
| * fix mingw64 detectionSteve Lhomme2021-09-231-1/+1
|/ | | | | | | | | | | | | | __MINGW64__ is only defined for 64 bits builds of mingw64 [1]. The intended test what to only use the CertEnumCRLsInStoreFunc via LoadLibrary for some ancient mingw32 build and never for mingw64. __MINGW64_VERSION_MAJOR is a proper define to identify mingw64 against mingw32. [1] https://sourceforge.net/p/predef/wiki/Compilers/ Co-authored-by: Johannes Kauffmann <johanneskauffmann@hotmail.com> Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
* Merge branch 'x25519-and-x448' into 'master'Daiki Ueno2021-09-2321-9/+485
|\ | | | | | | | | certtool: generate, parse, and manipulate X25519 and X448 pubkeys, privkeys, and certificates See merge request gnutls/gnutls!1428
| * lib/x509: Avoid memcpy when string is emptyDaniel Kahn Gillmor2021-09-171-1/+2
| | | | | | | | | | | | | | | | This fixes an ASAN warning in fuzz/gnutls_private_key_parser_fuzzer when run against the malformed private key fuzz/gnutls_private_key_parser_fuzzer.in/10a5c92fa30ddb6cbb4286d7699b2b7a7e032b17 Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * NEWS: added news about certtool handling x448 and x25519Daniel Kahn Gillmor2021-09-171-0/+3
| | | | | | | | Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * tests: add test for generating x25519 and x448 certificatesDaniel Kahn Gillmor2021-09-172-1/+102
| | | | | | | | | | | | | | | | | | | | These certs should work just fine for the purposes of cryptographic e-mail (S/MIME). These usage flags are also used in the end-entity certificates found in https://datatracker.ietf.org/doc/draft-ietf-lamps-samples/ Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * tests: update details about sample X25519 certificateDaniel Kahn Gillmor2021-09-171-0/+10
| | | | | | | | Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * certtool: add x448 and x25519 for --key-typeDaniel Kahn Gillmor2021-09-172-1/+5
| | | | | | | | | | | | This is a simple extension of the certtool command-line interface. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * certtool: when making X25519 or X448 certs, always use "key agreement"Daniel Kahn Gillmor2021-09-171-0/+4
| | | | | | | | | | | | | | This is related to #1227 -- but in this case, it's enforcing a requirement of RFC 8410 §5. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * x509: handle X25519 and X448 in read_pubkeyDaniel Kahn Gillmor2021-09-171-0/+20
| | | | | | | | | | | | | | | | | | _gnutls_x509_read_ecdh_pubkey is basically a clone of _gnutls_x509_read_eddsa_pubkey. Another form of implementation would be to collapse these two static functions into a common function for all "CFRG" curves. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| * nettle: handle X25519 and X448 in pk_fixupDaniel Kahn Gillmor2021-09-171-0/+24
| | | | | | | | Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
View Lorry Controller Status