summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* doc: add note about CRL numbers to man pageMartin Sucha2018-05-191-0/+7
| | | | Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* certtool: ask again until serial/crl number is validMartin Sucha2018-05-191-24/+36
| | | | Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* tests: remove check for broken datefudgeMartin Sucha2018-05-191-5/+1
| | | | | | | | This check is not necessary with Fedora 28 build image currently used for CI as it contains datefudge 1.22 as well. Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* certtool: remove extra functionMartin Sucha2018-05-191-21/+3
| | | | | | I did not notice strip_nl previously. Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* tests: add negative tests for certtool crl numbersMartin Sucha2018-05-191-0/+63
| | | | Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* doc: add NEWS about serial and CRL numbersMartin Sucha2018-05-191-0/+8
| | | | Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* doc: add hex format to example templateMartin Sucha2018-05-191-1/+3
| | | | Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* certtool: use larger serial and CRL numbersMartin Sucha2018-05-198-65/+465
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Serial/CRL numbers can be up to 20 octets in length as per RFC 5280, so it should be possible to use such numbers as input to certtool. certtool only allowed to specify 63-bit numbers in template file or interactively (even though it generated larger numbers in batch mode by default). This patch allows large numbers to be specified as a hexadecimal string. Parsing of decimal numbers larger than native integers would require adding dependency on libgmp directly to certtool or extending the API exposed by GnuTLS library with parsing functions. Since most tools (including GnuTLS) display serial numbers in hexadecimal, it is not worth the trouble to support large decimal numbers. Default values are unified between batch mode and interactive input and their size is extended. CA/Browser forum recommends CAs to include at least 64 bits of random data in the certificate serial numbers in Baseline Requirements[1] section 7.1, but gnutls adds only 32 bits. Some other implementations generate default serial numbers with more entropy as well, here is the current state as of May 2018: +----------------+-------------------------------+ | Implementation | Random bits in default serial | +----------------+-------------------------------+ | OpenSSL [2] | 159 | | CFSSL [3] | 159 | | wolfSSL [4] | 128 | | GnuTLS | 32 | | Mbed TLS [5] | 0 (defaults to 1) | +----------------+-------------------------------+ The 20 octet field size can fit numbers up to 159 bits since the most significant bit must be zero as numbers in DER encoding are in two's complement and the serial and CRL numbers must be positive. Default serial numbers are extended to full 159 bits allowed by the field size and are completely random, which matches other implementations. CRL numbers have the same size requirements, but also need to be monotonic (RFC 5280, section 5.2.3). That's why timestamp is used in them. The timestamp portion is extended from 31 bits to 39 bits as 31 bits will overflow in year 2038. The rest of the available space up to 159 bits allowed in the 20 octet limit is filled with random bits. Since the new CRL numbers are larger, the requirement for them to be monotonically increasing is preserved when upgrading to a newer version. This does not hold the other way around though, so after using a newer version of certtool to generate a CRL with default number and publishing it, it's not possible to use older version anymore to generate subsequent CRLs. Unfortunately, there is no easy workaround for users of older certtool, since it is not possible to specify CRL numbers greater than 63 bits manually prior to this change. Users intending to downgrade to older version later are advised to specify the CRL numbers in new version of certtool manually with values they are smaller than what would get generated by default in the old version. grep does not recognize CRLF line endings generated in tests using MinGW, so we need to convert those to LF endings for $ in the regex to match test output correctly. datefudge 1.21 that is present in Fedora 26 image trims the timestamp to 32 bits. That bug was fixed in datefudge 1.22 available in the Debian image, so we check if datefudge behaves correctly and skip the test that uses more than 32 bits if datefudge is broken. [1] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.4.2.pdf [2] https://github.com/openssl/openssl/blob/6ebb49f3f9c9333611192561979bb799fa1eb76d/apps/apps.c#L1513 [3] https://github.com/cloudflare/cfssl/blob/5d63dbd981b5c408effbb58c442d54761ff94fbd/signer/local/local.go#L295 [4] https://github.com/wolfSSL/wolfssl/blob/d60b16c5b8c19cc61db4a5c3f5e085a7a158cd28/wolfcrypt/src/asn.c#L9791 [5] https://github.com/ARMmbed/mbedtls/blob/84a1107818aaddfd2abe4c5a3478cf84ab2e26b4/programs/x509/cert_write.c#L81 Signed-off-by: Martin Sucha <anty.sk+git@gmail.com>
* Merge branch 'tmp-prohibit-tls-dtls-mix' into 'master'Nikos Mavrogiannopoulos2018-05-1829-65/+746
|\ | | | | | | | | | | | | Added the notion of TLS-only and DTLS-only extensions Closes #440 See merge request gnutls/gnutls!634
| * handshake: do not send TLS extensions under DTLS and vice versatmp-prohibit-tls-dtls-mixNikos Mavrogiannopoulos2018-05-1725-57/+401
| | | | | | | | | | | | | | | | | | | | That is, introduce the notion of TLS-only and DTLS-only extensions, providing a framework to prevent sending extensions which are registered for example for TLS 1.3, under DTLS and vice versa. Resolves #440 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * gnutls_ext_raw_parse: introduced GNUTLS_EXT_RAW_FLAG_DTLS_CLIENT_HELLONikos Mavrogiannopoulos2018-05-176-8/+345
|/ | | | | | This allows parsing extensions from a DTLS client hello. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: fix serv location in testcompat-main-opensslNikos Mavrogiannopoulos2018-05-161-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests/suite: add missing file to distAndreas Metzler2018-05-151-1/+2
| | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* Allow running of test against installed gnutls-servAndreas Metzler2018-05-151-1/+2
| | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* gnutls_certificate_set_retrieve_function3: updated documentationtmp-pkcs11-pcertNikos Mavrogiannopoulos2018-05-122-15/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2018-05-123-0/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pcert: added functionality to retrieve listsNikos Mavrogiannopoulos2018-05-1212-32/+695
| | | | | | | | | That introduces gnutls_pcert_list_import_x509_file() and gnutls_x509_crt_list_import_url(). Resolves #373 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: sanity-cpp: fixes for win32Nikos Mavrogiannopoulos2018-05-121-2/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: bumped version of cache due to addition of CXXFLAGSNikos Mavrogiannopoulos2018-05-121-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: fix failures in cxx exampleNikos Mavrogiannopoulos2018-05-121-2/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* cxx: bring few modern functions, and allow to get the raw sessionNikos Mavrogiannopoulos2018-05-122-0/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'master' into 'master'Nikos Mavrogiannopoulos2018-05-126-44/+306
|\ | | | | | | | | | | | | New C++ interfaces for passing flags while construction Closes #438 See merge request gnutls/gnutls!637
| * New constructors for classes client_session() and server_session() provide ↵Philippe Widmer2018-05-106-44/+306
|/ | | | | | passing flags. Closes #438. Signed-off-by: Philippe Widmer <pw@earthwave.ch>
* tests: mini-record-timing: updated to work under newer gnutls [ci skip]Nikos Mavrogiannopoulos2018-05-101-13/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: key_update: improved error checking and increased timeouttmp-move-ci-to-f28Nikos Mavrogiannopoulos2018-05-101-4/+10
| | | | | | That is to avoid reaching the maximum number of key updates per second. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: moved fedora CI builds to F28Nikos Mavrogiannopoulos2018-05-091-3/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: testcompat-openssl: disable DSS ciphersuites under SSL3.0Nikos Mavrogiannopoulos2018-05-091-59/+64
| | | | | | | | Previously if openssl wouldn't support DSS, we would only disable DSS under TLS1.0 or later, not under SSL 3.0. This fixes interoperability with Fedora28 openssl. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Makefile.am: optimized the abi-check configure stepNikos Mavrogiannopoulos2018-05-092-4/+7
| | | | | | | Also ensured that the same build flags are applied in both builds for ABI checking. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* several updates to address issues found by clang static analyzerNikos Mavrogiannopoulos2018-05-096-10/+16
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* nettle: fix casts which result to warnings in newer gccNikos Mavrogiannopoulos2018-05-091-4/+14
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: updated for GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER from handshakeNikos Mavrogiannopoulos2018-05-071-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* handshake: use GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER consistentlyNikos Mavrogiannopoulos2018-05-073-3/+4
| | | | | | | | | Also treat GNUTLS_E_ILLEGAL_PARAMETER as a synonym if returned during a connection. Relates #442 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* CONTRIBUTING.md: documented status of C++ library [ci skip]Nikos Mavrogiannopoulos2018-05-071-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: cookie: fixed exit condition [ci skip]Nikos Mavrogiannopoulos2018-05-071-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-05-071-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: fixes in win32 buildsNikos Mavrogiannopoulos2018-05-071-3/+3
| | | | | | Relates #439 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: honor --ask-pass when loading a private keyNikos Mavrogiannopoulos2018-05-075-15/+50
| | | | | | | | | This also improves the password prompt when the password requested is not for a smart card. Resolves: #436 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: Disable full test suite for cross buildsMichael Weiser2018-05-071-1/+1
| | | | | | Disable the full test suite for cross CI builds to speed them up. Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* .gitlab-ci.yml: Expire all build log artifactsMichael Weiser2018-05-071-0/+4
| | | | Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* Use configured CC for pkg-config testMichael Weiser2018-05-072-2/+4
| | | | | | | Using the configured compiler aids in running the test suite under qemu or in a multlib scenario. Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* Add Debian-based qemu cross CI targetsMichael Weiser2018-05-071-2/+44
| | | | Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* updated-auto-generated filesNikos Mavrogiannopoulos2018-05-052-344/+376
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* fuzzer: added fresh TLS1.3 server traceNikos Mavrogiannopoulos2018-05-051-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-serv: all skipping DTLS cookie requestNikos Mavrogiannopoulos2018-05-052-33/+44
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: corrected data written by server traceNikos Mavrogiannopoulos2018-05-051-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: post handshake auth: test more combinationsNikos Mavrogiannopoulos2018-05-041-17/+42
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* post_handshake_auth: send extension irrespective of certificates being presentNikos Mavrogiannopoulos2018-05-041-1/+1
| | | | | | | | The feature does not necessarily require certificates to be present and an empty cert can be presented. Furthermore, the certificates can be set later on the credentials structure. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-openssl-suite' into 'master'Nikos Mavrogiannopoulos2018-05-0431-198/+1040
|\ | | | | | | | | | | | | Added testsuite for TLS1.3 interoperability with openssl Closes #228 and #427 See merge request gnutls/gnutls!621
| * updated auto-generated filesNikos Mavrogiannopoulos2018-05-042-72/+136
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * tests: added interop tests with openssl under TLS1.3Nikos Mavrogiannopoulos2018-05-0412-7/+677
| | | | | | | | | | | | | | | | | | | | | | | | | | This adds interoperability tests for: * PSK with elliptic curve DHE * RSA,RSA-PSS,secp256r1,ed25519 server certificate * RSA,RSA-PSS,secp256r1,ed25519 client certificate * X25519,SECP256R1 key share exchange * key share with HRR Relates #328 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status