summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Makefile.am: dropped .clcopying from dist filestmp-disable-openpgp-authenticationNikos Mavrogiannopoulos2017-03-291-1/+1
| | | | | | It was no longer being used. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Moved all openpgp-related variables and definitions into ifdef blocksNikos Mavrogiannopoulos2017-03-292-7/+9
| | | | | | This allows compilation with -Werror even if openpgp is disabled. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* OpenPGP authentication is disabled by defaultNikos Mavrogiannopoulos2017-03-293-10/+11
| | | | | | | | | The flag --enable-openpgp-authenticationcan be used to revert this change. Resolves #178 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Simplified the generation of ChangeLog [ci skip]Nikos Mavrogiannopoulos2017-03-293-12/+3
| | | | | | | Removed the dependency on git2cl and utilize git log directly. git2cl seems to provide incorrect output. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added global locks on tls-fuzzer testsNikos Mavrogiannopoulos2017-03-283-0/+13
| | | | | | | They both require access to the same port and thus cannot be run in parallel. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cert: ensure that there are no leftovers in certificate msgNikos Mavrogiannopoulos2017-03-281-1/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* testsuite: added tlsfuzzer certificate requiring testsNikos Mavrogiannopoulos2017-03-283-1/+113
| | | | | | | This enhances the testsuite by running all the tlsfuzzer fuzzer tests which require certificates from server. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* alert: return GNUTLS_A_BAD_CERTIFICATE on GNUTLS_E_PK_SIG_VERIFY_FAILEDNikos Mavrogiannopoulos2017-03-281-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: updated pkcs12 corpusNikos Mavrogiannopoulos2017-03-288-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: added PKCS#12 file parser fuzzerNikos Mavrogiannopoulos2017-03-275-35/+67
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-271-1/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ocsp-test: disable under windowsNikos Mavrogiannopoulos2017-03-261-2/+3
| | | | | | This test was failing because datefudge couldn't run under win32. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Revert "ocsp-test: disable under windows"Nikos Mavrogiannopoulos2017-03-261-5/+0
| | | | This reverts commit 90d5ad5a42759957866ba1d9c96f5dccfd3ea1cc.
* .travis.yml: no longer install pkg-configNikos Mavrogiannopoulos2017-03-261-1/+1
| | | | | | | Travis build seem to fail for some reason since pkg-config is already installed. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsp-test: disable under windowsNikos Mavrogiannopoulos2017-03-261-0/+5
| | | | | | This test was failing because datefudge couldn't run under win32. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: increase time of artifact expirationNikos Mavrogiannopoulos2017-03-251-1/+1
| | | | | | | This allows to re-run failed builds on the depending stages during that time. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.pc: Removed P11_KIT_LIBS from Libs.privateNikos Mavrogiannopoulos2017-03-251-1/+1
| | | | | | | It was already being included in Requires.private. Reported by Andreas Metzler. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.pc: don't include zlib twice in private libsNikos Mavrogiannopoulos2017-03-242-2/+5
|
* tests: create-chain.sh: do not explicitly set serialNikos Mavrogiannopoulos2017-03-231-4/+0
| | | | | | | We were previously exporting certificates with serial number being zero, which is not allowed by RFC5280. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-232-4/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added mini-x509-ipaddrNikos Mavrogiannopoulos2017-03-233-1/+367
| | | | | | | This is a unit test for GNUTLS_DT_IP_ADDRESS as used in gnutls_certificate_verify_peers(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Introduced GNUTLS_DT_IP_ADDRESSNikos Mavrogiannopoulos2017-03-232-7/+38
| | | | | | | This allows verifying an IP address using gnutls_certificate_verify_peers() or gnutls_x509_trust_list_verify_crt2(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-231-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether we fallback to CN unconditionallyNikos Mavrogiannopoulos2017-03-231-0/+6
| | | | | | | This is a unit test for: "gnutls_x509_crt_check_hostname2: do not fallback to CN unconditionally" Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_check_hostname2: do not fallback to CN unconditionallyNikos Mavrogiannopoulos2017-03-231-1/+12
| | | | | | | | | Do not fallback to checking the CN of a certificate for a hostname if supported names such as IP addresses were found in gnutls_x509_crt_check_hostname2(). This behavioral change is in order to satisfy the RFC6125 requirement of not falling back to CN in that case. Reported by Suphannee Sivakorn. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test of GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHESNikos Mavrogiannopoulos2017-03-231-0/+13
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Introduced verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHESNikos Mavrogiannopoulos2017-03-232-1/+10
| | | | | | | | | This flag when provided to the gnutls_x509_crt_check_hostname2() function (and its callers), will prevent IP matching of the subject alternative name. This can be utilized by applications which directly check for IP addresses using gnutls_x509_crt_check_ip(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2017-03-233-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for gnutls_x509_crt_check_ipNikos Mavrogiannopoulos2017-03-232-1/+214
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added gnutls_x509_crt_check_ip()Nikos Mavrogiannopoulos2017-03-233-3/+30
| | | | | | | | | | | | | This function allows to directly verify IP addresses on a certificate. That is a first step towards making gnutls_x509_crt_check_hostname2() not verify IP addresses. Based on discussion and suggestion by Suphannee Sivakorn. See https://lists.gnupg.org/pipermail/gnutls-devel/2017-March/008368.html Relates #185 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test of gnutls_pubkey_verify_data2 override flagsNikos Mavrogiannopoulos2017-03-212-1/+149
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: keygen -> privkey-keygenNikos Mavrogiannopoulos2017-03-212-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_check_key_cert_match: allow broken sigsNikos Mavrogiannopoulos2017-03-211-1/+1
| | | | | | | That ensures that when loading a certificate pair with SHA1, when SHA1 is disabled will not cause the server to fail to load. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitignore: more files to ignoreNikos Mavrogiannopoulos2017-03-211-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Use a common function to decide acceptable signaturesNikos Mavrogiannopoulos2017-03-213-7/+6
| | | | | | | | That is, ensure that results from all verification functions, including gnutls_pubkey_verify_data2(), will be consistent with SHA1 and other algorithms deprecation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* check_ocsp_response: utilize the same flags as in certificate verificationNikos Mavrogiannopoulos2017-03-211-5/+8
| | | | | | | That ensures that overrides like using broken algorithms are considered in OCSP validation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* extensions: print the name/type of any unexpected extensionNikos Mavrogiannopoulos2017-03-211-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added script to check pkg-config operationNikos Mavrogiannopoulos2017-03-212-1/+63
| | | | | | | That is, whether the generated gnutls.pc will function for compiling and linking. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.pc: don't pass the libtool vars to Libs.privateNikos Mavrogiannopoulos2017-03-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: improved tls-rehandshake testsNikos Mavrogiannopoulos2017-03-212-92/+8
| | | | | | | Used common definitions from cert-common.h for certificates, and improved error detection in tls-rehandshake-cert-2. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether a rehandshake without a cert worksNikos Mavrogiannopoulos2017-03-212-1/+313
| | | | | | | | | That is, check whether if on initial handshake the server requests a certificate, but on the following rehandshake he doesn't, whether the client behaves as expected. This tests: 1f685db853db6e48c77c6dbde0cdf716a7303baa Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: reset cert request state on handshake initNikos Mavrogiannopoulos2017-03-215-16/+14
| | | | | | | | That addresses a bug which on client side on case of an initial handshake with a client certificate, we continue to send this certificate even if on rehandshake we were not requested with on. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Revert "nettle/rnd: use gettime() instead of gnutls_time()"Nikos Mavrogiannopoulos2017-03-211-4/+4
| | | | | | This reverts commit c4842a21f65c7fc9a27932eb1792b1fc9e65f722. The time() syscall is also implemented as syscall() and is in fact performing better than gettime().
* README.md: corrected typo [ci skip]Nikos Mavrogiannopoulos2017-03-201-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* nettle/rnd: use gettime() instead of gnutls_time()Nikos Mavrogiannopoulos2017-03-201-4/+4
| | | | | | | | The gnulib gettime() maps to gettimeofday() or clock_gettime() which are both implemented as fast system calls - see vdso(7)- and as such are available without a switch to kernel mode. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: updated RNG documentation to reflect the previous changesNikos Mavrogiannopoulos2017-03-201-10/+11
|
* nettle/rnd: re-seed both key and nonce levels based on timeNikos Mavrogiannopoulos2017-03-201-12/+15
| | | | | | | The time(0) is quite cheap on modern operating systems, and thus we can rely on it to provide improved assurance in the output randomness. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle/pk: use nonce level for RSA paddingNikos Mavrogiannopoulos2017-03-201-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* README.md: corrected link for coverage in master [ci skip]Nikos Mavrogiannopoulos2017-03-181-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Avoid deprecation warnings when including gnutls/abstract.hMartin Storsjo2017-03-181-1/+1
| | | | | | | | | | | | | | | | | | | Since ac3de8f5, when all openpgp functionality was deprecated, a library user including gnutls/abstract.h gets warnings about deprecated declarations, like this: gnutls/openpgp.h:328:10: warning: ‘gnutls_openpgp_recv_key_func’ is deprecated [-Wdeprecated-declarations] gnutls_openpgp_recv_key_func func) _GNUTLS_GCC_ATTR_DEPRECATED; This warning is emitted since the gnutls_openpgp_set_recv_key_function prototype uses the deprecated typedef gnutls_openpgp_recv_key_func. By omitting the deprecation attribute from this individual typedef, we avoid the spurious warnings in calling code which just includes gnutls/abstract.h without actually using anything related to openpgp. Signed-off-by: Martin Storsjo <martin@martin.st>
View Lorry Controller Status