summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* doc updatetmp-gnutls_3_5_x-dtls-fixNikos Mavrogiannopoulos2018-01-161-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether get_mtu() functions relate to the set valuesNikos Mavrogiannopoulos2018-01-161-0/+25
| | | | | | | | That is, verify that gnutls_dtls_set_data_mtu() value would be reflected into gnutls_dtls_get_data_mtu(), as well as the gnutls_dtls_set_mtu() to gnutls_dtls_get_mtu(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* DTLS: improved data MTU calculation under CBC ciphersuitesNikos Mavrogiannopoulos2018-01-161-31/+34
| | | | | | | | | | | | | | | | | | | The data MTU calculation under CBC ciphersuites takes into account that the overhead of these ciphersuites is constant (IV + hash + 1 byte padding), though the capacity varies due to the padding block. That is, on 16-byte padding block, one padding byte is the overhead but the rest 15 bytes are accounted for data MTU. That also has the side effect that setting a data MTU using gnutls_dtls_set_data_mtu(), is not definite, and the actual MTU may be larger for these ciphersuites --i.e., the return value of gnutls_dtls_get_data_mtu(). (backported from master branch) Resolves #360 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* libtasn1: updated to latest master branchtmp-gnutls_3_5_x-update-libtasn1Nikos Mavrogiannopoulos2018-01-093-8/+32
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updatetmp-gnutls_3_5_x-fix-verification-issuesNikos Mavrogiannopoulos2018-01-071-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: updated copyright year for manualNikos Mavrogiannopoulos2018-01-071-2/+2
| | | | | | That eliminates the 'make syntax-check' error. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for self-signed verification errorNikos Mavrogiannopoulos2018-01-072-0/+146
| | | | | | Relates #347 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* x509/verify: when verifying against a self signed certificate ignore issuerNikos Mavrogiannopoulos2018-01-071-5/+7
| | | | | | | | | | That is, ignore issuer when checking the issuer's parameters strength. That resolves the issue of marking self-signed certificates as with insecure parameters during verification. Resolves #347 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-12-191-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* sysrng-linux: improved detection of getrandom()Nikos Mavrogiannopoulos2017-12-192-4/+4
| | | | | | The getrandom() call is defined in sys/random.h. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updatetmp-gnutls_3_5_x-pkcs11-loading-fixNikos Mavrogiannopoulos2017-11-061-0/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: refuse to load modules with duplicate informationNikos Mavrogiannopoulos2017-11-061-1/+2
| | | | | | | | That is, when ck_info matches, we soft fail loading the module. That is, because in several cases the pointers got by p11-kit may differ for the same modules. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: allow loading trusted modules when pkcs11 was initialized in manual modeNikos Mavrogiannopoulos2017-11-043-28/+26
| | | | | | | | | | | | | When a PKCS#11 trust module is used in the system, but gnutls_pkcs11_init() is explicitly called with GNUTLS_PKCS11_FLAG_MANUAL flag, then the PKCS#11 trust store was not loaded, and thus prevent any certificate validation. This change allows initializing the trust modules only even if generic PKCS#11 support is disabled by the application. Relates #316 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: introduce multiple levels of loadingNikos Mavrogiannopoulos2017-11-044-15/+50
| | | | | | | | | That allows to load the PKCS#11 trusted modules (on systems which use them) without loading all the potentially present PKCS#11 modules. Relates #315 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* released 3.5.16gnutls_3_5_16Nikos Mavrogiannopoulos2017-10-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc update [ci skip]Nikos Mavrogiannopoulos2017-10-162-8/+16
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: avoid usage of function introduced in 3.6.0Nikos Mavrogiannopoulos2017-10-151-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-10-151-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* bumped versionNikos Mavrogiannopoulos2017-10-152-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cmp_hsk_types: fixed check for SSLv2 helloNikos Mavrogiannopoulos2017-10-151-4/+4
| | | | | | | Previously, if SSLv2 hello support was disabled, the check for the expected TLS message was incorrect. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-10-021-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: check fingerprint generation with SHA512Nikos Mavrogiannopoulos2017-10-021-0/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: allow using --fingerprint with sha384 or sha512Nikos Mavrogiannopoulos2017-10-021-6/+8
| | | | | | Resolves #295 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-09-241-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* signature: on client side, only select a non-enabled signature if none matchNikos Mavrogiannopoulos2017-09-241-1/+11
| | | | | | | | | | | | That amends commit 6aa8c390b08a25b18c0799fbd42bd0eec703fae4: "On client side allow signing with the signature algorithm of our cert That allows to sign for example with DSA-SHA1 as client even if we do not allow DSA-SHA1 as signature algorithm for server's certificate. This allows to use a deprecated certificate without enabling deprecated algorithms globally." Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-09-241-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: enhanced resumption checks with same and different SNItmp-gnutls_3_5_x-sni-fixesNikos Mavrogiannopoulos2017-09-241-1/+35
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* server name: refuse to resume a session which server name doesn't matchNikos Mavrogiannopoulos2017-09-243-0/+52
| | | | | | | | That is, follow the RFC6066 requirement that server: "MUST NOT accept the request to resume the session if the server_name extension contains a different name." Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Ensure the SNI extension is parsed during cache-based resumptionThomas Klute2017-09-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes the parse_type of the SNI extension to GNUTLS_EXT_MANDATORY to ensure it is parsed during every handshake. With SNI previously classified as GNUTLS_EXT_APPLICATION, GnuTLS servers ignored the SNI extension when resuming a TLS session from cache, because "application" level extensions are skipped during resumption. As a result, gnutls_server_name_get() always returned GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE when called on the resumed session, breaking virtual server systems. According to RFC 6066, Section 3 the SNI extension must be parsed on session resumption if implemented at all: "A server that implements this extension MUST NOT accept the request to resume the session if the server_name extension contains a different name." This change allows applications using GnuTLS to match SNI data on resumed sessions. Signed-off-by: Thomas Klute <thomas2.klute@uni-dortmund.de>
* doc updategnutls_3_5_x_1_byte_fixNikos Mavrogiannopoulos2017-09-191-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for DTLS infinite loopNikos Mavrogiannopoulos2017-09-193-2/+616
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* priority_options.gperf: modified for gperf 3.1Nikos Mavrogiannopoulos2017-09-192-2/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ecdh: return more appropriate error code on empty packetNikos Mavrogiannopoulos2017-09-191-0/+5
| | | | | | | | This makes tlsfuzzer's test-x25519 detect the right error code on empty message. Previously this issue was masked by our refusal to accept 1-byte sized fragments. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* parse_handshake_header: allow 1-byte sized fragmentsNikos Mavrogiannopoulos2017-09-191-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]tmp-gnutls_3_5_x-openssl-renegoNikos Mavrogiannopoulos2017-09-071-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for safe renegotiation failure with opensslNikos Mavrogiannopoulos2017-09-061-1/+12
| | | | | | Relates #259 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: check SCSVs prior to resuming a sessionNikos Mavrogiannopoulos2017-09-063-6/+21
| | | | | | | | | | | This ensures that extensions which are also available as SCSVs are parsed prior to resuming a session. This resolves an issue with openssl sending SCSV instead of an extension for the safe renegotiation. Resolves #259 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cli-debug-args.def: Fix typoAvinash Sonawane2017-09-061-1/+1
| | | | Signed-off-by: Avinash Sonawane <rootkea@gmail.com>
* doc updateNikos Mavrogiannopoulos2017-08-281-0/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether generated private keys are marked privateNikos Mavrogiannopoulos2017-08-281-0/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added unit test of p11tool with --set-pinNikos Mavrogiannopoulos2017-08-281-0/+20
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: check whether generated or copied keys are marked as sensitiveNikos Mavrogiannopoulos2017-08-281-0/+15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* p11tool: allow obtaining PIN from command line on operationsNikos Mavrogiannopoulos2017-08-282-4/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* p11tool: explicitly mark generated keys as sensitiveNikos Mavrogiannopoulos2017-08-251-1/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updategnutls_3_5_15Nikos Mavrogiannopoulos2017-08-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* bumped versionNikos Mavrogiannopoulos2017-08-203-2/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-08-191-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* configure: disable hardware acceleration on aarch64/ilp32 modeNikos Mavrogiannopoulos2017-08-191-0/+6
| | | | | | | | | Our included assembly code for aarch64 is not suitable for that data mode. Resolves #252 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* _gnutls_recv_server_certificate_status: use the same type in subtracted valuesNikos Mavrogiannopoulos2017-08-151-2/+2
| | | | | | | | | | This ensures that there are no issues with subtracting those values. Note that the second is read from an uint24_t and thus it is always positive regardless its type. Relates #245 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_proc_srp_client_kx: use same type in subtracted valuesNikos Mavrogiannopoulos2017-08-151-1/+1
| | | | | | | | | | This ensures that there are no issues with subtracting those values. Note that the second is read from an uint16_t and thus it is always positive regardless its type. Relates #244 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status