summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* tests: removed unneeded ifdef in tlsext-decoding.ctmp-further-rng-improvementsNikos Mavrogiannopoulos2017-03-161-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: updated RNG designNikos Mavrogiannopoulos2017-03-161-25/+28
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle/rnd: introduced time limit for key generatorNikos Mavrogiannopoulos2017-03-161-9/+34
| | | | | | | | | That is, force re-key of the KEY and RANDOM PRNG after 2 hours of operation, irrespective of the amount of data having been output. At the same time, increase limits for key and nonce generators, to prevent a large amount of system calls in busy servers. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_pk_generate_keys: separate between ephemeral and long-term keysNikos Mavrogiannopoulos2017-03-166-17/+28
| | | | | | That allows using the faster generator for ephemeral keys. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle/pk: use the nonce level for digital signaturesNikos Mavrogiannopoulos2017-03-161-3/+3
| | | | | | | That is, we do not really require high quality secret data for the generation of signatures. A better approach would be to switch to predictable signatures (RFC6979). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: limit submodule update to avoid fetchtmp-limit-submodule-fetchNikos Mavrogiannopoulos2017-03-161-6/+6
| | | | | | This should reduce both the bandwidth and the time of the fetch. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Fix a typo in a variable name in an m4 scriptMartin Storsjo2017-03-151-1/+1
| | | | Signed-off-by: Martin Storsjo <martin@martin.st>
* build: disable valgrind tests by defaultAlon Bar-Lev2017-03-154-25/+31
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* .gitlab-ci.yml: ubsan build utilizes -Werror for the librarytmp-fix-werror-compilationNikos Mavrogiannopoulos2017-03-151-1/+4
| | | | | | | That brings back the -Werror for building, after its removal from clang-analyzer build. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: remove -Werror compilation from scan-buildNikos Mavrogiannopoulos2017-03-151-2/+2
| | | | | | | | | | When we pass '--status-bugs' to the command in combination with '-Werror' in CFLAGS it has the following side effects. In a failed due to Werror build, scan-build fails to find any issues, and marks the run as successfully completed. Hence, removes the -Werror from clang-analyzer. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* build: tests: resolve as-needed issue with seccompAlon Bar-Lev2017-03-141-4/+6
| | | | | | | | | | | Incorrect ordering of -lseccomp: <snip> -Wl,--as-needed ../lib/.libs/libgnutls.so -lseccomp ./.libs/libutils.a ./.libs/libutils.a(seccomp.o): In function seccomp_init' seccomp.c:(.text+0x2b): undefined reference to `seccomp_init' <snip> Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* fuzz: Corrected default options in fuzz scripts [ci skip]Nikos Mavrogiannopoulos2017-03-133-3/+4
| | | | | | | This change assumes that afl-fuzz (and not libfuzzer) will be used by default. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_pkcs11_privkey_init: document limitation on created object [ci skip]Nikos Mavrogiannopoulos2017-03-132-3/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: re-open privkey session handle on CKR_SESSION_HANDLE_INVALIDtmp-pkcs11-more-unit-testsNikos Mavrogiannopoulos2017-03-131-3/+11
| | | | | | | When initializing a private key operation, attempt to re-open the key if CKR_SESSION_HANDLE_INVALID is received. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: pkcs11-mock lib: check object session sanity prior to using itNikos Mavrogiannopoulos2017-03-131-34/+33
| | | | | | | This avoids crashes when the object is used after a fork but prior to the session being re-established. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added an OCSP response parsing coverage testNikos Mavrogiannopoulos2017-03-13328-2/+124
| | | | | | | | This inputs a large set of valid and invalid OCSP files in the OCSP parser with the intention to stress test its error checking, and prevent regressions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added a certificate parsing coverage testNikos Mavrogiannopoulos2017-03-13486-1/+124
| | | | | | | | This inputs a large set of valid and invalid certificates in the certificate parser with the intention to stress test its error checking, and prevent regressions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitignore: more files to ignoreNikos Mavrogiannopoulos2017-03-131-58/+74
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit tests for gnutls_pkcs11_token_get_mechanismNikos Mavrogiannopoulos2017-03-132-1/+113
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: included unit test for gnutls_pkcs11_obj_exportNikos Mavrogiannopoulos2017-03-131-1/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for gnutls_pkcs11_reinit()Nikos Mavrogiannopoulos2017-03-132-1/+173
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit tests for gnutls_pkcs11_obj_get_infoNikos Mavrogiannopoulos2017-03-132-1/+243
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-131-12/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs11_obj_get_info: don't include the terminator into output sizeNikos Mavrogiannopoulos2017-03-131-1/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: cert-tests: openpgp-certs: align test redirectionAlon Bar-Lev2017-03-131-1/+1
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* tests: suppressions.valgrind: supress fillin_rpathAlon Bar-Lev2017-03-136-0/+48
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* tests: remove unused suppressions.valgrindAlon Bar-Lev2017-03-131-16/+0
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* lib: unconditionally enable the self-check functionstmp-pkcs11-avoid-locksNikos Mavrogiannopoulos2017-03-138-46/+3
| | | | | | | | These functions were previously made available only in FIPS140-2 mode. Enabling them unconditionally allows applications to directly utilize that functionality for testing the gnutls library. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added unit test for gnutls_pkcs11_get_pin_functionNikos Mavrogiannopoulos2017-03-132-1/+60
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: moved ocsp-tests to main directoryNikos Mavrogiannopoulos2017-03-136-107/+71
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: re-open private key session inside a locked sectionNikos Mavrogiannopoulos2017-03-133-34/+67
| | | | | | | This prevents clashes when the same operation is carried in other threads. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: introduced locks to PKCS#11 private key structureNikos Mavrogiannopoulos2017-03-131-0/+24
| | | | | | | This allows to run PKCS#11 private key operations such as signing and decryption in parallel. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: introduced check for parallel operation (signatures) in PKCS#11 modeNikos Mavrogiannopoulos2017-03-132-1/+199
| | | | | | | That is, verify that parallel signatures using a single gnutls_pkcs11_privkey_t context work. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: scripts: suppress which errorsAlon Bar-Lev2017-03-121-2/+2
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* pkcs11: during scan, leave the provider loop asapNikos Mavrogiannopoulos2017-03-121-15/+15
| | | | | | | This optimizes access when multiple provider modules are available, by avoiding scanning irrelevant ones. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Do not attempt to parse a 32-bit integer if a packet is not 4 bytes.Alex Gaynor2017-03-113-2/+2
| | | | | | | This addresses: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=824 Signed-off-by: Alex Gaynor <alex.gaynor@gmail.com>
* fuzz: document how to run AFL [ci skip]Nikos Mavrogiannopoulos2017-03-091-0/+17
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: added initial corpus for the OCSP request parserNikos Mavrogiannopoulos2017-03-091-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: added initial corpus for OCSP response parserNikos Mavrogiannopoulos2017-03-094-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: added OCSP structure parsersNikos Mavrogiannopoulos2017-03-093-2/+104
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: increased minimized set of X.509 certificatesNikos Mavrogiannopoulos2017-03-097-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* PKCS8/PKCS12: enforce a maximum number of iterationsNikos Mavrogiannopoulos2017-03-093-3/+7
| | | | | | | | This prevents denial of service through very large iteration counts. Issue found via oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Do not attempt to parse a 32-bit integer if a packet is not 4 bytes.Alex Gaynor2017-03-093-2/+2
| | | | | | | This addresses: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=737 Signed-off-by: Alex Gaynor <alex.gaynor@gmail.com>
* Revert ".gitlab-ci.yml: include coverage statistics of FIPS140-2 code"Nikos Mavrogiannopoulos2017-03-091-2/+1
| | | | | | | This reverts commit 603772688c4e37dae437b4cede12e25b9dd9f678. The commit introduced a long wait for the coverage build without and significant benefit (the extend of the FIPS140 code is limited to have any impact on the overall coverage).
* sysrng-linux: define _rnd_get_system_entropy unconditionallyNikos Mavrogiannopoulos2017-03-091-1/+2
| | | | | | This fixes compilation in systems without getrandom(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: dtls-stress: use X.509 certificates instead of openpgptmp-openpgp-compatNikos Mavrogiannopoulos2017-03-082-59/+9
| | | | | | | This will allow the test tool to operate even after openpgp certificates are deprecated. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: added build without openpgp supportNikos Mavrogiannopoulos2017-03-081-2/+25
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-03-081-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added openpgp stub fileNikos Mavrogiannopoulos2017-03-082-1/+703
| | | | | | | That allows disabling openpgp authentication and at the same time retaining ABI compatibility with versions including openpgp. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updatetmp-improve-test-suiteNikos Mavrogiannopoulos2017-03-081-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status