summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* opencdk/read-packet.c: corrected typo in type castNikos Mavrogiannopoulos2017-02-201-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cdk_pkt_read: enforce packet limitsNikos Mavrogiannopoulos2017-02-201-0/+9
| | | | | | | | | | | | That ensures that there are no overflows in the subsequent calculations. Resolves the oss-fuzz found bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 Relates: #159 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added test case with invalid openpgp certNikos Mavrogiannopoulos2017-02-203-2/+4
| | | | | | | That triggers a heap buffer overflow: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Add LMTP, POP3, NNTP, Sieve and PostgreSQL support to gnutls-cliRobert Scheck2017-02-1910-3/+107
| | | | | | Add LMTP (RFC 2033), POP3 (RFC 2595), NNTP (RFC 4642), Sieve (RFC 5804) and PostgreSQL support to gnutls-cli ("--starttls-proto"). Signed-off-by: Robert Scheck <robert@fedoraproject.org>
* README.md: added CII best practices badge [ci skip]Nikos Mavrogiannopoulos2017-02-191-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: Improve port-checking infrastructure.tmp-work-without-netstatRical Jasan2017-02-191-6/+47
| | | | | | | | | | | | | | | | | | | | | | | The test suite unnecessarily failed on systems without netstat because it was assumed to be present. Instead of simply checking for its presence and indicating an unsupported test, however, the ss utility can be used as a drop-in replacement. When netstat/net-tools is not present, the ss utility from iproute2 still stands a fair chance of existing, and they also have similar enough semantics that they can be used interchangeably in the test suite. The functions in tests/scripts/common.sh that used netstat (wait_for_port, wait_for_free_port) now use new functions, check_if_port_in_use and check_if_port_listening, to abstract the call to netstat/ss. The eval'd variable GETPORT also used netstat, and has been updated accordingly. The new port-checking functions use another new function, have_port_finder, which takes care of the details of selecting ss (preferred) or netstat, or fails otherwise. Signed-off-by: Rical Jasan <ricaljasan@pacific.net> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* build: doc: install images also into htmldirAlon Bar-Lev2017-02-181-8/+11
| | | | | | images are required also by the html documentation. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* .gitlab-ci.yml: corrected coverage buildtmp-cert-fractional-secondsNikos Mavrogiannopoulos2017-02-181-3/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: remove submodule update from main buildNikos Mavrogiannopoulos2017-02-181-2/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2017-02-182-1/+3
|
* Makefile: improved symbols extractionNikos Mavrogiannopoulos2017-02-181-1/+1
| | | | | | That is, do not include non-function names. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-171-1/+7
|
* tests: ignore sanity checks in broken cert testNikos Mavrogiannopoulos2017-02-171-0/+2
| | | | | | | This allows the existing reproducers which contain certificates which are rejected by sanity checks, to still be used to detect regressions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added gnutls_x509_crt_set_flags()Nikos Mavrogiannopoulos2017-02-176-0/+37
| | | | | | | | This functions allows specifying flags to the certificate object. In particular it allows the single flag GNUTLS_X509_CRT_FLAG_IGNORE_SANITY which allows to ignore sanity checks at the import of the certificate. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-171-0/+4
|
* Introduced GNUTLS_E_CERTIFICATE_TIME_ERROR error codeNikos Mavrogiannopoulos2017-02-173-1/+4
| | | | | | This error code indicates an issue in the time fields of certificate. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/output: properly indicate error in Time fieldsNikos Mavrogiannopoulos2017-02-171-2/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/time: refuse importing certificates with invalid Time fieldsNikos Mavrogiannopoulos2017-02-171-0/+8
| | | | | | | | | That will refuse to import certificates which their time field is not in GMT, or contain fractional seconds. Resolves: #169 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_generalTime2gtime: refuse to parse fractional secondsNikos Mavrogiannopoulos2017-02-171-2/+7
| | | | | | Fractional seconds in GeneralizedTime are prohibited by RFC5280. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhanced test suite to include invalid X509v3 certNikos Mavrogiannopoulos2017-02-173-1/+29
| | | | | | | That certificate contains a GeneralizedTime with fractional seconds. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_list_import: fixed leak on import failureNikos Mavrogiannopoulos2017-02-171-0/+1
|
* tests: enhanced test suite to include creation of invalid certificatesNikos Mavrogiannopoulos2017-02-172-1/+217
| | | | | | | That is, check whether the creation of invalid V2 or V1 certificates will be detected, and that the correct error codes are returned. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_sign2: refuse to sign invalid X.509 certificatesNikos Mavrogiannopoulos2017-02-173-16/+37
| | | | | | | That is, do not sign X.509 certificates which have fields that shouldn't be present on their corresponding version. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_import: reject X.509v1 certificates with invalid fieldsNikos Mavrogiannopoulos2017-02-171-17/+53
| | | | | | | | | | | Refuse to import X.509v1 certificates which have fields that didn't exist in X.509v1 specification. That is the issuerUniqueID and subjectUniqueID fields. Resolves: #168 Resolves: #167 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhanced test suite to include invalid V1 certsNikos Mavrogiannopoulos2017-02-174-2/+96
| | | | | | | That is, added X.509v1 certificates with attributes that shouldn't have been presented (valid for X.509v2 only). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls.pc: do not include libidn2 in Requires.privatetmp-stages-updatesNikos Mavrogiannopoulos2017-02-152-6/+8
| | | | | | | | The libidn2 versions available do not include libidn2.pc, thus the inclusion was causing problems when using pkg-config. Instead we include -lidn2 in Libs.private. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: Re-organized stagesNikos Mavrogiannopoulos2017-02-151-116/+161
| | | | | | | | The less CPU intensive tasks were moved to earlier stage, and the CPU intensive tasks are only spawned only after basic syntax and ABI checks have succeeded. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.h: corrected typo [ci skip]Nikos Mavrogiannopoulos2017-02-121-1/+1
|
* <alloca.h> only if HAVE_ALLOCA_HMarcin Cieślak2017-02-092-0/+4
| | | | | | FreeBSD does know alloca() but has no such header Signed-off-by: Marcin Cieślak <saper@SAPER.INFO>
* doc: document the intention of the priority string usage [ci skip]Nikos Mavrogiannopoulos2017-02-051-2/+17
| | | | | | | | This documents the gnutls_set_default_priority() function, and how it is intended to be combined with an application that utilizes priority strings. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-051-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: modified tests for the disablement of 3DESNikos Mavrogiannopoulos2017-02-052-10/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Removed support for the 3DES cipher by defaultNikos Mavrogiannopoulos2017-02-051-6/+0
| | | | | | | | | That is a legacy cipher that is no longer needed to be included as backup cipher. Resolves #120 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509: optimize subject alternative name accesstmp-san-parsing-optimizationNikos Mavrogiannopoulos2017-02-053-47/+96
| | | | | | | | | | That reads SAN and IAN early on import, significantly reducing the running time of functions which iterate over the alternative names of a certificate, e.g., gnutls_x509_crt_check_hostname(). Relates #165 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .travis.yml: list all logs on failuretmp-travis7-fixNikos Mavrogiannopoulos2017-02-041-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enable all IDNA tests when compiled with libidn2Nikos Mavrogiannopoulos2017-02-047-11/+26
| | | | | | Keep IDNA2003-only tests on the ifdef HAVE_LIBIDN. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .travis.yml: updated instructions for travis buildstmp-travis5-fixNikos Mavrogiannopoulos2017-02-041-4/+4
| | | | | | Removed unbound and other minor fixes. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* extras/hex.h: do not use strlen as variable nametmp-fix-pkcs11-import-url4Nikos Mavrogiannopoulos2017-02-031-2/+2
| | | | | | That is, do not utilize a standard C function name as variable name. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs11_obj_list_import_url4: always return an initialized pointerNikos Mavrogiannopoulos2017-02-031-0/+1
| | | | | | | | | When returning success, but no elements, gnutls_pkcs11_obj_list_import_url4, could have returned zero number of elements with a pointer that was uninitialized. Ensure that an initialized (i.e., null in that case), pointer is always returned. Reported by Jeremy Harris. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: use libidn2 on windows buildsNikos Mavrogiannopoulos2017-02-031-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_heartbeat_allowed: corrected type on dummy wrappertmp-tz-fixNikos Mavrogiannopoulos2017-02-021-1/+1
| | | | | | | | That is, when compiling without heartbeat support, compilation could fail due to the dummy wrapper not returning the right type. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Address test suite failure due to timezone differences.Nikos Mavrogiannopoulos2017-02-021-1/+1
| | | | | | Reported by Thorsten Glaser and Andreas Metzler. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2017-01-311-1/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_heartbeat_allowed: corrected return typeNikos Mavrogiannopoulos2017-01-312-2/+2
| | | | | | | This reflects better the fact that this function returns a boolean. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _idn2_to_unicode_8z8z: do not err on mixed IDNA domainsNikos Mavrogiannopoulos2017-01-281-4/+1
| | | | | | | | That is allow domains of the form 'großes.xn--fa-hia.de'. The drawback is that we may not err early on invalid formatted names. We however delegate any such decisions to libidn2. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* README.md: added link to travis build for 3.5.x [ci skip]Nikos Mavrogiannopoulos2017-01-271-1/+1
| | | | | | | In addition to adding a link to travis build for 3.5.x branch removed link on 3.4.x branch. It is no longer active. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* heartbeat extension: doc updatetmp-libidn2Nikos Mavrogiannopoulos2017-01-261-2/+3
| | | | | | Document how to calculate the total TLS data transmitted. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* str-idna: improved error handlingNikos Mavrogiannopoulos2017-01-261-2/+5
| | | | | | | In addition to detecting input with invalid characters in _idn2_to_unicode_8z8z(), we also add support for case insensitive punycode header. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Updated auto-generated filesNikos Mavrogiannopoulos2017-01-263-0/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* str-idna: cleanups in IDNA handlingNikos Mavrogiannopoulos2017-01-261-9/+14
| | | | | | | | Ensure safe operation even with broken libidn2, and make sure that we properly allocate memory to caller, even on complex library configuration. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status