summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* nettle: use the nettle_get_secp API when availabletmp-new-nettle-abiNikos Mavrogiannopoulos2018-02-071-5/+15
| | | | | | Resolves #380 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle base64_encode_raw: use cast to avoid warningsNikos Mavrogiannopoulos2018-02-063-4/+4
| | | | | | | | | | | Nettle switched prototypes for base64_encode_raw() as follows: -base64_encode_raw(uint8_t *dst, size_t length, const uint8_t *src); +base64_encode_raw(char *dst, size_t length, const uint8_t *src); That means we need to cast fist param to void if we want to avoid warnings on different platforms. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* accelerated: x86-common: do not use _xgetbv() with clangNikos Mavrogiannopoulos2018-02-061-1/+1
| | | | | | Resolves #372 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* configure: treat solaris as ELF systemNikos Mavrogiannopoulos2018-02-061-0/+1
| | | | | | Resolves #376 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: repeat cipher test with multiple keys and noncestmp-aarch64-gcm-fixNikos Mavrogiannopoulos2018-02-061-61/+102
| | | | | | In addition include chacha20-poly1305 into the tests. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* accelerated: aarch64: fix GCM counter incrementNikos Mavrogiannopoulos2018-02-061-2/+3
| | | | | | Ensure that we restrict the GCM counter to the 4 bytes assigned to it. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* accelerated: fix use of SSSE3 vpaes_encryptNikos Mavrogiannopoulos2018-02-061-1/+7
| | | | | | | | | Previously we assumed that the nettle GCM internal functions will use the provided ECB function for single block encryption. Newer versions no longer operate that way. Ensure that we are compatible with them. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* accelerated: fix use of aesni_ecb_encrypt()tmp-aesni-gcm-fixNikos Mavrogiannopoulos2018-02-051-1/+1
| | | | | | | | | Previously we assumed that the nettle GCM internal functions will use the provided ECB function for single block encryption. Newer versions no longer operate that way. Ensure that we are compatible with them. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* serv: increase cache size used for resumptionNikos Mavrogiannopoulos2018-02-021-1/+1
| | | | | | | That allows sessions with longer parameters to be able to be resumed. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* CONTRIBUTING.md: check the issue closing as part of review [ci skip]Nikos Mavrogiannopoulos2018-02-021-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-cli: no longer print certificate types or compression methodsNikos Mavrogiannopoulos2018-02-021-19/+2
| | | | | | | We don't support any other compression methods than the null compression, nor any other certificate types. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Inline version macros into its users.Jay Foad2018-01-271-20/+22
| | | | | | | | | | This fixes a problem in _gnutls_version_is_supported() where we want to use preprocessing directives in the loop body. Doing this within a macro argument is undefined behaviour according to the C standard, and not supported by the system compiler on AIX. Signed-off-by: Jay Foad <jay.foad@gmail.com> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* updated auto-generated filestmp-fix-certtool-double-freeNikos Mavrogiannopoulos2018-01-261-474/+474
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: deprecated the --certificate-pubkey optionNikos Mavrogiannopoulos2018-01-261-1/+2
| | | | | | | That option is duplicate since --pubkey-info can provide the same information. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: avoid duplicate deinitialization on --certificate-pubkeyNikos Mavrogiannopoulos2018-01-261-4/+8
| | | | | | Resolves #368 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* dh: document why BER decoding rules are allowsNikos Mavrogiannopoulos2018-01-231-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pubkey: use the strict DER decoder for SubjectPublicKeyInfoNikos Mavrogiannopoulos2018-01-231-1/+1
| | | | | | | | Although there is no explicit RFC mentioning the SubjectPublicKeyInfo encoding, this structure is a subset of the X.509 certificate's structure and as such it is expected to be in DER form. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pk: document need for the generic BER decoderNikos Mavrogiannopoulos2018-01-231-0/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updatetmp-pkcs11-access-fixesNikos Mavrogiannopoulos2018-01-231-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: check whether deletion of a certificate object worksNikos Mavrogiannopoulos2018-01-231-0/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* p11tool: corrected issue preventing the deletion of objects in batch modeNikos Mavrogiannopoulos2018-01-231-0/+2
| | | | | | | Previously initialization of PIN callbacks would only happen during listing of objects, which happened only in non-batch mode. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* p11tool: corrected type affecting use of --only-urlsNikos Mavrogiannopoulos2018-01-231-1/+1
| | | | | | It would enable batch mode accidentally. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: pkcs11/tls-neg-pkcs11-key: updated for softhsm with PKCS#11 supportNikos Mavrogiannopoulos2018-01-221-12/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* added sub-section on selecting the right return value [ci skip]Nikos Mavrogiannopoulos2018-01-221-0/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-01-171-5/+15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* examples: use gnutls_certificate_set_x509_system_trustNikos Mavrogiannopoulos2018-01-172-11/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updatetmp-dtls-further-mtu-improvementsNikos Mavrogiannopoulos2018-01-161-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: privkey-verify-broken: addressed uninitialized var useNikos Mavrogiannopoulos2018-01-161-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether get_mtu() functions relate to the set valuesNikos Mavrogiannopoulos2018-01-161-0/+25
| | | | | | | | That is, verify that gnutls_dtls_set_data_mtu() value would be reflected into gnutls_dtls_get_data_mtu(), as well as the gnutls_dtls_set_mtu() to gnutls_dtls_get_mtu(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for _gnutls_record_overhead()Nikos Mavrogiannopoulos2018-01-165-3/+110
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* DTLS: improved data MTU calculation under CBC ciphersuitesNikos Mavrogiannopoulos2018-01-163-46/+69
| | | | | | | | | | | | | | | | | The data MTU calculation under CBC ciphersuites takes into account that the overhead of these ciphersuites is constant (IV + hash + 1 byte padding), though the capacity varies due to the padding block. That is, on 16-byte padding block, one padding byte is the overhead but the rest 15 bytes are accounted for data MTU. That also has the side effect that setting a data MTU using gnutls_dtls_set_data_mtu(), is not definite, and the actual MTU may be larger for these ciphersuites --i.e., the return value of gnutls_dtls_get_data_mtu(). Resolves #360 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: added reproducer for leak in gnutls_x509_crl_list_importtmp-mem-leakNikos Mavrogiannopoulos2018-01-101-0/+1
| | | | | | | That was detected by oss-fuzz in: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4930 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_list_import: eliminated memory leakNikos Mavrogiannopoulos2018-01-101-3/+5
| | | | | | | That leak would be triggered if GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED flag was used and the input data would exceed the maximum limit. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* libtasn1: updated to latest libtasn1 master branchtmp-update-libtasn1Nikos Mavrogiannopoulos2018-01-093-8/+32
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs12_key_parser_fuzzer.in: added reproducer for oss-fuzz #4890Nikos Mavrogiannopoulos2018-01-091-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-01-071-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: updated copyright year for manualtmp-fix-verification-issuesNikos Mavrogiannopoulos2018-01-061-2/+2
| | | | | | That eliminates the 'make syntax-check' error. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for self-signed verification errorNikos Mavrogiannopoulos2018-01-062-0/+144
| | | | | | Relates #347 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* x509/verify: when verifying against a self signed certificate ignore issuerNikos Mavrogiannopoulos2017-12-301-5/+7
| | | | | | | | | | That is, ignore issuer when checking the issuer's parameters strength. That resolves the issue of marking self-signed certificates as with insecure parameters during verification. Resolves #347 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_pk_self_test: include ECDSA tests on GNUTLS_PK_ECtmp-update-fips-self-testsNikos Mavrogiannopoulos2017-12-211-24/+25
| | | | | | | | Previously when a request for a specific self check on GNUTLS_PK_EC was done, only ECDH tests would be run. This change includes the ECDSA tests as well (GNUTLS_PK_EC and GNUTLS_PK_ECDSA are an alias to each other). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: hash-large: increase parallelism to allow fast run in CItmp-speedup-hash-testsNikos Mavrogiannopoulos2017-12-203-50/+67
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: reference gnutls_prf_rfc5705 instead of gnutls_prf303-provide-a-consistent-set-of-default-ciphers-across-supported-protocolsNikos Mavrogiannopoulos2017-12-081-9/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: utils.h: forbid compilation with NDEBUGtmp-pkcs11-updateNikos Mavrogiannopoulos2017-12-031-0/+4
| | | | | | | This allows to rely on the assert() macro being functional on the test suite. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: p11-kit-load.sh: verify that all modules are loaded after a private ↵Nikos Mavrogiannopoulos2017-12-032-3/+23
| | | | | | key operation Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: enhanced pkcs11/list-tokensNikos Mavrogiannopoulos2017-12-031-4/+12
| | | | | | | | | This not only creates a trust list with the system certificates, but also attempts to verify a certificate, increasing the number of calls to PKCS#11 verification API (and thus ensuring there are no calls which may trigger the load of other modules). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11 verification: always use the ↵Nikos Mavrogiannopoulos2017-12-032-6/+10
| | | | | | | | | | GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE That is, make sure that all our calls to PKCS#11 subsystem for verification will only trigger the trust module initialization, and not the generic PKCS#11 initialization. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: simplify trusted module loading stateNikos Mavrogiannopoulos2017-12-032-13/+15
| | | | | | | | That is always utilize the same flags (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE) to determine whether to initialize trusted modules only or proceed with general initialization. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_pkcs11_check_init: improved transition between statesNikos Mavrogiannopoulos2017-12-033-20/+59
| | | | | | | | | | | | | The init_level_t for PKCS#11 modules, was incorrectly handled as a linear state transition, causing few cases in the transition to be incorrectly handled. Define precisely the state transitions and enforce them in _gnutls_pkcs11_check_init. That addresses a regression introduced by the previous state handling addition, which made impossible to switch from the trusted state to the all modules. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: corrected destructive/p11-kit-load.sh error checkingNikos Mavrogiannopoulos2017-12-021-21/+47
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-serv: fix double-free on inactivity timeouttmp-dueno-serv-double-freeDaiki Ueno2017-12-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Previously, gnutls-serv --echo segfaulted when closing client connection after inactivity timeout. Here is the valgrind output: ==20246== Invalid free() / delete / delete[] / realloc() ==20246== at 0x4C2FD18: free (vg_replace_malloc.c:530) ==20246== by 0x405310: listener_free (serv.c:154) ==20246== by 0x408B57: tcp_server (serv.c:1568) ==20246== by 0x407DA6: main (serv.c:1231) ==20246== Address 0x6ed4fe0 is 0 bytes inside a block of size 3 free'd ==20246== at 0x4C2FD18: free (vg_replace_malloc.c:530) ==20246== by 0x408A1D: tcp_server (serv.c:1548) ==20246== by 0x407DA6: main (serv.c:1231) ==20246== Block was alloc'd at ==20246== at 0x4C2EB6B: malloc (vg_replace_malloc.c:299) ==20246== by 0x6A64489: strdup (in /usr/lib64/libc-2.25.so) ==20246== by 0x407310: get_response (serv.c:948) ==20246== by 0x408840: tcp_server (serv.c:1492) ==20246== by 0x407DA6: main (serv.c:1231) ==20246== Signed-off-by: Daiki Ueno <dueno@redhat.com>
View Lorry Controller Status