summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* OCSP: find_signercert: improved DER length calculationtmp-ocsp-improvementsNikos Mavrogiannopoulos2017-07-011-7/+30
| | | | | | | | | | Previously we were assuming a fixed amount of length bytes which is not correct for all possible lengths. Use libtasn1 to decode the length field. Resolves: #223 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* OCSP: check the subject public key identifier field to figure issuerNikos Mavrogiannopoulos2017-07-011-2/+16
| | | | | | | | | | | | | | | | Normally when attempting to match the 'Responder Key ID' in an OCSP response against the issuer certificate we check (according to RFC6960) against the hash of the SPKI field. However, in few certificates (see commit: "added ECDSA OCSP response verification"), that may not be the case. In that certificate, that value matches the Subject Public Key identifier field but not the hash. To account for these certificates, we enhance the matching to also consider the Subject Public Key identifier field. Relates: #223 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* OCSP: added more verbose debug logging on verificationNikos Mavrogiannopoulos2017-07-011-0/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added ECDSA OCSP response verificationNikos Mavrogiannopoulos2017-07-014-1/+67
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .travis.yml: do not fail on brew install failuresNikos Mavrogiannopoulos2017-06-301-1/+1
| | | | | | | | brew install seems to fail on several occasions when a newer package is available than the installed. Ignore those errors rather than failing build. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added check on saving certs and OCSP responsestmp-ocsp-save-testsNikos Mavrogiannopoulos2017-06-292-1/+78
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: save OCSP response at the time certificate is savedNikos Mavrogiannopoulos2017-06-291-8/+17
| | | | | | | That ensures that we always save the OCSP response, even when certificate verification fails. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* moved compression-related APIs to compat.htmp-remove-support-for-compressionNikos Mavrogiannopoulos2017-06-222-11/+17
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: removed any references to compression and documented changeNikos Mavrogiannopoulos2017-06-223-40/+39
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: removed tests related to zlib supportNikos Mavrogiannopoulos2017-06-223-43/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-06-221-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Removed support for compression mechanismsNikos Mavrogiannopoulos2017-06-2217-901/+112
| | | | | | | | | | They are not required for TLS 1.3, and are deprecated for TLS 1.2. We eliminate them in order to reduce the complexity in the record packet handling. Resolves #212 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-cli: be less verbose in OCSP error messagestmp-ocsptool-updatesNikos Mavrogiannopoulos2017-06-201-1/+2
| | | | | | | | Previously we were reporting "No issuer found" if any certificate in a chain could not be verified. That was confusing information and not strictly necessary. No longer print that. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-cli: improved error message of OCSP failureNikos Mavrogiannopoulos2017-06-201-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2017-06-202-151/+238
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: ocsptool: added test of --verify-response with --load-chainNikos Mavrogiannopoulos2017-06-205-1/+221
| | | | | | | This utilizes the provided chain to find the signer of the OCSP response. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsp: print response's signature algorithm in compact listingNikos Mavrogiannopoulos2017-06-201-16/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ocsptool: verify_response will print information on the responseNikos Mavrogiannopoulos2017-06-201-0/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ocsptool: doc updateNikos Mavrogiannopoulos2017-06-201-21/+41
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ocsptool: allow combining --load-trust with --verify-responseNikos Mavrogiannopoulos2017-06-201-7/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ocsptool: --load-chain will sort the input chainNikos Mavrogiannopoulos2017-06-203-1/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsptool: introduced --verify-allow-broken optionNikos Mavrogiannopoulos2017-06-192-2/+12
| | | | | | | This allows verification to succeed even when broken algorithms are involved. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsptool: the --verify-response can be combined with --load-chainNikos Mavrogiannopoulos2017-06-191-39/+53
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_certificate_verification_status_print: mention OCSP in error messagesNikos Mavrogiannopoulos2017-06-191-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsptool: added --load-chain optionNikos Mavrogiannopoulos2017-06-194-197/+224
| | | | | | | This option allows to directly verify all the members of a certificate chain. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-06-191-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enabled X25519 interop tests with openssl 1.1.0Nikos Mavrogiannopoulos2017-06-192-15/+31
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* NORMAL priority: no longer enable the smaller curves by defaultNikos Mavrogiannopoulos2017-06-191-4/+0
| | | | | | | They are not widely enabled by web servers, and they provide no advantage over X25519. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* NORMAL priority: enable X25519 curveNikos Mavrogiannopoulos2017-06-191-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: cleanups in pkcs11_login()tmp-safenet-updates-v2Nikos Mavrogiannopoulos2017-06-171-12/+21
| | | | | | | | Use pkcs11_rv_to_err() to return the right error code map after PKCS#11 calls; separate checks for already log in status for SO and user login. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: pkcs11-mock: reset state when requesting reauthNikos Mavrogiannopoulos2017-06-171-1/+4
| | | | | | | | That is, for the MOCK_FLAG_SAFENET_ALWAYS_AUTH flag we ensure that GetSessionInfo() will return the right state when authentication is required for the first time. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: improved handling of HSMs without CKU_CONTEXT_SPECIFIC supportNikos Mavrogiannopoulos2017-06-172-34/+28
| | | | | | | | That is, when the HSM returns CKR_USER_NOT_LOGGED_IN, switch to CKU_USER, instead of relying to a fallback within pkcs11_login(). That simplifies login logic. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added unit test for safenet protectserver HSM's PKCS#11 supporttmp-handle-safenet-hsmsNikos Mavrogiannopoulos2017-06-164-11/+224
| | | | | | | That is, detect whether the absence of C_Login will fallback to CKU_USER after CKU_CONTEXT_SPECIFIC is tried. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: simplified pkcs11_login()Nikos Mavrogiannopoulos2017-06-163-21/+19
| | | | | | By cleanups, as well as including the reauth flag in the flags option. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: the GNUTLS_PKCS11_OBJ_FLAG_LOGIN will force a loginNikos Mavrogiannopoulos2017-06-163-25/+36
| | | | | | | | That is, even in tokens which do not have a CKF_LOGIN_REQUIRED flag a login will be forced. This allows operation on the safenet HSMs which do not set that flag. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Handle specially safenet HSMs which cannot handle CKU_CONTEXT_SPECIFICNikos Mavrogiannopoulos2017-06-162-5/+26
| | | | | | | | | | These HSMs do not support CKA_ALWAYS_AUTHENTICATE, nor understand CKU_CONTEXT_SPECIFIC, but rather return CKR_USER_NOT_LOGGED_IN on the first private key operation. Try to discover that state by calling C_Login when CKR_USER_NOT_LOGGED_IN is seen, and retrying with CKU_USER after CKU_CONTEXT_SPECIFIC login fails. See discussion in https://github.com/OpenSC/libp11/issues/160 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Added documentation to legacy openpgp functionsNikos Mavrogiannopoulos2017-06-161-0/+143
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Removed unnecessary certificate type functionalityNikos Mavrogiannopoulos2017-06-163-97/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* NEWS: doc updateNikos Mavrogiannopoulos2017-06-161-4/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2017-06-166-1439/+954
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: removed references to openpgpNikos Mavrogiannopoulos2017-06-165-17/+14
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* po: removed openpgp/output.cNikos Mavrogiannopoulos2017-06-161-1/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* guile: removed openpgp related testsNikos Mavrogiannopoulos2017-06-1610-415/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: removed the openpgp certificate fuzzerNikos Mavrogiannopoulos2017-06-163-51/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tools: removed options for openpgp supportNikos Mavrogiannopoulos2017-06-167-753/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Removed support for openpgp certificates and keysNikos Mavrogiannopoulos2017-06-1677-18765/+28
| | | | | | Resolves #178 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: removed openpgp related testsNikos Mavrogiannopoulos2017-06-1617-1998/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for assertion triggerNikos Mavrogiannopoulos2017-06-161-0/+0
| | | | | | | | This relates to handshakes with support for RSA-PSS. Found with oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2132 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle: ported fix for assertion failure in pss_verify_mgf1Daiki Ueno2017-06-161-4/+8
| | | | | | | Backport the upstream fix from: https://git.lysator.liu.se/nettle/nettle/commit/b1252fedf6ee1dbb8468d1d3f177711a16e83e52 Signed-off-by: Daiki Ueno <dueno@redhat.com>
* .gitlab-ci.yml: keep logs of tests in abi buildNikos Mavrogiannopoulos2017-06-161-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status