summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * psk: save the username on auth info struct under TLS1.3Nikos Mavrogiannopoulos2018-04-063-1/+25
| | | | | | | | | | | | | | Add the necessary tests to verify that gnutls_psk_server_get_username() reports the right username under TLS1.2 and TLS1.3. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * tests: enhanced test suite for TLS1.3 and PSKNikos Mavrogiannopoulos2018-04-065-42/+411
| | | | | | | | | | | | | | | | That includes tests with unknown usernames and connections with wrong key and updates to fastopen.sh to use certificate auth, making it applicable under TLS1.3. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| * priority: added GROUP-DH-ALL and GROUP-EC-ALLNikos Mavrogiannopoulos2018-04-062-1/+31
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * dumbfw: account for extension data paddingNikos Mavrogiannopoulos2018-04-061-3/+5
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * Simplified the _gnutls13_psk_ext_parser interface and added unit testsNikos Mavrogiannopoulos2018-04-067-85/+247
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * Added support for out-of-band Pre-shared keys under TLS1.3Ander Juaristi2018-04-0633-136/+1379
|/ | | | | | | | | | | That adds support for pre-shared keys with and without Diffie-Hellman key exchange. That's a modified version of initial Ander's patch. Resolves #414 Resolves #125 Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.org>
* certtool: key-type desc was moved along the privkey functionality [ci skip]Nikos Mavrogiannopoulos2018-04-061-9/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_record_can_use_length_hiding: corrected return typeNikos Mavrogiannopoulos2018-04-042-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* encrypt_packet_tls13: reverted to original APINikos Mavrogiannopoulos2018-04-041-23/+23
| | | | | | | That allows more uniformity across encrypt/decrypt, and across different protocol handling. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-nettle-version-check-update' into 'master'Nikos Mavrogiannopoulos2018-03-261-1/+1
|\ | | | | | | | | nettle: corrected typo in version check for compatibility mode with 3.3 See merge request gnutls/gnutls!614
| * nettle: corrected typo in version check for compatibility mode with 3.3tmp-nettle-version-check-updateNikos Mavrogiannopoulos2018-03-251-1/+1
|/ | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tmp-draft-ietf-tls13-26' into 'master'Nikos Mavrogiannopoulos2018-03-2414-115/+362
|\ | | | | | | | | | | | | Move to draft-ietf-tls-tls13-26 Closes #409, #378, and #410 See merge request gnutls/gnutls!611
| * doc updatetmp-draft-ietf-tls13-26Nikos Mavrogiannopoulos2018-03-231-1/+5
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * protocols: bumped TLS1.3 protocol to draft -26Nikos Mavrogiannopoulos2018-03-233-6/+6
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * record: added AAD data when encrypting or decryptingNikos Mavrogiannopoulos2018-03-231-36/+54
| | | | | | | | | | | | | | | | This is a requirement of draft-ietf-tls-tls13-25 Resolves #409 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * priorities: disable any key exchange methods if there is no TLS1.2 or earlierNikos Mavrogiannopoulos2018-03-232-16/+37
| | | | | | | | | | | | | | | | | | | | | | That is, because TLS1.2 has specific requirements in the ordering of curves/groups if certain ciphersuites (ECDHE/DHE) are present, and by being able to eliminate them early we simplify the negotiation for TLS1.3-only clients/servers. Relates #378 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * _gnutls_supported_ecc_recv_params: take into account precedenceNikos Mavrogiannopoulos2018-03-237-58/+259
| | | | | | | | | | | | | | | | | | | | | | | | That is, when %SERVER_PRECEDENCE is given in the priority string make sure that the negotiated curve of DH group respects the server's priorities. That's very relevant under TLS1.3 as ciphersuite negotiation itself, where %SERVER_PRECEDENCE applied, does contain only the cipher algorithm and MAC unlike TLS1.2 which included key exchange as well. Resolves #378 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * supported_versions: cannot be used to negotiate pre-TLS1.3Nikos Mavrogiannopoulos2018-03-231-0/+3
|/ | | | | | | | This is a requirement of draft-ietf-tls-tls13-26 Resolves #410 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-03-231-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: mention gnutls_privkey_import_ext4 in upgrade from 3.5.xNikos Mavrogiannopoulos2018-03-232-2/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: added since field in gnutls_record_send2() descriptionNikos Mavrogiannopoulos2018-03-232-1/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Makefile.am: reduce automake warnings and corrected versionNikos Mavrogiannopoulos2018-03-231-6/+6
| | | | | | | That is, avoid using the := syntax, set the right version variable and use a hidden file for abi-check cache stamp. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* The abi-check target was updated to check against the last tagNikos Mavrogiannopoulos2018-03-223-25/+50
| | | | | | | | | | | | | | | | | As abi-dumper and abi-compliance-checker tools are not reliable when run across different systems, we now compare the previous tag ABI with the current compiled library. That is in contrast with the previous behavior of storing the output files of abi-dumper, which can become obsolete on a CI update. That also moves the ABI check only on the CI, and not in the 'make dist' rule as it takes significant time to run. This relates to an issue reported against libidn2's use of abi-compliance-checker but it affects gnutls as they share similar code: https://gitlab.com/libidn/libidn2/issues/42 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* nettle/pk: include nettle/version.hNikos Mavrogiannopoulos2018-03-201-0/+1
| | | | | | That enables the nettle version macros to operate. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: avoid duplicate runs of tests when not necessarytmp-update-tests-for-tls1.3Nikos Mavrogiannopoulos2018-03-191-15/+16
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: moved invalid-cert reproducer into fuzz/ reproducersNikos Mavrogiannopoulos2018-03-193-43/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: testpkcs11.sh was moved to the main testsNikos Mavrogiannopoulos2018-03-1916-52/+53
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: long-crl.sh was moved to main suiteNikos Mavrogiannopoulos2018-03-195-8/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: suite: dropped ocsp-coverage and cert-coverageNikos Mavrogiannopoulos2018-03-19813-246/+2
| | | | | | | These tests are duplicates of fuzz/gnutls_ocsp_resp/req_parser_fuzzer and gnutls_x509_parser_fuzzer. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: testsrn.sh was removed as duplicate of safe-renegotation/ testsNikos Mavrogiannopoulos2018-03-198-128/+13
| | | | | | | Also safe-renegotiation tests were made TLS1.2-only as they do not apply to TLS1.3. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: pkcs7-cat: moved to main suiteNikos Mavrogiannopoulos2018-03-1910-10/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: updated for TLS1.3 inclusionNikos Mavrogiannopoulos2018-03-1981-1472/+1002
| | | | | | | | | This moves the test to use a specific version or test multiple TLS versions if applicable. Resolves #413 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: mini-record-retvals was split into return vals checking and alerts ↵Nikos Mavrogiannopoulos2018-03-193-16/+321
| | | | | | checking Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: client-fast-open: updated for TLS1.3Nikos Mavrogiannopoulos2018-03-191-15/+25
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: removed unused testNikos Mavrogiannopoulos2018-03-191-246/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: auto-verify: update for TLS1.3Nikos Mavrogiannopoulos2018-03-191-19/+30
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-03-191-1/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tmp-nmav-draft-ietf-tls-tls13-22' into 'master'Nikos Mavrogiannopoulos2018-03-1042-400/+1260
|\ | | | | | | | | | | | | Move to draft-ietf-tls-tls-23 Closes #391, #400, #393, #389, #397, #398, #395, and #396 See merge request gnutls/gnutls!610
| * tlsfuzzer: updated to the latest versiontmp-nmav-draft-ietf-tls-tls13-22Nikos Mavrogiannopoulos2018-03-094-9/+7
| | | | | | | | | | | | Also enabled the RSA-PSS tests. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * alert: send the appropriate alert on GNUTLS_E_ERROR_IN_FINISHED_PACKETNikos Mavrogiannopoulos2018-03-091-0/+1
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * Bumped TLS1.3 draft version to -23Nikos Mavrogiannopoulos2018-03-093-6/+6
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * Hello retry request matches server helloNikos Mavrogiannopoulos2018-03-097-20/+89
| | | | | | | | | | | | | | | | | | That also distinguishes between them by using the special random value, and implements the version check as in draft-ietf-tls-tls13-24. Resolves #391 #390 #392 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * tests: added negative tests for RSA-PSS key exchangeNikos Mavrogiannopoulos2018-03-095-3/+141
| | | | | | | | | | | | Relates #400 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * signatures: distinguish RSA-PSS signatures with RSA PKCS#1 1.5 certificates ↵Nikos Mavrogiannopoulos2018-03-0920-103/+241
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | from "pure" This change enhances signature algorithms to have a private key algorithm parameter. That is, to allow signature algorithms operating with a private key of type X while the public key is of type Y. That is useful for the RSA-PSS signatures which are of two types; one which is seen from servers having PKCS#1 1.5 certificates, the other with RSA-PSS certificates, while both utilize RSA-PSS private keys. This is a draft-ietf-tls-tls13-23 change. Resolves #400 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * Server hello format follows TLS1.2 formatNikos Mavrogiannopoulos2018-03-088-201/+307
| | | | | | | | | | | | | | | | | | | | | | Also version negotiation was moved to supported_versions extension, and session ID is set by client following appendix D.4. This is a draft-ietf-tls-tls13-22 change. Resolves #393, #389, #397 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * Renumbered the key share extension to 51Nikos Mavrogiannopoulos2018-03-083-11/+11
| | | | | | | | | | | | | | | | This is a draft-ietf-tls-tls13-23 change. Resolves #398 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * record: ignore any ChangeCipherSpec messages under TLS1.3 handshakeNikos Mavrogiannopoulos2018-03-087-65/+474
| | | | | | | | | | | | | | | | | | | | Also send ChangeCipherSpec messages under TLS1.3 handshake. This is a draft-ietf-tls-tls13-22 change. Resolves #395 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * record: send 0x0303 under TLS1.3Nikos Mavrogiannopoulos2018-03-081-5/+6
|/ | | | | | | | This is a draft-ietf-tls-tls13-22 change. Resolves #396 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cryptodev: fix prototype of cryptodev_mac_fast [ci skip]Nikos Mavrogiannopoulos2018-03-081-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cryptodev: added missing macro [ci skip]Nikos Mavrogiannopoulos2018-03-071-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status