summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* handshake: reject no_renegotiation alert if handshake is incompletetmp-renegotiation-3_6_xDaiki Ueno2020-09-034-13/+36
| | | | | | | | | | | | | | If the initial handshake is incomplete and the server sends a no_renegotiation alert, the client should treat it as a fatal error even if its level is warning. Otherwise the same handshake state (e.g., DHE parameters) are reused in the next gnutls_handshake call, if it is called in the loop idiom: do { ret = gnutls_handshake(session); } while (ret < 0 && gnutls_error_is_fatal(ret) == 0); Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'tmp-backport-3.6' into 'gnutls_3_6_x'Daiki Ueno2020-09-03148-281/+2361
|\ | | | | | | | | Backport bug fixes from master to gnutls_3_6_x See merge request gnutls/gnutls!1317
| * NEWS: Mention 3.6.15 changestmp-backport-3.6Daiki Ueno2020-09-031-0/+27
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * handshake: check TLS version against modified server prioritiesDaiki Ueno2020-09-032-12/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | The server needs to take into account of multiple factors when determining the TLS protocol version actually being used: - the legacy version - "supported_versions" extension - user_hello_func that may modify the server's priorities Only after that it can check whether the TLS version is enabled in the server's priorities. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * gnutls_aead_cipher_decrypt: check output buffer size before writingDaiki Ueno2020-09-032-0/+91
| | | | | | | | | | | | | | | | | | While the documentation of gnutls_aead_cipher_decrypt indicates that the inout argument ptext_len initially holds the size that sufficiently fits the expected output size, there was no runtime check on that. This makes the interface robuster against misuses. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * gnutls_x509_crt_export2: return 0 instead of the lengthDaiki Ueno2020-09-032-4/+11
| | | | | | | | | | | | This aligns the behavior to the documentation. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * minitasn1: move WARN_CFLAGS setting to configure.acDaiki Ueno2020-09-032-4/+1
| | | | | | | | | | | | | | Some compilers don't support -Wno-type-limits, while they support -Wtype-limits. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * _gnutls_fips_mode_enabled: treat selftest failure as FIPS disabledDaiki Ueno2020-09-031-1/+10
| | | | | | | | | | | | | | | | | | Previously gnutls_fips140_mode_enabled() returned true, even after selftests have failed and the library state has switched to error. While later calls to crypto operations fails, it would be more convenient to have a function to detect that state. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * doc: assorted typo fixesDaiki Ueno2020-09-0323-31/+31
| | | | | | | | | | | | Spotted by codespell. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * serv, cli: ensure that invalid flag is always setDaiki Ueno2020-09-031-1/+4
| | | | | | | | | | | | | | | | According to the documentation, the GNUTLS_CERT_INVALID flag must always be set in case of verification failure, together with the flag indicating the actual error cause. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * cert-session: fail hard if mandatory stapling is not honoredDaiki Ueno2020-09-031-0/+1
| | | | | | | | | | | | | | | | According to the documentation, the GNUTLS_CERT_INVALID flag must always be set in case of verification failure, together with the flag indicating the actual error cause. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * mangle gnutls-built ecc_scalar_randomSteve Lhomme2020-08-311-1/+7
| | | | | | | | | | | | | | | | | | | | | | GNUTLS builds ecc-random.c but ecc_scalar_random() is a public API. So we mangle the internal version we build. ecc_mod_random is unaffected as it's an internal API that is mangled by GNUTLS. Fixes #1016 Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
| * pubkey: avoid spurious audit messages from _gnutls_pubkey_compatible_with_sig()Petr Pavlu2020-08-311-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When checking in _gnutls_pubkey_compatible_with_sig() whether a public key is compatible with a signature algorithm, run first pubkey_supports_sig() before performing weaker checks that can accept the given algorithm but with an audit-log warning. This avoids an issue when a weaker check would log an audit message for some signature algorithm that would then be determined as incompatible by the pubkey_supports_sig() check anyway. For instance, a GnuTLS server might have a certificate with a SECP384R1 public key and a client can report that it supports ECDSA-SECP256R1-SHA256 and ECDSA-SECP384R1-SHA384. In such a case, the GnuTLS server will eventually find that it must use ECDSA-SECP384R1-SHA384 with this public key. However, the code would first run _gnutls_pubkey_compatible_with_sig() to check if SECP384R1 is compatible with ECDSA-SECP256R1-SHA256. The function would report the audit warning "The hash size used in signature (32) is less than the expected (48)" but then reject the signature algorithm in pubkey_supports_sig() as incompatible because it has a different curve. Since the algorithm gets rejected it is not necessary to inform about its hash size difference in the audit log. Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
| * ecdh: perform SP800-56A rev3 full pubkey validation on keygenDaiki Ueno2020-08-311-2/+180
| | | | | | | | | | | | | | This implements full public key validation required in SP800-56A rev3, section 5.6.2.3.3. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * dh: perform SP800-56A rev3 full pubkey validation on keygenDaiki Ueno2020-08-311-0/+90
| | | | | | | | | | | | | | This implements full public key validation required in SP800-56A rev3, section 5.6.2.3.1. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * dh-primes: make the FIPS approved check return Q valueDaiki Ueno2020-08-313-20/+30
| | | | | | | | | | | | | | This is necessary for full public key validation in SP800-56A (revision 3), section 5.6.2.3.1. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * ecdh: check validity of P before exportDaiki Ueno2020-08-311-6/+21
| | | | | | | | | | | | | | | | | | | | SP800-56A rev3 section 5.7.1.2 step 2 mandates that the validity of the calculated shared secret is verified before the data is returned to the caller. This patch adds the validation check. Suggested by Stephan Mueller. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * dh: check validity of Z before exportDaiki Ueno2020-08-311-9/+17
| | | | | | | | | | | | | | | | | | | | SP800-56A rev3 section 5.7.1.1 step 2 mandates that the validity of the calculated shared secret is verified before the data is returned to the caller. This patch adds the validation check. Suggested by Stephan Mueller. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * build: use $(LIBPTHREAD) rather than non-existent $(LTLIBPTHREAD)James Bottomley2020-08-312-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On a very recent openSUSE build, libgnutls is getting built without libpthread. This caused a thread related error when trying to load a pkcs11 module that uses threading. The reason is rather convoluted: glibc actually controls all the pthread_ function calls, but it returns success without doing anything unless -lpthread is in the link list. What's happening is that gnutls_system_mutex_init() is being called on _gnutls_pkcs11_mutex before library pthreading is initialized, so the pthread_mutex_init ends up being a nop. Then, when the pkcs11 module is loaded, pthreads get initialized and the call to pthread_mutex_lock is real, but errors out on the uninitialized mutex. The problem seems to be that nothing in the gnulib macros gnutls relies on for threading support detection actually sets LTLIBPTHREAD, they only set LIBPTHREAD. The fix is to use LIBPTHREAD in lib/Makefile.in Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
| * .gitlab-ci: disable config.cache for nettle-master buildsDmitry Baryshkov2020-08-311-2/+2
| | | | | | | | | | | | | | | | Disable usage of config.cache for nettle-master builds. Such config.cache files can easily become stale, thus resulting in build failures. Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
| * tests: split up system-override-sig-hash.shAlexander Sosedkin2020-08-313-20/+46
| | | | | | | | | | | | | | | | | | Split up system-override-sig-hash.sh so that the errors won't get swallowed or conflated. Also correct unused `srcdir` to `builddir`, which I believe was meant to be set there. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
| * fix connectx not available on older macOS SDKSteve Lhomme2020-08-311-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes this compilation error: system/fastopen.c:134:9: error: 'connectx' is only available on macOS 10.11 or newer [-Werror,-Wunguarded-availability] ret = connectx(fd, &endpoints, SAE_ASSOCID_ANY, CONNECT_RESUME_ON_READ_WRITE | CONNECT_DATA_IDEMPOTENT, NULL, 0, NULL, NULL); ^~~~~~~~ /Applications/Xcode9.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.13.sdk/usr/include/sys/socket.h:713:5: note: 'connectx' has been marked as being introduced in macOS 10.11 here, but the deployment target is macOS 10.7.0 The detection is the same as found in curl [1]. If HAVE_BUILTIN_AVAILABLE is not available we fallback to the code without TCP_FASTOPEN_OSX. The OS values match exactly the values found in https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/sys/socket.h [1] https://github.com/curl/curl/commit/870d849d48a26b8eeb0d4bb1f4655367a4a191ca Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
| * safe_memcmp: remove in favor of gnutls_memcmpDaiki Ueno2020-08-316-17/+9
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * dhe: check if DH params in SKE match the FIPS approved algorithmsDaiki Ueno2020-08-3131-32/+521
| | | | | | | | | | | | | | | | SP800-56A rev. 3 restricts the FIPS compliant clients to use only approved DH parameters, defined in RFC 7919 and RFC 3526. This adds a check in the handling of ServerKeyExchange if DHE is negotiated. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * dh-primes: add MODP primes from RFC 3526Daiki Ueno2020-08-312-0/+962
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * Wipe session ticket keys before releasing the session structureFiona Klute2020-08-311-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | This includes both a copy of the master key and one or two derived keys, all of which could be used to decrypt session tickets if stolen. The derived keys could only be used for tickets issued within a certain time frame (by default several hours). The documentation for gnutls_session_ticket_enable_server() already states that the master key should be wiped before releasing it, and the same should apply to internal copies. Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
| * Modied the license to GPLv2.1+ to keep with LICENSE file.Lei Maohui2020-08-312-18/+22
| | | | | | | | Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com>
| * Update tlsfuzzer to get Python interpreter detectionFiona Klute2020-08-310-0/+0
| | | | | | | | | | | | | | | | Tlsfuzzer also assumed the Python interpreter would be called "python", this update is necessary to get a fixed version (see https://github.com/tomato42/tlsfuzzer/pull/671). Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
| * Detect Python interpreter instead of assuming "python"Fiona Klute2020-08-314-6/+18
| | | | | | | | | | | | | | This makes the extended test suite work one Debian(-ish) systems without Python 2, where the Python 3 interpreter is called "python3". Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
| * .gitlab-ci.yml: bump configure cache versionDaiki Ueno2020-08-311-1/+1
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * .gitignore: ignore more filesDaiki Ueno2020-08-311-1/+27
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * build: avoid -Wenum-conversion warnings with GCC 10Daiki Ueno2020-08-3112-20/+33
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * refine tests for ancient servers which support both SSL 3.0 and TLS 1.0, but ↵Daniel Lenski2020-08-312-5/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | both only with %NO_EXTENSIONS This is a follow-up to !1221. See #958 and https://gitlab.com/openconnect/openconnect/-/issues/145 for a real-world example of ancient Cisco servers with these deficiencies. With !1221 only, gnutls-cli-debug reports that these ancient servers only support SSL 3.0 (but without extensions). Information after this point is largely erroneous: $ gnutls-cli-debug ***vpn.***.com GnuTLS debug client 3.6.12 Checking ***vpn.***.com:443 whether the server accepts default record size (512 bytes)... no whether %ALLOW_SMALL_RECORDS is required... no for SSL 3.0 (RFC6101) support... yes for SSL 3.0 with extensions... no With this additional change, gnutls-cli-debug correctly reports that such a server also supports TLS 1.0 (but again with extensions disabled). Below I've marked some of the significant fields that have changed: $ gnutls-cli-debug ***vpn.***.com GnuTLS debug client 3.6.12 Checking ***vpn.***.com:443 whether the server accepts default record size (512 bytes)... no whether %ALLOW_SMALL_RECORDS is required... no for SSL 3.0 (RFC6101) support... yes for SSL 3.0 with extensions... no whether we need to disable TLS 1.2... yes whether we need to disable TLS 1.1... yes # This is now correct: whether we need to disable TLS 1.0... no # This is now correct: whether %NO_EXTENSIONS is required... yes # This is now correct: for TLS 1.0 (RFC2246) support... yes for TLS 1.1 (RFC4346) support... no fallback from TLS 1.1 to... failed for TLS 1.2 (RFC5246) support... no # This is now correct: for known TLS or SSL protocols support... yes TLS1.2 neg fallback from TLS 1.6 to... failed (server requires fallback dance) for inappropriate fallback (RFC7507) support... no for HTTPS server name... ****** for certificate chain order... sorted for Safe renegotiation support (SCSV)... no for version rollback bug in RSA PMS... no for version rollback bug in Client Hello... no whether the server ignores the RSA PMS version... no whether small records (512 bytes) are tolerated on handshake... yes whether cipher suites not in SSL 3.0 spec are accepted... yes whether a bogus TLS record version in the client hello is accepted... yes whether the server understands TLS closure alerts... partially whether the server supports session resumption... yes for anonymous authentication support... no for ephemeral Diffie-Hellman support... no for RFC7919 Diffie-Hellman support... no for AES-GCM cipher (RFC5288) support... no for AES-CCM cipher (RFC6655) support... no for AES-CCM-8 cipher (RFC6655) support... no for AES-CBC cipher (RFC3268) support... no for CAMELLIA-GCM cipher (RFC6367) support... no for CAMELLIA-CBC cipher (RFC5932) support... no # This is now correct: for 3DES-CBC cipher (RFC2246) support... yes # This is now correct: for ARCFOUR 128 cipher (RFC2246) support... yes for CHACHA20-POLY1305 cipher (RFC7905) support... no for GOST28147-CNT cipher (draft-smyshlyaev-tls12-gost-suites) support... no for MD5 MAC support... yes for SHA1 MAC support... yes for SHA256 MAC support... no for GOST28147-IMIT MAC (draft-smyshlyaev-tls12-gost-suites) support... no Signed-off-by: Daniel Lenski <dlenski@gmail.com>
| * tests/cert-test/invalid-sig: use datefudge to test expired certsDaiki Ueno2020-08-311-18/+25
| | | | | | | | | | | | | | Suggested by Andreas Metzler in: https://gitlab.com/gnutls/gnutls/-/issues/1021 Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * tests: check_for_datefudge: don't exit the test programsDaiki Ueno2020-08-3148-48/+53
| | | | | | | | | | | | | | | | This makes check_for_datefudge not to immediately exit the program, but to return non-zero to allow the tests by themselves to control the behavior when "datefudge" is not found. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * configure.ac: prefer the latest version of build infrastructureDaiki Ueno2020-08-311-0/+3
| | | | | | | | | | | | | | | | | | | | AM_GNU_GETTEXT_REQUIRE_VERSION tells autopoint to copy the latest possible build infrastructure installed on the system, rather than the fixed version from the archive.dir.tar.xz. This makes the bootstrapping slightly faster and allows us not to stick with the ancient gettext version. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * configure: improve nettle, gmp, and hogweed soname detectionVitezslav Cizek2020-08-311-3/+12
| | | | | | | | | | | | | | | | | | | | | | Some linkers might optimize away the libraries passed on the command line if they aren't actually needed, such as gnu ld with --as-needed. The ldd output then won't list the shared libraries and the detection will fail. Make sure nettle and others are really used. Signed-off-by: Vitezslav Cizek <vcizek@suse.com>
| * tests: updated tlsfuzzer tests to latest versionKrenzelokFrantisek2020-08-312-0/+2
| | | | | | | | | | | | excluded some tests from test-certificate-malformed.py Signed-off-by: KrenzelokFrantisek <krenzelok.frantisek@gmail.com>
| * gnutls_cipher_init: fix potential memleakDaiki Ueno2020-08-311-4/+14
| | | | | | | | | | | | | | | | Upon failure this function returns without freeing memory allocated internally. This makes sure that it is released and do not touch the output handle argument. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * gnutls_aead_cipher_init: fix potential memleakDaiki Ueno2020-08-311-4/+11
| | | | | | | | | | | | | | | | | | | | | | When _gnutls_aead_cipher_init() fails, the function returns without freeing the allocted handle. This was once fixed in commit 502be130493e8ce802cdf60fffdbb5f1885352a5 but regressed after a code reorganization in commit 2eef509ce5f2d250f8dcaeffa46444dd2b694e91. Reported by Miroslav Lichvar. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * serv: omit upper bound of --maxearlydata option definitionDaiki Ueno2020-08-311-1/+1
|/ | | | | | | | | | | | | | It turned out that AutoGen treats numbers that exceed INT_MAX in a platform dependent way. In this case, 4294967295 (UINT_MAX) is treated as is on 64-bit platforms, while it is interpreted as "-1" on 32-bit platforms. This causes a problem when the program documentation is compiled under multilib environment. Reported by Ivan Molodetskikh in: https://bugzilla.redhat.com/show_bug.cgi?id=1841844 and the cause was identified by Anderson Toshiyuki Sasaki. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'tmp-fix-iov-3_6' into 'gnutls_3_6_x'Daiki Ueno2020-06-212-40/+29
|\ | | | | | | | | crypto-api: always allocate memory when serializing iovec_t See merge request gnutls/gnutls!1290
| * crypto-api: always allocate memory when serializing iovec_ttmp-fix-iov-3_6Daiki Ueno2020-06-142-40/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The AEAD iov interface falls back to serializing the input buffers if the low-level cipher doesn't support scatter/gather encryption. However, there was a bug in the functions used for the serialization, which causes memory leaks under a certain condition (i.e. the number of input buffers is 1). This patch makes the logic of the functions simpler, by removing a micro-optimization that tries to minimize the number of calls to malloc/free. The original problem was reported by Marius Steffen in: https://bugzilla.samba.org/show_bug.cgi?id=14399 and the cause was investigated by Alexander Haase in: https://gitlab.com/gnutls/gnutls/-/merge_requests/1277 Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'fix-vista-ci-3_6_x' into 'gnutls_3_6_x'Dmitry Baryshkov2020-06-151-2/+45
|\ \ | |/ |/| | | | | Fix Vista CI and add a Vista DLL target (3_6_x branch) See merge request gnutls/gnutls!1282
| * CI: fix typo in the Vista targetSteve Lhomme2020-06-151-2/+45
|/ | | | | | | This resulted in the MinGW64.Vista+ target doing the same thing as the MinGW64 target. Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
* Merge branch 'tmp-fix-36-mandatory-lib' into 'gnutls_3_6_x'Dmitry Baryshkov2020-06-073-8/+8
|\ | | | | | | | | Merge the extra libraries to link dynamically in GNUTLS_LIBS_PRIVATE See merge request gnutls/gnutls!1281
| * Merge the extra libraries to link dynamically in GNUTLS_LIBS_PRIVATESteve Lhomme2020-06-073-8/+8
|/ | | | | | | | | This should fix #1020 where bcrypt is missing from thirdparty_libadd. Ultimately it would be good to add libraries that always need to be linked in one variable that is shared between the Makefile and the pkg-config file. Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
* Merge branch 'tmp-release-3.6.14' into 'master'3.6.14Daiki Ueno2020-06-033-4/+36
|\ | | | | | | | | Release 3.6.14 [ci skip] See merge request gnutls/gnutls!1272
| * Release 3.6.14 [ci skip]Daiki Ueno2020-06-033-4/+36
|/ | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'tmp-totp-init' into 'master'Daiki Ueno2020-06-034-19/+23
|\ | | | | | | | | stek: differentiate initial state from valid time window of TOTP See merge request gnutls/gnutls!1275
View Lorry Controller Status