summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* _gnutls_epoch_gc: ensure there are no stray epochs after gcNikos Mavrogiannopoulos2017-09-251-3/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* constate: simplified allocation of epochsNikos Mavrogiannopoulos2017-09-254-53/+30
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_epoch_get(): simplified useNikos Mavrogiannopoulos2017-09-253-5/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt/q_set_spki: always initialize the spki structureNikos Mavrogiannopoulos2017-09-242-2/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: always initialize the inline commands structtmp-enhance-static-analyzerNikos Mavrogiannopoulos2017-09-241-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli-debug: eliminated memory leaksNikos Mavrogiannopoulos2017-09-241-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsptool: eliminate memory leaksNikos Mavrogiannopoulos2017-09-241-5/+13
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: use assert to protect var accessNikos Mavrogiannopoulos2017-09-241-1/+3
| | | | | | | The code correctly uses the variables, but the assert ensures that static analyzers follow the intended paths too. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* srptool: removed unused variablesNikos Mavrogiannopoulos2017-09-241-4/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* psktool: remove unused variablesNikos Mavrogiannopoulos2017-09-241-4/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: fix memory leakNikos Mavrogiannopoulos2017-09-241-1/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tools: eliminated dead assignmentsNikos Mavrogiannopoulos2017-09-243-15/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsptool: check chain size on verificationNikos Mavrogiannopoulos2017-09-241-1/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: use static analyzer and Werror build in srcNikos Mavrogiannopoulos2017-09-241-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhanced resumption checks with same and different SNItmp-sni-fixesNikos Mavrogiannopoulos2017-09-231-1/+35
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* server name: refuse to resume a session which server name doesn't matchNikos Mavrogiannopoulos2017-09-233-0/+46
| | | | | | | | That is, follow the RFC6066 requirement that server: "MUST NOT accept the request to resume the session if the server_name extension contains a different name." Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: eliminate few memory leaksNikos Mavrogiannopoulos2017-09-232-4/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: New test for SNI parsing during cache-based session resumptionThomas Klute2017-09-232-1/+82
| | | | | Signed-off-by: Thomas Klute <thomas2.klute@uni-dortmund.de> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Ensure the SNI extension is parsed during cache-based resumptionThomas Klute2017-09-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes the parse_type of the SNI extension to GNUTLS_EXT_MANDATORY to ensure it is parsed during every handshake. With SNI previously classified as GNUTLS_EXT_APPLICATION, GnuTLS servers ignored the SNI extension when resuming a TLS session from cache, because "application" level extensions are skipped during resumption. As a result, gnutls_server_name_get() always returned GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE when called on the resumed session, breaking virtual server systems. According to RFC 6066, Section 3 the SNI extension must be parsed on session resumption if implemented at all: "A server that implements this extension MUST NOT accept the request to resume the session if the server_name extension contains a different name." This change allows applications using GnuTLS to match SNI data on resumed sessions. Signed-off-by: Thomas Klute <thomas2.klute@uni-dortmund.de>
* tests: explicitly check for gnutls.pc in pkgconfig.shDmitry Eremin-Solenikov2017-09-201-0/+5
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* test: use proper library name in pkgconfig.sh error messageDmitry Eremin-Solenikov2017-09-201-7/+9
| | | | | | | | If there is a -R flag in p11-kit-1.pc file, pkgconfig.sh test will still reference libidn2.pc, rather than proper source of the message. Also move the test for library flags before updating PKG_CONFIG_PATH. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tests: use libidn2 in pkgconfig.shDmitry Eremin-Solenikov2017-09-201-4/+6
| | | | | | | Since abe6a12b9766219163f99d7807a0b07fbe5f590c GnuTLS does not support libidn1. Switch pkgconfig.sh test to use libidn2. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* parse-datetime: Fix buffer overflowTim Rühsen2017-09-191-10/+7
|
* tlsfuzzer: document the reason of failure of few fragmentation testsNikos Mavrogiannopoulos2017-09-191-2/+2
| | | | | | | | | | | It seems that gnutls does not accept records carrying handshake messages that contain less bytes than necessary to recover the handshake header. The TLS protocol allows that option, and other implementations seem to accept that fragmentation. Relates #272 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* parse_handshake_header: removed duplicate checkNikos Mavrogiannopoulos2017-09-191-5/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ecdh: return more appropriate error code on empty packetNikos Mavrogiannopoulos2017-09-191-0/+5
| | | | | | | | This makes tlsfuzzer's test-x25519 detect the right error code on empty message. Previously this issue was masked by our refusal to accept 1-byte sized fragments. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* parse_handshake_header: allow 1-byte sized fragmentsNikos Mavrogiannopoulos2017-09-191-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for DTLS infinite loopNikos Mavrogiannopoulos2017-09-195-5/+441
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11/get_key_algo_type(): Always initialize bits variableTim Rühsen2017-09-181-2/+2
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* tests/base64-raw: Remove unused variableTim Rühsen2017-09-181-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* gnutls.h: Remove redundant function declarationsTim Rühsen2017-09-181-14/+0
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* x509: removed debugging code [ci skip]Nikos Mavrogiannopoulos2017-09-161-1/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: modified the MD5 signature algorithm negotiation teststmp-remove-sha224Nikos Mavrogiannopoulos2017-09-134-335/+721
| | | | | | | | Since GnuTLS can no longer negotiate MD5, we utilize a byte stream of a connection which advertises MD5, and we make sure we detect the right error code for the rejection of MD5 signature. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-09-131-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsfuzzer: no longer include tests involving SHA224 signaturesNikos Mavrogiannopoulos2017-09-131-1/+8
| | | | | | We no longer support them. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* algorithms/sign: removed TLS identifiers for legacy algorithmsNikos Mavrogiannopoulos2017-09-131-6/+5
| | | | | | | | | That is, for the MD5-using algorithms, as well as for the DSA2 signature algorithms that were never really used with TLS 1.2. Kept DSA-SHA1 in order to be used by TLS 1.2 and legacy applications. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* algorithms/sign: legacy signature algorithms were moved toward the end of ↵Nikos Mavrogiannopoulos2017-09-131-168/+183
| | | | | | the list Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* algorithms/sign: no longer enable SHA224 hash in signaturesNikos Mavrogiannopoulos2017-09-131-3/+4
| | | | | | | | TLS 1.3 requires that SHA224 MUST NOT be used, and given the fact that SHA224 was never widespread used in TLS 1.2, there is no reason to keep these algorithms at all. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsfuzzer: added large client hello teststmp-large-client-hello-tlsfuzzerNikos Mavrogiannopoulos2017-09-081-0/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* win32: removed no longer used subdirNikos Mavrogiannopoulos2017-09-083-218/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: added warning cppcheck checksNikos Mavrogiannopoulos2017-09-081-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: removed initialization stepNikos Mavrogiannopoulos2017-09-081-21/+1
| | | | | | | | That is, combine syntax-check with the static analyzers run. That provides more parallelism per build and reduces the overall time spent on a successful run. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: added README on FreeBSD CI setupNikos Mavrogiannopoulos2017-09-081-0/+70
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: added FreeBSD buildNikos Mavrogiannopoulos2017-09-081-21/+21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: ip-utils: added include for FreeBSD compilationNikos Mavrogiannopoulos2017-09-081-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: enable more cppcheck testsNikos Mavrogiannopoulos2017-09-082-2/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: updated tlsfuzzer to reduce rsa-pss failuresNikos Mavrogiannopoulos2017-09-081-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* crq: doc updatetmp-sign-with-default-algoNikos Mavrogiannopoulos2017-09-081-2/+16
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for gnutls_x509_crq_signNikos Mavrogiannopoulos2017-09-082-1/+165
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added verification checks into crl_apisNikos Mavrogiannopoulos2017-09-081-46/+80
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status