summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'wip/dueno/external-psk-importer' into 'master'HEADmasterDaiki Ueno2023-05-0520-86/+791
|\ | | | | | | | | | | | | psk: Add basic support for RFC 9258 external PSK importer interface Closes #1355 See merge request gnutls/gnutls!1741
| * psk: Add basic support for RFC 9258 external PSK importer interfaceDaiki Ueno2023-05-0420-86/+791
|/ | | | | | | | | | | | | | | | | | | | | | | | This adds a minimal, callback-based API to import external PSK, following RFC 9258. The client and the server importing external PSK are supposed to set a callback to retrieve PSK, which returns flags that may indicate the PSK is imported, along with the key: typedef int gnutls_psk_client_credentials_function3( gnutls_session_t session, gnutls_datum_t *username, gnutls_datum_t *key, gnutls_psk_key_flags *flags); typedef int gnutls_psk_server_credentials_function3( gnutls_session_t session, const gnutls_datum_t *username, gnutls_datum_t *key, gnutls_psk_key_flags *flags); Those callbacks are responsible to call gnutls_psk_format_imported_identity() for external PSKs to build a serialized PSK identity, and set GNUTLS_PSK_KEY_EXT in flags if the identity is an imported one. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/clang-format' into 'master'Daiki Ueno2023-04-241077-111576/+104519
|\ | | | | | | | | build: switch to using clang-format instead of GNU indent See merge request gnutls/gnutls!1727
| * build: re-indent codeDaiki Ueno2023-04-241069-111337/+103655
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * doc: add missing documentation for enumsDaiki Ueno2023-04-241-0/+4
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * .gitlab-ci.yml: install clang15-extra-tools for clang-formatDaiki Ueno2023-04-241-1/+1
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * gnutls.h.in: stop indenting doc-comments for typedefsDaiki Ueno2023-04-241-81/+81
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * build: use /* clang-format {on|off} */ annotationDaiki Ueno2023-04-2418-78/+8
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * doc: mention how to indent source codeDaiki Ueno2023-04-242-7/+6
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * build: switch to using clang-format instead of GNU indentDaiki Ueno2023-04-244-66/+758
|/ | | | | | | | | | | | | | | | | | | | | | | | | | GNU indent yields weird output when using the Linux kernel coding style as in the below examples, which affects code readability. - Too long lines cause unexpected indentation: if (! (priv->flags & GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED) && (priv->flags & GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT) && data.size > 0) { - Unary operators (`-` and `+`) after a type cast are not recognized properly: `(time_t)-1` becomes `(time-t) - 1` - Long conditionals are wrapped before binary operators, such as `&&` or `||`. This is not mandatory in the style, but all the occurrences are replaced with that style This switches to using clang-format instead, with the configuration used in the Linux kernel as of commit 596ff4a09b8981790e15572e8e7bc904df5835e7: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/.clang-format Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/shuffle-exts-followup' into 'master'Daiki Ueno2023-04-219-46/+67
|\ | | | | | | | | doc: mention ClientHello extensions shuffling See merge request gnutls/gnutls!1738
| * doc: fix typo in %DISABLE_SAFE_RENEGOTIATION documentationDaiki Ueno2023-04-201-2/+2
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * doc: mention ClientHello extensions shufflingDaiki Ueno2023-04-202-0/+13
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * hello_ext: minor cleanup of extension shuffling codeDaiki Ueno2023-04-207-44/+52
|/ | | | | | | | | | This reduces the number of calls to gnutls_rnd(GNUTLS_RND_RANDOM) based on the assumption that extension indices fit in uint8_t. This also renames the priority string modifier from %NO_EXTS_SHUFFLE to %NO_SHUFFLE_EXTENSIONS. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'master' into 'master'Daiki Ueno2023-04-131-0/+44
|\ | | | | | | | | add test for gnutls_certificate_set_x509_trust See merge request gnutls/gnutls!1740
| * tests: add test for gnutls_certificate_set_x509_trustxuraoqing2023-04-131-0/+44
|/ | | | Signed-off-by: xuraoqing <xuraoqing@huawei.com>
* Merge branch 'tmp-ametzler-faketime' into 'master'Daiki Ueno2023-04-0559-228/+255
|\ | | | | | | | | Use faketime instead of datefudge See merge request gnutls/gnutls!1716
| * Update docs for faketime instead of datefudgeAndreas Metzler2023-04-042-4/+5
| | | | | | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
| * Drop unused function.Andreas Metzler2023-04-041-13/+0
| | | | | | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
| * Also use gnutls_timewrapper non-frozen timeAndreas Metzler2023-04-0433-87/+87
| | | | | | | | | | | | also switch timeout/wrapper order Signed-off-by: Andreas Metzler <ametzler@bebt.de>
| * Use gnutls_timewrapper for static (frozen time) instancesAndreas Metzler2023-04-0432-116/+113
| | | | | | | | | | | | Also switch setsid/wrapper order Signed-off-by: Andreas Metzler <ametzler@bebt.de>
| * Add wrapper around faketime/datefudgeAndreas Metzler2023-04-041-3/+45
| | | | | | | | | | | | Prefer faketime, fall back to datefudge. Signed-off-by: Andreas Metzler <ametzler@bebt.de>
| * Change timestamp format for faketime compatibility.Andreas Metzler2023-04-0431-88/+88
|/ | | | | | | Change all timestamps passed to "datefudge -s" to "YYYY-MM-DD hh:mm:ss" format for compatibility with faketime -f ("Freeze clock" advanced format) Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* Merge branch 'issue1471' into 'master'Daiki Ueno2023-04-042-5/+15
|\ | | | | | | | | Fix for issue #1471: Add configurable timeout to gnutls-serv See merge request gnutls/gnutls!1726
| * gnutls-serv: add configurable timeoutATHARVA S MARATHE2023-04-042-5/+15
|/ | | | | | | | This adds --timeout option to gnutls-serv to control the inactivity interval, which would be useful for testing. Fixes: #1471 Signed-off-by: maratheatharva <atharvamarathe8@gmail.com>
* Merge branch 'pbkdf' into 'master'Daiki Ueno2023-04-012-3/+33
|\ | | | | | | | | fips: add additional pbkdf limit checks as defined in SP 800-132 See merge request gnutls/gnutls!1736
| * fips: adjust pbkdf2 tests for SP 800-132 limitsTobias Heider2023-03-301-3/+23
| | | | | | | | | | | | | | | | - Make sure to always use approved iteration count - Check that salt < 16 return non-approved - Check that iteration count < 1000 returns non-approved Signed-off-by: Tobias Heider <tobias.heider@canonical.com>
| * fips: add additional pbkdf limit checks as defined in SP 800-132Tobias Heider2023-03-301-0/+10
| | | | | | | | Signed-off-by: Tobias Heider <tobias.heider@canonical.com>
* | Merge branch 'dev0' into 'master'Daiki Ueno2023-04-017-7/+64
|\ \ | |/ |/| | | | | | | | | added clientHello extension permutation Closes #1465 See merge request gnutls/gnutls!1737
| * hello_ext: add ClientHello extension permutation@Ajit2023-04-017-7/+64
|/ | | | | | | | | This adds a mechanism to randomize the order of TLS extensions in the ClientHello to make fingerprinting harder. The mechanism is enabled by default and a new priority keyword %NO_EXTS_SHUFFLE has been added to turn it off. Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>
* Merge branch 'wip/dueno/psk-username' into 'master'Daiki Ueno2023-03-305-18/+11
|\ | | | | | | | | src: print_info: prefer gnutls_psk_server_get_username2 See merge request gnutls/gnutls!1730
| * psk: guard against the case where psk_auth_info_t has NULL usernameDaiki Ueno2023-03-214-14/+5
| | | | | | | | | | | | | | This happens when gnutls_psk_server_get_username is called from a client. Also simplify the embedded NUL-byte check with memchr. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * src: print_info: prefer gnutls_psk_server_get_username2Daiki Ueno2023-03-211-4/+6
| | | | | | | | | | | | | | | | gnutls_psk_server_get_username only supports NUL-terminated usernames, while we added support for non-NULL terminated usernames in d00638997fa269a975095d852633b48b2b64fbf9. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'dev' into 'master'Daiki Ueno2023-03-2810-14/+26
|\ \ | | | | | | | | | | | | Modifier GNUTLS_NO_EXTENSIONS renamed to GNUTLS_NO_DEFAULT_EXTENSIONS See merge request gnutls/gnutls!1734
| * | changes to keep backward compatibilitypeonix2023-03-284-0/+12
| | | | | | | | | | | | Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>
| * | reformattedpeonix2023-03-281-2/+2
| | | | | | | | | | | | Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>
| * | Updated desc for @GNUTLS_NO_DEFAULT_EXTENSIONSpeonix2023-03-281-1/+1
| | | | | | | | | | | | Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>
| * | Modifier GNUTLS_NO_EXTENSIONS renamed to GNUTLS_NO_DEFAULT_EXTENSIONSpeonix2023-03-288-13/+13
|/ / | | | | | | Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>
* | Merge branch 'master' into 'master'Daiki Ueno2023-03-222-4/+21
|\ \ | | | | | | | | | | | | add DER crl list import test See merge request gnutls/gnutls!1733
| * | fix incorrect parameter description of crl import functionxuraoqing2023-03-221-4/+4
| | | | | | | | | | | | Signed-off-by: xuraoqing <xuraoqing@huawei.com>
| * | add DER crl list import testxuraoqing2023-03-201-0/+17
| | | | | | | | | | | | Signed-off-by: xuraoqing <xuraoqing@huawei.com>
* | | Merge branch 'master' into 'master'Daiki Ueno2023-03-201-0/+29
|\ \ \ | |/ / | | / | |/ |/| add get dn by oid test See merge request gnutls/gnutls!1731
| * add get dn by oid testxuraoqing2023-03-201-0/+29
|/ | | | Signed-off-by: xuraoqing <xuraoqing@huawei.com>
* Merge branch 'tests-keys_limits_single' into 'master'Daiki Ueno2023-03-181-246/+94
|\ | | | | | | | | test:tls13/key_limits: rewrite key_limits testcase as single process See merge request gnutls/gnutls!1728
| * rewrite tests/tls13/key_limits.c in single processYongye Zhu2023-03-181-246/+94
|/ | | | Signed-off-by: Yongye Zhu <zyy1102000@gmail.com>
* Merge branch 'wip/dueno/pre-bootstrap' into 'master'Daiki Ueno2023-03-181-2/+3
|\ | | | | | | | | .gitlab-ci.yml: make use of .pre stage See merge request gnutls/gnutls!1729
| * .gitlab-ci.yml: make use of .pre stageDaiki Ueno2023-03-181-2/+3
|/ | | | | | | | | | Jobs in the .pre stage run before any other jobs: https://docs.gitlab.com/ee/ci/yaml/index.html#stage-pre As commit-check is lightweight and a prerequisite for merging MRs, this moves it from the test stage to .pre. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'wip/dueno/distrust-after' into 'master'Daiki Ueno2023-03-179-3/+647
|\ | | | | | | | | | | | | pkcs11: respect Mozilla's time-based distrust upon issuer lookup Closes #912 See merge request gnutls/gnutls!1725
| * pkcs11: respect Mozilla's time-based distrust upon issuer lookupDaiki Ueno2023-03-179-3/+647
| | | | | | | | | | | | | | | | | | This implements the basic logic needed to support time-based distrust of CA, according to [1]. 1. https://wiki.mozilla.org/CA/Additional_Trust_Changes#Distrust_After Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'master' into 'master'Daiki Ueno2023-03-131-0/+55
|\ \ | |/ |/| | | | | add CRL issuer get test See merge request gnutls/gnutls!1722
View Lorry Controller Status