summaryrefslogtreecommitdiff
path: root/lib/Makefile.am
Commit message (Collapse)AuthorAgeFilesLines
* trust: make filesystem path construction flexibleDaiki Ueno2023-01-111-1/+1
| | | | | | | | | | To handle pathnames longer than the fixed length (previously 256), this adds a set of internal API functions around the gnutls_pathbuf_st struct, which enables to safely and efficiently construct pathnames. The new API initially uses the statically allocated buffer and starts allocating memory on heap only after the limit has reached. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* fips: rename .gnutls.hmac back to .libgnutls.so.*.hmacDaiki Ueno2022-11-301-4/+4
| | | | | | | | | | | | | Using a GnuTLS specific construction of .hmac file name causes a problem with dracut, which expects that .hmac files are installed alongside the corresponding shared libraries. To preserve backward compatibility, this renames the file name back to .libgnutls.so.*.hmac, while the content remains the same covering all the dependent libraries (libgnutls, libhogweed, libnettle, and libgmp). Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Extend fipshmac to take a path to libgnutls.soZoltan Fridrich2022-05-051-1/+1
| | | | Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
* Consolidate FIPS .hmac filesZoltan Fridrich2022-03-301-3/+3
| | | | Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
* tpm2: dynamically load tss2 libraries as neededDaiki Ueno2022-03-021-3/+3
| | | | | | | | | libtss2-esys links to OpenSSL or mbed TLS for cryptography, which may cause packaging issues. This instead dlopen's tss2 libraries as needed so non-TPM applications continue working without loading multiple crypto libraries. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Add compress_certificate extension (RFC8879)Zoltan Fridrich2022-03-011-2/+11
| | | | Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
* build: hide maintainer tool invocation behind AM_V_GENDaiki Ueno2022-01-161-3/+3
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Port openconnect TPM2 codeNikos Mavrogiannopoulos2021-11-131-2/+7
| | | | | | | | | | This introduces transparent loading of TPM2 keys which are in PEM form by gnutls_privkey_import_x509_raw() and higher level functions which wrap it. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Co-authored-by: David Woodhouse <dwmw2@infradead.org> Co-authored-by: Daiki Ueno <ueno@gnu.org>
* ktls: basic implementation of SW modeHedgehog50402021-10-191-1/+1
| | | | | | | | | | | | | | | | | ktls enables us to offload encryption/decryption to the kernel prerequisites: - configured with `--enable-ktls` - tls module `modprobe tls` check with 'lsmod | grep tls' - per connection: gnutls_transport_set_int{2} must be set When prerequisities are met then ktls is used by default. If GnuTLS encounters a error during KTLS initialization, it will not use ktls and fallback to userspace. Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
* build: do not install .hmac filesDaiki Ueno2021-04-251-11/+0
| | | | | | | | | | | | It turned out that distro package building process might perform post-processing (e.g., strip) of the shared libraries after install, and that may cause inconsistency with the installed .hmac files. Let's not try too hard on this but defer the final hmac calculation to distributions. It is still useful to keep our own fipshmac as it makes it easier to run FIPS tests. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* fips: replace fipshmac usage with internal programOndrej Moris2021-02-171-0/+24
| | | | | | | | | | | This introduces a non-installed program "fipshmac" and uses it for generating HMAC files required in FIPS 140-2. The generated files are installed along with the main library. Resolves issues #1101. Signed-off-by: Ondrej Moris <omoris@redhat.com> Co-authored-by: Daiki Ueno <dueno@redhat.com>
* build: use $(LIBPTHREAD) rather than non-existent $(LTLIBPTHREAD)tmp-pthreadJames Bottomley2020-06-291-1/+7
| | | | | | | | | | | | | | | | | | | | On a very recent openSUSE build, libgnutls is getting built without libpthread. This caused a thread related error when trying to load a pkcs11 module that uses threading. The reason is rather convoluted: glibc actually controls all the pthread_ function calls, but it returns success without doing anything unless -lpthread is in the link list. What's happening is that gnutls_system_mutex_init() is being called on _gnutls_pkcs11_mutex before library pthreading is initialized, so the pthread_mutex_init ends up being a nop. Then, when the pkcs11 module is loaded, pthreads get initialized and the call to pthread_mutex_lock is real, but errors out on the uninitialized mutex. The problem seems to be that nothing in the gnulib macros gnutls relies on for threading support detection actually sets LTLIBPTHREAD, they only set LIBPTHREAD. The fix is to use LIBPTHREAD in lib/Makefile.in Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* Merge the extra libraries to link dynamically in GNUTLS_LIBS_PRIVATESteve Lhomme2020-06-061-1/+1
| | | | | | | | | This should fix #1020 where bcrypt is missing from thirdparty_libadd. Ultimately it would be good to add libraries that always need to be linked in one variable that is shared between the Makefile and the pkg-config file. Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
* win32: link with crypt32Steve Lhomme2020-05-201-5/+1
| | | | | | | | | | | Since 5d03564cccd2c10c41252ea468d4a098bd08e9c1 we use CertOpenStore(). To properly link it needs to be linked with the crypt32.dll. https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certopenstore This library was missing from the pkg-config library. It exists in thirdparty_libadd to link gnutls as a DLL. Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
* Add GOST key transport supportDmitry Eremin-Solenikov2019-11-071-0/+8
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* lib: drop gnutls_uint64 usage as sequence numberDmitry Eremin-Solenikov2019-10-241-1/+1
| | | | | | | | GnuTLS is depending already on uint64_t being a properly defined type. So there is no need to have a special byte-array type for 8-byte integers. Use uint64_t instead, thus simplifying a code quite heavily. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* iov: add iterator interface for giovec_tDaiki Ueno2019-08-091-1/+2
| | | | | | | This adds an iterator interface over giovec_t array, extracting a fixed sized block. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Ship inih/LICENSE.txt in release tarballAndreas Metzler2019-07-291-1/+1
| | | | | | | inih's license terms requires shipping a copy of the license when redistributing the source. Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* Use inih to parse configuration fileNikos Mavrogiannopoulos2019-06-201-3/+3
| | | | | | | | | This introduces the inih copylib, and makes our configuration file parsing more flexible. Relates: #587 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added profile to correspond to the future security parameterNikos Mavrogiannopoulos2019-05-201-1/+1
| | | | | | | | | | It seems that the FUTURE security level parameter was added without a corresponding verification profile. This patch address the issue by introducing it. Resolves: #770 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: increase the default number of tickets we send to 2tmp-increase-nr-of-ticketsNikos Mavrogiannopoulos2019-03-201-5/+5
| | | | | | | | | | | This makes it easier for clients which perform multiple connections to the server to use the tickets sent by a default server. That's because 2 tickets allow for 2 new connections (if one is using each ticket once as recommended), which in turn lead to 4 new and so on. Resolves: #596 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use inet_pton() from gnulibtmp-gnulib-ptonTim Rühsen2019-02-101-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use inet_ntop() from gnulibtmp-gnulib-ntopTim Rühsen2019-02-071-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* update on "Fix gnutls.pc for multiarch builds"Nikos Mavrogiannopoulos2019-01-231-1/+1
| | | | | | | This replaces LTLIBUNISTRING with LIBUNISTRING in Makefile.am. The former is no longer produced by configure.ac. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* vasprintf: use from gnulib; don't bundle twiceNikos Mavrogiannopoulos2018-12-191-1/+1
| | | | | | Relates #653 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-151-3/+3
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-121-1/+2
| | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: handle early dataDaiki Ueno2018-11-111-0/+1
| | | | | | | | | | | This plumbers early data handling in the handshake processes, which consists of: - traffic key updates taking into account of client_early_traffic_secret - early data buffering in both server and client - the EndOfEarlyData message handling - making use of max_early_data_size extension in NewSessionTicket Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Added session ticket key rotation with TOTPAnder Juaristi2018-09-191-2/+2
| | | | | | | | | | | This introduces session ticket key rotation on server side. The key set with gnutls_session_ticket_enable_server() is used as a master key to generate time-based keys for tickets. The rotation relates to the gnutls_db_set_cache_expiration() period. Resolves #184 Signed-off-by: Ander Juaristi <a@juaristi.eus>
* cipher: separated CBC w/o EtM handlingNikos Mavrogiannopoulos2018-06-121-1/+1
| | | | | | This would allow to further modify for more invasive work-arounds. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added support for out-of-band Pre-shared keys under TLS1.3Ander Juaristi2018-04-061-1/+2
| | | | | | | | | | | That adds support for pre-shared keys with and without Diffie-Hellman key exchange. That's a modified version of initial Ander's patch. Resolves #414 Resolves #125 Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.org>
* x509/cert: reorganizedNikos Mavrogiannopoulos2018-02-191-2/+2
| | | | | | | Split functionality related to certificate credentials and session certificate handling in cert-cred.c and cert-session.c Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ocsp: moved non-extension related functions to ocsp-api.cNikos Mavrogiannopoulos2018-02-191-1/+1
| | | | | | | That keeps ext/status_response.c clear of items that are not related with the extension handling. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: added support for post-handshake authenticationNikos Mavrogiannopoulos2018-02-191-1/+2
| | | | | | | | | | | | That is: * introduced a gnutls_init() flag for clients to enable post-handshake authentication * introduced gnutls_reauth() function, to be called by servers to request authentication, and by clients to perform authentication Resolves #562 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: added TLS1.3 passive key updateNikos Mavrogiannopoulos2018-02-191-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: added support for reading and sending cookie extensionNikos Mavrogiannopoulos2018-02-191-1/+2
| | | | | | That introduces an internal API to associate data to an extension. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: send hello retry request when no key share matchesNikos Mavrogiannopoulos2018-02-191-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: parse new session ticket messageNikos Mavrogiannopoulos2018-02-191-0/+1
| | | | | | That does not include extension handling. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: added basic support for TLS 1.3 handshake in client sideNikos Mavrogiannopoulos2018-02-191-1/+6
| | | | | | | | | | | | | That does not include support for client certificates as it requires extension handling improvements in order for extensions to be context sensitive (now they cannot distinguish whether the parsing routine is called during client hello or certificate request reading) This does not include proper parsing of extensions present in the certificate message. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: added parsing of encrypted extensionsNikos Mavrogiannopoulos2018-02-191-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* crypto-api: introduce internal version of AEAD APINikos Mavrogiannopoulos2018-02-191-1/+1
| | | | | | | This allows to initialize the TLS 1.3 connection state without additional allocations as required by the external API. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: introduced TLS 1.3 handshake client state machine outlineNikos Mavrogiannopoulos2018-02-191-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* extensions: files renamed to hello_extNikos Mavrogiannopoulos2018-02-191-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* extv: introduced a low-level extension parsing codeNikos Mavrogiannopoulos2018-02-191-1/+1
| | | | | | | This will simplify the parsing and handling of extensions throughout the TLS 1.3 message contents. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added TLS 1.3 HKDF key derivation functionalityNikos Mavrogiannopoulos2018-02-191-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fips140: added function for applications to switch the FIPS140-2 modeNikos Mavrogiannopoulos2018-02-191-1/+1
| | | | | | | | | | That would allow FIPS140-2 compliant applications to use forbidden algorithms by switching to a lax FIPS140-2 mode. Resolves #352 Resolves #353 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* sed: use it in a portable way in makefilesNikos Mavrogiannopoulos2017-08-201-3/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Introduced atomic.h to simplify handling of atomic integersNikos Mavrogiannopoulos2017-07-251-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* priority_options.gperf: modified for gperf 3.1Nikos Mavrogiannopoulos2017-07-061-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status