summaryrefslogtreecommitdiff
path: root/lib/errors.c
Commit message (Collapse)AuthorAgeFilesLines
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* tls13/certificate: utilize "certificate_required" alerttmp-cert-reqDaiki Ueno2019-03-051-0/+2
| | | | | | | This could make errors more distinguishable when the client sends no certificates or a bad certificate. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Add GNUTLS_E_RECEIVED_DISALLOWED_NAME for illegal SNI namesTim Rühsen2019-01-311-2/+4
| | | | | | | | | | An illegal/disallowed SNI server name previously generated the misleading message "An illegal parameter has been received.". This commit changes it to "A disallowed SNI server name has been received.". Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* vasprintf: use from gnulib; don't bundle twiceNikos Mavrogiannopoulos2018-12-191-1/+0
| | | | | | Relates #653 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-121-0/+2
| | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_set_add_functionDaiki Ueno2018-11-121-0/+1
| | | | | | | This adds a way to store an entry if it is not found in the database, so that the implementation can provide atomic test-and-set. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: send missing extension alertNikos Mavrogiannopoulos2018-10-161-0/+2
| | | | | | | When a key share extension is not seen under TLS1.3, send the missing extension alert. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* trust list: added flag to force failure on CRL validation errorNikos Mavrogiannopoulos2018-09-211-0/+2
| | | | | | | This allows an application to be notified of the addition of invalid CRLs in the trust list. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs11_token_get_ptr, gnutls_pkcs11_obj_get_ptr: introducedNikos Mavrogiannopoulos2018-05-211-0/+2
| | | | | | | | | This allows an application to open a PKCS#11 token using a URI, and use it directly, bypassing gnutls. That is useful to take advantage of PKCS#11 functionality not wrapped by gnutls but still use PKCS#11 URIs to identify the token. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added support for out-of-band Pre-shared keys under TLS1.3Ander Juaristi2018-04-061-3/+3
| | | | | | | | | | | That adds support for pre-shared keys with and without Diffie-Hellman key exchange. That's a modified version of initial Ander's patch. Resolves #414 Resolves #125 Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.org>
* gnutls_certificate_set_ocsp_status_request_file: match input response to ↵Nikos Mavrogiannopoulos2018-02-191-0/+2
| | | | | | | | | | | certificates That is, iterate through the certificate chain to figure to which certificate the response corresponds to, and assign it to it. That allows for applications to re-use this function to set multiple responses when available. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: added support for post-handshake authenticationNikos Mavrogiannopoulos2018-02-191-0/+2
| | | | | | | | | | | | That is: * introduced a gnutls_init() flag for clients to enable post-handshake authentication * introduced gnutls_reauth() function, to be called by servers to request authentication, and by clients to perform authentication Resolves #562 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added support for key share extensionNikos Mavrogiannopoulos2018-02-191-0/+2
| | | | | | This enables TLS 1.3 key exchange based on the key share extension. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_privkey_verify_seed: improved error on missing validation parametersNikos Mavrogiannopoulos2017-08-071-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* introduced error code GNUTLS_E_PK_INVALID_PUBKEY_PARAMSNikos Mavrogiannopoulos2017-08-041-1/+3
| | | | | | | This is being use to indicate errors in the public key parameters such as the RSA-PSS salt size or digest algorithm. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* GNUTLS_E_INSUFFICIENT_SECURITY: moved to fatal errorsNikos Mavrogiannopoulos2017-05-311-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pubkey_verify_hash2: corrected operation with RSA-PSS keysNikos Mavrogiannopoulos2017-05-291-0/+2
| | | | | | | | | | | | | That is, do not check the flag GNUTLS_VERIFY_USE_RSA_PSS, as we already have enough information to determine whether an RSA-PSS signature is used (the sign algorithm). Also return the code GNUTLS_E_INCOMPATIBLE_SIG_WITH_KEY when a signature algorithm incompatible with the public key is encountered. In addition, fixed few misplacements of GNUTLS_PK_RSA_PSS in switch cases. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls.h: introduced GNUTLS_E_ASN1_TIME_ERRORNikos Mavrogiannopoulos2017-05-011-0/+6
| | | | | | | This corresponds to libtasn1 ASN1_TIME_ENCODING_ERROR and indicates an error in the DER or BER encoding of time field. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls.h: introduced GNUTLS_E_TLS_PACKET_DECODING_ERROR [ci skip]Nikos Mavrogiannopoulos2017-03-081-2/+2
| | | | | | | This is an alias to GNUTLS_E_UNEXPECTED_PACKET_LENGTH. That allows distinguishing the alert from GNUTLS_E_RECORD_OVERFLOW. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* alerts: separated record overflow from decode error alertsNikos Mavrogiannopoulos2017-03-071-0/+3
| | | | | | Introduced GNUTLS_E_RECORD_OVERFLOW. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Introduced GNUTLS_E_CERTIFICATE_TIME_ERROR error codeNikos Mavrogiannopoulos2017-02-171-0/+2
| | | | | | This error code indicates an issue in the time fields of certificate. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Refuse to send data during handshakeNikos Mavrogiannopoulos2017-01-181-1/+1
| | | | | | | | | That prevents buggy applications from transmitting sensitive data during handshake. Resolves #158 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_utf8_password_normalize: perform more strict check on input charactersNikos Mavrogiannopoulos2016-11-281-0/+2
| | | | | That is, ensure that the input characters are in the valid class of characters for the PRECIS FreeformClass.
* When writing alternative names to certificates ensure we write in ACE formatNikos Mavrogiannopoulos2016-11-251-0/+2
|
* pkcs7: return GNUTLS_E_PK_SIG_VERIFY_FAILED on hash mismatchNikos Mavrogiannopoulos2016-11-251-0/+2
| | | | In addition introduce a new error code to warn about no embedded data.
* PKCS#7/8: normalize the password according to rfc7613Nikos Mavrogiannopoulos2016-11-201-0/+2
|
* gnutls_x509_crt_verify_data2: introduce constraints checks on the provided ↵Nikos Mavrogiannopoulos2016-10-181-1/+3
| | | | | | certificate That is check the provided certificate for validity in time and key usage.
* Introduced separate error codes for invalid private and public keysNikos Mavrogiannopoulos2016-09-171-0/+4
| | | | | | This allows functions like decryption and verification to report the specific issue they encountered on public key error. The new codes are GNUTLS_E_PK_INVALID_PUBKEY and GNUTLS_E_PK_INVALID_PRIVKEY
* several spacing fixes to keep syntax-check happyNikos Mavrogiannopoulos2016-09-111-2/+2
|
* x509: Separate out IP handling functionsMartin Ukrop2016-08-091-0/+3
| | | | | | | | | | | | | | - Moved IP/CIDR to string conversion functions into separate header and export privately for the use in tests. - Placed ip_in_cidr() into separate header for easy testing - Add publicly available function to convert text CIDR to RFC5280 format for the use in name constraints extension. - certtool: Use GnuTLS exported CIDR functions instead of local ones. - Export mask_to_prefix, mask_ip for internal GnuTLS use. - Introduce new error value (malformed cidr) and add to description functions in errors.c. Signed-off-by: Martin Ukrop <mukrop@redhat.com>
* introduced: GNUTLS_E_UNAVAILABLE_DURING_HANDSHAKENikos Mavrogiannopoulos2016-07-221-0/+2
| | | | | | | | | This error code is returned when the session resumption parameters are requested during a handshake. That is, to increase the clarity when requesting these parameters while false start is active and the handshake is not complete even if gnutls_handshake() has returned. Relates #114
* errors: include GNUTLS_E_IDNA_ERROR to the listNikos Mavrogiannopoulos2016-05-121-0/+2
|
* Add support for sending unrecognized name alertsHubert Kario2016-05-061-0/+2
| | | | | | To better test support for server_name extension in TLS, it's necessary to be able to differentiate between name being rejected because it is unknown to the server and it being malformed.
* handshake: enhance same certificate checks to apply to PSK/SRP usernameNikos Mavrogiannopoulos2016-04-291-2/+2
| | | | | | That is, unless GNUTLS_ALLOW_ID_CHANGE is specified, during a rehandshake clients will not be allowed to present another certificate than the original, or change their username for PSK or SRP ciphersuites.
* Updated false start support to be transparent to applications.Nikos Mavrogiannopoulos2016-04-151-0/+2
| | | | | | | That is, an additional flag GNUTLS_ENABLE_FALSE_START is introduced for gnutls_init(), and that enables support for false start. At this point false start will be performed by the handshake if possible, and gnutls_record_recv() will handle handshake completion.
* Introduced GNUTLS_E_ASN1_EMBEDDED_NULL_IN_STRINGNikos Mavrogiannopoulos2016-03-161-0/+2
| | | | | This error code is returned when an embedded NULL is detected in a string.
* Do not allow certificate change during a rehandshakeNikos Mavrogiannopoulos2015-12-081-0/+2
| | | | | | That is require that the certificate of the peer remains the same and return GNUTLS_E_SESSION_CERTIFICATE_CHANGED otherwise. To revert to the previous behavior the GNUTLS_ALLOW_CERT_CHANGE flag was introduced.
* When decoding extensions do not ignore decoding errorsNikos Mavrogiannopoulos2015-11-291-0/+2
| | | | | | That is, move from a parsing error tolerance to a more strict decoding approach. Relates #40
* Added API to verify private keys generated with seedNikos Mavrogiannopoulos2015-09-131-0/+2
|
* Introduced GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR to be returned by the ↵Nikos Mavrogiannopoulos2015-08-271-0/+2
| | | | auto-verification functions
* Removed the 'gnutls_' prefix from files to simplify file namingNikos Mavrogiannopoulos2015-08-231-0/+679
View Lorry Controller Status