summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'tmp-pthread' into 'master'Dmitry Baryshkov2020-07-041-1/+7
|\ | | | | | | | | build: use $(LIBPTHREAD) rather than non-existent $(LTLIBPTHREAD) See merge request gnutls/gnutls!1296
| * build: use $(LIBPTHREAD) rather than non-existent $(LTLIBPTHREAD)tmp-pthreadJames Bottomley2020-06-291-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On a very recent openSUSE build, libgnutls is getting built without libpthread. This caused a thread related error when trying to load a pkcs11 module that uses threading. The reason is rather convoluted: glibc actually controls all the pthread_ function calls, but it returns success without doing anything unless -lpthread is in the link list. What's happening is that gnutls_system_mutex_init() is being called on _gnutls_pkcs11_mutex before library pthreading is initialized, so the pthread_mutex_init ends up being a nop. Then, when the pkcs11 module is loaded, pthreads get initialized and the call to pthread_mutex_lock is real, but errors out on the uninitialized mutex. The problem seems to be that nothing in the gnulib macros gnutls relies on for threading support detection actually sets LTLIBPTHREAD, they only set LIBPTHREAD. The fix is to use LIBPTHREAD in lib/Makefile.in Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
* | fix connectx not available on older macOS SDKSteve Lhomme2020-07-021-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes this compilation error: system/fastopen.c:134:9: error: 'connectx' is only available on macOS 10.11 or newer [-Werror,-Wunguarded-availability] ret = connectx(fd, &endpoints, SAE_ASSOCID_ANY, CONNECT_RESUME_ON_READ_WRITE | CONNECT_DATA_IDEMPOTENT, NULL, 0, NULL, NULL); ^~~~~~~~ /Applications/Xcode9.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.13.sdk/usr/include/sys/socket.h:713:5: note: 'connectx' has been marked as being introduced in macOS 10.11 here, but the deployment target is macOS 10.7.0 The detection is the same as found in curl [1]. If HAVE_BUILTIN_AVAILABLE is not available we fallback to the code without TCP_FASTOPEN_OSX. The OS values match exactly the values found in https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/sys/socket.h [1] https://github.com/curl/curl/commit/870d849d48a26b8eeb0d4bb1f4655367a4a191ca Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
* | safe_memcmp: remove in favor of gnutls_memcmptmp-safe-memcmpDaiki Ueno2020-06-296-17/+9
| | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | dhe: check if DH params in SKE match the FIPS approved algorithmstmp-sp800-56ar3Daiki Ueno2020-06-273-0/+48
| | | | | | | | | | | | | | | | SP800-56A rev. 3 restricts the FIPS compliant clients to use only approved DH parameters, defined in RFC 7919 and RFC 3526. This adds a check in the handling of ServerKeyExchange if DHE is negotiated. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | dh-primes: add MODP primes from RFC 3526Daiki Ueno2020-06-262-0/+962
|/ | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Merge branch 'tmp-clear-session-ticket-keys' into 'master'Daiki Ueno2020-06-211-0/+8
|\ | | | | | | | | Wipe session ticket keys before releasing the session structure See merge request gnutls/gnutls!1289
| * Wipe session ticket keys before releasing the session structureFiona Klute2020-06-141-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | This includes both a copy of the master key and one or two derived keys, all of which could be used to decrypt session tickets if stolen. The derived keys could only be used for tickets issued within a certain time frame (by default several hours). The documentation for gnutls_session_ticket_enable_server() already states that the master key should be wiped before releasing it, and the same should apply to internal copies. Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
* | Merge branch 'master' into 'master'Daiki Ueno2020-06-182-18/+22
|\ \ | | | | | | | | | | | | issues #1018- Modied the license to GPLv2.1+ to keep with LICENSE file. See merge request gnutls/gnutls!1285
| * | Modied the license to GPLv2.1+ to keep with LICENSE file.Lei Maohui2020-06-082-18/+22
| |/ | | | | | | Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com>
* | Merge branch 'master' into 'tmp-mark-gost94-as-broken'Dmitry Baryshkov2020-06-15166-15774/+17997
|\ \ | | | | | | | | | # Conflicts: # lib/crypto-selftests-pk.c
| * | build: avoid -Wenum-conversion warnings with GCC 10Daiki Ueno2020-06-1510-16/+29
| |/ | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * Merge branch 'tmp-iov-memleak' into 'master'Dmitry Baryshkov2020-06-071-25/+11
| |\ | | | | | | | | | | | | | | | | | | crypto-api: always allocate memory when serializing iovec_t Closes #1017 See merge request gnutls/gnutls!1278
| | * crypto-api: always allocate memory when serializing iovec_ttmp-iov-memleakDaiki Ueno2020-06-051-25/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The AEAD iov interface falls back to serializing the input buffers if the low-level cipher doesn't support scatter/gather encryption. However, there was a bug in the functions used for the serialization, which causes memory leaks under a certain condition (i.e. the number of input buffers is 1). This patch makes the logic of the functions simpler, by removing a micro-optimization that tries to minimize the number of calls to malloc/free. The original problem was reported by Marius Steffen in: https://bugzilla.samba.org/show_bug.cgi?id=14399 and the cause was investigated by Alexander Haase in: https://gitlab.com/gnutls/gnutls/-/merge_requests/1277 Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * | Merge branch 'gost-split-6' into 'master'Dmitry Baryshkov2020-06-0624-9/+14350
| |\ \ | | | | | | | | | | | | | | | | MAGMA/KUZNYECHIK CTR-ACPKM and CMAC support See merge request gnutls/gnutls!1161
| | * | crypto-selftest: add test vectors for MAGMA/KUZNYECHIK-CTR-ACPKMDmitry Eremin-Solenikov2020-06-071-1/+694
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | crypto-api: add _gnutls_cipher_set_key wrapper()Dmitry Eremin-Solenikov2020-06-072-0/+27
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | cipher/mac: enhance handlers with setkey callbackDmitry Eremin-Solenikov2020-06-074-0/+22
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | selftests: add test vectors for MAGMA/KUZNYECHIK-OMACDmitry Eremin-Solenikov2020-06-071-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | Add test vectors for newly added MAC algorithms. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | lib: add Magma/Kuznyechik OMAC supportDmitry Eremin-Solenikov2020-06-073-1/+46
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | lib: add Magma/Kuznyechik ciphers supportDmitry Eremin-Solenikov2020-06-073-0/+132
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | nettle/gost: add ACPKM rekeying codeDmitry Eremin-Solenikov2020-06-073-0/+152
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | nettle/gost: add CMAC-64/Magma/Kuznyechik codeDmitry Eremin-Solenikov2020-06-075-6/+236
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | nettle/gost: add Kuznyechik codeDmitry Eremin-Solenikov2020-06-074-1/+12829
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | nettle/gost: add Magma codeDmitry Eremin-Solenikov2020-06-073-0/+173
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| | * | nettle/gost: export gost28147_decrypt_simple for magma cipherDmitry Eremin-Solenikov2020-06-072-2/+5
| | | | | | | | | | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| * | | Merge the extra libraries to link dynamically in GNUTLS_LIBS_PRIVATESteve Lhomme2020-06-062-2/+2
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | This should fix #1020 where bcrypt is missing from thirdparty_libadd. Ultimately it would be good to add libraries that always need to be linked in one variable that is shared between the Makefile and the pkg-config file. Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
| * | Merge branch 'tmp-aead-init-leak' into 'master'Daiki Ueno2020-06-051-8/+25
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | gnutls_aead_cipher_init: fix potential memleak Closes #1010 See merge request gnutls/gnutls!1274
| | * | gnutls_cipher_init: fix potential memleaktmp-aead-init-leakDaiki Ueno2020-06-021-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upon failure this function returns without freeing memory allocated internally. This makes sure that it is released and do not touch the output handle argument. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| | * | gnutls_aead_cipher_init: fix potential memleakDaiki Ueno2020-06-021-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When _gnutls_aead_cipher_init() fails, the function returns without freeing the allocted handle. This was once fixed in commit 502be130493e8ce802cdf60fffdbb5f1885352a5 but regressed after a code reorganization in commit 2eef509ce5f2d250f8dcaeffa46444dd2b694e91. Reported by Miroslav Lichvar. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * | | Implements a callback function gnutls_x509_trust_list_set_getissuer_function()Sahana Prasad2020-06-037-82/+169
| | |/ | |/| | | | | | | Signed-off-by: Sahana Prasad <sahana@redhat.com>
| * | valgrind: check if session ticket key is used without initializationtmp-totp-initDaiki Ueno2020-06-032-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | This adds a valgrind client request for session->key.session_ticket_key to make sure that it is not used without initialization. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * | stek: differentiate initial state from valid time window of TOTPDaiki Ueno2020-06-031-12/+5
| |/ | | | | | | | | | | | | | | | | There was a confusion in the TOTP implementation in stek.c. When the mechanism is initialized at the first time, it records the timestamp but doesn't initialize the key. This removes the timestamp recording at the initialization phase, so the key is properly set later. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * Merge branch 'tmp-known-certs' into 'master'Daiki Ueno2020-05-314-35/+87
| |\ | | | | | | | | | | | | _gnutls_pkcs11_verify_crt_status: check validity against system cert See merge request gnutls/gnutls!1271
| | * x509: trigger fallback verification path when cert is expiredDaiki Ueno2020-05-311-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | gnutls_x509_trust_list_verify_crt2 use the macro SIGNER_OLD_OR_UNKNOWN to trigger the fallback verification path if the signer of the last certificate is not in the trust store. Previously, it doesn't take into account of the condition where the certificate is expired. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| | * _gnutls_pkcs11_verify_crt_status: check validity against system certDaiki Ueno2020-05-313-30/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To verify a certificate chain, this function replaces known certificates with the ones in the system trust store if possible. However, if it is found, the function checks the validity of the original certificate rather than the certificate found in the trust store. That reveals a problem in a scenario that (1) a certificate is signed by multiple issuers and (2) one of the issuers' certificate has expired and included in the input chain. This patch makes it a little robuster by actually retrieving the certificate from the trust store and perform check against it. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * | Merge branch 'nowincrypt' into 'master'Dmitry Baryshkov2020-05-313-1/+93
| |\ \ | | |/ | |/| | | | | | | use bcrypt for the windows random generator instead of wincrypt See merge request gnutls/gnutls!1255
| | * win32: use bcrypt instead of CryptoAPI on Vista+ for random numbersSteve Lhomme2020-05-283-1/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CryptoAPI is a deprecated API [1] that is forbidden in UWP builds. Rewrite the CryptoAPI calls in bcrypt. bcrypt is used instead of CryptoAPI when targeting Windows Vista and above. https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptdecrypt Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
| * | Merge branch 'add-aes192-gcm' into 'master'Dmitry Baryshkov2020-05-3013-0/+122
| |\ \ | | | | | | | | | | | | | | | | lib: add support for AES-192-GCM See merge request gnutls/gnutls!1267
| | * | lib: add support for AES-192-GCMDmitry Baryshkov2020-05-2713-0/+122
| | | | | | | | | | | | | | | | | | | | | | | | Add support for AES-192 in GCM mode. Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
| * | | Merge branch 'tmp-fileio' into 'master'Daiki Ueno2020-05-3013-77/+80
| |\ \ \ | | |_|/ | |/| | | | | | | | | | lib: improve external file loading See merge request gnutls/gnutls!1261
| | * | build: write "FILE *fp" instead of "FILE *fd"tmp-fileioDaiki Ueno2020-05-304-38/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes it clear that "fd" is not a file descriptor but a FILE pointer. Suggested by Tim Rühsen. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| | * | gnutls_load_file: document limitation regarding partial failureDaiki Ueno2020-05-301-0/+4
| | | | | | | | | | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
| | * | cert-cred: clear private key data loaded from fileDaiki Ueno2020-05-302-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes use of the RF_SENSITIVE flag newly added to read_file function when reading potentially senstive information from a file. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| | * | lib: avoid file descriptor leak when application forksDaiki Ueno2020-05-308-11/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes use of the "e" flag of fopen, provided by the Gnulib's fopen-gnu module. Reported by Remi Denis-Courmont in: https://gitlab.com/gnutls/gnutls/-/issues/985 and fix suggested by Tim Rühsen. Signed-off-by: Daiki Ueno <ueno@gnu.org>
| | * | gnulib: update git submoduleDaiki Ueno2020-05-296-32/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This brings in the new fopen-gnu module and the RF_SENSITIVE flag for fread_file and read_file. This also adds the following changes to be consistent with the latest changes in Gnulib: - the callers of fread_file and read_file to be adjusted for the FLAGS argument - "attribute.h" needs to be used extensively Signed-off-by: Daiki Ueno <ueno@gnu.org>
| * | | Merge branch 'ncrypt-uwp10' into 'master'Dmitry Baryshkov2020-05-271-142/+176
| |\ \ \ | | | | | | | | | | | | | | | | | | | | win32: allow using ncrypt in UWP builds See merge request gnutls/gnutls!1256
| | * | | win32: move the NCRYPT key import into a functionSteve Lhomme2020-05-271-142/+176
| | | |/ | | |/| | | | | | | | | | | | | | | | | No functional change. The has been simply moved. Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
| * | | Merge branch 'static-ncrypt' into 'master'Dmitry Baryshkov2020-05-272-4/+6
| |\ \ \ | | | | | | | | | | | | | | | | | | | | Allow statically linking ncrypt (win32) See merge request gnutls/gnutls!1254
| | * | | configure.ac: determine if the Vista APIs can be linked staticallySteve Lhomme2020-05-272-4/+6
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If _WIN32_WINNT is higher or equal to 0x0600, Vista API's are allowed during the build. We can assume that the minimum platform the code will run on is Vista [1] In that case there's no need to call API's (ncrypt) dynamically when it can be done statically. [1] https://docs.microsoft.com/en-us/cpp/porting/modifying-winver-and-win32-winnt Signed-off-by: Steve Lhomme <robux4@ycbcr.xyz>
View Lorry Controller Status