summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* x509: rework issuer callbackDaiki Ueno2020-11-191-9/+8
| | | | | | | | | | | | | | | | The previous issuer callback API had a drawback: the callback is supposed to add CA to the trust list by itself. This was error-prone, because the callback must check the new CA is trusted by the already added CA. This instead moves the responsibility to the library. This also rewrites the chain amendment logic in a side-effect free manner. The application can assume that the trust information stored on gnutls_x509_trust_list_t shouldn't change after the verification. The missingissuer test has been extended to cover all the possible patterns exhaustively. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: remove use of siginterruptDaiki Ueno2020-11-041-3/+5
| | | | | | | GCC 10 warns this: tests.c:702:2: error: 'siginterrupt' is deprecated: Use sigaction with SA_RESTART instead [-Werror=deprecated-declarations] Signed-off-by: Daiki Ueno <ueno@gnu.org>
* psktool: Fix hex-encoding logic of usernameDaiki Ueno2020-10-311-4/+11
| | | | | | | | | | The previous code didn't modify the pointer to the realloc'ed region nor check overflow before calling realloc. Spotted by Anderson Sasaki in: <https://gitlab.com/gnutls/gnutls/-/merge_requests/1345#note_439063374>. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* srptool: fix FILE pointer leakDaiki Ueno2020-10-301-1/+1
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* psktool: encode username if it contains special characterDaiki Ueno2020-10-301-32/+70
| | | | | | | This also moves the hex encoding of key to write_key for readability and makes file stream closing robuster. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* serv: use only async-signal-safe functions in signal handlerstmp-src-fixesDaiki Ueno2020-10-181-1/+12
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* serv: peer_print_info: add overflow check on reallocDaiki Ueno2020-10-181-9/+15
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* serv: replace our own list implementation with Gnulib's gl_listDaiki Ueno2020-10-184-490/+84
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: remove dead assignmentsDaiki Ueno2020-09-182-3/+3
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: ignore pointless -Wformat-nonliteral warningtmp-gnulibDaiki Ueno2020-09-171-0/+3
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: ignore pointless -Wformat-y2k warningDaiki Ueno2020-09-171-0/+3
| | | | | | Printing UTCTime really needs last 2 digits of the year. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src/cli: adds new option '--ca-auto-retrieve' that can be used with ↵Sahana Prasad2020-09-022-4/+200
| | | | | | | | | | gnutls-cli to automatically download missing intermediate CAs in a certificate chain lib/cred-cert.c : adds set and get APIs to get user data in the gnutls_x509_trust_list_set_getissuer_function() callback. Signed-off-by: Sahana Prasad <sahana@redhat.com>
* improve gnutls-serv EOL processingAlbrecht Dreß2020-08-292-3/+13
| | | | | | add option `--crlf` to gnutls-serv to disable replacing a received CRLF by LF in echo mode (fixes #1073). Signed-off-by: Albrecht Dreß <albrecht.dress@arcor.de>
* Merge branch 'tmp-typo-fixes' into 'master'Daiki Ueno2020-08-144-5/+5
|\ | | | | | | | | doc: assorted typo fixes See merge request gnutls/gnutls!1305
| * doc: assorted typo fixestmp-typo-fixesDaiki Ueno2020-08-124-5/+5
| | | | | | | | | | | | Spotted by codespell. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'tmp-cert-invalid' into 'master'Daiki Ueno2020-08-141-1/+4
|\ \ | | | | | | | | | | | | cert-session: ensure that invalid flag is always set See merge request gnutls/gnutls!1304
| * | serv, cli: ensure that invalid flag is always settmp-cert-invalidDaiki Ueno2020-08-121-1/+4
| |/ | | | | | | | | | | | | | | According to the documentation, the GNUTLS_CERT_INVALID flag must always be set in case of verification failure, together with the flag indicating the actual error cause. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'tmp-fix-cert-pass' into 'master'Daiki Ueno2020-08-142-1/+11
|\ \ | |/ |/| | | | | | | | | Fix two issues about certtool and passwords Closes #933 and #888 See merge request gnutls/gnutls!1268
| * p12: do not encrypt encrypt certificate bag with empty passwordtmp-fix-cert-passDmitry Baryshkov2020-05-281-1/+2
| | | | | | | | | | | | | | | | | | | | Do not encrypt certificate bag if the user has specified empty password (--password ''). Encryption can be turned on by specifying --empty-password. Fixes #888 Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
| * certtool: do not ask for private key password if it was providedDmitry Baryshkov2020-05-281-0/+9
| | | | | | | | | | | | | | | | | | Make pin_callback() use cinfo->password if it is set (via command line or from template). Fixes #933 Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* | Merge branch 'tmp-enum' into 'master'Dmitry Baryshkov2020-06-151-3/+3
|\ \ | | | | | | | | | | | | build: minor fixes See merge request gnutls/gnutls!1287
| * | build: avoid -Wenum-conversion warnings with GCC 10Daiki Ueno2020-06-151-3/+3
| | | | | | | | | | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | | Merge branch 'better_SSL3.0_tests' into 'master'Dmitry Baryshkov2020-06-142-5/+24
|\ \ \ | |/ / |/| | | | | | | | refine tests for ancient servers which support both SSL 3.0 and TLS 1.0, but both only with %NO_EXTENSIONS See merge request gnutls/gnutls!1251
| * | refine tests for ancient servers which support both SSL 3.0 and TLS 1.0, but ↵Daniel Lenski2020-05-172-5/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | both only with %NO_EXTENSIONS This is a follow-up to !1221. See #958 and https://gitlab.com/openconnect/openconnect/-/issues/145 for a real-world example of ancient Cisco servers with these deficiencies. With !1221 only, gnutls-cli-debug reports that these ancient servers only support SSL 3.0 (but without extensions). Information after this point is largely erroneous: $ gnutls-cli-debug ***vpn.***.com GnuTLS debug client 3.6.12 Checking ***vpn.***.com:443 whether the server accepts default record size (512 bytes)... no whether %ALLOW_SMALL_RECORDS is required... no for SSL 3.0 (RFC6101) support... yes for SSL 3.0 with extensions... no With this additional change, gnutls-cli-debug correctly reports that such a server also supports TLS 1.0 (but again with extensions disabled). Below I've marked some of the significant fields that have changed: $ gnutls-cli-debug ***vpn.***.com GnuTLS debug client 3.6.12 Checking ***vpn.***.com:443 whether the server accepts default record size (512 bytes)... no whether %ALLOW_SMALL_RECORDS is required... no for SSL 3.0 (RFC6101) support... yes for SSL 3.0 with extensions... no whether we need to disable TLS 1.2... yes whether we need to disable TLS 1.1... yes # This is now correct: whether we need to disable TLS 1.0... no # This is now correct: whether %NO_EXTENSIONS is required... yes # This is now correct: for TLS 1.0 (RFC2246) support... yes for TLS 1.1 (RFC4346) support... no fallback from TLS 1.1 to... failed for TLS 1.2 (RFC5246) support... no # This is now correct: for known TLS or SSL protocols support... yes TLS1.2 neg fallback from TLS 1.6 to... failed (server requires fallback dance) for inappropriate fallback (RFC7507) support... no for HTTPS server name... ****** for certificate chain order... sorted for Safe renegotiation support (SCSV)... no for version rollback bug in RSA PMS... no for version rollback bug in Client Hello... no whether the server ignores the RSA PMS version... no whether small records (512 bytes) are tolerated on handshake... yes whether cipher suites not in SSL 3.0 spec are accepted... yes whether a bogus TLS record version in the client hello is accepted... yes whether the server understands TLS closure alerts... partially whether the server supports session resumption... yes for anonymous authentication support... no for ephemeral Diffie-Hellman support... no for RFC7919 Diffie-Hellman support... no for AES-GCM cipher (RFC5288) support... no for AES-CCM cipher (RFC6655) support... no for AES-CCM-8 cipher (RFC6655) support... no for AES-CBC cipher (RFC3268) support... no for CAMELLIA-GCM cipher (RFC6367) support... no for CAMELLIA-CBC cipher (RFC5932) support... no # This is now correct: for 3DES-CBC cipher (RFC2246) support... yes # This is now correct: for ARCFOUR 128 cipher (RFC2246) support... yes for CHACHA20-POLY1305 cipher (RFC7905) support... no for GOST28147-CNT cipher (draft-smyshlyaev-tls12-gost-suites) support... no for MD5 MAC support... yes for SHA1 MAC support... yes for SHA256 MAC support... no for GOST28147-IMIT MAC (draft-smyshlyaev-tls12-gost-suites) support... no Signed-off-by: Daniel Lenski <dlenski@gmail.com>
* | | serv: omit upper bound of --maxearlydata option definitiontmp-autogen-intDaiki Ueno2020-06-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It turned out that AutoGen treats numbers that exceed INT_MAX in a platform dependent way. In this case, 4294967295 (UINT_MAX) is treated as is on 64-bit platforms, while it is interpreted as "-1" on 32-bit platforms. This causes a problem when the program documentation is compiled under multilib environment. Reported by Ivan Molodetskikh in: https://bugzilla.redhat.com/show_bug.cgi?id=1841844 and the cause was identified by Anderson Toshiyuki Sasaki. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | | build: write "FILE *fp" instead of "FILE *fd"tmp-fileioDaiki Ueno2020-05-304-89/+89
| | | | | | | | | | | | | | | | | | | | | This makes it clear that "fd" is not a file descriptor but a FILE pointer. Suggested by Tim Rühsen. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | | gnulib: update git submoduleDaiki Ueno2020-05-294-32/+29
| |/ |/| | | | | | | | | | | | | | | | | | | This brings in the new fopen-gnu module and the RF_SENSITIVE flag for fread_file and read_file. This also adds the following changes to be consistent with the latest changes in Gnulib: - the callers of fread_file and read_file to be adjusted for the FLAGS argument - "attribute.h" needs to be used extensively Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | certtool: use gnutls_pkcs7_print_signature_infoDmitry Baryshkov2020-05-141-81/+7
| | | | | | | | | | | | Use new function to remove code duplication. Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* | Merge branch 'aesni-xts' into 'master'Daiki Ueno2020-05-081-0/+8
|\ \ | | | | | | | | | | | | accelerated: use AES-NI for AES-XTS when available See merge request gnutls/gnutls!1244
| * | benchmark: enable AES-XTS cipherAnderson Toshiyuki Sasaki2020-05-061-0/+8
| | | | | | | | | | | | Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
* | | gnutls-cli: Add option to wait for resumption dataAnderson Toshiyuki Sasaki2020-05-072-6/+21
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | This introduces the --waitresumption command line option which makes the client to wait for the resumption data until a ticket is received under TLS1.3. The client will block if no ticket is received. The new option has no effect if the option --resume is not provided. This is useful to force the client to wait for the resumption data when the server takes long to send the ticket, allowing the session resumption to be tested. This is a common scenario in CI systems where the testing machines have limited resources. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
* | New make target 'update-copyright-year'tmp-reproducible-buildTim Rühsen2020-05-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | We don't want to automatically update the copyright year as this prevents reproducible builds. Instead, 'make update-copyright-year' has to be executed at the start of each new year and the changes have to be pushed. Closes #980 Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* | Merge branch 'better_SSL3.0_tests' into 'master'Nikos Mavrogiannopoulos2020-03-273-2/+46
|\ \ | |/ | | | | | | improve gnutls-cli-debug testing of old SSL 3.0 servers See merge request gnutls/gnutls!1221
| * add additional tests of SSL 3.0 (with extensions, and with cipher suites not ↵Daniel Lenski2020-03-223-1/+42
| | | | | | | | | | | | | | | | in SSL 3.0) See #958 Signed-off-by: Daniel Lenski <dlenski@gmail.com>
| * test_ssl3: minimize cipher suites to those actually included in SSL 3.0Daniel Lenski2020-03-221-2/+5
| | | | | | | | | | | | See #958 Signed-off-by: Daniel Lenski <dlenski@gmail.com>
| * SSL 3.0 (RFC6101) doesn't actually appear to require extensions, and some ↵Daniel Lenski2020-03-221-1/+1
| | | | | | | | | | | | | | | | servers don't accept them See #958 Signed-off-by: Daniel Lenski <dlenski@gmail.com>
* | gnutls-serv: Do not exit when a message to be echoed is receivedAnderson Toshiyuki Sasaki2020-03-241-2/+2
|/ | | | | | | | Previously, when gnutls-serv was executed with the --echo option, it would exit when a message to be echoed was received. Moreover, the server would output "Memory error" although no error occurred. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
* gnutls-cli: Add option to store all stapled OCSP responsesFiona Klute2020-02-082-16/+91
| | | | | | | | Note that there's a small modification to the behavior of the existing --ocsp-save option: If there is no stapled OCSP response the output file is still created and will be empty. Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
* Merge branch 'tmp-ed448' into 'master'Daiki Ueno2020-01-244-3/+8
|\ | | | | | | | | algorithms: implement X448 key exchange and Ed448 signature scheme See merge request gnutls/gnutls!984
| * algorithms: implement X448 key exchange and Ed448 signature schemeDaiki Ueno2020-01-234-3/+8
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | gnutls-cli-debug: ignore tests when algorithms are unavailableNikos Mavrogiannopoulos2020-01-181-2/+13
|/ | | | | | | | When gnutls-cli-debug is run on systems where a particular algorithm is disabled, ensure that we don't stop the testing; in that case we ignore the test. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: Log all stapled OCSP responses when running with --verboseFiona Klute2020-01-111-6/+15
| | | | Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
* certtool-cfg.c: Silence -Wunused-variable if HAVE_IPV6 not setTim Rühsen2020-01-031-1/+2
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* cli: fix building with GOST disabledDmitry Eremin-Solenikov2019-12-291-0/+2
| | | | | | | Fix building gnutls-cli (benchmark part) with GOST keys support being disabled. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* cli: support building with OCSP and ANON disabledDmitry Eremin-Solenikov2019-12-293-13/+52
| | | | | | | Support gnutls-cli when building GnuTLS with OCSP and ANON authentication API disabled. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* serv: support building with OCSP disabledDmitry Eremin-Solenikov2019-12-292-2/+32
| | | | | | Support gnutls-serv when building GnuTLS with OCSP API disabled. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* benchmark: enable benchmarking of GOST CNT ciphersuite/KXDmitry Eremin-Solenikov2019-12-271-0/+55
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* benchmark: support benchmarking GOST ciphers/MACsDmitry Eremin-Solenikov2019-12-271-0/+12
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* benchmark: use mac key size instead of block sizeDmitry Eremin-Solenikov2019-12-271-4/+4
| | | | | | | Use newly added gnutls_hmac_get_key_size() to get key size instead of assuming that key size = block size (incorrect for GOST 28147 IMIT). Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Merge branch 'tmp-certtool-crq' into 'master'Nikos Mavrogiannopoulos2019-12-231-1/+2
|\ | | | | | | | | certtool: always set extensions from template See merge request gnutls/gnutls!1130
View Lorry Controller Status