summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* cli: add --list-config optionDaiki Ueno2022-01-172-1/+15
| | | | | | | With this option gnutls-cli prints the build-time configuration of the library, retrieved through gnutls_get_library_config. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: avoid overriding noinst_PROGRAMSDaiki Ueno2022-01-161-4/+3
| | | | | | In src, we now have two helper programs: systemkey and dumpcfg. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: remove AutoGen .def filesDaiki Ueno2022-01-1512-4006/+0
| | | | | | | As neither the tools nor documentation depends on AutoGen, we don't need to include the AutoGen definition files. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: remove included copy of liboptsDaiki Ueno2022-01-1571-23059/+0
| | | | | | | As no tools link with libopts anymore, we don't need to include it in the distribution. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: replace autoopts/libopts with minimal config parserDaiki Ueno2022-01-154-121/+614
| | | | | | | This replaces configuration file parsing code previously provided by <autoopts/options.h>, with a minimal compatible implementation. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: generate option handling code from JSONDaiki Ueno2022-01-1426-185/+3236
| | | | | | | | | This replaces AutoGen based command-line parser with a Python script (gen-getopt.py), which takes JSON description as the input. The included JSON files were converted one-off using the parse-autogen program: https://gitlab.com/dueno/parse-autogen. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* certtool: --to-p12: use modern algorithms by defaultDaiki Ueno2022-01-072-5/+1
| | | | | | | | | Currently certtool uses PKCS12-3DES-SHA1 for encrypting keys in PKCS#12, while it is suggested to migrate to more modern algorithms, namely AES-128-CBC with PBKDF2 and SHA-256: https://bugzilla.redhat.com/show_bug.cgi?id=1759982 Signed-off-by: Daiki Ueno <ueno@gnu.org>
* p11tool: add --mark-always-authenticate optionAlon Bar-Lev2022-01-032-0/+11
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* Port openconnect TPM2 codeNikos Mavrogiannopoulos2021-11-131-0/+4
| | | | | | | | | | This introduces transparent loading of TPM2 keys which are in PEM form by gnutls_privkey_import_x509_raw() and higher level functions which wrap it. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Co-authored-by: David Woodhouse <dwmw2@infradead.org> Co-authored-by: Daiki Ueno <ueno@gnu.org>
* certtool: add x448 and x25519 for --key-typeDaniel Kahn Gillmor2021-09-172-1/+5
| | | | | | This is a simple extension of the certtool command-line interface. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* certtool: when making X25519 or X448 certs, always use "key agreement"Daniel Kahn Gillmor2021-09-171-0/+4
| | | | | | | This is related to #1227 -- but in this case, it's enforcing a requirement of RFC 8410 §5. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* Enable X25519 and X448 everywhere that EdDSA is supported.Daniel Kahn Gillmor2021-09-172-1/+4
| | | | | | | These are just trivial extension points where the codepath is the same for the ECDH scheme as it is for the EdDSA scheme. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* build: remove tautological if conditionsDaiki Ueno2021-09-091-1/+1
| | | | | | Spotted by LGTM. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* p11tool: mention how CKA_IDs of certs are calculated upon --writeDaiki Ueno2021-06-111-2/+3
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* certtool: order DN components by scale.Daniel Kahn Gillmor2021-05-281-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DN components are expected to be ordered by scale, with the wire format representing larger-scale components (like country or organization) before smaller-scale components (like state or organizationalUnit). The bulk of the changes here of course are changes to the target certificates in the test suite. Note that a change was necessary in tests/cert-tests/crq.sh because it tests the "interactive" mode of certtool. If any user is scripting certtool in this way, this change will cause a backwards-incompatible break. However, I think this is OK -- the supported scripted/batch mode for certtool should use a template file, and I don't think it's important to maintain a strict api on the interactive mode. The main change here is to order the DN from least-specific-to-most, in particular: country, state, locality, org, orgunit, cn, uid But I've also made an additional arbitrary choice, which is that DC (domain component) comes *after* uid. This was already the case in certificate generation, but in *request* generation, it was the other way around. I've changed request generation to match this ordering from certificate generation. Closes: #1243 Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* serv: stop setting AI_ADDRCONFIG on getaddrinfoDaiki Ueno2021-05-141-5/+1
| | | | | | | | | AI_ADDRCONFIG is only useful when the NODE argument is given in the getaddrinfo call, as described in RFC 3493 6.1. Suggested by Andreas Metzler in: https://gitlab.com/gnutls/gnutls/-/issues/1007#note_356637206 Signed-off-by: Daiki Ueno <ueno@gnu.org>
* systemkey: remove unused --inder and --infile optionsDaiki Ueno2021-05-132-29/+3
| | | | | | | While those options have no effect, the command previously tried to open a file for reading and leaked file descriptor. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* srptool: add missing fclose on error pathDaiki Ueno2021-05-131-0/+2
| | | | | | | | | | | | | Spotted by gcc analyzer: srptool.c:113:32: warning: leak of FILE 'fp' [CWE-775] [-Wanalyzer-file-leak] 113 | return -1; | ^ also: srptool.c:560:32: warning: leak of FILE 'fp' [CWE-775] [-Wanalyzer-file-leak] 560 | return -1; | ^ Signed-off-by: Daiki Ueno <ueno@gnu.org>
* gnutls-serv: use only async-signal-safe functions in signal handlerDaiki Ueno2021-05-111-1/+1
| | | | | | | | | Spotted by gcc analyzer: serv.c:1138:9: warning: call to 'exit' from within signal handler [CWE-479] [-Wanalyzer-unsafe-call-within-signal-handler] 1138 | exit(1); | ^~~~~~~ Signed-off-by: Daiki Ueno <ueno@gnu.org>
* certtool: tighten allocation checkDaiki Ueno2021-05-111-0/+1
| | | | | | | | | Spotted by gcc analyzer: certtool-cfg.c:856:24: warning: use of possibly-NULL 'copy' where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument] 856 | while (strcmp(pass, copy) != 0 | ^~~~~~~~~~~~~~~~~~ Signed-off-by: Daiki Ueno <ueno@gnu.org>
* psktool: tighten allocation checkDaiki Ueno2021-05-111-1/+5
| | | | | | | | | Spotted by gcc analyzer: psk.c:275:21: warning: use of possibly-NULL '_username.data' where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument] 275 | if (strncmp(p, (const char *) _username.data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Daiki Ueno <ueno@gnu.org>
* spelling: The possessive pronoun "its" has no apostrophe.Daniel Kahn Gillmor2021-05-052-4/+4
| | | | | | | | "it's" is for contractions like "it is" or "it has". "its" is a possessive pronoun, like "his" or "hers" or "theirs", none of which have an apostrophe in them either. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* certtool: Align warning about --provable with actual codeDaniel Kahn Gillmor2021-05-041-1/+1
| | | | | | | | | | | | | | | | If I try to generate an ed25519 key, it is *not* an ECDSA key. But I see this warning: 0 dkg@host:~$ certtool --generate-privkey --provable --key-type ed25519 Generating a 256 bit EdDSA (Ed25519) private key ... The --provable parameter cannot be used with ECDSA keys. 1 dkg@host:~$ Looking at the code and documentation, it's clear that --provable only works for RSA and DSA. This fix aligns the warning message with the underlying mechanism. Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
* certtool: fix parsing of --verify-profile optionDaiki Ueno2021-05-031-1/+1
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* certtool: don't copy CRL distribution point from CA certDaiki Ueno2021-04-281-3/+1
| | | | | | | | | | Suggested by Thomas Karlsson in: https://gitlab.com/gnutls/gnutls/-/issues/1126 While this changes the default behavior, CDP can always be set through the template or interactive input. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Add AF_ALG accelerationStephan Mueller2021-04-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch set adds the backend implementation to use the Linux kernel crypto API via the AF_ALG interface. The GnuTLS AF_ALG extension uses libkcapi [1] as the backend library which implements the actual kernel communication. [1] http://www.chronox.de/libkcapi.html The symmetric cipher support, the hashing and the MAC support are validated to work correctly using NIST CAVS test vectors. The AEAD cipher support was tested by connecting to a remote host using gnutls-cli (the following log strips out unrelated information): Processed 143 CA certificate(s). ... - Certificate type: X.509 - Got a certificate list of 1 certificates. - Certificate[0] info: ... - Description: (TLS1.2)-(ECDHE-SECP384R1)-(RSA-SHA512)-(AES-256-GCM) - Session ID: 9E:5E:FC:09:2A:4E:2A:3D:22:44:68:42:C3:F6:2D:AB:F9:67:08:CE:6D:EE:E4:A2:EF:80:43:FE:3B:D9:1E:FE - Ephemeral EC Diffie-Hellman parameters - Using curve: SECP384R1 - Curve size: 384 bits - Version: TLS1.2 - Key Exchange: ECDHE-RSA - Server Signature: RSA-SHA512 - Cipher: AES-256-GCM - MAC: AEAD - Options: extended master secret, safe renegotiation, - Handshake was completed - Simple Client Mode: Signed-off-by: Stephan Mueller <smueller@chronox.de> Co-authored-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Hedgehog5040 <krenzelok.frantisek@gmail.com>
* src: avoid file descriptor leak in socket_open2Daiki Ueno2021-03-151-1/+8
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* gnutls-cli-debug: avoid resource leak in saving DHE paramsDaiki Ueno2021-03-151-3/+12
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* srptool: avoid FILE pointer leak on errorDaiki Ueno2021-03-151-2/+2
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* x509: rework issuer callbackDaiki Ueno2020-11-191-9/+8
| | | | | | | | | | | | | | | | The previous issuer callback API had a drawback: the callback is supposed to add CA to the trust list by itself. This was error-prone, because the callback must check the new CA is trusted by the already added CA. This instead moves the responsibility to the library. This also rewrites the chain amendment logic in a side-effect free manner. The application can assume that the trust information stored on gnutls_x509_trust_list_t shouldn't change after the verification. The missingissuer test has been extended to cover all the possible patterns exhaustively. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src: remove use of siginterruptDaiki Ueno2020-11-041-3/+5
| | | | | | | GCC 10 warns this: tests.c:702:2: error: 'siginterrupt' is deprecated: Use sigaction with SA_RESTART instead [-Werror=deprecated-declarations] Signed-off-by: Daiki Ueno <ueno@gnu.org>
* psktool: Fix hex-encoding logic of usernameDaiki Ueno2020-10-311-4/+11
| | | | | | | | | | The previous code didn't modify the pointer to the realloc'ed region nor check overflow before calling realloc. Spotted by Anderson Sasaki in: <https://gitlab.com/gnutls/gnutls/-/merge_requests/1345#note_439063374>. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* srptool: fix FILE pointer leakDaiki Ueno2020-10-301-1/+1
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* psktool: encode username if it contains special characterDaiki Ueno2020-10-301-32/+70
| | | | | | | This also moves the hex encoding of key to write_key for readability and makes file stream closing robuster. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* serv: use only async-signal-safe functions in signal handlerstmp-src-fixesDaiki Ueno2020-10-181-1/+12
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* serv: peer_print_info: add overflow check on reallocDaiki Ueno2020-10-181-9/+15
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* serv: replace our own list implementation with Gnulib's gl_listDaiki Ueno2020-10-184-490/+84
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: remove dead assignmentsDaiki Ueno2020-09-182-3/+3
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: ignore pointless -Wformat-nonliteral warningtmp-gnulibDaiki Ueno2020-09-171-0/+3
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* build: ignore pointless -Wformat-y2k warningDaiki Ueno2020-09-171-0/+3
| | | | | | Printing UTCTime really needs last 2 digits of the year. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* src/cli: adds new option '--ca-auto-retrieve' that can be used with ↵Sahana Prasad2020-09-022-4/+200
| | | | | | | | | | gnutls-cli to automatically download missing intermediate CAs in a certificate chain lib/cred-cert.c : adds set and get APIs to get user data in the gnutls_x509_trust_list_set_getissuer_function() callback. Signed-off-by: Sahana Prasad <sahana@redhat.com>
* improve gnutls-serv EOL processingAlbrecht Dreß2020-08-292-3/+13
| | | | | | add option `--crlf` to gnutls-serv to disable replacing a received CRLF by LF in echo mode (fixes #1073). Signed-off-by: Albrecht Dreß <albrecht.dress@arcor.de>
* Merge branch 'tmp-typo-fixes' into 'master'Daiki Ueno2020-08-144-5/+5
|\ | | | | | | | | doc: assorted typo fixes See merge request gnutls/gnutls!1305
| * doc: assorted typo fixestmp-typo-fixesDaiki Ueno2020-08-124-5/+5
| | | | | | | | | | | | Spotted by codespell. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'tmp-cert-invalid' into 'master'Daiki Ueno2020-08-141-1/+4
|\ \ | | | | | | | | | | | | cert-session: ensure that invalid flag is always set See merge request gnutls/gnutls!1304
| * | serv, cli: ensure that invalid flag is always settmp-cert-invalidDaiki Ueno2020-08-121-1/+4
| |/ | | | | | | | | | | | | | | According to the documentation, the GNUTLS_CERT_INVALID flag must always be set in case of verification failure, together with the flag indicating the actual error cause. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* | Merge branch 'tmp-fix-cert-pass' into 'master'Daiki Ueno2020-08-142-1/+11
|\ \ | |/ |/| | | | | | | | | Fix two issues about certtool and passwords Closes #933 and #888 See merge request gnutls/gnutls!1268
| * p12: do not encrypt encrypt certificate bag with empty passwordtmp-fix-cert-passDmitry Baryshkov2020-05-281-1/+2
| | | | | | | | | | | | | | | | | | | | Do not encrypt certificate bag if the user has specified empty password (--password ''). Encryption can be turned on by specifying --empty-password. Fixes #888 Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
| * certtool: do not ask for private key password if it was providedDmitry Baryshkov2020-05-281-0/+9
| | | | | | | | | | | | | | | | | | Make pin_callback() use cinfo->password if it is set (via command line or from template). Fixes #933 Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* | Merge branch 'tmp-enum' into 'master'Dmitry Baryshkov2020-06-151-3/+3
|\ \ | | | | | | | | | | | | build: minor fixes See merge request gnutls/gnutls!1287
View Lorry Controller Status