summaryrefslogtreecommitdiff
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* tests: added check for random value of client and server hello in TLSNikos Mavrogiannopoulos2020-03-302-1/+268
| | | | | | | This creates a tests that checks whether the TLS client and server hello have sufficient non-zero bytes. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for client hello random value behavior in DTLSNikos Mavrogiannopoulos2020-03-302-1/+338
| | | | | | | | | This adds an equivalent test of tls13/hello_random_value.c for DTLS and extends the tests for server hello as well. Relates: #960 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tmp-get-keylog-func' into 'master'Daiki Ueno2020-03-251-0/+2
|\ | | | | | | | | gnutls_session_get_keylog_function: new function See merge request gnutls/gnutls!1220
| * gnutls_session_get_keylog_function: new functiontmp-get-keylog-funcDaiki Ueno2020-03-221-0/+2
| | | | | | | | | | | | | | | | This adds a way to retrieve the keylog function set by gnutls_session_set_keylog_function() to allow application protocols to implement custom logging facility. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | psk: Allow non-NULL PSK usernamesAnder Juaristi2020-03-234-57/+536
|/ | | | | | | | | | | | | | | | | | | | | | | This commit closes #586. Two new functions are introduced: gnutls_psk_server_get_username2() and gnutls_psk_set_client_username2(), which are identical in behavior to those named similarly (without the final '2'), but allow arbitrary gnutls datums (not strings) to be used as usernames. Two new callback functions are also introduced, with their respective setters: gnutls_psk_set_server_credentials_function2() and gnutls_psk_set_client_credentials_function2(). In addition, the password file format is extended so that non-string usernames can be specified. A leading '#' character tells GnuTLS that the username should be interpreted as a raw byte string (encoded in HEX). Example: #deadbeef:9e32cf7786321a828ef7668f09fb35db Signed-off-by: Ander Juaristi's avatarAnder Juaristi <a@juaristi.eus>
* Merge branch 'eddsa-pkcs11' into 'master'Nikos Mavrogiannopoulos2020-03-202-0/+85
|\ | | | | | | | | | | | | Add support for loading Ed25519 keys from PKCS#11 and using them Closes #946 See merge request gnutls/gnutls!1200
| * tests: Verify writing and reading of ECDSA public keys from PKCS#11Jakub Jelen2020-03-181-0/+42
| | | | | | | | Signed-off-by: Jakub Jelen <jjelen@redhat.com>
| * tests: Verify writing and reading of EdDSA public keysJakub Jelen2020-03-181-0/+43
| | | | | | | | Signed-off-by: Jakub Jelen <jjelen@redhat.com>
* | state: add function to get the current hash algorithmtmp-prf-getDaiki Ueno2020-03-192-0/+12
| | | | | | | | | | | | | | | | This is particularly useful when the application applies key derivation function by itself with the same underlying hash algorithm as the session. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | Merge branch 'tmp-ed448-fixes' into 'master'Daiki Ueno2020-03-182-1/+18
|\ \ | | | | | | | | | | | | ed448: fix certificate signature verification See merge request gnutls/gnutls!1213
| * | tests/sign-is-secure: fix off-by-one errortmp-ed448-fixesDaiki Ueno2020-03-161-1/+1
| | | | | | | | | | | | | | | | | | | | | Reported by Peter Dettman in: https://gitlab.com/gnutls/gnutls/-/issues/128#note_304892538 Signed-off-by: Daiki Ueno <dueno@redhat.com>
| * | algorithms: properly calculate hash strength for Ed448Daiki Ueno2020-03-161-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Ed448 signature scheme internally uses XOF (SHAKE256) as the hash function with 114-octet output. According to FIPS-202, the strength against collisions is calculated as: min(114*8/2, 256) = 256 Reported by Peter Dettman in: https://gitlab.com/gnutls/gnutls/-/issues/128#note_304892538 Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | | lib/x509: use common routine for parsing data versionDmitry Baryshkov2020-03-121-1/+1
|/ / | | | | | | | | | | | | | | | | | | OSS Fuzzer noted an issue in parsing (incorrect) CRL files with zero-length version field. Certificate parser does not have this issue, while CRL and OCSP Request and Response parsers shows this problem. To remove code duplication extract common function and use it from all four parsers. Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* | Merge branch 'tmp-gen-suppressions' into 'master'Nikos Mavrogiannopoulos2020-03-061-0/+7
|\ \ | | | | | | | | | | | | Let valgrind suggest suppression rules on any issue it finds See merge request gnutls/gnutls!1195
| * | Add valgrind suppression for fun:decode_complex_string.isra.0tmp-gen-suppressionsTim Rühsen2020-02-211-0/+7
| |/ | | | | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* | keylogfile: simplify the callback mechanismtmp-keylog-funcDaiki Ueno2020-02-222-58/+18
|/ | | | | | | | | | This partially reverts commit 97117556 with a simpler interface. The original intention of having the callback mechanism was to reuse it for monitoring QUIC encryption changes. However, it turned out to be insufficient because such changes must be emitted after a new epoch is ready. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-keylog-hook' into 'master'Daiki Ueno2020-02-072-1/+390
|\ | | | | | | | | | | | | keylogfile: generalize with a callback Closes #852 See merge request gnutls/gnutls!1184
| * keylogfile: generalize with a callbacktmp-keylog-hookDaiki Ueno2020-02-072-1/+390
| | | | | | | | | | | | | | | | | | This refactors the keylogfile mechanism by adding a callback to get notified when a new secret is derived and installed. That way, consumers can implement custom logging feature per session, which is particularly useful in QUIC implementation. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | testcompat-openssl: improve testing against secured OpenSSL versions.Dimitri John Ledkov2020-02-061-40/+33
|/ | | | | | | | | In Debian, and soon Ubuntu, OpenSSL is compiled with SECLEVEL=2 and requiring minimum TLSv1.2. However, smaller hashes/keys/versions are allowed if one enables SECLEVEL=1. Do so when testing pre v1.2 algos, and thus enabling testing more compatability combinations. Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
* tests: skip pkcs12-gost under GNUTLS_FORCE_FIPS_MODEDaiki Ueno2020-02-041-0/+5
| | | | | | | The MAC algorithm used in the PBKDF2 is actually prohibited in the FIPS mode and previously there wasn't a check for that. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add generic crypto functions for KDFDaiki Ueno2020-02-042-1/+161
| | | | | | | | | | This exposes HKDF and PBKDF2 functions from the library. Instead of defining a single KDF interface as in PKCS #11, this patch defines 3 distinct functions for HKDF-Extract, HKDF-Expand, and PBKDF2 derivation, so that we can take advantage of compile time checking of necesssary parameters. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-20200126-bashismintest' into 'master'Tim Rühsen2020-01-271-4/+4
|\ | | | | | | | | Avoid pushd/popd bashism in testsuite See merge request gnutls/gnutls!1180
| * Avoid pushd/popd bashism in testsuiteAndreas Metzler2020-01-261-4/+4
| | | | | | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* | tlsfuzzer: optimized tests for CI and enabled x448Nikos Mavrogiannopoulos2020-01-261-4/+4
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* | tlsfuzzer: fix test-tls13-large-number-of-extensions.pyNikos Mavrogiannopoulos2020-01-261-3/+7
|/ | | | | | | | | This test requires a TLS-1.3-only server as its tests clash with extensions supported by a TLS-1.2 server. Ensure that the extensions that overlap with TLS-1.2 are not manipulated as we don't have a pure TLS-1.3-only implementation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tmp-ci-make-j' into 'master'Tim Rühsen2020-01-261-1/+1
|\ | | | | | | | | | | | | Use 'make -j' with higher values for CI builds and tests Closes #897 See merge request gnutls/gnutls!1154
| * tests/key-material-dtls.c: Try again on GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTEDtmp-ci-make-jTim Rühsen2020-01-261-1/+1
| | | | | | | | | | | | This fixes issues on the CI cross-runners with 'make -jN', N > 1. Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* | tests: updated tlsfuzzer tests to latest versionNikos Mavrogiannopoulos2020-01-267-24/+76
|/ | | | | | | | | | | This adds new tests, reduces running time, and removes test-tls13-obsolete-curves.py. The latter introduced too pendantic tests on curves we don't implement, and requires significant changes to passing with limited benefit. For example it requires the server to error on mismatching entries (and we simply ignore them). As its value is low (we do not target to be a reference implementation for testing broken clients), it was removed. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'legacy-gost-512' into 'master'Nikos Mavrogiannopoulos2020-01-242-6/+6
|\ | | | | | | | | x509: include digestParamSet into GOST 512-bit curves A and B params See merge request gnutls/gnutls!1173
| * x509: include digestParamSet into GOST 512-bit curves A and B paramsDmitry Eremin-Solenikov2020-01-202-6/+6
| | | | | | | | | | | | | | | | Old implementations do not understand PublicKeyParams with omitted digestParamSet. So include the field for old 512-bit curves to improve compatibility with old implementations. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | Merge branch 'tmp-ed448' into 'master'Daiki Ueno2020-01-246-48/+54
|\ \ | | | | | | | | | | | | algorithms: implement X448 key exchange and Ed448 signature scheme See merge request gnutls/gnutls!984
| * | tlsfuzzer: enable tests for X448Daiki Ueno2020-01-232-28/+2
| | | | | | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
| * | algorithms: implement X448 key exchange and Ed448 signature schemeDaiki Ueno2020-01-234-20/+52
| |/ | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | Merge branch 'fix-gost-pkcs12' into 'master'Dmitry Baryshkov2020-01-201-0/+14
|\ \ | | | | | | | | | | | | pkcs12: use correct key length when using STREEBOG-512 See merge request gnutls/gnutls!1171
| * | pkcs12: use correct key length when using STREEBOG-512Dmitry Baryshkov2020-01-201-0/+14
| |/ | | | | | | | | | | | | | | | | PKCS#12 files using GOST HMAC (GOST R 34.11-94 and Streebog) use special function to generate MAC key. Pass correct key length (fixed to be 32) when generating PKCS#12 files protected with Streebog (currently it incorrectly uses 64 there). Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* | Merge branch 'tmp-tls13-ocsp' into 'master'Nikos Mavrogiannopoulos2020-01-202-1/+220
|\ \ | | | | | | | | | | | | | | | | | | tls13: fix issues with client OCSP responses Closes #876 See merge request gnutls/gnutls!1169
| * | tls13: request OCSP responses as a serverNikos Mavrogiannopoulos2020-01-202-1/+220
| |/ | | | | | | | | | | | | | | | | | | | | The TLS1.3 protocol requires the server to advertise an empty OCSP status request extension on its certificate verify message for an OCSP response to be sent by the client. We now always send this extension to allow clients attaching those responses. Resolves: #876 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | gnutls-cli-debug: ignore tests when algorithms are unavailableNikos Mavrogiannopoulos2020-01-181-0/+30
|/ | | | | | | | When gnutls-cli-debug is run on systems where a particular algorithm is disabled, ensure that we don't stop the testing; in that case we ignore the test. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'override-default-priority' into 'master'Nikos Mavrogiannopoulos2020-01-135-2/+103
|\ | | | | | | | | libgnutls: Add system-wide default-priority-string override. See merge request gnutls/gnutls!1158
| * libgnutls: Add system-wide default-priority-string override.Dimitri John Ledkov2020-01-135-2/+103
| | | | | | | | Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
* | Merge branch 'tmp-oid-fix' into 'master'Nikos Mavrogiannopoulos2020-01-138-50/+50
|\ \ | | | | | | | | | | | | tests: replace invalid extension OIDs with valid ones See merge request gnutls/gnutls!1153
| * | tests: replace invalid extension OIDs with valid onesNikos Mavrogiannopoulos2020-01-078-50/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libtasn1 4.15.0 or earlier allow encoding and decoding of invalid OIDs, but more recent versions may stop accepting them. Ensure that our test suite includes OIDs which can be decoded by all versions of libtasn1. Relates: https://gitlab.com/gnutls/libtasn1/issues/25 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* | | tests/priorities: add tests for GOST ciphersuites enablementDmitry Eremin-Solenikov2020-01-121-0/+3
| | | | | | | | | | | | | | | | | | Add test counting GOST ciphersuites and ciphers available. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | | Merge branch 'gost-priorities' into 'master'Dmitry Eremin-Solenikov2020-01-123-32/+32
|\ \ \ | | | | | | | | | | | | | | | | Extend GOST priority settings and documentation See merge request gnutls/gnutls!1160
| * | | priority: add more GOST shortcutsDmitry Eremin-Solenikov2020-01-093-31/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add shortcuts for GOST ciphers, MACs and KXes. For now they contain only one item, but this list will be expanded as support for GOST-CTR-ACPKM ciphersuites will be added. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| * | | lib/priority: add SIGN-GOST-ALL keywordDmitry Eremin-Solenikov2020-01-093-28/+28
| |/ / | | | | | | | | | | | | | | | | | | Add SIGN-GOST-ALL keyword containing all defined GOST signature algorithms. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | | Merge branch 'tmp-ocsp-revocation' into 'master'Daiki Ueno2020-01-102-1/+462
|\ \ \ | |_|/ |/| | | | | | | | ocsp: set GNUTLS_CERT_INVALID if OCSP response indicates revocation See merge request gnutls/gnutls!1159
| * | tests: add test for revoked OCSP responsetmp-ocsp-revocationDaiki Ueno2020-01-102-1/+462
| |/ | | | | | | | | | | | | This adds a test that exercises a failed handshake upon receipt of an OCSP response with the "revoked" status. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | Merge branch 'tmp-ocsp-check' into 'master'903-add-crl-and-crq-fuzzersNikos Mavrogiannopoulos2020-01-093-1/+11
|\ \ | | | | | | | | | | | | | | | | | | Provide flag to identify sessions that an OCSP response was requested Closes #829 See merge request gnutls/gnutls!1131
| * | Provide flag to identify sessions that an OCSP response was requestedNikos Mavrogiannopoulos2019-12-153-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | That adds the flag GNUTLS_SFLAGS_CLI_REQUESTED_OCSP which can be checked by a server application to determine whether the client has requested stapled OCSP responses. This includes minor cleanups in the status request handling code. Resolves: #829 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status