Merge branch 'tmp-f29' into 'master'

.gitlab-ci.yml: move to fedora29 for CI

Closes #607

See merge request gnutls/gnutls!794

9 files changed, 84 insertions, 53 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d86bb5c17a..7565a4204e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,7 +7,7 @@ stages:
 # name to allow expiration of old caches.
 
 cache:
-  key: "$CI_JOB_NAME-ver6"
+  key: "$CI_JOB_NAME-ver7"
   paths:
     - cache/
 
@@ -28,8 +28,9 @@ variables:
   BUILD_IMAGES_PROJECT: gnutls/build-images
   DEBIAN_BUILD: buildenv-debian
   DEBIAN_CROSS_BUILD: buildenv-debian-cross
-  FEDORA_BUILD: buildenv-f28
-  FEDORA_X86_BUILD: buildenv-f28-x86
+  DEBIAN_X86_CROSS_BUILD: buildenv-debian-x86-cross
+  FEDORA28_BUILD: buildenv-f28
+  FEDORA_BUILD: buildenv-f29
   CPPCHECK_OPTIONS: "--enable=warning --enable=style --enable=performance --enable=portability --std=c99 --suppressions-list=devel/cppcheck.suppressions --template='{id}:{file}:{line},{severity},{message}'"
   GET_SOURCES_ATTEMPTS: "3"
 
@@ -63,8 +64,6 @@ abi/coverage.Debian:
   - make -j$(nproc)
   - make abi-check
   - make pic-check
-  - cd devel/openssl && ./config enable-tls1_3 && make -j$(nproc) && cd ../..
-  - make -C tests/suite TESTS=testcompat-tls13-openssl.sh check
   - make -j$(nproc) check
   - make local-code-coverage-output || true
   tags:
@@ -112,14 +111,15 @@ minimal.Fedora.x86_64:
   - tags
   retry: 1
 
-# This enables SSL3.0 and SHA-1 support
+# This enables SSL3.0 and SHA-1 support, and runs interop tests
+# with openssl 1.1.0, which include legacy algorithms like DSA.
 SSL-3.0.Fedora.x86_64:
   stage: stage1-testing
-  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA28_BUILD
   script:
   - ./bootstrap
   - mkdir -p build && cd build &&
-    dash ../configure --disable-gcc-warnings --cache-file ../cache/config.cache --enable-sha1-support --enable-ssl3-support --enable-seccomp-tests --disable-doc --disable-guile &&
+    dash ../configure --disable-tls13-interop --disable-gcc-warnings --cache-file ../cache/config.cache --enable-sha1-support --enable-ssl3-support --enable-seccomp-tests --disable-doc --disable-guile &&
     make -j$(nproc) && make check -j$(nproc)
   - cd ..
   tags:
@@ -397,32 +397,6 @@ FreeBSD.x86_64:
       - tests/*/*.log
   retry: 1
 
-Fedora.x86:
-  stage: stage1-testing
-  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_X86_BUILD
-  script:
-  - ./bootstrap
-  - mkdir -p build && cd build &&
-    CC="ccache gcc -m32" PKG_CONFIG_LIBDIR=/usr/lib/pkgconfig/ TIME_T_32_BIT_OK=yes
-    ../configure --disable-gcc-warnings --host=i686-redhat-linux --target=i686-redhat-linux
-      --libdir=/usr/lib --disable-cxx --disable-non-suiteb-curves --enable-seccomp-tests
-      --disable-full-test-suite --disable-doc --disable-guile --cache-file ../cache/config.cache &&
-    make -j$(nproc) && make check -j$(nproc) SKIP_DATEFUDGE_CHECK=1 &&
-    make pic-check
-  tags:
-  - shared
-  except:
-  - tags
-  artifacts:
-    expire_in: 1 week
-    when: on_failure
-    paths:
-      - build/*.log
-      - build/tests/*.log
-      - build/tests/*/*.log
-      - build/tests/suite/*/*.log
-  retry: 1
-
 # Two runs, one with normal backend and another with pkcs11 trust store
 ubsan-Werror.Fedora.x86_64:
   stage: stage1-testing
@@ -482,6 +456,44 @@ Debian.x86_64:
       - build/tests/suite/*/*.log
   retry: 1
 
+Debian.cross.i686-linux-gnu:
+  stage: stage1-testing
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_X86_CROSS_BUILD
+  script:
+  - build=$(dpkg-architecture -qDEB_HOST_GNU_TYPE)
+  - host=i686-linux-gnu
+  # not setting CC_FOR_BUILD paired with qemu-user/binfmt somehow causes
+  # config.guess to detect the target as the build platform and not activate
+  # cross-compile mode even though --build is given
+  - export CC_FOR_BUILD="ccache gcc"
+  - export CC="ccache $host-gcc"
+  - ./bootstrap
+  - mkdir -p build
+  - cd build
+  # Debian's softhsm package is not multiarch yet. Missing softhsm libraries
+  # for the target will cause the test suite to fail when p11-kit is enabled.
+  - dash ../configure --build=$build --host=$host --disable-gcc-warnings
+      --cache-file ../cache/config.cache --disable-doc --disable-guile
+      --without-p11-kit --disable-full-test-suite
+  - make -j$(nproc)
+  - make check -j$(nproc)
+  - cd ..
+  tags:
+  - shared
+  - docker
+  except:
+  - tags
+  artifacts:
+    expire_in: 1 week
+    when: on_failure
+    paths:
+      - build/guile/tests/*.log
+      - build/*.log
+      - build/tests/*.log
+      - build/tests/*/*.log
+      - build/tests/suite/*/*.log
+  retry: 1
+
 .Debian.cross.template: &Debian_cross_template
   stage: stage1-testing
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_CROSS_BUILD
diff --git a/configure.ac b/configure.ac
index 2a36a6ed83..dc38c538e5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -175,6 +175,12 @@ esac
 
 fi
 
+AC_ARG_ENABLE(tls13-interop,
+  AS_HELP_STRING([--disable-tls13-interop], [disable TLS1.3 interoperability testing with openssl]),
+    enable_tls13_interop=$enableval, enable_tls13_interop=yes)
+
+AM_CONDITIONAL(ENABLE_TLS13_INTEROP, test "$enable_tls13_interop" != "no")
+
 dnl Check for iovec type
 AC_CHECK_MEMBERS([struct iovec.iov_base],
       [
diff --git a/lib/x509/common.c b/lib/x509/common.c
index b0ee8b80cc..060c2aede1 100644
--- a/lib/x509/common.c
+++ b/lib/x509/common.c
@@ -441,7 +441,7 @@ _gnutls_x509_dn_to_string(const char *oid, void *value,
 {
 	const struct oid_to_string *oentry;
 	int ret;
-	gnutls_datum_t tmp;
+	gnutls_datum_t tmp = {NULL, 0};
 
 	if (value == NULL || value_size <= 0) {
 		gnutls_assert();
@@ -633,6 +633,9 @@ _gnutls_x509_decode_string(unsigned int etype,
 	unsigned int str_size, len;
 	gnutls_datum_t td;
 
+	output->data = NULL;
+	output->size = 0;
+
 	if (allow_ber)
 		ret =
 		    asn1_decode_simple_ber(etype, der, der_size, &str, &str_size, NULL);
diff --git a/lib/x509/dn.c b/lib/x509/dn.c
index 07b9d94b6b..828bd9059d 100644
--- a/lib/x509/dn.c
+++ b/lib/x509/dn.c
@@ -286,6 +286,8 @@ _gnutls_x509_parse_dn(ASN1_TYPE asn1_struct,
 		goto cleanup;
 	}
 
+	assert(dn.data != NULL);
+
 	if (buf) {
 		memcpy(buf, dn.data, dn.size);
 		buf[dn.size] = 0;
diff --git a/lib/x509/pkcs12.c b/lib/x509/pkcs12.c
index 414f9aa3d3..1f5b4bdf88 100644
--- a/lib/x509/pkcs12.c
+++ b/lib/x509/pkcs12.c
@@ -446,16 +446,17 @@ _pkcs12_decode_safe_contents(const gnutls_datum_t * content,
 		    || bag_type == GNUTLS_BAG_CRL
 		    || bag_type == GNUTLS_BAG_SECRET) {
 			gnutls_datum_t tmp = bag->element[i].data;
+			bag->element[i].data.data = NULL;
+			bag->element[i].data.size = 0;
 
 			result =
 			    _pkcs12_decode_crt_bag(bag_type, &tmp,
 						   &bag->element[i].data);
+			_gnutls_free_datum(&tmp);
 			if (result < 0) {
 				gnutls_assert();
 				goto cleanup;
 			}
-
-			_gnutls_free_datum(&tmp);
 		}
 
 		/* read the bag attributes
@@ -1212,12 +1213,8 @@ pkcs12_try_gost:
 		goto cleanup;
 	}
 
-	_gnutls_free_datum(&tmp);
-	_gnutls_free_datum(&salt);
-
-	return 0;
-
-      cleanup:
+	result = 0;
+ cleanup:
 	_gnutls_free_datum(&tmp);
 	_gnutls_free_datum(&salt);
 	return result;
@@ -2024,12 +2021,13 @@ gnutls_pkcs12_mac_info(gnutls_pkcs12_t pkcs12, unsigned int *mac,
 				memcpy(salt, dsalt.data, dsalt.size);
 		} else {
 			*salt_size = dsalt.size;
-			return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
+			ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
+			goto cleanup;
 		}
 	}
 
 	ret = 0;
-      cleanup:
+ cleanup:
 	_gnutls_free_datum(&tmp);
 	_gnutls_free_datum(&dsalt);
 	return ret;
diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 1880f6acc3..6fe6cd91c3 100644
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -154,6 +154,9 @@ gnutls_x509_crt_equals2(gnutls_x509_crt_t cert1,
 {
 	bool result;
 
+	if (cert1 == NULL || der == NULL)
+		return 0;
+
 	if (cert1->der.size == 0 || cert1->modified) {
 		gnutls_datum_t tmp1;
 		int ret;
@@ -4196,8 +4199,10 @@ void gnutls_x509_crt_set_pin_function(gnutls_x509_crt_t crt,
 				      gnutls_pin_callback_t fn,
 				      void *userdata)
 {
-	crt->pin.cb = fn;
-	crt->pin.data = userdata;
+	if (crt) {
+		crt->pin.cb = fn;
+		crt->pin.data = userdata;
+	}
 }
 
 /**
diff --git a/src/cli.c b/src/cli.c
index 5f82e1486f..60de6bc68f 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -40,6 +40,7 @@
 #include <fcntl.h>
 #include <netdb.h>
 #include <ctype.h>
+#include <assert.h>
 
 /* Get TCP_FASTOPEN */
 #ifdef HAVE_NETINET_TCP_H
@@ -914,6 +915,8 @@ bool parse_for_inline_commands_in_buffer(char *buffer, size_t bytes,
 		inline_cmds->new_buffer_ptr = buffer + bytes;
 	}
 
+	assert(local_buffer_ptr != NULL);
+
 	inline_cmds->current_ptr = local_buffer_ptr;
 
 	if (local_buffer_ptr[0] == inline_commands_prefix[0]
diff --git a/tests/suite/Makefile.am b/tests/suite/Makefile.am
index f43fe90eee..f6e413ee56 100644
--- a/tests/suite/Makefile.am
+++ b/tests/suite/Makefile.am
@@ -111,6 +111,10 @@ scripts_to_test += tls-fuzzer/tls-fuzzer-nocert-ssl3.sh
 TESTS_ENVIRONMENT += ENABLE_SSL3=1
 endif
 
+if ENABLE_TLS13_INTEROP
+scripts_to_test += testcompat-tls13-openssl.sh
+endif
+
 if ENABLE_DANE
 scripts_to_test += testdane.sh
 endif
@@ -129,7 +133,7 @@ scripts_to_test += eagain.sh
 endif
 endif
 
-nodist_check_SCRIPTS = $(scripts_to_test) testcompat-tls13-openssl.sh
+nodist_check_SCRIPTS = $(scripts_to_test)
 
 TESTS = $(scripts_to_test) prime-check
 
diff --git a/tests/suite/testcompat-tls13-openssl.sh b/tests/suite/testcompat-tls13-openssl.sh
index b28aad5bf0..8f385f515e 100755
--- a/tests/suite/testcompat-tls13-openssl.sh
+++ b/tests/suite/testcompat-tls13-openssl.sh
@@ -55,9 +55,7 @@ check_for_datefudge
 
 PORT="${PORT:-${RPORT}}"
 
-export LD_LIBRARY_PATH=${abs_top_srcdir}/devel/openssl
-echo LD_LIBRARY_PATH=$LD_LIBRARY_PATH
-SERV=../../devel/openssl/apps/openssl
+SERV=openssl
 OPENSSL_CLI="$SERV"
 
 if test -z "$OUTPUT";then
@@ -347,14 +345,14 @@ _EOF_
 	echo_cmd "${PREFIX}Checking TLS 1.3 with post handshake auth..."
 
 	eval "${GETPORT}"
-	launch_server $$ --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.3${ADD}" --x509certfile "${SERV_CERT}" --x509keyfile "${SERV_KEY}" --x509cafile "${CA_CERT}" #>>${OUTPUT} 2>&1
+	launch_server $$ --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.3${ADD}" --x509certfile "${SERV_CERT}" --x509keyfile "${SERV_KEY}" --x509cafile "${CA_CERT}" >>${OUTPUT} 2>&1
 	PID=$!
 	wait_server ${PID}
 
 	expect - >/dev/null <<_EOF_
 set timeout 10
 set os_error_flag 1
-spawn ${OPENSSL_CLI} s_client -force_pha -host localhost -port "${PORT}" -cert "${CLI_CERT}" -key "${CLI_KEY}" -CAfile "${CA_CERT}"
+spawn ${OPENSSL_CLI} s_client -enable_pha -host localhost -port "${PORT}" -cert "${CLI_CERT}" -key "${CLI_KEY}" -CAfile "${CA_CERT}"
 
 expect "SSL-Session" {send "**REAUTH**\n"} timeout {exit 1}
 expect {