summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* .gitlab-ci.yml: backported and simplified CI setupgnutls_3_5_x-backport-smaller-gitlabciNikos Mavrogiannopoulos2017-04-071-145/+109
| | | | | | | This makes builds independent by reducing interactions between artifacts of builds. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]gnutls_3_5_11Nikos Mavrogiannopoulos2017-04-071-1/+1
|
* released 3.5.11Nikos Mavrogiannopoulos2017-04-073-3/+7
|
* Added openpgp stub fileNikos Mavrogiannopoulos2017-04-072-1/+703
| | | | | | | That allows disabling openpgp authentication and at the same time retaining ABI compatibility with versions including openpgp. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updategnutls_3_5_x-backport-macosx-system-trustNikos Mavrogiannopoulos2017-04-061-0/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added basic check for system trust storeNikos Mavrogiannopoulos2017-04-062-1/+74
| | | | | | | | | This checks whether the gnutls_certificate_set_x509_system_trust() and thus the trust list equivalent function operate as expected and return a positive number of certificates. The test is ignored in systems where these functions return GNUTLS_E_UNIMPLEMENTED_FEATURE. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_x509_trust_list_add_system_trust: Add macOS keychain supportDavid Caldwell2017-04-063-1/+77
| | | | | | | | | | | | Also don't check for a default_trust_store_file in configure when building on macOS (unless explicitly asked to with --with-default-trust-store-file=xxx), because otherwise it finds /etc/ssl/cert.pem: This file is new (since 10.12.2?), which means libraries built on the newest OS version wouldn't work the same way on an older versions (and vice versa). "/etc/ssl/cert.pem" also doesn't seem to reflect additions and deletions from the user's or system's trusted roots keychain (in my limited testing). Signed-off-by: David Caldwell <david@porkrind.org>
* Rename uint64 to gnutls_uint64 to avoid conflict with macOSDavid Caldwell2017-04-0611-48/+48
| | | | Signed-off-by: David Caldwell <david@porkrind.org>
* certtool: fixed newline skip code in smime-to-p7 codegnutls_3_5_x-backport-coverity-fixesNikos Mavrogiannopoulos2017-04-051-1/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* is_level_acceptable: ensure issuer is not dereferenced when nullNikos Mavrogiannopoulos2017-04-051-4/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: guard the value of tl before gnutls_pkcs7_verifyNikos Mavrogiannopoulos2017-04-051-1/+5
| | | | | | This utilizes assert() as it cannot be triggered in practice. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Avoid using ASN1_MAX_NAME_SIZE directlyNikos Mavrogiannopoulos2017-04-0511-52/+53
| | | | | | | | | Since ASN1_MAX_NAME_SIZE refers to a single element in the asn1 tree, it is not suitable to hold the maximum combined name. Instead use a local definition of MAX_NAME_SIZE, which is a multiple of the ASN1_MAX_NAME_SIZE. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crq_set_challenge_password: don't accept null passwordNikos Mavrogiannopoulos2017-04-051-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Mark with (void) the functions where the returned value is not checked ↵Nikos Mavrogiannopoulos2017-04-056-22/+32
| | | | | | | | intentionally This allows static analysers to properly warn on unchecked return values. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* removed duplicate codeNikos Mavrogiannopoulos2017-04-051-3/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake/record: mark with comments all expected fall-through switchesNikos Mavrogiannopoulos2017-04-052-34/+41
| | | | | | | This reduces warnings from static analysers like coverity and makes explicit the intention. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutlsxx.cpp: fixed misleading indentation issuesNikos Mavrogiannopoulos2017-04-051-5/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: document intended fallthroughNikos Mavrogiannopoulos2017-04-051-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: fixed possible buffer overflow to avoid spurious complaintsNikos Mavrogiannopoulos2017-04-051-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_transport_set_pull_timeout_function: doc update [ci skip]Nikos Mavrogiannopoulos2017-04-041-5/+9
| | | | | | | Clarified when this function should be set. Based on suggestion by Sean Greenslade. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Use NORMAL priority for SSLv23_*_method.Andreas Metzler2017-04-031-2/+2
| | | | | | | Instead of enforcing TLS1.0/SSL3.0 use gnutls NORMAL priority for SSLv23_*_methods. http://bugs.debian.org/857436
* tests: Copy template out of ${srcdir}Matt Turner2017-04-011-2/+2
| | | | | | Otherwise, out of tree builds will fail to copy the template. Signed-off-by: Matt Turner <mattst88@gmail.com>
* tests: added checks with problematic PKCS#12 filesNikos Mavrogiannopoulos2017-03-315-2/+69
| | | | | | | These check whether parsing of unsupported files (e.g., with RC2-128), will succeed. This serves as functionality check for gnutls_pkcs8_info. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs8_info: do not free oid on GNUTLS_E_UNKNOWN_CIPHER_TYPENikos Mavrogiannopoulos2017-03-311-1/+5
| | | | | | | The documented behavior of the function was to return a valid OID in that case. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2017-03-301-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .travis.yml: no longer install pkg-configNikos Mavrogiannopoulos2017-03-281-1/+1
| | | | | | | Travis build seem to fail for some reason since pkg-config is already installed. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ocsp-test: disable under windowsNikos Mavrogiannopoulos2017-03-261-2/+2
| | | | | | This test was failing because datefudge couldn't run under win32. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Revert "ocsp-test: disable under windows"Nikos Mavrogiannopoulos2017-03-261-5/+0
| | | | This reverts commit 90d5ad5a42759957866ba1d9c96f5dccfd3ea1cc.
* ocsp-test: disable under windowsNikos Mavrogiannopoulos2017-03-261-0/+5
| | | | | | This test was failing because datefudge couldn't run under win32. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: increase time of artifact expirationNikos Mavrogiannopoulos2017-03-251-1/+1
| | | | | | | This allows to re-run failed builds on the depending stages during that time. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.pc: Removed P11_KIT_LIBS from Libs.privateNikos Mavrogiannopoulos2017-03-251-1/+1
| | | | | | | It was already being included in Requires.private. Reported by Andreas Metzler. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.pc: don't include zlib twice in private libsNikos Mavrogiannopoulos2017-03-232-2/+5
|
* tests: added unit test of gnutls_pubkey_verify_data2 override flagsNikos Mavrogiannopoulos2017-03-222-1/+142
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_check_key_cert_match: allow broken sigsNikos Mavrogiannopoulos2017-03-221-1/+1
| | | | | | | That ensures that when loading a certificate pair with SHA1, when SHA1 is disabled will not cause the server to fail to load. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Use a common function to decide acceptable signaturesNikos Mavrogiannopoulos2017-03-223-7/+6
| | | | | | | | That is, ensure that results from all verification functions, including gnutls_pubkey_verify_data2(), will be consistent with SHA1 and other algorithms deprecation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* check_ocsp_response: utilize the same flags as in certificate verificationNikos Mavrogiannopoulos2017-03-221-5/+8
| | | | | | | That ensures that overrides like using broken algorithms are considered in OCSP validation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-211-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added script to check pkg-config operationNikos Mavrogiannopoulos2017-03-212-1/+63
| | | | | | | That is, whether the generated gnutls.pc will function for compiling and linking. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.pc: don't pass the libtool vars to Libs.privateNikos Mavrogiannopoulos2017-03-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updateNikos Mavrogiannopoulos2017-03-211-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: improved tls-rehandshake testsNikos Mavrogiannopoulos2017-03-212-92/+8
| | | | | | | Used common definitions from cert-common.h for certificates, and improved error detection in tls-rehandshake-cert-2. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether a rehandshake without a cert worksNikos Mavrogiannopoulos2017-03-212-1/+313
| | | | | | | | | That is, check whether if on initial handshake the server requests a certificate, but on the following rehandshake he doesn't, whether the client behaves as expected. This tests: 1f685db853db6e48c77c6dbde0cdf716a7303baa Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: reset cert request state on handshake initNikos Mavrogiannopoulos2017-03-215-16/+14
| | | | | | | | That addresses a bug which on client side on case of an initial handshake with a client certificate, we continue to send this certificate even if on rehandshake we were not requested with on. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Avoid deprecation warnings when including gnutls/abstract.hMartin Storsjo2017-03-181-1/+1
| | | | | | | | | | | | | | | | | | | Since ac3de8f5, when all openpgp functionality was deprecated, a library user including gnutls/abstract.h gets warnings about deprecated declarations, like this: gnutls/openpgp.h:328:10: warning: ‘gnutls_openpgp_recv_key_func’ is deprecated [-Wdeprecated-declarations] gnutls_openpgp_recv_key_func func) _GNUTLS_GCC_ATTR_DEPRECATED; This warning is emitted since the gnutls_openpgp_set_recv_key_function prototype uses the deprecated typedef gnutls_openpgp_recv_key_func. By omitting the deprecation attribute from this individual typedef, we avoid the spurious warnings in calling code which just includes gnutls/abstract.h without actually using anything related to openpgp. Signed-off-by: Martin Storsjo <martin@martin.st>
* Fix a typo in a variable name in an m4 scriptMartin Storsjo2017-03-161-1/+1
| | | | Signed-off-by: Martin Storsjo <martin@martin.st>
* build: disable valgrind tests by defaultAlon Bar-Lev2017-03-154-24/+30
| | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* build: tests: resolve as-needed issue with seccompAlon Bar-Lev2017-03-141-4/+6
| | | | | | | | | | | Incorrect ordering of -lseccomp: <snip> -Wl,--as-needed ../lib/.libs/libgnutls.so -lseccomp ./.libs/libutils.a ./.libs/libutils.a(seccomp.o): In function seccomp_init' seccomp.c:(.text+0x2b): undefined reference to `seccomp_init' <snip> Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* gnutls_pkcs11_privkey_init: document limitation on created objectNikos Mavrogiannopoulos2017-03-142-3/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: re-open privkey session handle on CKR_SESSION_HANDLE_INVALIDNikos Mavrogiannopoulos2017-03-141-3/+11
| | | | | | | When initializing a private key operation, attempt to re-open the key if CKR_SESSION_HANDLE_INVALID is received. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-03-141-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status