delta/gnutls.git - gitlab.com: gnutls/gnutls.git

	Commit message (Collapse)	Author	Age	Files	Lines
...
*	Merge branch 'tmp-keyupdate-fixes' into 'master'	Nikos Mavrogiannopoulos	2019-05-23	3	-9/+23
\|\ \| \| \| \| \| \| \| \| \| \| \| \|	Fix handling of malformed KeyUpdate messages Closes #699 See merge request gnutls/gnutls!1005
\| *	tls13/key_update: increase handling limit from 1 to 8	Daiki Ueno	2019-05-22	2	-8/+20
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	The limit was too small when testing the capability of handling multiple KeyUpdate messages with tlsfuzzer. This requires a change in the rate limit logic, as previously it doesn't count the KeyUpdate messages despite the name of KEY_UPDATES_PER_SEC. Signed-off-by: Daiki Ueno <dueno@redhat.com>
\| *	record_add_to_buffers: check if there is an incomplete handshake header	Daiki Ueno	2019-05-22	1	-1/+3
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	The function checks if a Handshake message is interleaved with an Application Data, but the check was insuffient because it assumed that a complete header is received in the buffer. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* \|	Merge branch 'tmp-small-records' into 'master'	Daiki Ueno	2019-05-23	10	-8/+24
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \|	priority: add new option to allow small records (>= 64) See merge request gnutls/gnutls!1006
\| * \|	tlsfuzzer: use %ALLOW_SMALL_RECORDS for testingtmp-small-records	Daiki Ueno	2019-05-22	4	-6/+3
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Daiki Ueno <dueno@redhat.com>
\| * \|	priority: add new option to allow small records (>= 64)	Daiki Ueno	2019-05-22	6	-2/+21
\| \|/ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	There is a mismatch in the lower limit of record sizes in RFC 8449 (64) and our default (512). If the server advertises a smaller limit than our default, the client has no way to keep communicating with the server. This patch adds a new priority string option %ALLOW_SMALL_RECORDS to set the limit to 64. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* \|	Merge branch 'tmp-remove-unused-flag' into 'master'	Nikos Mavrogiannopoulos	2019-05-23	3	-13/+23
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	pubkey: remove deprecated OLD_PUBKEY_VERIFY_FLAG_TLS1_RSA Closes #754 See merge request gnutls/gnutls!1004
\| * \|	tests: verify functionality of GNUTLS_VERIFY_DISABLE_CA_SIGN flagtmp-remove-unused-flag	Nikos Mavrogiannopoulos	2019-05-21	2	-9/+21
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
\| * \|	pubkey: remove deprecated TLS1_RSA flag check	Kenneth J. Miller	2019-05-21	1	-4/+2
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	The gnutls_certificate_verify_flags comparisons against OLD_PUBKEY_VERIFY_FLAG_TLS1_RSA conflicts with GNUTLS_VERIFY_DISABLE_CA_SIGN and no longer seems to be used in calls to both gnutls_pubkey_verify_data2 and gnutls_pubkey_verify_hash2 as it seems to have been fully replaced by GNUTLS_VERIFY_USE_TLS1_RSA. Resolves: #754 Signed-off-by: Kenneth J. Miller <ken@miller.ec>
* \| \|	Merge branch 'tmp-privkey-tls13' into 'master'	Daiki Ueno	2019-05-22	13	-20/+434
\|\ \ \ \| \|_\|/ \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \|	server auth: disable TLS 1.3 if no signature algorithm is usable Closes #731 See merge request gnutls/gnutls!987
\| * \|	algorithms: eliminate the FFDHE alert desc requirement	Daiki Ueno	2019-05-22	5	-19/+18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This implements the errata for RFC 7919 eliminating the requirement to reply with an insufficient_security alert when we have negotiated an FFDHE group, but cannot find common ciphersuite: https://www.rfc-editor.org/errata/eid4908 Signed-off-by: Daiki Ueno <dueno@redhat.com>
\| * \|	server auth: disable TLS 1.3 if no signature algorithm is usable	Daiki Ueno	2019-05-20	9	-2/+417
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This is a server side counterpart of 005a4d04145707daad9588acedfdb5f6cd97c80c. Instead of signalling an error when no algorithm is usable in TLS 1.3, it downgrades the session to TLS 1.2 with a warning. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* \| \|	Merge branch 'mark_const' into 'master'	Tim Rühsen	2019-05-21	2	-2/+2
\|\ \ \ \| \|_\|/ \|/\| \| \| \| \| \| \| \|	Mark second argument of function gnutls_x509_crt_equals2 as const See merge request gnutls/gnutls!1000
\| * \|	Mark second argument of function gnutls_x509_crt_equals2 as const	Aleksei Nikiforov	2019-05-21	2	-2/+2
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This will allow using this function with certificates returned by function gnutls_certificate_get_peers without casts dropping const qualifier or making temporary copies out of retrieved data. Signed-off-by: Aleksei Nikiforov <darktemplar@basealt.ru>
* \| \|	x509.h: corrected typo in newly introduced definition	Nikos Mavrogiannopoulos	2019-05-21	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* \| \|	Merge branch 'tmp-minor-fixes' into 'master'	Nikos Mavrogiannopoulos	2019-05-21	44	-167/+730
\|\ \ \ \| \|_\|/ \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \|	Few minor bug fixes for the next release Closes #770 and #767 See merge request gnutls/gnutls!1003
\| * \|	x509.h: removed stray '%'	Nikos Mavrogiannopoulos	2019-05-20	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
\| * \|	certtool: CA certificates will contain the digital signature key usage flag	Nikos Mavrogiannopoulos	2019-05-20	28	-127/+231
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This change ensures that all certificates will contain the digital signature key usage flag if that's specified in the template. Resolves: #767 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
\| * \|	Added profile to correspond to the future security parameter	Nikos Mavrogiannopoulos	2019-05-20	11	-34/+393
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	It seems that the FUTURE security level parameter was added without a corresponding verification profile. This patch address the issue by introducing it. Resolves: #770 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
\| * \|	tests: added unit tests of utc and generalTime convertor	Nikos Mavrogiannopoulos	2019-05-20	4	-3/+102
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
\| * \|	algorithms/secparams.c: fixed indentation	Nikos Mavrogiannopoulos	2019-05-20	1	-1/+2
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
\| * \|	gnutls-serv: GERR macro will output in stderr	Nikos Mavrogiannopoulos	2019-05-20	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* \| \|	Merge branch 'tmp-fix-evil-idna' into 'master'	Tim Rühsen	2019-05-20	3	-3/+15
\|\ \ \ \| \|/ / \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \|	Apply STD3 ASCII rules in gnutls_idna_map() Closes #720 See merge request gnutls/gnutls!1001
\| * \|	Apply STD3 ASCII rules in gnutls_idna_map()tmp-fix-evil-idna	Tim Rühsen	2019-05-20	3	-3/+15
\|/ / \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* \|	Merge branch 'tmp-fix-gcc4.4' into 'master'	Tim Rühsen	2019-05-17	2	-3/+4
\|\ \ \| \|/ \|/\| \| \| \| \|	Tmp fix gcc4.4 See merge request gnutls/gnutls!996
\| *	Fix _Thread_local for C99 installed in C11 environmentstmp-fix-gcc4.4	Tim Rühsen	2019-05-17	1	-2/+4
\| \| \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
\| *	Remove redundant typedef of Tspi_Context_GetTpmObject_func()	Tim Rühsen	2019-05-17	1	-1/+0
\|/ \| \| \| \| \|	Gcc 4.4 errors out on this. Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
*	Merge branch 'tmp-update-gnulib' into 'master'	Tim Rühsen	2019-05-16	1	-0/+0
\|\ \| \| \| \| \| \| \| \| \| \| \| \|	Update gnulib for gcc-9 manywarnings Closes #768 See merge request gnutls/gnutls!999
\| *	Update gnulib for gcc-9 manywarningstmp-update-gnulib	Tim Rühsen	2019-05-15	1	-0/+0
\|/ \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
*	Merge branch 'tmp-check-allocations' into 'master'	Nikos Mavrogiannopoulos	2019-05-15	4	-0/+14
\|\ \| \| \| \| \| \| \| \| \| \| \| \|	Check all memory allocation in examples and certtool Closes #739 See merge request gnutls/gnutls!998
\| *	Check all memory allocation in examples and certtooltmp-check-allocations	Nikos Mavrogiannopoulos	2019-05-14	4	-0/+14
\| \| \| \| \| \| \| \| \| \| \| \|	Resolves: #739 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* \|	Merge branch 'tmp-fix-GETPORT' into 'master'	Tim Rühsen	2019-05-14	1	-7/+10
\|\ \ \| \|/ \|/\| \| \| \| \|	Fix endless looping GETPORT in tests/scripts/common.sh See merge request gnutls/gnutls!997
\| *	Fix endless looping GETPORT in tests/scripts/common.shtmp-fix-GETPORT	Tim Rühsen	2019-05-10	1	-7/+10
\| \| \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* \|	Merge branch 'tmp-record-sizes' into 'master'	Daiki Ueno	2019-05-14	19	-50/+410
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \|	ext/record_size_limit: distinguish sending and receiving limits See merge request gnutls/gnutls!985
\| * \|	ext/record_size_limit: distinguish sending and receiving limitstmp-record-sizes	Daiki Ueno	2019-05-14	19	-50/+410
\| \|/ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	The previous behavior was that both sending and receiving limits are negotiated to be the same value. It was problematic when: - client sends a record_size_limit with a large value in CH - server sends a record_size_limit with a smaller value in EE - client updates the limit for both sending and receiving, upon receiving EE - server sends a Certificate message larger than the limit With this patch, each peer maintains the sending / receiving limits separately so not to confuse with the contradicting settings. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* \|	Merge branch 'fix-streebog' into 'master'	Dmitry Eremin-Solenikov	2019-05-13	3	-5/+26
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \|	lib/nettle: fix carry flag in Streebog code See merge request gnutls/gnutls!992
\| * \|	lib/nettle: fix carry flag in Streebog code	Dmitry Eremin-Solenikov	2019-05-13	3	-5/+26
\|/ / \| \| \| \| \| \| \| \| \| \|	Fix carry flag being calculated incorrectly in Streebog code. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* \|	Merge branch 'tmp-lgtm-suppress-ctime' into 'master'	Nikos Mavrogiannopoulos	2019-05-10	18	-31/+85
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \|	tools: suppress ctime() error from lgtm warnings See merge request gnutls/gnutls!994
\| * \|	dane.h: added multiple inclusion header guardtmp-lgtm-suppress-ctime	Nikos Mavrogiannopoulos	2019-05-09	1	-0/+4
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
\| * \|	tools: suppress ctime() error from static analysers	Nikos Mavrogiannopoulos	2019-05-09	6	-13/+40
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This function is not thread safe and can be easily misused even in single threaded scenarios (one such minor bug fixed). Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
\| * \|	accelerated: added header guards	Nikos Mavrogiannopoulos	2019-05-08	11	-18/+41
\| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* \| \|	Merge branch 'tmp-fix-srp' into 'master'	Nikos Mavrogiannopoulos	2019-05-10	2	-4/+11
\|\ \ \ \| \|_\|/ \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \|	_gnutls_srp_entry_free: follow consistent behavior in freeing data Closes #761 See merge request gnutls/gnutls!995
\| * \|	_gnutls_srp_entry_free: follow consistent behavior in freeing datatmp-fix-srp	Nikos Mavrogiannopoulos	2019-05-10	2	-4/+11
\|/ / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	_gnutls_srp_entry_free would previously not free any parameters that were known to gnutls to account for documented behavior of gnutls_srp_set_server_credentials_function(). This was not updated when the newly added 8192 parameter was added to the library. This introduces a safety check for generator parameters, even though in practice they are the same pointer. Resolves: #761 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* \|	Merge branch 'fix-guile-option' into 'master'	Tim Rühsen	2019-05-09	1	-3/+3
\|\ \ \| \|/ \|/\| \| \| \| \|	guile: Properly format guile configure options See merge request gnutls/gnutls!991
\| *	guile: Properly format guile configure options	Daniel Schaefer	2019-05-05	1	-3/+3
\| \| \| \| \| \| \| \| \| \| \| \| \| \|	Without the square brackets autoconf turns hyphens into underscores, which is not what we want or what the help says. Signed-off-by: Daniel Schaefer <git@danielschaefer.me>
* \|	Merge branch 'tmp-header-guards' into 'master'	Tim Rühsen	2019-05-08	166	-337/+645
\|\ \ \| \|/ \|/\| \| \| \| \| \| \| \| \|	Add or clean header guards in lib/ Closes #728 See merge request gnutls/gnutls!954
\| *	Add or clean header guards in lib/nettletmp-header-guards	Tim Rühsen	2019-05-07	25	-58/+88
\| \| \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
\| *	Add or clean header guards in tests/	Tim Rühsen	2019-05-07	12	-12/+52
\| \| \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
\| *	Add or clean header guards in src/	Tim Rühsen	2019-05-07	10	-17/+41
\| \| \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
\| *	Add or clean header guards in lib/x509/	Tim Rühsen	2019-05-07	12	-21/+46
\| \| \| \| \| \| \| \|	Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>