summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* updated auto-generated filesNikos Mavrogiannopoulos2017-08-045-1418/+1641
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/output: print error on invalid public key parameters on certificateNikos Mavrogiannopoulos2017-08-042-18/+36
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pk_get_oid: return early on unknown algorithmNikos Mavrogiannopoulos2017-08-041-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether the gnutls_x509_*_set_spki will reject invalid valuesNikos Mavrogiannopoulos2017-08-041-0/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: updated for gnutls_x509_spki_get_rsa_pss_paramsNikos Mavrogiannopoulos2017-08-043-33/+41
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test of generation of legal and illegal rsa-pss parametersNikos Mavrogiannopoulos2017-08-041-0/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* spki: combined all exported functions to a single set and getNikos Mavrogiannopoulos2017-08-045-125/+57
| | | | | | | | This simplifies setting parameters for a particular key type, as well as getting them. The advantage is that they are set atomically, preventing an inadverterly half-filled structure. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: set RSA-PSS parameters using GNUTLS_KEYGEN_SPKI kdata typeNikos Mavrogiannopoulos2017-08-041-4/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* introduced error code GNUTLS_E_PK_INVALID_PUBKEY_PARAMSNikos Mavrogiannopoulos2017-08-044-5/+8
| | | | | | | This is being use to indicate errors in the public key parameters such as the RSA-PSS salt size or digest algorithm. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_privkey_generate*: allow specifying the SPKI parameters for key ↵Nikos Mavrogiannopoulos2017-08-043-16/+26
| | | | | | | | | | generation This in turn removes the need for reading the flag GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE on the key generation process. The flag is now only used during key signing which is also its documented purpose. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_privkey_set_spki: check validity of parameters setNikos Mavrogiannopoulos2017-08-041-0/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_cr*_set_spki: check for validity of parameters setNikos Mavrogiannopoulos2017-08-042-54/+90
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_check_pubkey_params: removed unnecessary parameterNikos Mavrogiannopoulos2017-08-043-6/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added check for import of RSA-PSS key with invalid saltNikos Mavrogiannopoulos2017-08-042-0/+147
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pubkey_import_x509: propagate errors from ↵Nikos Mavrogiannopoulos2017-08-041-1/+5
| | | | | | gnutls_x509_crt_get_pk_algorithm Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _rsa_pss_verify_digest: verify the validity of the salt_size length on ↵Nikos Mavrogiannopoulos2017-08-041-0/+2
| | | | | | verification Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_privkey_import: immediately exit on GNUTLS_E_PK_INVALID_PRIVKEYNikos Mavrogiannopoulos2017-08-041-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* wrap_nettle_pk_fixup: check RSA PSS parameters for validity on importNikos Mavrogiannopoulos2017-08-041-2/+14
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_*_set_spki: removed arbitrary restrictions to setting parametersNikos Mavrogiannopoulos2017-08-042-21/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for the SPKI abstract functionsNikos Mavrogiannopoulos2017-08-042-1/+138
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: chainverify: included negative and positive tests with RSA-PSS signed ↵Nikos Mavrogiannopoulos2017-08-043-11/+883
| | | | | | chains Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pct_test: use local SPKI structure to override parameters if not setNikos Mavrogiannopoulos2017-08-041-3/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fixup_spki_params: use GNUTLS_E_CONSTRAINT_ERROR for RSA-PSS violationsNikos Mavrogiannopoulos2017-08-041-3/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_read_pkalgo_params: initialize params structureNikos Mavrogiannopoulos2017-08-041-2/+4
| | | | | | | | That is the primary call on these parameters, thus it should initialize the structure with something reasonable. That is similar to behavior of _gnutls_x509_read_rsa_pss_params. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* RSA-PSS parameter checking was moved to lower level functionsNikos Mavrogiannopoulos2017-08-044-36/+34
| | | | | | That way all PKI callers get protected by the checks. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* signature security level check were moved to lower level functionsNikos Mavrogiannopoulos2017-08-044-25/+31
| | | | | | | That way all callers (including PKI functions) get protected by the available checks. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _wrap_nettle_pk_encrypt: return GNUTLS_E_INVALID_REQUEST on unsupported ↵Nikos Mavrogiannopoulos2017-08-041-2/+2
| | | | | | | | algorithms That is a more specific error code than internal error. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: print signature algorithm in cert verification outputNikos Mavrogiannopoulos2017-08-041-0/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* verify_crt: translate GNUTLS_E_CONSTRAINT_ERROR to verification status flagNikos Mavrogiannopoulos2017-08-041-0/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/sign: in debugging mode print the signature algorithmNikos Mavrogiannopoulos2017-08-041-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_validate_sign_params: use GNUTLS_E_CONSTRAINT_ERROR for ↵Nikos Mavrogiannopoulos2017-08-041-2/+2
| | | | | | mismatch of RSA-PSS parameters Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_read_rsa_pss_params: fail early on unknown hash algorithmsNikos Mavrogiannopoulos2017-08-041-4/+12
| | | | | | | Also utilize GNUTLS_E_CONSTRAINT_ERROR for signaling differences between the hash functions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pubkey_get_preferred_hash_algorithm: will take into account the ↵Nikos Mavrogiannopoulos2017-08-041-2/+14
| | | | | | | | | RSA-PSS SPKI In addition it will offer a SHA hash depending on the key size for RSA public keys. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: sign_params_to_flags: use strtok to parse inputNikos Mavrogiannopoulos2017-08-041-5/+20
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: copy SPKI information from private key when availableNikos Mavrogiannopoulos2017-08-041-15/+14
| | | | | | That also addresses a bug due to which SPKI information was not set. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/output: Subject Public Key parameters are printed just before actual keyNikos Mavrogiannopoulos2017-08-041-65/+28
| | | | | | | That allows to easier figure out algorithm and basic parameters, rather than having them at the end of long key output. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_set_spki: be more verbose in parameter restrictionsNikos Mavrogiannopoulos2017-08-041-4/+14
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_privkey_update_spki_params: use GNUTLS_E_CONSTRAINT_ERROR on ↵Nikos Mavrogiannopoulos2017-08-041-3/+2
| | | | | | | | | | | | | mismatch of hash That is a more specific error code for hash mismatch between public key information and signature. In addition only override the salt size, if it is set to zero without the proper flags. That prevents the update function from setting an invalid (lower) than the expected size. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cert-tests: use .tmp suffix for all testsNikos Mavrogiannopoulos2017-08-042-3/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: allow specifying RSA-PSS parameters for key generationNikos Mavrogiannopoulos2017-08-042-14/+30
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_write_rsa_pss_params: refuse to write RSA-PSS parameters we ↵Nikos Mavrogiannopoulos2017-08-041-0/+4
| | | | | | cannot use Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: group together common optionsNikos Mavrogiannopoulos2017-08-041-202/+279
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: modified to account new errorsNikos Mavrogiannopoulos2017-08-031-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_*_get_signature_algorithm: simplified error handlingNikos Mavrogiannopoulos2017-08-034-18/+22
| | | | | | | | | These functions were documented to return a negative error code on failure, as well as GNUTLS_SIGN_UNKNOWN on unknown algorithms. Simplify them by only returning GNUTLS_SIGN_UNKNOWN on all error conditions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_get_signature_algorithm: return negative error code on unknown ↵Nikos Mavrogiannopoulos2017-08-031-3/+6
| | | | | | | | algorithm This allows internal callers to quickly fail on errors. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* compare_sig_algorithm: modify to work even for certs with unsupported ↵Nikos Mavrogiannopoulos2017-08-031-9/+16
| | | | | | signature algorithm Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pubkey_verify_hashed_data: simplified and made staticNikos Mavrogiannopoulos2017-08-033-29/+38
| | | | | | | | That also removes its ability to operate with the 'unknown' signature algorithm, and forces the TLS 1.0 key exchange to supply the right algorithm or flags. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pubkey_verify_data: accept signature entry instead of PK and hashNikos Mavrogiannopoulos2017-08-034-22/+26
| | | | | | | That aligns better with current callers which know the signature algorithm in use. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* NEWS: documented the SPKI handling functionsNikos Mavrogiannopoulos2017-08-031-0/+18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added RSA and RSA PSS key unit testsNikos Mavrogiannopoulos2017-08-032-1/+176
| | | | | | | | | | That is test: 1. Whether RSA-PSS keys will refuse to sign with incompatible signature 2. Whether RSA-PSS public keys cannot be used for encryption 3. Whether RSA-PSS keys cannot be used for signing with PKCS#1 1.5 4. Whether an RSA key can be converted to an RSA-PSS one with the public APIs Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status