summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* .gitlab-ci.yml: added compilation of selected fedora components in CItmp-change-buildroot-to-f25Nikos Mavrogiannopoulos2017-02-221-0/+43
| | | | This allows to catch early regressions due to changes.
* nettle/pk: corrected memcpy of Q in DSA paramsNikos Mavrogiannopoulos2017-02-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* crypto.h: improved documentation of randomness levelsNikos Mavrogiannopoulos2017-02-211-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* nettle/pk: use the appropriate level of randomness for each operationNikos Mavrogiannopoulos2017-02-211-14/+36
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* srp: use nonce level for SRP password randomizationNikos Mavrogiannopoulos2017-02-211-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: document the use of assert()Nikos Mavrogiannopoulos2017-02-211-0/+21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: removed protocol/ directoryNikos Mavrogiannopoulos2017-02-21205-270483/+0
| | | | | | | | While it was used during the first years of development, today it is way more easy to access protocol documents via the IETF web site. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added SECURITY.md, a description of the security issue handling processNikos Mavrogiannopoulos2017-02-211-0/+32
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: require clang analyzer build to be warning freeNikos Mavrogiannopoulos2017-02-211-3/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* configure: no longer use -Wframe-larger-thanNikos Mavrogiannopoulos2017-02-201-1/+0
| | | | | | | | We do not require a specific stack size, and there is legacy code which utilizes large stack sizes. As such remove the warnings to allow for a warning free compilation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: avoid calling memcpy will null optionsNikos Mavrogiannopoulos2017-02-201-2/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* preinitialize variables to work-around warnings with clangNikos Mavrogiannopoulos2017-02-204-2/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* eliminated dead code as indicated by clang scan-buildNikos Mavrogiannopoulos2017-02-209-11/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs7: corrected error checking in write_signer_idNikos Mavrogiannopoulos2017-02-201-6/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* preinitialize variables to work-around warnings with clang's scan-buildNikos Mavrogiannopoulos2017-02-205-13/+16
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* eliminated various clang warnings with non-null argumentsNikos Mavrogiannopoulos2017-02-2010-4/+23
| | | | | | | That is, use assert() to ensure that known to be non-null variables will be used as input to functions requiring non-null. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* make_printable_string: allow operation with null inputNikos Mavrogiannopoulos2017-02-201-0/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: replaced clang's build with clang analyser's scan-buildNikos Mavrogiannopoulos2017-02-201-21/+22
| | | | | | This introduces a static analyser pass in the CI. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: added cppcheck runNikos Mavrogiannopoulos2017-02-201-0/+21
| | | | | | This adds a basic static analysis of the source code. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* opencdk/read-packet.c: corrected typo in type castNikos Mavrogiannopoulos2017-02-201-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cdk_pkt_read: enforce packet limitsNikos Mavrogiannopoulos2017-02-201-0/+9
| | | | | | | | | | | | That ensures that there are no overflows in the subsequent calculations. Resolves the oss-fuzz found bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 Relates: #159 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added test case with invalid openpgp certNikos Mavrogiannopoulos2017-02-203-2/+4
| | | | | | | That triggers a heap buffer overflow: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Add LMTP, POP3, NNTP, Sieve and PostgreSQL support to gnutls-cliRobert Scheck2017-02-1910-3/+107
| | | | | | Add LMTP (RFC 2033), POP3 (RFC 2595), NNTP (RFC 4642), Sieve (RFC 5804) and PostgreSQL support to gnutls-cli ("--starttls-proto"). Signed-off-by: Robert Scheck <robert@fedoraproject.org>
* README.md: added CII best practices badge [ci skip]Nikos Mavrogiannopoulos2017-02-191-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: Improve port-checking infrastructure.tmp-work-without-netstatRical Jasan2017-02-191-6/+47
| | | | | | | | | | | | | | | | | | | | | | | The test suite unnecessarily failed on systems without netstat because it was assumed to be present. Instead of simply checking for its presence and indicating an unsupported test, however, the ss utility can be used as a drop-in replacement. When netstat/net-tools is not present, the ss utility from iproute2 still stands a fair chance of existing, and they also have similar enough semantics that they can be used interchangeably in the test suite. The functions in tests/scripts/common.sh that used netstat (wait_for_port, wait_for_free_port) now use new functions, check_if_port_in_use and check_if_port_listening, to abstract the call to netstat/ss. The eval'd variable GETPORT also used netstat, and has been updated accordingly. The new port-checking functions use another new function, have_port_finder, which takes care of the details of selecting ss (preferred) or netstat, or fails otherwise. Signed-off-by: Rical Jasan <ricaljasan@pacific.net> Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* build: doc: install images also into htmldirAlon Bar-Lev2017-02-181-8/+11
| | | | | | images are required also by the html documentation. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
* .gitlab-ci.yml: corrected coverage buildtmp-cert-fractional-secondsNikos Mavrogiannopoulos2017-02-181-3/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: remove submodule update from main buildNikos Mavrogiannopoulos2017-02-181-2/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2017-02-182-1/+3
|
* Makefile: improved symbols extractionNikos Mavrogiannopoulos2017-02-181-1/+1
| | | | | | That is, do not include non-function names. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-171-1/+7
|
* tests: ignore sanity checks in broken cert testNikos Mavrogiannopoulos2017-02-171-0/+2
| | | | | | | This allows the existing reproducers which contain certificates which are rejected by sanity checks, to still be used to detect regressions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Added gnutls_x509_crt_set_flags()Nikos Mavrogiannopoulos2017-02-176-0/+37
| | | | | | | | This functions allows specifying flags to the certificate object. In particular it allows the single flag GNUTLS_X509_CRT_FLAG_IGNORE_SANITY which allows to ignore sanity checks at the import of the certificate. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-171-0/+4
|
* Introduced GNUTLS_E_CERTIFICATE_TIME_ERROR error codeNikos Mavrogiannopoulos2017-02-173-1/+4
| | | | | | This error code indicates an issue in the time fields of certificate. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/output: properly indicate error in Time fieldsNikos Mavrogiannopoulos2017-02-171-2/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* x509/time: refuse importing certificates with invalid Time fieldsNikos Mavrogiannopoulos2017-02-171-0/+8
| | | | | | | | | That will refuse to import certificates which their time field is not in GMT, or contain fractional seconds. Resolves: #169 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_x509_generalTime2gtime: refuse to parse fractional secondsNikos Mavrogiannopoulos2017-02-171-2/+7
| | | | | | Fractional seconds in GeneralizedTime are prohibited by RFC5280. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhanced test suite to include invalid X509v3 certNikos Mavrogiannopoulos2017-02-173-1/+29
| | | | | | | That certificate contains a GeneralizedTime with fractional seconds. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_list_import: fixed leak on import failureNikos Mavrogiannopoulos2017-02-171-0/+1
|
* tests: enhanced test suite to include creation of invalid certificatesNikos Mavrogiannopoulos2017-02-172-1/+217
| | | | | | | That is, check whether the creation of invalid V2 or V1 certificates will be detected, and that the correct error codes are returned. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_sign2: refuse to sign invalid X.509 certificatesNikos Mavrogiannopoulos2017-02-173-16/+37
| | | | | | | That is, do not sign X.509 certificates which have fields that shouldn't be present on their corresponding version. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_import: reject X.509v1 certificates with invalid fieldsNikos Mavrogiannopoulos2017-02-171-17/+53
| | | | | | | | | | | Refuse to import X.509v1 certificates which have fields that didn't exist in X.509v1 specification. That is the issuerUniqueID and subjectUniqueID fields. Resolves: #168 Resolves: #167 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhanced test suite to include invalid V1 certsNikos Mavrogiannopoulos2017-02-174-2/+96
| | | | | | | That is, added X.509v1 certificates with attributes that shouldn't have been presented (valid for X.509v2 only). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls.pc: do not include libidn2 in Requires.privatetmp-stages-updatesNikos Mavrogiannopoulos2017-02-152-6/+8
| | | | | | | | The libidn2 versions available do not include libidn2.pc, thus the inclusion was causing problems when using pkg-config. Instead we include -lidn2 in Libs.private. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: Re-organized stagesNikos Mavrogiannopoulos2017-02-151-116/+161
| | | | | | | | The less CPU intensive tasks were moved to earlier stage, and the CPU intensive tasks are only spawned only after basic syntax and ABI checks have succeeded. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls.h: corrected typo [ci skip]Nikos Mavrogiannopoulos2017-02-121-1/+1
|
* <alloca.h> only if HAVE_ALLOCA_HMarcin Cieślak2017-02-092-0/+4
| | | | | | FreeBSD does know alloca() but has no such header Signed-off-by: Marcin Cieślak <saper@SAPER.INFO>
* doc: document the intention of the priority string usage [ci skip]Nikos Mavrogiannopoulos2017-02-051-2/+17
| | | | | | | | This documents the gnutls_set_default_priority() function, and how it is intended to be combined with an application that utilizes priority strings. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc updateNikos Mavrogiannopoulos2017-02-051-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status