summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* updated auto-generated filestmp-fix-certtool-double-freeNikos Mavrogiannopoulos2018-01-261-474/+474
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: deprecated the --certificate-pubkey optionNikos Mavrogiannopoulos2018-01-261-1/+2
| | | | | | | That option is duplicate since --pubkey-info can provide the same information. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* certtool: avoid duplicate deinitialization on --certificate-pubkeyNikos Mavrogiannopoulos2018-01-261-4/+8
| | | | | | Resolves #368 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* dh: document why BER decoding rules are allowsNikos Mavrogiannopoulos2018-01-231-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pubkey: use the strict DER decoder for SubjectPublicKeyInfoNikos Mavrogiannopoulos2018-01-231-1/+1
| | | | | | | | Although there is no explicit RFC mentioning the SubjectPublicKeyInfo encoding, this structure is a subset of the X.509 certificate's structure and as such it is expected to be in DER form. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pk: document need for the generic BER decoderNikos Mavrogiannopoulos2018-01-231-0/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updatetmp-pkcs11-access-fixesNikos Mavrogiannopoulos2018-01-231-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: check whether deletion of a certificate object worksNikos Mavrogiannopoulos2018-01-231-0/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* p11tool: corrected issue preventing the deletion of objects in batch modeNikos Mavrogiannopoulos2018-01-231-0/+2
| | | | | | | Previously initialization of PIN callbacks would only happen during listing of objects, which happened only in non-batch mode. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* p11tool: corrected type affecting use of --only-urlsNikos Mavrogiannopoulos2018-01-231-1/+1
| | | | | | It would enable batch mode accidentally. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: pkcs11/tls-neg-pkcs11-key: updated for softhsm with PKCS#11 supportNikos Mavrogiannopoulos2018-01-221-12/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* added sub-section on selecting the right return value [ci skip]Nikos Mavrogiannopoulos2018-01-221-0/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-01-171-5/+15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* examples: use gnutls_certificate_set_x509_system_trustNikos Mavrogiannopoulos2018-01-172-11/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc updatetmp-dtls-further-mtu-improvementsNikos Mavrogiannopoulos2018-01-161-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: privkey-verify-broken: addressed uninitialized var useNikos Mavrogiannopoulos2018-01-161-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check whether get_mtu() functions relate to the set valuesNikos Mavrogiannopoulos2018-01-161-0/+25
| | | | | | | | That is, verify that gnutls_dtls_set_data_mtu() value would be reflected into gnutls_dtls_get_data_mtu(), as well as the gnutls_dtls_set_mtu() to gnutls_dtls_get_mtu(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for _gnutls_record_overhead()Nikos Mavrogiannopoulos2018-01-165-3/+110
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* DTLS: improved data MTU calculation under CBC ciphersuitesNikos Mavrogiannopoulos2018-01-163-46/+69
| | | | | | | | | | | | | | | | | The data MTU calculation under CBC ciphersuites takes into account that the overhead of these ciphersuites is constant (IV + hash + 1 byte padding), though the capacity varies due to the padding block. That is, on 16-byte padding block, one padding byte is the overhead but the rest 15 bytes are accounted for data MTU. That also has the side effect that setting a data MTU using gnutls_dtls_set_data_mtu(), is not definite, and the actual MTU may be larger for these ciphersuites --i.e., the return value of gnutls_dtls_get_data_mtu(). Resolves #360 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: added reproducer for leak in gnutls_x509_crl_list_importtmp-mem-leakNikos Mavrogiannopoulos2018-01-101-0/+1
| | | | | | | That was detected by oss-fuzz in: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4930 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_list_import: eliminated memory leakNikos Mavrogiannopoulos2018-01-101-3/+5
| | | | | | | That leak would be triggered if GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED flag was used and the input data would exceed the maximum limit. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* libtasn1: updated to latest libtasn1 master branchtmp-update-libtasn1Nikos Mavrogiannopoulos2018-01-093-8/+32
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs12_key_parser_fuzzer.in: added reproducer for oss-fuzz #4890Nikos Mavrogiannopoulos2018-01-091-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-01-071-0/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: updated copyright year for manualtmp-fix-verification-issuesNikos Mavrogiannopoulos2018-01-061-2/+2
| | | | | | That eliminates the 'make syntax-check' error. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added reproducer for self-signed verification errorNikos Mavrogiannopoulos2018-01-062-0/+144
| | | | | | Relates #347 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* x509/verify: when verifying against a self signed certificate ignore issuerNikos Mavrogiannopoulos2017-12-301-5/+7
| | | | | | | | | | That is, ignore issuer when checking the issuer's parameters strength. That resolves the issue of marking self-signed certificates as with insecure parameters during verification. Resolves #347 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_pk_self_test: include ECDSA tests on GNUTLS_PK_ECtmp-update-fips-self-testsNikos Mavrogiannopoulos2017-12-211-24/+25
| | | | | | | | Previously when a request for a specific self check on GNUTLS_PK_EC was done, only ECDH tests would be run. This change includes the ECDSA tests as well (GNUTLS_PK_EC and GNUTLS_PK_ECDSA are an alias to each other). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: hash-large: increase parallelism to allow fast run in CItmp-speedup-hash-testsNikos Mavrogiannopoulos2017-12-203-50/+67
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: reference gnutls_prf_rfc5705 instead of gnutls_prf303-provide-a-consistent-set-of-default-ciphers-across-supported-protocolsNikos Mavrogiannopoulos2017-12-081-9/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: utils.h: forbid compilation with NDEBUGtmp-pkcs11-updateNikos Mavrogiannopoulos2017-12-031-0/+4
| | | | | | | This allows to rely on the assert() macro being functional on the test suite. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: p11-kit-load.sh: verify that all modules are loaded after a private ↵Nikos Mavrogiannopoulos2017-12-032-3/+23
| | | | | | key operation Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: enhanced pkcs11/list-tokensNikos Mavrogiannopoulos2017-12-031-4/+12
| | | | | | | | | This not only creates a trust list with the system certificates, but also attempts to verify a certificate, increasing the number of calls to PKCS#11 verification API (and thus ensuring there are no calls which may trigger the load of other modules). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11 verification: always use the ↵Nikos Mavrogiannopoulos2017-12-032-6/+10
| | | | | | | | | | GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE That is, make sure that all our calls to PKCS#11 subsystem for verification will only trigger the trust module initialization, and not the generic PKCS#11 initialization. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: simplify trusted module loading stateNikos Mavrogiannopoulos2017-12-032-13/+15
| | | | | | | | That is always utilize the same flags (GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE) to determine whether to initialize trusted modules only or proceed with general initialization. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_pkcs11_check_init: improved transition between statesNikos Mavrogiannopoulos2017-12-033-20/+59
| | | | | | | | | | | | | The init_level_t for PKCS#11 modules, was incorrectly handled as a linear state transition, causing few cases in the transition to be incorrectly handled. Define precisely the state transitions and enforce them in _gnutls_pkcs11_check_init. That addresses a regression introduced by the previous state handling addition, which made impossible to switch from the trusted state to the all modules. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: corrected destructive/p11-kit-load.sh error checkingNikos Mavrogiannopoulos2017-12-021-21/+47
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-serv: fix double-free on inactivity timeouttmp-dueno-serv-double-freeDaiki Ueno2017-12-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Previously, gnutls-serv --echo segfaulted when closing client connection after inactivity timeout. Here is the valgrind output: ==20246== Invalid free() / delete / delete[] / realloc() ==20246== at 0x4C2FD18: free (vg_replace_malloc.c:530) ==20246== by 0x405310: listener_free (serv.c:154) ==20246== by 0x408B57: tcp_server (serv.c:1568) ==20246== by 0x407DA6: main (serv.c:1231) ==20246== Address 0x6ed4fe0 is 0 bytes inside a block of size 3 free'd ==20246== at 0x4C2FD18: free (vg_replace_malloc.c:530) ==20246== by 0x408A1D: tcp_server (serv.c:1548) ==20246== by 0x407DA6: main (serv.c:1231) ==20246== Block was alloc'd at ==20246== at 0x4C2EB6B: malloc (vg_replace_malloc.c:299) ==20246== by 0x6A64489: strdup (in /usr/lib64/libc-2.25.so) ==20246== by 0x407310: get_response (serv.c:948) ==20246== by 0x408840: tcp_server (serv.c:1492) ==20246== by 0x407DA6: main (serv.c:1231) ==20246== Signed-off-by: Daiki Ueno <dueno@redhat.com>
* .dir-locals.el: new fileDaiki Ueno2017-11-301-0/+1
| | | | | | This forces Emacs to use the Linux kernel coding style for all C code. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* build: remove m4 files pulled in by autopointDaiki Ueno2017-11-303-905/+0
| | | | | | | Having these files in the git repository causes unnecessary changes after "make bootstrap". Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls_aead_cipher_init: corrected potential memory leakNikos Mavrogiannopoulos2017-11-291-4/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: provided basic documentation of the FIPS140-2 mode [ci skip]Nikos Mavrogiannopoulos2017-11-283-4/+41
| | | | | | Resolves #332 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: verify whether group remains the same after resumptiontmp-restore-group-infoNikos Mavrogiannopoulos2017-11-271-0/+19
| | | | | | Resolves #331 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* _gnutls_set_resumed_parameters: restore the group from resumed parametersNikos Mavrogiannopoulos2017-11-271-0/+1
| | | | | | | That allows resumed sessions to have the original group information such as curve used for key exchange or FFDHE parameters. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: removed unnecessary assertNikos Mavrogiannopoulos2017-11-241-1/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: delete temporary filesNikos Mavrogiannopoulos2017-11-241-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* session state: use the right type for send_cert_req variableNikos Mavrogiannopoulos2017-11-241-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: client-fastopen: introduce child signal handler and delay prior to ↵Nikos Mavrogiannopoulos2017-11-241-5/+8
| | | | | | | | starting This addresses a hang issue on freebsd builds. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* psktool: allow up to 512-byte keysNikos Mavrogiannopoulos2017-11-221-1/+1
| | | | | | | | | | This aligns the psktool --help output with the psktool operation. Suggested by Jack Lloyd. Resolves #327 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* getfuncs-map.pl: added gnutls_srp_8192_group* symbols to ignore listtmp-srp-updatesNikos Mavrogiannopoulos2017-11-221-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status