summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* tests: key_update: improved error checking and increased timeouttmp-move-ci-to-f28Nikos Mavrogiannopoulos2018-05-101-4/+10
| | | | | | That is to avoid reaching the maximum number of key updates per second. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* .gitlab-ci.yml: moved fedora CI builds to F28Nikos Mavrogiannopoulos2018-05-091-3/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: testcompat-openssl: disable DSS ciphersuites under SSL3.0Nikos Mavrogiannopoulos2018-05-091-59/+64
| | | | | | | | Previously if openssl wouldn't support DSS, we would only disable DSS under TLS1.0 or later, not under SSL 3.0. This fixes interoperability with Fedora28 openssl. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Makefile.am: optimized the abi-check configure stepNikos Mavrogiannopoulos2018-05-092-4/+7
| | | | | | | Also ensured that the same build flags are applied in both builds for ABI checking. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* several updates to address issues found by clang static analyzerNikos Mavrogiannopoulos2018-05-096-10/+16
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* nettle: fix casts which result to warnings in newer gccNikos Mavrogiannopoulos2018-05-091-4/+14
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: updated for GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER from handshakeNikos Mavrogiannopoulos2018-05-071-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* handshake: use GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER consistentlyNikos Mavrogiannopoulos2018-05-073-3/+4
| | | | | | | | | Also treat GNUTLS_E_ILLEGAL_PARAMETER as a synonym if returned during a connection. Relates #442 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* CONTRIBUTING.md: documented status of C++ library [ci skip]Nikos Mavrogiannopoulos2018-05-071-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: cookie: fixed exit condition [ci skip]Nikos Mavrogiannopoulos2018-05-071-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc update [ci skip]Nikos Mavrogiannopoulos2018-05-071-0/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: fixes in win32 buildsNikos Mavrogiannopoulos2018-05-071-3/+3
| | | | | | Relates #439 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: honor --ask-pass when loading a private keyNikos Mavrogiannopoulos2018-05-075-15/+50
| | | | | | | | | This also improves the password prompt when the password requested is not for a smart card. Resolves: #436 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: Disable full test suite for cross buildsMichael Weiser2018-05-071-1/+1
| | | | | | Disable the full test suite for cross CI builds to speed them up. Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* .gitlab-ci.yml: Expire all build log artifactsMichael Weiser2018-05-071-0/+4
| | | | Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* Use configured CC for pkg-config testMichael Weiser2018-05-072-2/+4
| | | | | | | Using the configured compiler aids in running the test suite under qemu or in a multlib scenario. Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* Add Debian-based qemu cross CI targetsMichael Weiser2018-05-071-2/+44
| | | | Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
* updated-auto-generated filesNikos Mavrogiannopoulos2018-05-052-344/+376
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* fuzzer: added fresh TLS1.3 server traceNikos Mavrogiannopoulos2018-05-051-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-serv: all skipping DTLS cookie requestNikos Mavrogiannopoulos2018-05-052-33/+44
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: corrected data written by server traceNikos Mavrogiannopoulos2018-05-051-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: post handshake auth: test more combinationsNikos Mavrogiannopoulos2018-05-041-17/+42
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* post_handshake_auth: send extension irrespective of certificates being presentNikos Mavrogiannopoulos2018-05-041-1/+1
| | | | | | | | The feature does not necessarily require certificates to be present and an empty cert can be presented. Furthermore, the certificates can be set later on the credentials structure. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-openssl-suite' into 'master'Nikos Mavrogiannopoulos2018-05-0431-198/+1040
|\ | | | | | | | | | | | | Added testsuite for TLS1.3 interoperability with openssl Closes #228 and #427 See merge request gnutls/gnutls!621
| * updated auto-generated filesNikos Mavrogiannopoulos2018-05-042-72/+136
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * tests: added interop tests with openssl under TLS1.3Nikos Mavrogiannopoulos2018-05-0412-7/+677
| | | | | | | | | | | | | | | | | | | | | | | | | | This adds interoperability tests for: * PSK with elliptic curve DHE * RSA,RSA-PSS,secp256r1,ed25519 server certificate * RSA,RSA-PSS,secp256r1,ed25519 client certificate * X25519,SECP256R1 key share exchange * key share with HRR Relates #328 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * doc: clarified re-handshake details under TLS1.2 serverNikos Mavrogiannopoulos2018-05-041-1/+5
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * tls13/certificate_request: corrected check of duplicate signature algorithmsNikos Mavrogiannopoulos2018-05-044-22/+45
| | | | | | | | | | | | | | | | | | | | Made the check local when parsing a certificate request, as we may receive multiple requests when post-handshake authentication is in place. Furthermore check whether this extension has been received as this is a mandatory one. In addition handle a memory leak when multiple peer certificates are set. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * gnutls_reauth: doc updateNikos Mavrogiannopoulos2018-05-041-1/+3
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * gnutls-cli: enhanced tool for TLS1.3 optionsNikos Mavrogiannopoulos2018-05-045-21/+91
| | | | | | | | | | | | | | This patch allows a client to enable post-handshake authentication, perform re-key and restrict the sent key shares. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| * tls13/certificate: send empty certificate instead of skippingNikos Mavrogiannopoulos2018-05-041-25/+24
| | | | | | | | | | | | | | | | | | | | According to TLS1.3 spec: The server's certificate_list MUST always be non-empty. A client will send an empty certificate_list if it does not have an appropriate certificate to send in response to the server's authentication request. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * _gnutls_figure_common_ciphersuite: ignore certificate check if PSK is negotiatedNikos Mavrogiannopoulos2018-05-041-6/+2
| | | | | | | | | | | | | | | | That is, if we are performing PSK under TLS1.3, don't bother checking whether the certificate is compatible with the ciphersuite; there isn't any. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * tls13/certificate_verify: corrected context in signatures in client sideNikos Mavrogiannopoulos2018-05-041-7/+24
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * _gnutls13_handshake_sign_data: avoid unnecessary copyNikos Mavrogiannopoulos2018-05-041-6/+9
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * handshake: cleanup in TLS1.3 initial secret calculationNikos Mavrogiannopoulos2018-05-041-15/+3
| | | | | | | | | | | | That eliminates duplicate code in server hello parsing. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * psk: compute binder which is compatible with draft-ietf-tls-tls13Nikos Mavrogiannopoulos2018-05-042-15/+21
|/ | | | | | | | | Previously the computed binder values was not compatible with any TLS1.3 draft, and was not interoperating with openssl or tlslite. Resolves #427 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* CONTRIBUTING.md: added text on CI [ci skip]Nikos Mavrogiannopoulos2018-05-041-1/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: fallback scsv: check proper fallback under TLS 1.3Nikos Mavrogiannopoulos2018-05-031-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* encrypt_packet_tls13: made size check saferNikos Mavrogiannopoulos2018-05-031-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-pkcs11-sensitive-fix' into 'master'Nikos Mavrogiannopoulos2018-05-039-17/+206
|\ | | | | | | | | pkcs11: mark private key objects as sensitive by default See merge request gnutls/gnutls!627
| * pkcs11: mark private key objects as sensitive by defaulttmp-pkcs11-sensitive-fixNikos Mavrogiannopoulos2018-05-039-17/+206
|/ | | | | | | That is, to prevent accidentally creating objects which can be exported. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tmp-rsa-psk-fix' into 'master'Nikos Mavrogiannopoulos2018-04-305-10/+271
|\ | | | | | | | | RSA-PSK ciphersuites: only use under TLS1.2 See merge request gnutls/gnutls!624
| * tests: check the behavior of TLS1.2 key exchange methods under TLS1.3Nikos Mavrogiannopoulos2018-04-303-1/+249
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * psk: mark psk_ke_modes as invalid when ignoredNikos Mavrogiannopoulos2018-04-301-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | TLS1.3 handles the receiving of pre-shared keys extension as invalid when the psk_ke_modes extension is not received as well. As such, when we ignore the psk_ke_modes for some reason (e.g., no credentials) we need to indicate that it was received. We use the invalid mode flag for that reason, allowing the handshake to fail later for the right reason (e.g., no credentials error rather than illegal extension). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * priority: handle RSA-PSK ciphersuites similar to SRPNikos Mavrogiannopoulos2018-04-301-5/+11
|/ | | | | | That is, when specified disable TLS1.3. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-sni-hostname' into 'master'Nikos Mavrogiannopoulos2018-04-2910-1023/+1135
|\ | | | | | | | | | | | | tests: updated sni-hostname check for TLS1.3 Closes #344 See merge request gnutls/gnutls!623
| * Add another sni related testtmp-sni-hostnameAndreas Metzler2018-04-291-0/+3
| | | | | | | | | | | | | | As --sni-hostname does not imply --verify-hostname a hostname mismatch still triggers an error. Signed-off-by: Andreas Metzler <ametzler@bebt.de>
| * tests: sni-hostname was updated to support TLS1.3Nikos Mavrogiannopoulos2018-04-294-9/+70
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * updated auto-generated filesNikos Mavrogiannopoulos2018-04-294-1005/+1040
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| * doc: Add crossreference/warningAndreas Metzler2018-04-291-1/+1
| | | | | | | | | | | | Add pointer to --verify-hostname to --sni-hostname description. Signed-off-by: Andreas Metzler <ametzler@bebt.de>
View Lorry Controller Status