summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* sysrng-linux: improved detection of getrandom()tmp-remove-arcfour-from-benchmarksNikos Mavrogiannopoulos2017-05-202-4/+4
| | | | | | The getrandom() call is defined in sys/random.h. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: use 16k buffers in --benchmark-tls-ciphersNikos Mavrogiannopoulos2017-05-201-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: cleaned up --benchmark-ciphers outputNikos Mavrogiannopoulos2017-05-201-2/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: no longer include arcfour in benchmarksNikos Mavrogiannopoulos2017-05-202-8/+0
| | | | | | | This cipher is considered broken and no longer included in the default set of ciphers. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* documented the make files-update make optionNikos Mavrogiannopoulos2017-05-201-0/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* updated auto-generated filesNikos Mavrogiannopoulos2017-05-202-194/+247
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added TLS server test for multi-key usageNikos Mavrogiannopoulos2017-05-202-1/+78
| | | | | | That is, a server which utilizes both RSA and ECDSA keys. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* p11tool: mark provider opts as deprecatedNikos Mavrogiannopoulos2017-05-201-0/+1
| | | | | | | | That is, to avoid listing that option in p11tool --help, as it is only useful for debugging very low level interfaces with PKCS#11 parameter passing. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-serv: allow user to specify multiple x509certile/x509keyfileDmitry Eremin-Solenikov2017-05-202-67/+50
| | | | | | | | | | Instead of adding more and more variants like x509dsakeyfile or x509ecckeyfile (counting eddsa and gost in future), allow user to specify x509certfile/x509keyfile multiple times. Keep the old options as compatibility options. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Fix two memory leaks in debug output of gnutls toolsDmitry Eremin-Solenikov2017-05-192-1/+3
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Don't let GnuTLS headers in NETTLE_CFLAGS override local headersDmitry Eremin-Solenikov2017-05-191-10/+10
| | | | | | | Change order of CFLAGS so that local headers always come before ones in $(NETTLE_CFLAGS). Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* find_signer: eliminate memory leakNikos Mavrogiannopoulos2017-05-151-1/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: add test for signing with certificate listKarl Tarbe2017-05-155-2/+361
| | | | | | | Signing with one certificate, but includes the other certificates inside the PKCS#7 structure. Signed-off-by: Karl Tarbe <karl.tarbe@cyber.ee>
* certtool: allow multiple certificates in --p7-signKarl Tarbe2017-05-142-6/+20
| | | | Signed-off-by: Karl Tarbe <karl.tarbe@cyber.ee>
* Fix autoconf progress message concerning heartbeat [ci skip]Andreas Metzler2017-05-141-1/+1
|
* doc: corrected typo [ci skip]Nikos Mavrogiannopoulos2017-05-111-1/+1
| | | | | | Reported by Andreas Metzler. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* test: corrected typo preventing the run of openpgp test [ci skip]Nikos Mavrogiannopoulos2017-05-111-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* updated auto-generated filesNikos Mavrogiannopoulos2017-05-102-62/+95
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11_override_cert_exts: do not use CKA_X_DISTRUSTED flag when retrievingNikos Mavrogiannopoulos2017-05-101-7/+2
| | | | | | | | This flag was introduced in order for reducing the number of duplicate stapled extensions returned by p11-kit. Unfortunately that fix was bogus and in fact it resulted to p11-kit not returning any stapled extensions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for p11-kit trust storeNikos Mavrogiannopoulos2017-05-104-2/+166
| | | | | | | This verifies whether an Example Root CA can be read together with its stapled extensions. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* p11tool: added the --provider-opts optionNikos Mavrogiannopoulos2017-05-102-1/+14
| | | | | | | This option allows passing parameters to the PKCS#11 module loading process, i.e., passed to gnutls_pkcs11_add_provider(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11_add_provider: allow passing parameters to p11-kit trust moduleNikos Mavrogiannopoulos2017-05-101-8/+36
| | | | | | | | | | When the @params argument of gnutls_pkcs11_add_provider() starts with 'p11-kit:' the specified provider is loaded as an unmanaged module and the rest of parameters are being passed opaque to the module. This allows loading for example the p11-kit trust module with a custom path for the trust database. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: introduced checks in alternative chain discoveryNikos Mavrogiannopoulos2017-05-105-2/+185
| | | | | | | These cope with alternative chain discovery in the case of insecure algorithm found in the chain. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: modified pkcs1-pad to account for alt path searchNikos Mavrogiannopoulos2017-05-101-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_x509_trust_list_verify_crt2: treat signers with insecure algorithms ↵Nikos Mavrogiannopoulos2017-05-101-6/+24
| | | | | | | | | | | | | as unknown The reason is that many servers utilize a legacy chain to improve compatibility with old clients and that chain often contains insecure algorithm. In that case try to construct alternative paths. To maintain compatibility with previous versions, we ensure that the same error code (verification status) is returned in these cases as before by sending the cached error if the alternative path fails too. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* updated auto-generated filesNikos Mavrogiannopoulos2017-05-105-1043/+1076
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Makefile: files-update directive will update the auto-generated files in src/Nikos Mavrogiannopoulos2017-05-102-8/+17
| | | | | | This simplifies the update of files generated by autogen. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added check for gnutls-cli's sni-hostname optionNikos Mavrogiannopoulos2017-05-102-1/+67
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-cli: introduced --sni-hostname optionNikos Mavrogiannopoulos2017-05-102-1/+11
| | | | | | | This allows overriding the value set on the TLS server name indication extension. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Makefile: added phony targets to .PHONY [ci skip]Nikos Mavrogiannopoulos2017-05-101-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: doc update [ci skip]Nikos Mavrogiannopoulos2017-05-091-4/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* errors.h: _gnutls_cert_log will only print on non-null certificatesNikos Mavrogiannopoulos2017-05-081-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* rsa-psk: Use the correct username datumtmp-fix-rsa-psk-cbNicolas Dufresne2017-05-061-2/+2
| | | | | | | | | In rsa-psk we properly request username for the case the application uses a callback, but later we use the username cached in the credentials structure. This will lead to empty username issues. Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
* tests: added check for PSK client callback in RSA-PSKNikos Mavrogiannopoulos2017-05-062-1/+319
| | | | | | | | | | This check verifies whether gnutls_psk_client_credentials_function is operational, and the parameters sent are taken into account by the server. Relates !364 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: simplified name of mini-rsa-psk checkNikos Mavrogiannopoulos2017-05-062-48/+14
| | | | | | | In addition modernize the used APIs and added explicit check on the received by the server username value. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: utilize the email_protection_key template optiontmp-certtool-updateNikos Mavrogiannopoulos2017-05-055-19/+21
| | | | | | | This ensures that generated certificates and requests will include that key purpose when the option is present. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* certtool: introduced the email_protection_key optionNikos Mavrogiannopoulos2017-05-053-0/+40
| | | | | | | | This option was introduced in documentation for certtool without an implementation of it. It is a shortcut for option key_purpose_oid = 1.3.6.1.5.5.7.3.4 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls-cli: Use CRLF with --starttls-proto=smtp.Andreas Metzler2017-05-011-2/+2
| | | | Closes https://gitlab.com/gnutls/gnutls/issues/200
* doc: remove libidn from instructions and add libidn2tmp-remove-idna2003Nikos Mavrogiannopoulos2017-05-011-3/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: updateNikos Mavrogiannopoulos2017-05-011-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* added newline in debug messages [ci skip]Nikos Mavrogiannopoulos2017-05-012-4/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Removed support for libidn1Nikos Mavrogiannopoulos2017-05-0114-170/+61
| | | | | | | | | | Currently we support both IDNA2003 and IDNA2008. However, IDNA2003 is already obsolete by registrars and NICs, thus there is no reason to continue supporting it. We switch to IDNA2008 exclusively using libidn2. Resolves #194 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* updated minitasn1Nikos Mavrogiannopoulos2017-05-013-3/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls.h: introduced GNUTLS_E_ASN1_TIME_ERRORNikos Mavrogiannopoulos2017-05-012-0/+7
| | | | | | | This corresponds to libtasn1 ASN1_TIME_ENCODING_ERROR and indicates an error in the DER or BER encoding of time field. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs12_simple_parse: set to null vars after deinitializationtmp-fix-pkcs12-crash2Nikos Mavrogiannopoulos2017-04-301-0/+4
| | | | | | | This avoids having the variables being deinitialized twice during cleanup. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhance with checks to verify that textual IPs are not matchedtmp-hostname-verif-updatesNikos Mavrogiannopoulos2017-04-301-0/+85
| | | | | | | | That verifies that the hostname check verification function will not succeed if given textual IPs, and the certificate contains textual IPs in DNSname or in the CN fields. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_x509_crt_check_hostname2: no match dns fields against IPsNikos Mavrogiannopoulos2017-04-301-9/+11
| | | | | | | | | | Previously we were checking textual IP address matching against the DNS fields. This match was non-standard and was intended to work around few broken servers. However that also led to not evaluating and IP constraints for that IP. No longer follow that broken behavior. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: check against symbols present only in IDNA2003Nikos Mavrogiannopoulos2017-04-301-1/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_idna_map: fallback to IDNA2008 transitional encoding on failureNikos Mavrogiannopoulos2017-04-301-1/+7
| | | | | | | This aligns with the behavior of firefox, which maps to IDNA2008, and fallbacks to IDNA2003 if that fails (e.g., mapping doesn't exist). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* fuzz: fix leaks in PKCS#12 fuzzerNikos Mavrogiannopoulos2017-04-281-4/+10
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status