summaryrefslogtreecommitdiff
path: root/devel
Commit message (Collapse)AuthorAgeFilesLines
* abi: add enum values for GNUTLS_CIPHER_CHACHA20_*tmp-chachaDaiki Ueno2020-03-191-0/+2
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* nettle: vendor in ChaCha20 implementation from nettleDaiki Ueno2020-03-192-0/+83
| | | | | | | This enables to use bundled ChaCha20 implementation if the system nettle doesn't have nettle_chacha_set_counter. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* keylogfile: simplify the callback mechanismtmp-keylog-funcDaiki Ueno2020-02-222-2/+2
| | | | | | | | | | This partially reverts commit 97117556 with a simpler interface. The original intention of having the callback mechanism was to reuse it for monitoring QUIC encryption changes. However, it turned out to be insufficient because such changes must be emitted after a new epoch is ready. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* keylogfile: generalize with a callbacktmp-keylog-hookDaiki Ueno2020-02-072-0/+2
| | | | | | | | | This refactors the keylogfile mechanism by adding a callback to get notified when a new secret is derived and installed. That way, consumers can implement custom logging feature per session, which is particularly useful in QUIC implementation. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add generic crypto functions for KDFDaiki Ueno2020-02-042-0/+7
| | | | | | | | | | This exposes HKDF and PBKDF2 functions from the library. Instead of defining a single KDF interface as in PKCS #11, this patch defines 3 distinct functions for HKDF-Extract, HKDF-Expand, and PBKDF2 derivation, so that we can take advantage of compile time checking of necesssary parameters. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* algorithms: implement X448 key exchange and Ed448 signature schemeDaiki Ueno2020-01-232-6/+26
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* nettle: vendor in Curve448 and Ed448 implementationDaiki Ueno2020-01-232-0/+154
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-ocsp-check' into 'master'903-add-crl-and-crq-fuzzersNikos Mavrogiannopoulos2020-01-091-0/+5
|\ | | | | | | | | | | | | Provide flag to identify sessions that an OCSP response was requested Closes #829 See merge request gnutls/gnutls!1131
| * gnutls_ocsp_status_request_is_checked: mark explicitly as unsigned the ↵Nikos Mavrogiannopoulos2019-12-161-0/+5
| | | | | | | | | | | | | | | | return type Also some documentation updates. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | crypto-api: add gnutls_hmac_get_key_size() functionDmitry Eremin-Solenikov2019-12-272-0/+2
| | | | | | | | | | | | Add gnutls_hmac_get_key_size() to retrieve MAC key size. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | updated auto-generated filesNikos Mavrogiannopoulos2019-12-193-1640/+1702
|/ | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* abi: updated to latest const changes and added NEWS entrytmp-more-const-1Nikos Mavrogiannopoulos2019-12-105-10001/+10682
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Add const to function arguments in lib/x509Tim Rühsen2019-12-071-0/+5
| | | | | | | This change does not introduce functionality changes. It just adds const promises to the caller. Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Add support for VKO GOST key exchangeDmitry Eremin-Solenikov2019-11-081-0/+1
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Declare groups corresponding to GOST curvesDmitry Eremin-Solenikov2019-11-071-0/+7
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* lib: define more GOST curvesDmitry Eremin-Solenikov2019-10-061-1/+6
| | | | | | | Declare GOST curves from GOST R 34.10-2001 and GOST R 34.10-2012 (test curves) and GOST curves defined by TC26 itself. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* nettle: provide GOST 28147-89 IMIT MAC supportDmitry Eremin-Solenikov2019-09-281-0/+1
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* nettle: provide GOST 28147-89 CNT mode supportDmitry Eremin-Solenikov2019-09-281-0/+1
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* crypto-api: add gnutls_aead_cipher_{en,de}cryptv2tmp-encryptv2Daiki Ueno2019-08-092-0/+29
| | | | | | | This adds an in-place equivalent of gnutls_aead_cipher_encrypt() and gnutls_aead_cipher_decrypt(), that works on data buffers. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* abi-check: correctly bail-out on errorstmp-fix-abicheckNikos Mavrogiannopoulos2019-07-221-0/+40
| | | | | | Added suppressions for _MAX enumerator values. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* libgnutls.abignore: added comment linking to syntaxNikos Mavrogiannopoulos2019-07-211-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* lib: add support for AES-GMACDmitry Eremin-Solenikov2019-06-281-0/+3
| | | | | | | | | Add support for computing AES-GMAC using MAC API, as requested by Samba for SMB3 support. Resolves: #781 Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Align _gnutls_x86_cpuid_s as OPENSSL_ia32cap_P would beNikos Mavrogiannopoulos2019-06-274-133/+0
| | | | | | | | | | | | We were not setting the third array member correctly, though this didn't have any impact to previous implementations as they did not rely on it. This also moves away from the custom implementation of cpuid (which was limited), and we now rely on the compiler's version. This effectively enables support for SHA_NI. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Updated asm files to latest version under cryptogams licenseNikos Mavrogiannopoulos2019-06-274-0/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* lib: add support for gnutls_hash_copy()Dmitry Eremin-Solenikov2019-06-262-0/+2
| | | | | | Add gnutls_hash_copy() function for copying message digest context. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* api: add gnutls_hmac_copy() functionDmitry Eremin-Solenikov2019-06-262-0/+2
| | | | | | | | | Add gnutls_hmac_copy() API to duplicate MAC handler state, which is necessary for SMB3 support. Resolves: #787 Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* updated auto-generated filesNikos Mavrogiannopoulos2019-06-203-6795/+6929
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Use inih to parse configuration fileNikos Mavrogiannopoulos2019-06-201-0/+2
| | | | | | | | | This introduces the inih copylib, and makes our configuration file parsing more flexible. Relates: #587 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Add plumbing to handle Q parameter in DH exchangesSimo Sorce2019-05-232-0/+24
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* ext/record_size_limit: distinguish sending and receiving limitstmp-record-sizesDaiki Ueno2019-05-142-2/+10
| | | | | | | | | | | | | | | | The previous behavior was that both sending and receiving limits are negotiated to be the same value. It was problematic when: - client sends a record_size_limit with a large value in CH - server sends a record_size_limit with a smaller value in EE - client updates the limit for both sending and receiving, upon receiving EE - server sends a Certificate message larger than the limit With this patch, each peer maintains the sending / receiving limits separately so not to confuse with the contradicting settings. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* abi-check: supply --hd2 to abi-check-latest targetDaiki Ueno2019-05-031-1/+1
| | | | | | | To suppress changes in internal structures. Suggested by Nikos Mavrogiannopoulos. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* prf: add function to retrieve early keying materialDaiki Ueno2019-04-192-0/+2
| | | | | | | | | This adds a new function gnutls_prf_early, which shall be called in a handshake hook waiting for GNUTLS_HANDSHAKE_CLIENT_HELLO. The test needs to be run in a datefudge wrapper as the early secrets depend on the current time (through PSK). Signed-off-by: Daiki Ueno <dueno@redhat.com>
* abi-check: simplify ABI comparison using libabigail toolsNikos Mavrogiannopoulos2019-04-1611-174947/+46225
| | | | | | | | | | | | | These have output ABI format compatibility and that means we can take snapshots to test ABI against. We also hard-code explicitly the SONAME version to ensure no accidental SONAME bumps happen. This patch also moves symbols.last in the devel/ subdirectory and no internal files are shipped. Relates: #292 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Pass CI commit check if branches are 'even'tmp-check-evenTim Rühsen2019-04-091-2/+5
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Fix check_if_signedSimo Sorce2019-04-011-10/+15
| | | | | | | | | | | | | Fix the target branch we check against by adding upstream as remote. Drop the use of set -e as this causes the shell to immediately exit on errors instead of allowing the code to check the failure and report what it faled about. Also print which commits are being checked and what information was found so that a CI failure can be better diagnosed. Signed-off-by: Simo Sorce <simo@redhat.com>
* Let check_if_signed fail if git failstmp-fail-sigcheckTim Rühsen2019-03-281-2/+4
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use https:// for arbitrary files #1Tim Rühsen2019-03-131-12/+12
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* .gitlab-ci.yml: added thread sanitizer runtmp-false-start-clarificationsNikos Mavrogiannopoulos2019-03-022-0/+10
| | | | | | | This checks for unsafe uses of variables in our included threaded tests. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cppcheck: suppress warning on nettle code [ci skip]Nikos Mavrogiannopoulos2019-02-261-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* check_if_signed: Get source branch if not setTim Rühsen2019-02-181-0/+5
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Check for Signed-off-by: in CITim Rühsen2019-01-201-0/+25
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* README-ci.freebsd.md: require autogenDaiki Ueno2018-11-131-1/+1
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* protocols: bumped TLS1.3 version number to RFC8446 valueNikos Mavrogiannopoulos2018-08-201-0/+0
| | | | | | | | This adds support of the final RFC numbers. Resolves #542 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* testcompat-tls13-openssl: fix openssl interactionsNikos Mavrogiannopoulos2018-06-271-0/+0
| | | | | | | | | | | | | * Do not require certificate validation on tests where no certificate is sent * Rekey test performs data transfer after re-key This introduces a dependency on the expect package for testing, and updates openssl to address an issue in post-handshake auth interop testing. Resolves #488 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* README-ci.freebsd.md: updated for new build method with gnulib [ci skip]Nikos Mavrogiannopoulos2018-06-141-2/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added interop tests with openssl under TLS1.3Nikos Mavrogiannopoulos2018-05-041-0/+0
| | | | | | | | | | | | | This adds interoperability tests for: * PSK with elliptic curve DHE * RSA,RSA-PSS,secp256r1,ed25519 server certificate * RSA,RSA-PSS,secp256r1,ed25519 client certificate * X25519,SECP256R1 key share exchange * key share with HRR Relates #328 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: added README on FreeBSD CI setupNikos Mavrogiannopoulos2017-09-081-0/+70
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* .gitlab-ci.yml: enable more cppcheck testsNikos Mavrogiannopoulos2017-09-081-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* abi-check: added check for 3.6.0 ABI compatibilityNikos Mavrogiannopoulos2017-08-181-0/+39891
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status