summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* inet_ntop4: casted signed/unsigned comparisonminor-cleanupsNikos Mavrogiannopoulos2016-09-101-1/+1
|
* system.h: undefine macros before defining themNikos Mavrogiannopoulos2016-09-101-0/+3
|
* _gnutls_fbase64_decode: use memsub macro instead of castsNikos Mavrogiannopoulos2016-09-101-3/+3
|
* doc updateNikos Mavrogiannopoulos2016-09-071-2/+2
|
* _gnutls_ucs2_to_utf8: corrected use of WideCharToMultiByte in windowsNikos Mavrogiannopoulos2016-09-071-2/+3
|
* libgnutls.map: export _gnutls_utf8_to_ucs2 and _gnutls_ucs2_to_utf8 for testingNikos Mavrogiannopoulos2016-09-061-0/+3
|
* pkcs12: enhanced to allow encrypting using UCS2 passwordsNikos Mavrogiannopoulos2016-09-061-40/+42
| | | | | That is use _gnutls_utf8_to_ucs2() to convert the provided password to UCS2.
* _gnutls_ucs2_to_utf8: fixed null termination check in windows codeNikos Mavrogiannopoulos2016-09-061-1/+1
|
* Added _gnutls_utf8_to_ucs2()Nikos Mavrogiannopoulos2016-09-062-1/+153
| | | | This function allows to convert between UTF8 to UCS2 big-endian.
* pkcs7 encryption: corrected memory leaksNikos Mavrogiannopoulos2016-09-061-2/+2
|
* x509: Adjust IP name constraints behaviorMartin Ukrop2016-09-061-40/+18
| | | | | | | - Modified IPv4/IPv6 interaction in name constraints -- IPv4 and IPv6 no have empty intersection (previously: were treated independently). - Current behavior is more conservative -- in case of IPv4 constraint cert, subcerts will not be able to have IPv6 addresses. - Tests updated accordingly. - Behavior now matches NSS.
* minitasn1: updated to latest git versionNikos Mavrogiannopoulos2016-09-052-8/+8
|
* _gnutls_encode_ber_rs_raw: simplifiedNikos Mavrogiannopoulos2016-09-051-15/+10
| | | | That is, use a single allocation for temporary data.
* Introduced helper function _gnutls_decode_ber_rs_raw()Nikos Mavrogiannopoulos2016-09-053-0/+49
|
* _gnutls_encode_ber_rs_raw: zero-pad values when necessaryNikos Mavrogiannopoulos2016-09-051-13/+46
| | | | | | | This addresses issue when encoding values obtained via PKCS#11 which may not be necessarily padded. Resolves #122
* Import DTLS sliding window validation from OpenConnect ESP codeDavid Woodhouse2016-09-022-47/+92
| | | | | | | | | | | In this implementation, the end of the sliding window is always advanced to the latest received packet, and we accept up to 64 packets before that one. We no longer refuse to accept packets because they are *too* far ahead of what we've already seen. Some of the test cases are fixed up accordingly. This matches the code in OpenConnect esp-seqno.c at commit 314ac65.
* nettle: removed unused variable in windows rngNikos Mavrogiannopoulos2016-08-291-2/+0
|
* dtls: ensure that the DTLS window doesn't get stalledNikos Mavrogiannopoulos2016-08-291-1/+9
| | | | | That is ensure that it is forwarded at least one place if more than 16 packets have been received since the first one.
* gnutls_pkcs12_simple_parse: set the key value to null on failureDavid Woodhouse2016-08-291-1/+3
|
* gnutls_ocsp_resp_get_single: reorganized function to eliminate memory leaksNikos Mavrogiannopoulos2016-08-281-59/+76
| | | | | | Simplified and optimized the function operation, by removing unecessary memory allocations, as well as eliminate memory leaks on certain error cases.
* ocsp: corrected the comparison of the serial size in OCSP responseNikos Mavrogiannopoulos2016-08-271-0/+1
| | | | | | | Previously the OCSP certificate check wouldn't verify the serial length and could succeed in cases it shouldn't. Reported by Stefan Buehler.
* pkcs8: cleaned up PKCS#8 decoding from common code with PKCS#7Nikos Mavrogiannopoulos2016-08-268-1622/+1703
|
* pkcs8: added support for decryption with PBES1-DES-CBC-MD5Nikos Mavrogiannopoulos2016-08-267-90/+360
| | | | | | | While this is a legacy (and insecure) cipher combination it is the default output of openssl up until the 1.0.2 version. We introduce this option to allow decrypting private keys from these versions of openssl.
* doc: be more explicit about the usage of gnutls_global_init/deinit [ci skip]Nikos Mavrogiannopoulos2016-08-241-5/+8
|
* Added support for decrypting PKCS#8 files which use HMAC-SHA256 as PRFNikos Mavrogiannopoulos2016-08-248-31/+91
| | | | This improves compatibility with new openssl versions.
* Ported openssl format fix from openconnectNikos Mavrogiannopoulos2016-08-241-2/+2
| | | | Patch by David Woodhouse
* gnutls_record_recv(): doc: push -> pullPhilippe Proulx2016-08-231-1/+1
| | | | Signed-off-by: Philippe Proulx <eeppeliteloop@gmail.com>
* rnd-linux: added check for SYS_getrandom being definedNikos Mavrogiannopoulos2016-08-231-1/+5
| | | | | This allows to compile the getrandom() code in old Linux systems which do not have the system call defined.
* gnutls_key_generate: fail if the state of the library is invalidNikos Mavrogiannopoulos2016-08-101-1/+4
| | | | Suggested by Stephan Mueller.
* gnutls_safe_renegotiation_status: changed return type to unsignedNikos Mavrogiannopoulos2016-08-092-2/+2
|
* x509: Add support for IP constraintsMartin Ukrop2016-08-092-112/+344
| | | | | | | | | | | | | | | | - IP constraints are now checked against the subject alternative name field. - Implemented IP name constraints merging. - Added IP constraints validity checking during loading and getting the name constraints object from the user. - Add a convenience function name_constraints_node_new that allocates a name constraints node and sets its fields. Use this new function where applicable. - Add documentation for is_nc_empty, _gnutls_name_constraints_node_free, _gnutls_name_constraints_intersect. - Small improvements elsewhere (polishing). Signed-off-by: Martin Ukrop <mukrop@redhat.com>
* x509: Separate out IP handling functionsMartin Ukrop2016-08-0910-92/+376
| | | | | | | | | | | | | | - Moved IP/CIDR to string conversion functions into separate header and export privately for the use in tests. - Placed ip_in_cidr() into separate header for easy testing - Add publicly available function to convert text CIDR to RFC5280 format for the use in name constraints extension. - certtool: Use GnuTLS exported CIDR functions instead of local ones. - Export mask_to_prefix, mask_ip for internal GnuTLS use. - Introduce new error value (malformed cidr) and add to description functions in errors.c. Signed-off-by: Martin Ukrop <mukrop@redhat.com>
* gnutls_transport_set_fastopen: added flags optionstcp-fast-openNikos Mavrogiannopoulos2016-08-082-2/+5
| | | | | This will allow minor modifications to the semantics of the function in the future, without introducing a new API.
* Fix gnutls_pkcs12_simple_parse to always extract the complete chainstefan-fixesStefan Sørensen2016-08-081-20/+15
| | | | | | | | | gnutls_pkcs12_simple_parse was only collecting extra certificates that was possible elements of the certificate chain when the extra_certs argument was not NULL. Fix by allways collecting all the certificates, any unneeded certificates are released before returning if extra_certs is NULL anyway. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
* Fix invalid pointer operation in gnutls_certificate_get_x509_crtStefan Sørensen2016-08-081-2/+2
| | | | | | | | The access to the allocated crt_list variable was missing a pointer dereference, leading to memory corruption for any certificate list with more than one element. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
* x509: call the fixup functions after loading private keysNikos Mavrogiannopoulos2016-08-082-12/+41
| | | | | That way we can better report errors which relate to illegal parameters being detected.
* nettle: use rsa_*_key_prepare on key importNikos Mavrogiannopoulos2016-08-081-10/+52
| | | | | | | | | | | Previously we calculated the size of the key directly, but by using the rsa_*_key_prepare we benefit from any checks that may be introduced in the future. Specifically any checks for invalid public keys (e.g., keys that may crash the underlying gmp functions). This patch avoids calling rsa_private_key_prepare every time we construct a nettle private key struct, because this function requires a bigint multiplication. We call that function once on private key import.
* Revert "nettle: use rsa_*_key_prepare"Nikos Mavrogiannopoulos2016-08-081-32/+12
| | | | This reverts commit c801a15bca9ea8f3f7abd4be48bebd36c54eeba2.
* gnutls.h: moved all compatibility defines outside the enumNikos Mavrogiannopoulos2016-08-081-8/+11
|
* pkcs11: is_object_pkcs11_url -> is_pkcs11_url_objectNikos Mavrogiannopoulos2016-08-052-3/+5
| | | | Renamed function for clarity.
* gnutls_fips140_mode_enabled: changed return type to unsignedNikos Mavrogiannopoulos2016-08-052-2/+2
|
* gnutls_pkcs11_privkey_status: return type changed to unsignedNikos Mavrogiannopoulos2016-08-042-2/+2
|
* fastopen: improved error checking at connect()Nikos Mavrogiannopoulos2016-08-021-1/+1
|
* nettle: use rsa_*_key_prepareNikos Mavrogiannopoulos2016-08-011-12/+32
| | | | | | | Previously we calculated the size of the key directly, but by using the rsa_*_key_prepare we benefit from any checks that may be introduced in the future. Specifically any checks for invalid public keys (e.g., keys that may crash the underlying gmp functions).
* gnutls_transport_set_fastopen: doc updateNikos Mavrogiannopoulos2016-07-291-7/+18
|
* getrandom: use SYS_getrandom instead of __NR_getrandomNikos Mavrogiannopoulos2016-07-291-1/+1
| | | | | These are identical definitions, but according to syscall() SYS_getrandom is the expected value.
* x059: Fix asymmetry in name constraints intersectionMartin Ukrop2016-07-291-5/+21
| | | | | | | | - In _gnutls_name_constraints_intersect, if *_nc had a node of some type not present in _nc2, this was preserved. However, if it was vice versa (_nc2 having a type not present in *_nc), this node was discarded. - This is now fixed. - Removed redundant return value check that was accidentally left when refactoring from set_datum to explicit NULL setting. Signed-off-by: Martin Ukrop <mukrop@redhat.com>
* gnutls_x509_crl_list_import2 was ignoring the passed flags if all CTLs in ↵Tim Kosse2016-07-281-1/+1
| | | | the list fit within the initially allocated memory.
* gnutls_certificate_get_peers may return an unsorted listNikos Mavrogiannopoulos2016-07-281-3/+6
|
* gnutls_x509_crt_list_import2 was ignoring the passed flags if all ↵Tim Kosse2016-07-281-1/+1
| | | | certificates in the list fit within the initially allocated memory.
View Lorry Controller Status