summaryrefslogtreecommitdiff
path: root/tests/Makefile.am
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'tmp-record-size-limit-fixes' into 'master'Daiki Ueno2019-01-241-1/+2
|\ | | | | | | | | Fix record_size_limit extension handling when resuming See merge request gnutls/gnutls!886
| * tests: check record_size_limit is reset after resumptionDaiki Ueno2019-01-231-1/+2
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | gnutls-serv: improvements in UDP servertmp-fix-udp-servNikos Mavrogiannopoulos2019-01-231-1/+2
|/ | | | | | | | | | | | This modifies the server to deinitialize the session after use (avoiding leaks), and to only send the hello verify request when a client hello is seen. This also adds a basic unit test of gnutls-serv with the --udp option. Resolves #632 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* When sending no extensions do not include a zero lengthNikos Mavrogiannopoulos2019-01-091-1/+1
| | | | | | | | | | | | | | According to RFC5246: The presence of extensions can be detected by determining whether there are bytes following the compression_method field at the end of the ServerHello. and as such we correct our behavior to not send the zero length bytes. This was our behavior in 3.5.x and 3.3.x branch, and thus this corrects a regression of gnutls with these branches. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
* Fix 'make distcheck'Tim Rühsen2019-01-021-1/+1
| | | | | | | | | | The following error will be fixed: ERROR: files left in build directory after distclean: ./tests/softhsm-privkey-eddsa-test.config make[1]: *** [Makefile:1833: distcleancheck] Error 1 Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* win32: Check that CertOpenStore is behaving as CertOpenSystemStoreHugo Beauzée-Luyssen2018-12-201-0/+4
| | | | | The test isn't located in tests/windows since we need the actual libcrypt32 implementations.
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-151-1/+2
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* Add support for EDDSA/Ed25519 object support via PKCS#11Simo Sorce2018-11-191-0/+1
| | | | | | | | | Tested with softHSM 2.5.0 Resolves #417 Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tpm12_testing' into 'master'Nikos Mavrogiannopoulos2018-11-161-0/+4
|\ | | | | | | | | tests: tpm: Add a test case for tpmtool See merge request gnutls/gnutls!807
| * tests: tpm: Add a test case for tpmtoolStefan Berger2018-11-161-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This test case exercises tpmtool and uses certtool to create a self-signed certificate with the TPM. It uses swtpm as TPM emulator and configures tcsd to talk to swtpm. Extend the Readme.md with the packages needed for TPM support and TPM test support. This test case needs to be run as root since tcsd needs to be started as root. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
* | Merge branch 'tmp-anti-replay-updates' into 'master'Nikos Mavrogiannopoulos2018-11-161-1/+1
|\ \ | | | | | | | | | | | | | | | | | | updates in anti-replay subsystem Closes #610 See merge request gnutls/gnutls!805
| * | tests: added a test for detecting duplicate early dataNikos Mavrogiannopoulos2018-11-151-1/+1
| |/ | | | | | | | | | | Resolves #610 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | tests: verify whether certificate request levels behave consistentlyNikos Mavrogiannopoulos2018-11-151-1/+1
|/ | | | | | | | | This verifies whether the behavior of GNUTLS_CERT_IGNORE, GNUTLS_CERT_REQUEST and GNUTLS_CERT_REQUIRE is consistent accross protocols. Relates #615 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-121-1/+12
| | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tests: add tests for early dataDaiki Ueno2018-11-121-1/+1
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls_priority_init: ignore CTYPE-OPENPGP optionstmp-ignore-ctypesNikos Mavrogiannopoulos2018-11-011-1/+1
| | | | | | | | | | | | In GnuTLS 3.6.0 we dropped support for openpgp keys, however the CTYPE-OPENPGP is often seen in applications, sometimes as -CTYPE-OPENPGP to ensure it is not enabled. We simply ignore this priority string when seen, to avoid preventing these applications from running. Resolves #593 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_priority_set: do not override the version after handshake is completeNikos Mavrogiannopoulos2018-10-301-1/+1
| | | | | | | | | | | When an application would re-set priorities prior to a rehandshake we would override the negotiated version with the highest supported, something which may lead to issues. This disables that unnecessary version override. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634736 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-uris' into 'master'Nikos Mavrogiannopoulos2018-10-181-1/+9
|\ | | | | | | | | | | | | pkcs11 uris: the scheme is case insensitive Closes #590 See merge request gnutls/gnutls!616
| * pkcs11 uris: the URI scheme is case insensitivetmp-urisNikos Mavrogiannopoulos2018-10-121-1/+9
| | | | | | | | | | | | | | | | | | | | | | Makes the comparisons of the URI scheme to use c_strcasecmp from gnulib. It also replaces various straw strcasecmp with the gnulib variant. This ensures that comparison will be reliable irrespective of the locale. Resolves #590 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | tests: eagain-auto-auth: only compiled in systems with cmocka availableNikos Mavrogiannopoulos2018-10-161-2/+3
| | | | | | | | | | | | This fixes build issue at MacOSX CI. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | gnutls_init: added flag for automatic re-authenticationNikos Mavrogiannopoulos2018-10-161-1/+3
|/ | | | | | | | | This introduces the GNUTLS_AUTO_REAUTH gnutls_init() flag and makes re-authentication under TLS simpler to enable and use. Resolves #571 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for gnutls_session_set_idtmp-add-unit-testNikos Mavrogiannopoulos2018-10-061-1/+1
| | | | | | | | | | This adds a unit and a negative test which ensures that a client will not be tricked in performing resumption when this function is used. Resolves #585 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_priority_set: do not override version on handshaketmp-fix-priority-set-callNikos Mavrogiannopoulos2018-10-031-1/+1
| | | | | | | | | | When handshake is in progress, do not override the default TLS version in the session. This allows gnutls_priority_set to be called in the post_client_hello function without breaking the handshake. Resolves #580 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Merge branch 'tmp-be-strict-on-crls' into 'master'Nikos Mavrogiannopoulos2018-09-211-1/+1
|\ | | | | | | | | | | | | gnutls-cli enables CRL validation on startup Closes #564 See merge request gnutls/gnutls!752
| * gnutls-cli: enable CRL validation on startupNikos Mavrogiannopoulos2018-09-211-1/+1
| | | | | | | | | | | | | | | | This also makes the failure in adding CRLs or CAs, a fatal error. Resolves #564 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | Added session ticket key rotation with TOTPAnder Juaristi2018-09-191-1/+2
|/ | | | | | | | | | | This introduces session ticket key rotation on server side. The key set with gnutls_session_ticket_enable_server() is used as a master key to generate time-based keys for tickets. The rotation relates to the gnutls_db_set_cache_expiration() period. Resolves #184 Signed-off-by: Ander Juaristi <a@juaristi.eus>
* dtls: recover when a NewSessionTicket message is lostNikos Mavrogiannopoulos2018-09-141-1/+1
| | | | | | | | | | | When the server's NewSessionTicket gets lost while the ChangeCipherSpec goes through, the client did not request retransmission by retransmitting his last flight, and the handshake was blocked. This commit addresses the issue and adds a reproducer. Resolves #543 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* priority: be backwards compatible with priority strings starting with NONENikos Mavrogiannopoulos2018-09-121-0/+1
| | | | | | | | | | | That is, we allow priority strings which do not enable any groups to work, by disabling TLS1.3. For example 'NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-GCM:+SIGN-ALL:+COMP-NULL' is still operational, but no TLS1.3 is enabled when specified. Resolves: #549 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Implemented RFC7250 certificate type negotiation extensions.Tom Vrancken2018-08-201-2/+3
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* ext/record_size_limit: new extensionDaiki Ueno2018-08-201-1/+1
| | | | | | | | | | | This implements the record_size_limit extension as defined in RFC 8449. Although it obsoletes the max_record_size extension, for compatibility reasons GnuTLS still sends it on certain occasions. For example, when the new size is representable as the codepoint defined for max_record_size. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls_memset: use explicit_bzeroNikos Mavrogiannopoulos2018-08-081-2/+10
| | | | | | | | | That is, use the glibc function when available and the second parameter is zero. Resolves #230 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Ensure we are sending the right protocol version on second client helloNikos Mavrogiannopoulos2018-08-071-0/+2
| | | | | | | | | | | | That is, when we respond to a Hello Retry Request as client, we put the TLS1.2 version on the second client hello to send a hello that is as close as possible to the original hello. That effectively separates the handling of TLS1.2 rehandshake and TLS1.3 hello retry request when sending a client hello. Resolves #535 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tls1.3: server returns early on handshake when no cert is provided by clientNikos Mavrogiannopoulos2018-08-031-0/+2
| | | | | | | | | | | | Under TLS1.3 the server knows the negotiated keys early, if no client certificate is sent. In that case, the server is not only able to transmit the session ticket immediately after its finished message, but is also able to transmit data, similarly to false start. Resolves #481 Resolves #457 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test of handshake with large certificateNikos Mavrogiannopoulos2018-07-261-2/+2
| | | | | | | | | This checks whether handshake message fragmentation and de-fragmentation is functional on server and client. Resolves #513 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* allow no certificates to be reported by the ↵Nikos Mavrogiannopoulos2018-07-241-1/+1
| | | | | | | | | | | gnutls_certificate_retrieve_function callbacks In 9829ef9a we introduced a wrapper over the older callback functions which didn't handle this case. Resolves #528 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* cert-cred: fix possible segfault when resetting cert retrieval functionDmitry Eremin-Solenikov2018-07-241-1/+2
| | | | | | | | | | Reset get_cert_callback3 callback to NULL if provided callback is NULL. Otherwise after the certificate request call_legacy_cert_cb1 / call_legacy_cert_cb2 will try to unconditionally call legacy_cert_cb1 / legacy_cert_cb2 callback (set to NULL) leading to segfault. Fixes: 9829ef9a3ca06d60472599df7c74ebb9a53f1fe2 Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* gnutls_x509_privkey_import_ecc_raw: encode parameters on importtmp-fix-pkcs8-exportNikos Mavrogiannopoulos2018-07-201-1/+1
| | | | | | | | | | | | | That makes the structure fully usable after import. In _encode_privkey() use the lower-level _gnutls_x509_export_int2() for key encoding as the call to higher gnutls_x509_privkey_export2() could result to an infinite recursion when keys are incomplete. Introduced additional tests for PKCS#8 key import and export. Resolves: #516 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: handshake-timeout: use virt_sec_sleep() to avoid long delays in testNikos Mavrogiannopoulos2018-07-111-1/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* generate_session_ticket: tickets cannot extend the original session timeNikos Mavrogiannopoulos2018-07-111-2/+2
| | | | | | | | | That is, on a resumed session the server would not issue new tickets that would have extended the lifetime of the originally issued ticket. Resolves #476 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_priority_init2,gnutls_set_default_priority_append: introducedNikos Mavrogiannopoulos2018-07-091-2/+2
| | | | | | | | This allows enhancing the default priority with additional options, allowing an application to introduce stricter (or weaker) settings without requiring it to override all settings. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: introduced test for post-handshake auth + PSKNikos Mavrogiannopoulos2018-07-021-1/+2
| | | | | | Relates #489 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Expand x509 sign/verify test with GOST algorithmsDmitry Eremin-Solenikov2018-06-231-1/+2
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tests: check whether we send the pre-shared key extension after dumbfwNikos Mavrogiannopoulos2018-06-221-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhance padding checkNikos Mavrogiannopoulos2018-06-201-1/+1
| | | | | | | This introduces tests for zero-data transfers with padding as well as padding and de-padding with safe padding flag set. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* distclean temp. test files for 'make distcheck'Tim Rühsen2018-06-141-0/+3
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* priorities: introduced %FORCE_ETMtmp-measure-recordNikos Mavrogiannopoulos2018-06-121-1/+1
| | | | | | | | | This introduces a priority string option to force encrypt-then-mac during negotiation, to prevent negotiating the legacy CBC ciphersuites. Resolves #472 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added main use-case test for gnutls_session_ticket_send()Nikos Mavrogiannopoulos2018-05-261-1/+1
| | | | | | | | | It verifies whether a server can use gnutls_session_ticket_send() to send a ticket after re-authentication, and whether a client can receive that ticket and re-authenticate with it, while its certificate is made available to server. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: exercise TLS 1.3 session resumptionDaiki Ueno2018-05-261-1/+10
| | | | | | | | | | This requires a few changes to the resume.c test: because NewSessionTicket is a post-handshake message, gnutls_session_get_data2() needs to be called after sending the first application data. Also, when GNUTLS_E_AGAIN, gnutls_record_recv() needs to retry. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls_pkcs11_token_get_ptr, gnutls_pkcs11_obj_get_ptr: introducedNikos Mavrogiannopoulos2018-05-211-1/+10
| | | | | | | | | This allows an application to open a PKCS#11 token using a URI, and use it directly, bypassing gnutls. That is useful to take advantage of PKCS#11 functionality not wrapped by gnutls but still use PKCS#11 URIs to identify the token. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* handshake: do not send TLS extensions under DTLS and vice versatmp-prohibit-tls-dtls-mixNikos Mavrogiannopoulos2018-05-171-1/+1
| | | | | | | | | | That is, introduce the notion of TLS-only and DTLS-only extensions, providing a framework to prevent sending extensions which are registered for example for TLS 1.3, under DTLS and vice versa. Resolves #440 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status