summaryrefslogtreecommitdiff
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* Constant time/cache PKCS#1 RSA decryptiontmp-fix-CVE-2018-16868Simo Sorce2018-11-301-0/+18
| | | | | | | | | | | This patch tries to make the code have the same time and memory access aptterns across all branches of the decryption function so that timining or cache side channels are minimized or neutralized. To do so it uses a new nettle rsa decryption function that is side-channel silent. Signed-off-by: Simo Sorce <simo@redhat.com>
* Added test about rsa decryption under pkcs11Nikos Mavrogiannopoulos2018-11-301-6/+22
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: attempt to fix test errors on Mac OS XDmitry Eremin-Solenikov2018-11-296-8/+8
| | | | | | | | It looks like Mac OS X's grep has issues with applying basic regexps with alternation operator inside. Use several grep calls in pipeline to achieve the same result. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tests: fix crl test under MinGW32/64Dmitry Eremin-Solenikov2018-11-284-6/+6
| | | | | | | Use --outfile instead of output redirection to stop CR from sneaking into temp file. Extra CR symbols make grep choke on that file. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Fix session description info printingNikos Mavrogiannopoulos2018-11-273-40/+94
| | | | | | | | This fixes a truncation issue in session description information printing for certain ciphersuites, and adds a limited testing of expected description strings for certain ciphersuites. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tpm12_extend_testcase' into 'master'Tim Rühsen2018-11-272-5/+24
|\ | | | | | | | | Fix some minor issue in the TPM test cases See merge request gnutls/gnutls!814
| * tests: tpm: Use kill_proc to terminate a processStefan Berger2018-11-262-3/+22
| | | | | | | | | | | | | | Use kill_proc to terminate a process by first sending it SIGTERM, waiting max. 1 second and then use SIGKILL. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
| * tests: tpm: Redirect help screen output to stdoutStefan Berger2018-11-261-2/+2
| | | | | | | | | | | | | | The dash shell doesn't seem to understand &>/dev/null, so use >/dev/null to quiet down the help screen check. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
* | Prevent applications from combining legacy versions of TLS with TLS1.3tmp-tls10-tls13-fixNikos Mavrogiannopoulos2018-11-271-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | It can happen that an application due to a misconfiguration, enables TLS1.3 in combination with TLS1.0 or TLS1.1 only. In that case a server which is unaware of the TLS1.3 protocol will reply by selecting the TLS1.2 protocol instead and that answer will be rejected by the client. With this change we ensure that TLS1.3 is not enabled in these problematic scenarios. Resolves: #621 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | cert-tests: verify --no-text switch for pkcs7/pkcs12 infoDmitry Eremin-Solenikov2018-11-262-0/+28
| | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | certtool: don't output textual information if --no-text was givenDmitry Eremin-Solenikov2018-11-261-1/+1
| | | | | | | | | | | | | | Disable text output if --no-text option was given for --p7-info and --p12-info. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | certtool: don't output pkcs12 information to stderrDmitry Eremin-Solenikov2018-11-261-0/+5
| | | | | | | | | | | | Print all pkcs12-info output to outfile, rather than stderr. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | cert-tests: verify --no-text switch for cert/crq/pub/privkeysDmitry Eremin-Solenikov2018-11-264-0/+86
| | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | tests: resume: suppress compiler warningsDaiki Ueno2018-11-261-4/+1
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | tests: remove unnecessary session creation in tls13/anti_replayDaiki Ueno2018-11-241-10/+0
| | | | | | | | | | | | | | This test only checks the behavior of _gnutls_anti_replay_check, thus session is not needed at all. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | tests: added test for RSA decryption under gnutls_privkey_import_ext4Nikos Mavrogiannopoulos2018-11-201-17/+40
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | Merge branch 'tmp-eddsa-pkcs11' into 'master'Nikos Mavrogiannopoulos2018-11-196-24/+409
|\ \ | |/ |/| | | | | | | | | Added support for Ed25519 keys under PKCS#11 Closes #417 See merge request gnutls/gnutls!812
| * tests: added TLS1.3 tests for PKCS#11 and external key typesNikos Mavrogiannopoulos2018-11-192-19/+95
| | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| * Add support for EDDSA/Ed25519 object support via PKCS#11Simo Sorce2018-11-194-3/+313
| | | | | | | | | | | | | | | | | | Tested with softHSM 2.5.0 Resolves #417 Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| * Fix RSA-PSS tests to properly return skip valueSimo Sorce2018-11-191-2/+1
| | | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* | Merge branch 'tmp-fix-certificate-type' into 'master'Nikos Mavrogiannopoulos2018-11-193-4/+14
|\ \ | |/ |/| | | | | gnutls_certificate_type_get*: ensure that the default type is returned See merge request gnutls/gnutls!806
| * tests: resume: use spaces around '?' and ':' according to coding styleNikos Mavrogiannopoulos2018-11-191-4/+4
| | | | | | | | | | | | Also set a link to the kernel coding style in CONTRIBUTIONS.md Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
| * gnutls_certificate_type_get*: ensure that the default type is returnedNikos Mavrogiannopoulos2018-11-183-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | That is, ensure that unless we negotiate something else than X509, the default certificate type is returned to applications. Previously we wouldn't do that for TLS1.3 resumed sessions, and we would return zero (invalid type) instead. That addresses issues with applications checking explicitly for X509 certificate type being present. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | tests/tls13-early-data: check if max_early_data_size is advertisedtmp-fix-max-early-data-sizeDaiki Ueno2018-11-181-7/+27
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | serv: add --maxearlydata optionDaiki Ueno2018-11-181-0/+18
|/ | | | | | Also exercise this in testcompat-tls13-openssl.sh. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tpm12_testing' into 'master'Nikos Mavrogiannopoulos2018-11-163-0/+460
|\ | | | | | | | | tests: tpm: Add a test case for tpmtool See merge request gnutls/gnutls!807
| * tests: tpm: Extend test case to not use --registerStefan Berger2018-11-161-40/+73
| | | | | | | | | | | | | | Extend the tpmtool test case to also test without the --register parameter. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
| * tests: tpm: Add a test case for tpmtoolStefan Berger2018-11-163-0/+427
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This test case exercises tpmtool and uses certtool to create a self-signed certificate with the TPM. It uses swtpm as TPM emulator and configures tcsd to talk to swtpm. Extend the Readme.md with the packages needed for TPM support and TPM test support. This test case needs to be run as root since tcsd needs to be started as root. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
* | Merge branch 'gost-raw-privkeys' into 'master'Nikos Mavrogiannopoulos2018-11-1615-2/+321
|\ \ | | | | | | | | | | | | Improve support of GOST private keys parsing See merge request gnutls/gnutls!802
| * | cert-tests: test parsing and decoding of GOST private keysDmitry Eremin-Solenikov2018-11-1615-2/+321
| | | | | | | | | | | | | | | | | | | | | Add a test for parsing and decoding GOST private keys in different formats, incuding encrypted keys. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | | Merge branch 'tmp-anti-replay-updates' into 'master'Nikos Mavrogiannopoulos2018-11-164-25/+505
|\ \ \ | |/ / |/| | | | | | | | | | | | | | updates in anti-replay subsystem Closes #610 See merge request gnutls/gnutls!805
| * | anti_replay: moved new add function into anti_replay structureNikos Mavrogiannopoulos2018-11-153-33/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new function was not sharing anything with the existing gnutls_db_* backend, and moving it to anti_replay structure is more clean and allows for deviations from the old API conventions (e.g., now we can pass pointers for efficiency and pass the expiration time as part of the call). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| * | tests: added a test for detecting duplicate early dataNikos Mavrogiannopoulos2018-11-152-1/+480
| | | | | | | | | | | | | | | | | | Resolves #610 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | | gnutls_x509_privkey_import_ecc_raw(): fail on invalid sizesNikos Mavrogiannopoulos2018-11-152-0/+10
| | | | | | | | | | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | | tests: verify whether certificate request levels behave consistentlyNikos Mavrogiannopoulos2018-11-152-78/+34
|/ / | | | | | | | | | | | | | | | | This verifies whether the behavior of GNUTLS_CERT_IGNORE, GNUTLS_CERT_REQUEST and GNUTLS_CERT_REQUIRE is consistent accross protocols. Relates #615 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* | tests: add testfile from RFC4134 Section 4.5Dmitry Eremin-Solenikov2018-11-144-1/+87
|/ | | | | | | Add test example demonstrating indefinite-length BER encoding of PKCS#7 data. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Merge branch 'tmp-0rtt' into 'master'Daiki Ueno2018-11-125-3/+652
|\ | | | | | | | | | | | | add support for 0-RTT Closes #127 See merge request gnutls/gnutls!775
| * TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-123-14/+277
| | | | | | | | | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
| * db: introduce gnutls_db_check_entry_expire_timeDaiki Ueno2018-11-121-1/+8
| | | | | | | | | | | | | | | | | | | | This would be particularly useful when the same database is used to store long-lived TLS 1.2 session data and short-lived TLS 1.3 anti-replay entries. Note that the existing gnutls_db_check_entry doesn't fit in this use-case, as it takes gnutls_session_t as the argument. Signed-off-by: Daiki Ueno <dueno@redhat.com>
| * testcompat-tls13-openssl: exercise early data transmissionDaiki Ueno2018-11-121-0/+54
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
| * tests: add tests for early dataDaiki Ueno2018-11-122-1/+326
| | | | | | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | tls13: use system's openssl for interop testingNikos Mavrogiannopoulos2018-11-102-6/+8
|/ | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* testcompat-openssl: do not test DSS or small curves with 1.1.1tmp-fix-ci-runsNikos Mavrogiannopoulos2018-11-071-25/+39
| | | | | | | DSA uses 1024-bit parameters, and these together with curves of less than 256 bits are not accepted by debian's openssl. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-ignore-ctypes' into 'master'Nikos Mavrogiannopoulos2018-11-024-1/+11
|\ | | | | | | | | | | | | gnutls_priority_init: ignore CTYPE-OPENPGP options Closes #593 See merge request gnutls/gnutls!789
| * gnutls_priority_init: ignore CTYPE-OPENPGP optionstmp-ignore-ctypesNikos Mavrogiannopoulos2018-11-014-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | In GnuTLS 3.6.0 we dropped support for openpgp keys, however the CTYPE-OPENPGP is often seen in applications, sometimes as -CTYPE-OPENPGP to ensure it is not enabled. We simply ignore this priority string when seen, to avoid preventing these applications from running. Resolves #593 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* | ext/record_size_limit: handle the extension in TLS 1.2 ServerHellotmp-fix-record-size-limit-tls12Daiki Ueno2018-11-011-8/+18
|/ | | | | | | Previously it had assumed that TLS 1.2 servers don't send the extension, while actually it can be present in ServerHello. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls_priority_set: do not override the version after handshake is completeNikos Mavrogiannopoulos2018-10-302-1/+136
| | | | | | | | | | | When an application would re-set priorities prior to a rehandshake we would override the negotiated version with the highest supported, something which may lead to issues. This disables that unnecessary version override. See: https://bugzilla.redhat.com/show_bug.cgi?id=1634736 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* system: provide a means to replace gettime implementationDaiki Ueno2018-10-261-6/+21
| | | | | | | | | While gettime() is extensively used in the code, the library previously hadn't provided a way to replace it for testing. This adds a new internal function _gnutls_global_set_gettime_function and makes use of it through virt-time.h. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-fix-fips-mode' into 'master'Nikos Mavrogiannopoulos2018-10-241-0/+8
|\ | | | | | | | | fips140: aligned code with documentation See merge request gnutls/gnutls!781
| * fips140: aligned code with documentationtmp-fix-fips-modeNikos Mavrogiannopoulos2018-10-231-0/+8
| | | | | | | | | | | | | | That is, we introduce the documented but unimplemented macros GNUTLS_FIPS140_SET_LAX_MODE() and GNUTLS_FIPS140_SET_STRICT_MODE(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status