GitLab

build: avoid potential integer overflow in array allocation

Closes #1179

See merge request !1392

Signed-off-by: Daiki Ueno <ueno@gnu.org>

keys-win: free certificate context in gnutls_system_key_iter_deinit

Closes #1197

See merge request !1406

Suggested by Bjørn Christensen in:
#1197

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

This relies on _gnutls_reallocarray for all occasions of array
allocations, so that they can benefit from the built-in overflow
checks.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

Use explicit error value, as rv is not set in this code path.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

build: doc: install missing image file gnutls-crypto-layers.png

See merge request !1405

Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Fix resource leaks spotted by coverity

See merge request !1403

gnulib: update git submodule

Closes #1190

See merge request !1402

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

This brings in the fix for parse-datetime test failures on NetBSD:
https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00069.html
https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=35f8ff2e1162bf3ee60d99b6812f2ae10f3f2898

Signed-off-by: Daiki Ueno <ueno@gnu.org>

sysrng-linux: re-open /dev/urandom every time

Closes #1188

See merge request !1396

Fix issues with AGGRESSIVE_REALLOC

See merge request !1401

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

gnutls_buffer_append_data: avoid use-after-free in the callers

Closes #1151

See merge request !1399

x86: toggle polarity of check_fast_pclmul

See merge request !1400

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

This helps detect common mistakes[1] in realloc usage with valgrind,
where the caller assumes that the original ptr is always returned.

1. https://bugzilla.mozilla.org/show_bug.cgi?id=1377618

Signed-off-by: Daiki Ueno <ueno@gnu.org>
Co-authored-by: Alexander Sosedkin <asosedkin@redhat.com>

Otherwise GCC produces the following warnings as the stub
__get_cpuid() is defined as '#define __get_cpuid(...) 0':

x86-common.c: In function 'register_x86_crypto':
x86-common.c:314:15: warning: 'a' may be used uninitialized in this function [-Wmaybe-uninitialized]
  314 |  family = ((a >> 8) & 0x0F);
      |            ~~~^~~~~
x86-common.c:308:15: note: 'a' was declared here
  308 |  unsigned int a,b,c,d;
      |               ^
Signed-off-by: Daiki Ueno <ueno@gnu.org>

The function shared the same logic as in _gnutls_buffer_resize.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Prompted by the following comment of Daiki Ueno:
> I also wonder why we keep the fd open for such a long time in the first
> place. Both OpenSSL and NSS have a similar fallback to /dev/urandom
> if getrandom is not available, but opens the device in one-shot,
> when reseeding is needed (and that's pretty rare).
!1383 (comment 521749519)

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

gnutls_x509_trust_list_verify_crt2: skip duplicated certs for PKCS#11 too

See merge request !1398

output UTF-8 decoded id-on-xmppAddr SAN's

See merge request !1397

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>

The commit 09b40be6 (part of
!1370) didn't cover the case where the trust store is
backed by PKCS #11

, because it used _gnutls_trust_list_get_issuer,
which only works with file based trust store.

This patch replaces the call with more generic
gnutls_x509_trust_list_get_issuer so it also works with other trust
store implementations.

Reported by Michal Ruprich.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

tls_x509_crt_get_subject_alt_name()` makes a promise [1] "If an
otherName OID is known, the data will be decoded. ... RFC 3920
id-on-xmppAddr SAN is recognized." which it didn't hold.

Before this patch the output was still in DER format, e.g. for a
id-on-xmppAddr which is always UTF-8 (0x0c): `0x0c <len> <xmppAddr>`

This patch fixes the issue and now it returns the decoded string.

[1]
https://www.gnutls.org/manual/gnutls.html#gnutls_005fx509_005fcrt_005fget_005fsubject_005falt_005fname

Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>

Certificate type handling improvements

See merge request !1394