Commits · master · gnutls / GnuTLS

20 Sep, 2017 3 commits

tests: explicitly check for gnutls.pc in pkgconfig.sh · 30c551bd
```
Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
```
Dmitry Eremin-Solenikov committed Sep 20, 2017
30c551bd Browse Files

test: use proper library name in pkgconfig.sh error message · 6e2cf400

If there is a -R flag in p11-kit-1.pc file, pkgconfig.sh test will still
reference libidn2.pc, rather than proper source of the message. Also
move the test for library flags before updating PKG_CONFIG_PATH.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

committed Sep 20, 2017

6e2cf400 Browse Files

tests: use libidn2 in pkgconfig.sh · 1512eac4

Since abe6a12b GnuTLS does not support
libidn1. Switch pkgconfig.sh test to use libidn2.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

committed Sep 20, 2017

1512eac4 Browse Files

19 Sep, 2017 6 commits
- parse-datetime: Fix buffer overflow · 3029923c
  
  Tim Rühsen committed Sep 19, 2017
  
  3029923c Browse Files
- tlsfuzzer: document the reason of failure of few fragmentation tests · 041e7bd5
```
It seems that gnutls does not accept records carrying handshake messages
that contain less bytes than necessary to recover the handshake header.
The TLS protocol allows that option, and other implementations seem to
accept that fragmentation.

Relates #272

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 19, 2017
  041e7bd5 Browse Files
- parse_handshake_header: removed duplicate check · ce6899d3
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
```
  Nikos Mavrogiannopoulos committed Sep 19, 2017
  ce6899d3 Browse Files
- ecdh: return more appropriate error code on empty packet · 3a9e47de
```
This makes tlsfuzzer's test-x25519 detect the right error
code on empty message. Previously this issue was masked by our
refusal to accept 1-byte sized fragments.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
```
  Nikos Mavrogiannopoulos committed Sep 19, 2017
  3a9e47de Browse Files
- parse_handshake_header: allow 1-byte sized fragments · b072aff8
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 19, 2017
  b072aff8 Browse Files
- tests: added reproducer for DTLS infinite loop · c070a9e0
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 19, 2017
  c070a9e0 Browse Files
18 Sep, 2017 3 commits
- pkcs11/get_key_algo_type(): Always initialize bits variable · 0b4ef990
```
Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
```
  Tim Rühsen committed Sep 18, 2017
  0b4ef990 Browse Files
- tests/base64-raw: Remove unused variable · 9275a02d
```
Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
```
  Tim Rühsen committed Sep 18, 2017
  9275a02d Browse Files
- gnutls.h: Remove redundant function declarations · bf4bbfc5
```
Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
```
  Tim Rühsen committed Sep 18, 2017
  bf4bbfc5 Browse Files
16 Sep, 2017 1 commit
- x509: removed debugging code [ci skip] · 96e777e1
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 16, 2017
  96e777e1 Browse Files
13 Sep, 2017 6 commits

tests: modified the MD5 signature algorithm negotiation tests · 7221e14c

Since GnuTLS can no longer negotiate MD5, we utilize a byte stream
of a connection which advertises MD5, and we make sure we detect the
right error code for the rejection of MD5 signature.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

committed Sep 13, 2017

7221e14c Browse Files

doc update · d5bb1940
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
Nikos Mavrogiannopoulos committed Sep 13, 2017
d5bb1940 Browse Files
tlsfuzzer: no longer include tests involving SHA224 signatures · 966a3c90
```
We no longer support them.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
Nikos Mavrogiannopoulos committed Sep 13, 2017
966a3c90 Browse Files

algorithms/sign: removed TLS identifiers for legacy algorithms · a3ab260d

That is, for the MD5-using algorithms, as well as for the DSA2
signature algorithms that were never really used with TLS 1.2.

Kept DSA-SHA1 in order to be used by TLS 1.2 and legacy applications.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

committed Sep 13, 2017

a3ab260d Browse Files

algorithms/sign: legacy signature algorithms were moved toward the end of the list · 4dea5ce7
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
Nikos Mavrogiannopoulos committed Sep 13, 2017
4dea5ce7 Browse Files

algorithms/sign: no longer enable SHA224 hash in signatures · 7626ad45

TLS 1.3 requires that SHA224 MUST NOT be used, and given the
fact that SHA224 was never widespread used in TLS 1.2, there
is no reason to keep these algorithms at all.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

committed Sep 13, 2017

7626ad45 Browse Files

08 Sep, 2017 21 commits
- tlsfuzzer: added large client hello tests · 06ce8968
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  06ce8968 Browse Files
- win32: removed no longer used subdir · 71045637
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  71045637 Browse Files
- .gitlab-ci.yml: added warning cppcheck checks · f9f729ec
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  f9f729ec Browse Files
- .gitlab-ci.yml: removed initialization step · 0edc7f38
```
That is, combine syntax-check with the static analyzers run. That
provides more parallelism per build and reduces the overall time
spent on a successful run.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  0edc7f38 Browse Files
- doc: added README on FreeBSD CI setup · 8efc7926
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  8efc7926 Browse Files
- .gitlab-ci.yml: added FreeBSD build · 9e606261
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  9e606261 Browse Files
- tests: ip-utils: added include for FreeBSD compilation · 29d4b064
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  29d4b064 Browse Files
- .gitlab-ci.yml: enable more cppcheck tests · 60e31b66
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  60e31b66 Browse Files
- tests: updated tlsfuzzer to reduce rsa-pss failures · 6c0572e0
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  6c0572e0 Browse Files
- crq: doc update · 1c6dd015
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  1c6dd015 Browse Files
- tests: added unit test for gnutls_x509_crq_sign · 36f769bd
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  36f769bd Browse Files
- tests: added verification checks into crl_apis · 45746a0e
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  45746a0e Browse Files
- gnutls_x509_crl_verify: check next update field for presence · f6821a90
```
If not present do not attempt to utilize its value.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  f6821a90 Browse Files
- tests: added verification check into crt_apis · 77039f38
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  77039f38 Browse Files
- tests: added unit test for gnutls_x509_crt_sign · 4eb8ec90
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  4eb8ec90 Browse Files
- doc update · 813110ed
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  813110ed Browse Files
- gnutls_x509_crq_sign: undeprecate · a2a7e382
```
After the updates of the function semantics, it is no longer
needed to deprecate it.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  a2a7e382 Browse Files
- gnutls_x509_crl_sign: undeprecate · f65ff8a7
```
After the updates of the function semantics, it is no longer
needed to deprecate it.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  f65ff8a7 Browse Files
- gnutls_x509_crq_sign: no longer sign with SHA1 · 982e9663
```
Modify the behavior of the functions to sign with an appropriate
to the public key hash algorithm. That although it modifies the
semantics of the functions, it allows them to be useful even after
SHA1 is considered insecure.

In addition to that, the functions which accept a hash algorithm, will
accept a null hash, which instructs the function to select a
reasonable choice.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  982e9663 Browse Files
- gnutls_x509_*_sign: no longer sign with SHA1 · d4f53725
```
Modify the behavior of the functions to sign with an appropriate
to the public key hash algorithm. That although it modifies the
semantics of the functions, it allows them to be useful even after
SHA1 is considered insecure.

In addition to that, the functions which accept a hash algorithm, will
accept a null hash, which instructs the function to select a
reasonable choice.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  d4f53725 Browse Files
- doc: document the change of gnutls_x509_crt_sign · 3a91d55f
```
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
```
  Nikos Mavrogiannopoulos committed Sep 08, 2017
  3a91d55f Browse Files