nettle: prohibit deterministic ECDSA/DSA under FIPS except selftests

Signed-off-by: Daiki Ueno <dueno@redhat.com>

nettle: enable deterministic ECDSA/DSA during FIPS selftests

Signed-off-by: Daiki Ueno <dueno@redhat.com>

pk: implement deterministic ECDSA/DSA

This exposes the deterministic ECDSA/DSA functionality through the
GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

privkey_sign_prehashed: remove unused argument

Signed-off-by: Daiki Ueno <dueno@redhat.com>

privkey_sign_raw_data: remove unnecessary local variable

Signed-off-by: Daiki Ueno <dueno@redhat.com>

nettle: add functions for deterministic ECDSA/DSA

This adds functions to perform deterministic ECDSA/DSA, namely
_gnutls_{ecdsa,dsa}_compute_k(), which computes the k value according
to RFC 6979.  The retrieved k value can be given to
nettle_{ecdsa,dsa}_sign() through a wrapper random function.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tmp-fixes' into 'master'

Minor fixes in 3.6.9 release

Closes #810 and #812

See merge request gnutls/gnutls!1053

Merge branch 'patch-1' into 'master'

Notes about Ubuntu specific software versions not available.

See merge request gnutls/gnutls!1029

read_cpuid_vals: use __get_cpuid_count() only when available

This makes the functionality available on gcc 4.8.

Resolves: #812

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

src/Makefile.am: fix detection of .bak files

This fixes detection in a way to work in builds outside the
source directory.

Resolves: #810

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

configure: AS_HELP_STRING cannot print variables; don't try

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-sign-cas' into 'master'

certtool: default to yes on signing certificates for CAs

See merge request gnutls/gnutls!1048

Notes about Ubuntu specific software versions not available.

Signed-off-by: Karsten Ohme <k_o_@users.sourceforge.net>

Merge branch 'tmp-missing-inih-license' into 'master'

Ship inih/LICENSE.txt in release tarball

See merge request gnutls/gnutls!1050

Ship inih/LICENSE.txt in release tarball

inih's license terms requires shipping a copy of the license when
redistributing the source.

Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Merge branch 'mcatanzaro/#806' into 'master'

Improve documentation of gnutls_record_send()

Closes #806

See merge request gnutls/gnutls!1049

Improve documentation of gnutls_record_send()

It's no longer required to retry this function with the same parameters
if you want to use gnutls_record_discard_queued().

Fixes #806

Signed-off-by: Michael Catanzaro <mcatanzaro@igalia.com>

certtool: default to yes on signing certificates for CAs

When asking the questions for CA certificate generation, default
to yes to signing certificates. This is because that's the most
common type of CAs generated and defaulting to yes eliminates
the need for restart on error.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

bumped version for 3.6.9

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'fix-gost' into 'master'

nettle/gost: support building with GOST-enabled Nettle

See merge request gnutls/gnutls!1044

gnutls.h: mark AEAD ciphers as such in gnutls_cipher_algorithm_t description

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

abi-check: correctly bail-out on errors

Added suppressions for _MAX enumerator values.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Support for Generalname registeredID from RFC 5280 in subject alt name

Added test certificates (cert10.der) with registered ID

Updated Makefile for inclusion of test certificates

Updated SAN unknown test certificates (cert5.der)

Signed-off-by: Karsten Ohme <k_o_@users.sourceforge.net>

libgnutls.abignore: added comment linking to syntax

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

NEWS: updated for upcoming release [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-tls-fuzzer' into 'master'

Fixed alerts returned on TLS1.3 corner cases

Closes #682

See merge request gnutls/gnutls!1045

Merge branch 'tmp-fix-doc-gnutls_certificate_set_retrieve_function3' into 'master'

Fix documented params for gnutls_certificate_retrieve_function3()

See merge request gnutls/gnutls!1047

Fix documented params for gnutls_certificate_retrieve_function3()

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fixed alerts returned on TLS1.3 corner cases

This enables the tls-fuzzer tests 'test-tls13-certificate-verify.py'.

Resolves: #682

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

nettle/backport: fix xts-backport guarding check

Check for nettle_xts_encrypt_message() function rather than just
xts_encrypt_message(). All functions in nettle are renamed to contain
`nettle_` prefix.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle/gost: support building with GOST-enabled Nettle

Nettle library starts to gain support for GOST algorithms. Support
building GnuTLS with GOST-enabled nettle library.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'guile-reauth' into 'master'

Support post-handshake reauthentication in the Guile bindings

See merge request gnutls/gnutls!1026

Merge branch 'tmp-session-ticket-valgrind' into 'master'

ext/session_ticket: eliminate redundant memcpy

See merge request gnutls/gnutls!1040

Merge branch 'tmp-pkcs11-login-error' into 'master'

pkcs11: ignore login error when traversing tokens

See merge request gnutls/gnutls!1031

tests: remove unused destructive/p11-kit-load.sh

This file is replaced with tests/p11-kit-load.sh and
tests/pkcs11/list-tokens.c.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

pkcs11: ignore login error when traversing tokens

If a token is a general access device, it is expected that login
attempt to that token returns error:
https://github.com/p11-glue/p11-kit/blob/master/trust/module.c#L852

On the other hand, _pkcs11_traverse_tokens treats the error as fatal
and stops iteration.  This behavior prevents object search without
token specifier if such tokens are registered in the system.

Reported by Stanislav Zidek in
https://bugzilla.redhat.com/show_bug.cgi?id=1705478

Signed-off-by: Daiki Ueno <dueno@redhat.com>

ext/session_ticket: avoid calling memcpy on overlapping memory areas

In _gnutls_encrypt_session_ticket, ticket.encrypted_state is allocated
from ticket_data->data, thus those memory areas may overlap.  Using
memcpy here leads to undefined behavior.

Spotted by valgrind run on ppc64le.

==95231== Source and destination overlap in memcpy(0x47ce3a2, 0x47ce3a2, 160)
==95231==    at 0x408A840: memcpy (vg_replace_strmem.c:1023)
==95231==    by 0x424EE9F: pack_ticket (session_ticket.c:139)
==95231==    by 0x424FA4F: _gnutls_encrypt_session_ticket (session_ticket.c:335)
==95231==    by 0x4199E3B: generate_session_ticket (session_ticket.c:249)
==95231==    by 0x419A333: _gnutls13_send_session_ticket (session_ticket.c:307)
==95231==    by 0x40F8817: _gnutls13_handshake_server (handshake-tls13.c:511)
==95231==    by 0x4110DEB: handshake_server (handshake.c:3331)
==95231==    by 0x410C70B: gnutls_handshake (handshake.c:2727)
==95231==    by 0x10009EBF: retry_handshake (serv.c:1306)
==95231==    by 0x1000AB67: tcp_server (serv.c:1500)
==95231==    by 0x10009E5B: main (serv.c:1297)
==95231==

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tmp-mark-infinite-loops' into 'master'

lib: mark infinite loops explicitly

See merge request gnutls/gnutls!1043

lib: mark infinite loops explicitly

There were few infinite loop constructions which were checking
for an always true condition. Make sure that this construction
is marked explicitly as while(1) to assist static analysers, or
reviewers.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-coverage' into 'master'

tests: improve coverage of CRQ related functions

See merge request gnutls/gnutls!1042

tests: improve coverage of CRQ related functions

That adds sanity check of crq-related functions that were not included
in the testsuite at all.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-var' into 'master'

encode_ber_digest_info: added sanity check

See merge request gnutls/gnutls!1041

Merge branch 'tmp-fix-ocsp' into 'master'

Improve the OCSP (status request) and interop testing

See merge request gnutls/gnutls!1024

encode_ber_digest_info: added sanity check

Issue found using oss-fuzz:
 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15665

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

testcompat-openssl: added interop test with DTLS 1.2

This tests AES-CBC ciphersuites in isolation, as they are
prioritized lower than AES-GCM. We want to test them explicitly
because they have different behavior under EtM.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added sanity check for rfc7633 behavior

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: status-request-missing: renamed to rfc7633-missing

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

status-request-ext: run under all TLS versions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: status-request: cleanup

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: status-request-missing: run for all TLS versions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-cli-debug' into 'master'

gnutls-cli-debug: test whether RSA key exchange is supported

Closes #449

See merge request gnutls/gnutls!1039

Merge branch 'tmp-fix-desc' into 'master'

gnutls_session_get_desc: avoid printing a NULL value

See merge request gnutls/gnutls!1038

Merge branch 'tmp-fips-drbg-continuous' into 'master'

nettle/rnd-fips: add FIPS 140-2 continuous RNG test

See merge request gnutls/gnutls!1034

gnutls-cli-debug: test whether RSA key exchange is supported

Resolves: #449

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_session_get_desc: avoid printing a NULL value

When gnutls_session_set_premaster() is used (under openconnect),
it is possible that gnutls_session_get_desc will print a string like
this: "(DTLS1.2)-(ECDHE-(null))-(AES-256-GCM)"

With this change we ensure that we do not print null values.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'mac-gmac' into 'master'

lib: add support for AES-GMAC

Closes #781

See merge request gnutls/gnutls!1036

Merge branch 'tmp-fix-gnutls_x509_crt_list_import2' into 'master'

Fix gnutls_x509_crt_list_import2() documentation

Closes #794

See merge request gnutls/gnutls!1037

nettle/rnd-fips: add FIPS 140-2 continuous RNG test

This adds a continuous random number generator test as defined in FIPS
140-2 4.9.2, by iteratively fetching fixed sized block from the system
and comparing consecutive blocks.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

lib: document gnutls_hmac_fast vs nonce relationship

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

tests/gnutls_hmac_fast: run test for AES-UMAC-96/-128

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle: return true for gnutls_mac_exists(AES-CMAC*)

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

NEWS: add an entry for AES-GMAC algorithms

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

tests/gnutls_hmac_fast: run test for AES-GMAC-128/-192/-256

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle/mac: fail mac calculation if nonce is required but not provided

Fail _wrap_nettle_mac_set_nonce() and _wrap_nettle_mac_fast() if MAC
requires nonce, but it was not supplied.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle/mac: in mac_fast call set_nonce after set_key

Calling set_nonce before set_key is plain incorrect. For GMAC key is not
initialized. For UMAC set_key will reset nonce to empty.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

lib: add support for AES-GMAC

Add support for computing AES-GMAC using MAC API, as requested by Samba
for SMB3 support.

Resolves: #781

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

tests: gnutls_x509_crt_list_import: verify that return code is as documented

That checks whether the return code of gnutls_x509_crt_list_import()
contains the number of loaded certificates.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_crt_list_import2: updated doc to reflect the actual return value options

Resolves: #794

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-asm' into 'master'

Updated asm files to latest version under cryptogams license

See merge request gnutls/gnutls!989

Align _gnutls_x86_cpuid_s as OPENSSL_ia32cap_P would be

We were not setting the third array member correctly, though
this didn't have any impact to previous implementations as they
did not rely on it. This also moves away from the custom implementation
of cpuid (which was limited), and we now rely on the compiler's
version.

This effectively enables support for SHA_NI.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Updated asm files to latest version under cryptogams license

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'hmac-copy' into 'master'

gnutls_hmac_copy() API

Closes #787

See merge request gnutls/gnutls!1035

NEWS: document gnutls_hash/hmac_copy addition

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

gnutls_hash/hmac_copy: check its usability in all cases

During the test suite run we require that all supported
MAC and hash algorithms implement the copy function.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

accelerated ciphers: implement hmac and hash copy

This implements the new API to all internal implementations.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

lib: add support for gnutls_hash_copy()

Add gnutls_hash_copy() function for copying message digest context.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

crypto-selftests: add test for gnutls_hmac_copy()

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

api: add gnutls_hmac_copy() function

Add gnutls_hmac_copy() API to duplicate MAC handler state, which is
necessary for SMB3 support.

Resolves: #787

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Add MAC copying support to nettle backend

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Add MAC api to support copying of instances

GOST ciphersuites requires continuously computing MAC of all the
previously sent or received data. The easies way to support that is to
add support for copy function, that creates MAC instance with the same
internal state.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'tmp-inih' into 'master'

Enhance the configuration file capabilities

Closes #587

See merge request gnutls/gnutls!1013

Merge branch 'makefile-patch' into 'master'

Corrected call for updating ABI files

See merge request gnutls/gnutls!1033

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

config: added ability to override and mark algorithms as disabled

This allows the system administrator or the distributor to use
the gnutls configuration file to mark hashes, signature algorithms,
TLS versions, curves, groups, ciphers KX, and MAC algorithms as
insecure (the last four only in the context of a TLS session).
It also allows to set a minimum profile which the applications
cannot fall below.

The options intentionally do not allow marking algorithms as
secure so that the configuration file cannot be used as an attack
vector. This change also makes sure that unsupported and disabled protocols
during compile time (e.g., SSL3.0), do not get listed by gnutls-cli.

The configuration file feature can be disabled at compile time
with an empty --with-system-priority-file.

This patch it introduces the function gnutls_get_system_config_file()
allowing applications to check whether a configuration file
was used.

Resolves: #587

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Use inih to parse configuration file

This introduces the inih copylib, and makes our configuration
file parsing more flexible.

Relates: #587

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-deprecate-registration-apis' into 'master'

Marked the crypto backend registration APIs as deprecated

Closes #789

See merge request gnutls/gnutls!1032

Marked the crypto backend registration APIs as deprecated

This is to warn for a future conversion of these APIs to a no-op.

Resolves: #789

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-small-records-tests' into 'master'

tests: improve record_size_limit tests

See merge request gnutls/gnutls!1023

gnutls-cli-debug.sh: sanity check of %ALLOW_SMALL_RECORDS test

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: test both with and without %ALLOW_SMALL_RECORDS

The option changes the behavior of the server, it would make sense to
check both with and without %ALLOW_SMALL_RECORDS.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tlsfuzzer: use fixed HTTP response for record_size_limit tests

Previously those tests assumed varying sizes of connection information
gnutls-serv sends.  This is too brittle and if the default algorithm
has changed the tests need to be updated.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

gnutls-serv: add --httpdata option to respond with fixed sized data

By default, the gnutls-server --http responds with the connection
information.  While this is useful for manual testing, fixed content
would be more desirable for automated testing.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

gnutls-cli-debug: check if %ALLOW_SMALL_RECORDS is required

This adds a new test against the server to check if
%ALLOW_SMALL_RECORDS is required to continue communicating with the
server.  The test is in two parts: one to check if the server accepts
records with the default size (512 bytes) and the other is to check if
%ALLOW_SMALL_RECORDS helps if the previuos test fails.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

gnutls-serv: add --recordsize option

This adds a means to set maximum record size to receive.  If the size
is less than our default (< 512), --priority with %ALLOW_SMALL_RECORDS
also needs to be specified.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Corrected call for updating ABI files

Signed-off-by: Karsten Ohme <k_o_@users.sourceforge.net>

doc: updated p11-kit links [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-ametzler-doc-syntax-fix' into 'master'

CONTRIBUTING.md: Fix syntax error  [ci skip]

See merge request gnutls/gnutls!1028

CONTRIBUTING.md: Fix syntax error  [ci skip]

Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Merge branch 'tmp-fix-raw-flag-in-newapi' into 'master'

gnutls_privkey_sign_hash2: accept the GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA flag

See merge request gnutls/gnutls!1025