Merge branch 'wip/dueno/mldsa-pk-from-sk' into 'master'

nettle: support deriving ML-DSA public key from expanded secret key

Closes #1723

See merge request gnutls/gnutls!2088

Merge branch 'master' into 'master'

aarch64: Enable GCS

Closes #1764

See merge request gnutls/gnutls!2038

nettle: support deriving ML-DSA public key from expanded secret key

RFC 9881 defines 3 private key formats for ML-DSA: "seed",
"expandedKey" and both. When it is "expandedKey", a non-trivial
conversion is required to derive a public key, which is now
implemented in leancrypto through lc_dilithium_pk_from_sk. This patch
modifies the pk_fixup backend function to use it to derive a public
key when importing a private key.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

aarch64: Enable GCS

Signed-off-by: Guillaume Gardet <guillaume.gardet@arm.com>

nettle: use "switch" instead of "if" in wrap_nettle_pk_fixup

This makes it easier to conditionalize code with #ifdef.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

privkey_to_pubkey: use constants to access public key parameters

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'master' into 'master'

Check client certificate usage in serv

See merge request gnutls/gnutls!2087

Merge branch 'wip/dueno/nc-tree' into 'master'

x509/name_constraints: rework with rbtree-list

See merge request gnutls/gnutls!2083

Use client certificate in gnutls-cli test

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>

Merge branch 'wip/dueno/doc-update' into 'master'

cli,serv: make it explicit that they are a testing program

See merge request gnutls/gnutls!2086

SECURITY.md: suggest CVSS v3.1 [ci skip]

Signed-off-by: Daiki Ueno <ueno@gnu.org>

SECURITY.md: don't impose normal process for low severity issues

Signed-off-by: Daiki Ueno <ueno@gnu.org>

SECURITY.md: make it explicit that testing programs are out of scope

Signed-off-by: Daiki Ueno <ueno@gnu.org>

cli,serv: make it explicit that they are a testing program

Signed-off-by: Daiki Ueno <ueno@gnu.org>

x509/name_constraints: refactor intersection/union with iterators

This refactors the loops in name_constraints_node_list_intersect and
name_constraints_node_list_union with gl_list_iterator_t, as well as
factor out the partitioning logic in _intersect to _partition.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Check client certificate usage in serv

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>

x509/name_constraints: redefine type_bitmask_t as unsigned long

Previously type_bitmask_t was defined as uint8_t, which were
zero-extended to a machine word when doing bit-wise operations.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

hello_ext: move static assertions from gnutls_int.h to hello_ext.c

Signed-off-by: Daiki Ueno <ueno@gnu.org>

x509/name_constraints: extensively use bool instead of unsigned

Signed-off-by: Daiki Ueno <ueno@gnu.org>

_gnutls_x509_name_constraints_is_empty: remove type argument

The type argument is only used in
gnutls_x509_name_constraints_check_crt defined in the same
file. Create a helper function name_constraints_contains_type split
from _gnutls_x509_name_constraints_is_empty to cater for that.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

x509/name_constraints: extensively use gnutls_x509_subject_alt_name_t

Signed-off-by: Daiki Ueno <ueno@gnu.org>

x509/name_constraints: rework with rbtree-list

Instead of sorting permitted sets on demand, use a sorted list backed
by a binary tree to represent the sorted view of the sets. The
amortized complexity should be O(log n) as before.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'wip/dueno/utils' into 'master'

mem,str,datum: rename `_steal_*` to `_take_*`

See merge request gnutls/gnutls!2085

mem: make _gnutls_take_pointer type safer

This changes the source parameter of _gnutls_take_pointer from "void **"
to "void *", while adding automatic cast using typeof.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

mem,str,datum: rename _steal_* to _take_*

While the name of _gnutls_steal_* functions was inspired by GLib's
g_steal_* family, it doesn't seem to be intuitive at first glance,
possibly because of the negative meaning of the word "steal". Let's
call it _gnutls_take_*, following the example of TAKE_* macros in
systemd and Option::take in Rust.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'ci-f43' into 'master'

.gitlab-ci.yml: move fedora jobs to Fedora 43

See merge request gnutls/gnutls!2082

Merge branch 'devel-ci-local' into 'master'

devel/ci-local.sh: add a gitlab-ci-local wrapper

See merge request gnutls/gnutls!2077

.gitlab-ci.yml: move fedora jobs to Fedora 43

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

devel/ci-local.sh: add a gitlab-ci-local wrapper

gitlab-ci-local doesn't play nicely with gnutls out of the box.
This adds a wrapper that smoothes several wrinkles out:
1. if you're using worktrees, bootstrapping submodules fails
2. there's no way to pass arbitrary arguments like `--remote` to podman
3. `artifacts: untracked: true` doesn't work without `paths` specified
4. commit-check job is skipped by default

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Merge branch 'c99' into 'master'

configure: make the C99 detection more resiliant

Closes #1806

See merge request gnutls/gnutls!2081

configure: make the C99 detection more resiliant

autoconf 2.73 will default to C23 by default, which means that the >C99
detection logic in configure.ac will fail because it only handles c11
and c99.

Instead of adding c23 to the list and then breaking again in the future,
flip the logic around (as suggested by Zack Weinberg) and check
explicitly for just c89.

Closes #1806.

Signed-off-by: Ross Burton <ross.burton@arm.com>

Merge branch 'ktls-chacha-iv-fix' into 'master'

ktls: fix ChaCha20-Poly1305 IV passing for TLS 1.2

See merge request gnutls/gnutls!2079

ktls: simplify ChaCha20‑Poly1305 IV passing

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

ktls: fix ChaCha20-Poly1305 IV passing for TLS 1.2

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Merge branch 'wip/dueno/remove-nettle-bundle' into 'master'

Remove no longer used files copied from Nettle

See merge request gnutls/gnutls!2078

nettle: remove unused block8.h, block-internal.h, and nettle-internal.h

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: remove bundled code for upstreamed GOST Streebog

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: remove check for nettle_rsa_sec_decrypt

Now that Nettle 3.10 is required to build the library, the check for
the function is redundant.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: remove check for nettle_cbc_aes128_encrypt

nettle_cbc_aes128_encrypt was added in Nettle 3.8, while we require
3.10 or later. We can use the function unconditionally.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: remove bundled code for *_shake_output

Now that Nettle 3.10 is required to build the library, the bundled
code is no longer used.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: remove bundled code for RSA-OAEP

Now that Nettle 3.10 is required to build the library, the bundled
code is no longer used.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: remove bundled code for AES-GCM-SIV

Now that Nettle 3.10 is required to build the library, the bundled
code is no longer used.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'wip/dueno/nettle-4-followup' into 'master'

accelerated: don't register custom HMAC for AArch64 if Nettle 4

Closes #1804

See merge request gnutls/gnutls!2080

nettle: revert workaround for base64_decode_update return values

This reverts commit d6014115969655005968491be1da8892ddedc134, as it
turned out that the change of error return value was only available in
an unreleased version of Nettle.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

accelerated: don't register custom HMAC for AArch64 if Nettle 4

As a follow-up of commit 4e3921c36529110a94c2a63e0d6601c502901589, add
missing #ifdefs for AArch64, as Nettle 4 doesn't provide an easy way
to implement a custom HMAC instance.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'update-gnulib' into 'master'

gnulib: update to 2026-03-01 1cc0125a28

See merge request gnutls/gnutls!2069

gnulib: update to 2026-03-01 1cc0125a28

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Merge branch 'fix-mingw' into 'master'

fix mingw

See merge request gnutls/gnutls!2076

.gitlab-ci.yml: unmark mingw jobs as manual

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

.gitlab-ci.yml: explicitly initialize wine prefix...

... with no concurrency, before running the tests

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

.gitlab-ci.yml: use separate 32 and 64 mingw images

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/name-constraints-ip: call gnutls_global_init explicitly

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/name-constraints-ip: turn check_for_error into a macro

This way we can get more meaningful diagnostics
with the use of the __LINE__ macro and tell the failures apart.

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Merge branch 'wip/dueno/nettle-4' into 'master'

Support building with Nettle 4

Closes #1791

See merge request gnutls/gnutls!2075

.gitlab-ci.yml: re-enable fedora/nettle jobs with Nettle master

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: catch both old and new error codes from base64_decode_update

Signed-off-by: Daiki Ueno <ueno@gnu.org>

rnd-fips: use Nettle 4 digest interface

We should switch to the drbg-ctr-aes256 module provided by Nettle.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

tls1-prf: use Nettle 4 digest interface

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: support Nettle 4 cipher interface

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: support Nettle 4 hash and MAC interfaces

Signed-off-by: Daiki Ueno <ueno@gnu.org>

dsa-fips: omit digest_size argument for sha384_digest with Nettle 4

Signed-off-by: Daiki Ueno <ueno@gnu.org>

accelerated: support GCM_DIGEST in Nettle 4

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'leak-related-tweaks' into 'master'

leak related tweaks, trying to catch #1799 in CI

See merge request gnutls/gnutls!2072

tests/gnutls-asan.supp: tighten up

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/slow: remove ASAN suppression file

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/tls13-early-data-neg2: add an overlooked free

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/resume-with-*: add a few overlooked frees

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/resume-with-previous-*: turn functions w/o retval void

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

accelerated: give up on defining nettle HMAC interface

Nettle 4 doesn't provide a way to define custom HMAC instances.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: use Nettle provided function types

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: include <nettle/sha[12].h> instead of deprecated <nettle/sha.h>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

nettle: use SHA*_BLOCK_SIZE instead of deprecated SHA*_DATA_SIZE

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Merge branch 'zfridric_devel' into 'master'

Fix parsing of BIT STRING encoded EdDSA keys

Closes #1749

See merge request gnutls/gnutls!2060

Add tests for different EDDSA ecpoint encodings

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Fix parsing of BIT STRING encoded EdDSA keys

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Merge branch 'const' into 'master'

Fix discard const qualifier

See merge request gnutls/gnutls!2073

Fix discard const qualifier

Since glibc-2.43 and ISO C23, the functions bsearch, memchr, strchr,
strpbrk, strrchr, strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr
that return pointers into their input arrays now have definitions as
macros that return a pointer to a const-qualified type when the input
argument is a pointer to a const-qualified type.

additional and p pointer returns are only being used for comparisons so declare
them as const, which matches the input variable.

Fixes:
    ../../../lib/x509/hostname-verify.c: In function 'gnutls_x509_crt_check_hostname2':
    ../../../lib/x509/hostname-verify.c:165:17: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
      165 |             ((p = strchr(hostname, ':')) != NULL ||
          |                 ^
    ../../../lib/x509/ip.c: In function 'gnutls_x509_cidr_to_rfc5280':
    ../../../lib/x509/ip.c:233:11: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
      233 |         p = strchr(cidr, '/');
          |           ^
    ../../lib/priority.c: In function '_gnutls_resolve_priorities':
    ../../lib/priority.c:2534:20: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
     2534 |         additional = strchr(ss, ':');
          |                    ^
    ../../lib/str.c: In function '_gnutls_hostname_compare':
    ../../lib/str.c:722:19: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
      722 |                 p = strrchr(certname, '.');
          |                   ^

Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>

Merge branch 'test-long-label-fix-leak' into 'master'

tests/pkcs11/long-label: fix a leak

Closes #1799

See merge request gnutls/gnutls!2068

tests/pkcs11/long-label: fix a leak

Fixes: #1799
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Merge branch 'wip/asosedkin/release-3.8.12' into 'master'

Release 3.8.12

Closes #1773 and #1790

See merge request gnutls/gnutls!2062

Release 3.8.12

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: name_constraints_node_list_intersect over sorted

Fixes: #1773
Fixes: GNUTLS-SA-2026-02-09-2
Fixes: CVE-2025-14831
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: make types_with_empty_intersection a bitmask

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: implement name_constraints_node_list_union

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: add sorted_view in preparation...

... for actually using it later for performance gains.

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: introduce a rich comparator

These are preparatory changes before implementing N * log N intersection
over sorted lists of constraints.

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: name_constraints_node_add_{new,copy}

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: reject some malformed domain names

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

tests/name-constraints-ip: stop swallowing errors...

... now when it started to pass

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

x509/name_constraints: use actual zeroes in universal exclude IP NC

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

pre_shared_key: add null check on pskcred

Fixes: #1790
Fixes: GNUTLS-SA-2026-02-09-1
Fixes: CVE-2026-1584
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

NEWS: add an entry for overflows reported by Tim Rühsen

_gnutls_bin2hex: make it robuster against empty input

Signed-off-by: Daiki Ueno <ueno@gnu.org>

tests: use public API in pkcs12_s2k test as possible

The pkcs12_s2k was using _gnutls_bin2hex, which is a private
function. This changes the test logic to compare with binary blogs
instead of hex encoded data, and switches to using a public function,
gnutls_hex_decode.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

x509: avoid integer overflow when escaping DN

Signed-off-by: Daiki Ueno <ueno@gnu.org>

buffer: add more extensive integer overflow checks

Signed-off-by: Daiki Ueno <ueno@gnu.org>

doc/Makefile: re-add three binaries to DISTCLEANFILES

This has previously been fixed in
8daba130cc0c4100186af0b61bc3e65d54a46727,
but then 5300a8683d937ccf09ed01170d3bcb93d97ed605 reverted it out
together with the other change.

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

.gitlab-ci.yml: kill wineserver before running tests

.gitlab-ci.yml: do not run fedora-i686/test w/o fedora-i686/build

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

.gitlab-ci.yml: unregister qemu binfmt handler first

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>