Stephan Mueller [Sat, 14 Oct 2017 18:46:09 +0000 (20:46 +0200)]
Add AF_ALG acceleration
The patch set adds the backend implementation to use the Linux kernel
crypto API via the AF_ALG interface. The GnuTLS AF_ALG extension uses
libkcapi [1] as the backend library which implements the actual kernel
communication.
[1] http://www.chronox.de/libkcapi.html
The symmetric cipher support, the hashing and the MAC support are
validated to work correctly using NIST CAVS test vectors.
The AEAD cipher support was tested by connecting to a remote host using
gnutls-cli (the following log strips out unrelated information):
Processed 143 CA certificate(s).
...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
...
- Description: (TLS1.2)-(ECDHE-SECP384R1)-(RSA-SHA512)-(AES-256-GCM)
- Session ID: 9E:5E:FC:09:2A:4E:2A:3D:22:44:68:42:C3:F6:2D:AB:F9:67:08:CE:6D:EE:E4:A2:EF:80:43:FE:3B:D9:1E:FE
- Ephemeral EC Diffie-Hellman parameters
- Using curve: SECP384R1
- Curve size: 384 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA512
- Cipher: AES-256-GCM
- MAC: AEAD
- Options: extended master secret, safe renegotiation,
- Handshake was completed
Daiki Ueno [Mon, 15 Mar 2021 08:55:20 +0000 (09:55 +0100)]
gnulib: update git submodule
This brings in the fix for parse-datetime test failures on NetBSD:
https://lists.gnu.org/archive/html/bug-gnulib/2021-03/msg00069.html
https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=35f8ff2e1162bf3ee60d99b6812f2ae10f3f2898
Daiki Ueno [Tue, 9 Mar 2021 19:29:37 +0000 (20:29 +0100)]
x86: flip polarity of check_fast_pclmul
Otherwise GCC produces the following warnings as the stub
__get_cpuid() is defined as '#define __get_cpuid(...) 0':
x86-common.c: In function 'register_x86_crypto':
x86-common.c:314:15: warning: 'a' may be used uninitialized in this function [-Wmaybe-uninitialized]
314 | family = ((a >> 8) & 0x0F);
| ~~~^~~~~
x86-common.c:308:15: note: 'a' was declared here
308 | unsigned int a,b,c,d;
| ^
Prompted by the following comment of Daiki Ueno:
> I also wonder why we keep the fd open for such a long time in the first
> place. Both OpenSSL and NSS have a similar fallback to /dev/urandom
> if getrandom is not available, but opens the device in one-shot,
> when reseeding is needed (and that's pretty rare).
https://gitlab.com/gnutls/gnutls/-/merge_requests/1383#note_521749519
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
Daiki Ueno [Fri, 5 Mar 2021 11:08:25 +0000 (12:08 +0100)]
gnutls_x509_trust_list_verify_crt2: skip duped certs for PKCS11 too
The commit 09b40be6e0e0a59ba4bd764067eb353241043a70 (part of
gnutls/gnutls!1370) didn't cover the case where the trust store is
backed by PKCS #11, because it used _gnutls_trust_list_get_issuer,
which only works with file based trust store.
This patch replaces the call with more generic
gnutls_x509_trust_list_get_issuer so it also works with other trust
store implementations.
Steffen Jaeckel [Thu, 4 Mar 2021 15:44:21 +0000 (16:44 +0100)]
output UTF-8 decoded id-on-xmppAddr SAN's
tls_x509_crt_get_subject_alt_name()` makes a promise [1] "If an
otherName OID is known, the data will be decoded. ... RFC 3920
id-on-xmppAddr SAN is recognized." which it didn't hold.
Before this patch the output was still in DER format, e.g. for a
id-on-xmppAddr which is always UTF-8 (0x0c): `0x0c <len> <xmppAddr>`
This patch fixes the issue and now it returns the decoded string.
JonasZhou [Thu, 25 Feb 2021 07:48:36 +0000 (15:48 +0800)]
padlock:add support for AES-192-CBC
Padlock code misses support for AES-192. Extend it to support AES-192.
Due to poor performance of padlock-aes-xxx-gcm, only padlock-aes-192-cbc
is added.
Daiki Ueno [Sat, 30 Jan 2021 08:25:06 +0000 (09:25 +0100)]
nettle: check lib state early to cope with synthesized error
tests/x509sign-verify-error.c calls _gnutls_lib_simulate_error before
the actual private key operations. That previously resulted in
infloop / conditional jump depending on uninitialized data, because
the random function (gnutls_rnd) was not able to feed sufficient
randomness in that case.
Ondrej Moris [Fri, 30 Oct 2020 19:43:56 +0000 (20:43 +0100)]
fips: replace fipshmac usage with internal program
This introduces a non-installed program "fipshmac" and uses it for
generating HMAC files required in FIPS 140-2. The generated files are
installed along with the main library.
Resolves issues #1101.
Signed-off-by: Ondrej Moris <omoris@redhat.com> Co-authored-by: Daiki Ueno <dueno@redhat.com>
Daiki Ueno [Tue, 16 Feb 2021 06:51:10 +0000 (07:51 +0100)]
gnutlsxx: dh_params, rsa_params: actually assign values in operator=
The previous implementation assigned the value to a temporary variable
and then return it without assigning it to 'this'. That is not only
contradictory to user's expectation but also cppcheck treats it as a
logic error.
Andreas Metzler [Tue, 9 Feb 2021 13:16:54 +0000 (14:16 +0100)]
Fix test error with nettle in non-default location
Move #include <nettle/memxor.h> from gnutls_int.h to lib/cipher.c, drop
now superfluous NETTLE_CFLAGS from CPPFLAGS of multiple tests #including
gnutls_int.h.
Daiki Ueno [Tue, 9 Feb 2021 14:26:07 +0000 (15:26 +0100)]
tests/gnutls-cli-debug.sh: don't unset system priority settings
When the test is exercised, GNUTLS_SYSTEM_PRIORITY_FILE is set in many
places, such as TESTS_ENVIRONMENT tests/Makefile.am or a packaging
system that runs the test in a restricted environment. Unsetting it
after a temporary use forces the remaining part of the test to use the
default system priority, which might not be the intention of the user.
The commit ebb19db9165fed30d73c83bab1b1b8740c132dfd caused a
regression, where duplicate certificates in a certificate chain are no
longer ignored but treated as a non-contiguous segment and that
results in calling the issuer callback, or a verification failure.
This adds a mechanism to record certificates already seen in the
chain, and skip them while still allow the caller to inject missing
certificates.
Signed-off-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Andreas Metzler <ametzler@debian.org>
Daiki Ueno [Sun, 24 Jan 2021 06:34:24 +0000 (07:34 +0100)]
handshake: TLS 1.3: don't generate session ID in resumption mode
The commit e0bb98e1f71f94691f600839ff748d3a9f469d3e revealed that the
previous code always generated session ID in the TLS 1.3 middlebox
compatibility mode even when the handshake is being resumed.
This could cause a difference in PSK binder calculation if the server
sends an HRR in the resumption handshake.
projects / thirdparty / gnutls.git / log
