build: fix srcdir detection when VPATH build

Unlike the ".c.c.bak:" and ".h.h.bak:" rules, ".def.stamp:" needs this
adjustment because the source files (*.bak) are not provided as $<.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tests: remove unnecessary session creation in tls13/anti_replay

This test only checks the behavior of _gnutls_anti_replay_check, thus
session is not needed at all.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

doc: corrected typos [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: added test for RSA decryption under gnutls_privkey_import_ext4

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

crypto-self-tests-pk: added RSA-PSS sign/verify tests

This also corrects the GOST R 34.10-2012-512-TC26-512-A self
test.

Relates: #597

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-eddsa-pkcs11' into 'master'

Added support for Ed25519 keys under PKCS#11

Closes #417

See merge request gnutls/gnutls!812

tests: added TLS1.3 tests for PKCS#11 and external key types

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Add support for EDDSA/Ed25519 object support via PKCS#11

Tested with softHSM 2.5.0

Resolves #417

Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-fix-certificate-type' into 'master'

gnutls_certificate_type_get*: ensure that the default type is returned

See merge request gnutls/gnutls!806

Fix RSA-PSS tests to properly return skip value

Signed-off-by: Simo Sorce <simo@redhat.com>

Merge branch 'tmp-fix-max-early-data-size' into 'master'

Fix max_early_data_size handling

See merge request gnutls/gnutls!811

gnutls_certificate_type_get*: updated documentation to list limitations

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: resume: use spaces around '?' and ':' according to coding style

Also set a link to the kernel coding style in CONTRIBUTIONS.md

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_certificate_type_get*: ensure that the default type is returned

That is, ensure that unless we negotiate something else than
X509, the default certificate type is returned to applications.
Previously we wouldn't do that for TLS1.3 resumed sessions, and
we would return zero (invalid type) instead.

That addresses issues with applications checking explicitly
for X509 certificate type being present.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests/tls13-early-data: check if max_early_data_size is advertised

Signed-off-by: Daiki Ueno <dueno@redhat.com>

serv: add --maxearlydata option

Also exercise this in testcompat-tls13-openssl.sh.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: gnutls_record_send_early_data: check the upper limit

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tls13/session_ticket: fix "max_early_data_size" extension handling

session->security_parameters.max_early_data_size is initially set to 0.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

update documentation on GNUTLS_AUTO_REAUTH and gnutls_record_get_direction [ci skip]

That clarifiesthe intention, and adds warning of using this flag when
multiple threads are involved. Based on suggestion by Michael Catanzaro.

Relates: #615

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.gitlab-ci.yml: run coverage build over fedora

This will include the TPM subsystem in the coverage report.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tpm12_testing' into 'master'

tests: tpm: Add a test case for tpmtool

See merge request gnutls/gnutls!807

tests: tpm: Extend test case to not use --register

Extend the tpmtool test case to also test without the --register
parameter.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

tests: tpm: Add a test case for tpmtool

This test case exercises tpmtool and uses certtool to create a
self-signed certificate with the TPM. It uses swtpm as TPM emulator and
configures tcsd to talk to swtpm.

Extend the Readme.md with the packages needed for TPM support and TPM test
support.

This test case needs to be run as root since tcsd needs to be started
as root.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

.gitlab-ci.yml: copy the log files of minimal.Fedora to the gitlab server

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Merge branch 'gost-raw-privkeys' into 'master'

Improve support of GOST private keys parsing

See merge request gnutls/gnutls!802

Merge branch 'tmp-anti-replay-updates' into 'master'

updates in anti-replay subsystem

Closes #610

See merge request gnutls/gnutls!805

lib: tpm: Fix a memory leak

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

doc: mention GOST private key unmasking and additional format support

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

cert-tests: test parsing and decoding of GOST private keys

Add a test for parsing and decoding GOST private keys in different
formats, incuding encrypted keys.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

certtool: support --pkcs-cipher none

If password is specified on command line currently certtool will always
output encrypted pkcs8 file. Add `--pkcs-cipher none' allowing one to
force certtool to output unencrypted private keys.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle/gost: gostdsa: use size_t instead of mp_limb_t

Use size_t for size variables instead of mp_limb_t (data type rather
than size type).

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

pkcs8: support GOST keys without encapsulation

Add support for yet another representation of GOST private keys:
LE-formatted number encoded into pkcs-8-PrivateKeyInfo.privateKey
without any additional encapsulation.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle: unmaks GOST private keys if necessary

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle/gost: support GOST key unmasking

New Russian reccomendation defines 'key masking' in the form of
several concatenated numbers, which must be multiplied modulo Q to get
private key.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

tpmtool: Fix a memory leak related to TPM key list

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Merge branch 'tmp-cert-status' into 'master'

tests: improve testsuite and ECC related minor fixes

See merge request gnutls/gnutls!799

updated auto-generated-files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

anti_replay: moved new add function into anti_replay structure

The new function was not sharing anything with the existing
gnutls_db_* backend, and moving it to anti_replay structure
is more clean and allows for deviations from the old API
conventions (e.g., now we can pass pointers for efficiency
and pass the expiration time as part of the call).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_x509_read_eddsa_pubkey(): sanity check the input values

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_x509_privkey_import_ecc_raw(): fail on invalid sizes

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify whether certificate request levels behave consistently

This verifies whether the behavior of GNUTLS_CERT_IGNORE, GNUTLS_CERT_REQUEST
and GNUTLS_CERT_REQUIRE is consistent accross protocols.

Relates #615

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc: minor updates in elliptic curve documentation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: added a test for detecting duplicate early data

Resolves #610

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'pkcs7-ber' into 'master'

pkcs7: allow BER encoding when parsing encapContentInfo.eContent

See merge request gnutls/gnutls!803

tests: add testfile from RFC4134 Section 4.5

Add test example demonstrating indefinite-length BER encoding of PKCS#7
data.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

pkcs7: allow BER encoding when parsing encapContentInfo.eContent

CMS specification explicitly allows BER encoding in CMS files. RFC 4134
example 4.5 uses BER indefinite encoding.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'tmp-autogen-bak' into 'master'

build: remove autogen .bak files from repository

See merge request gnutls/gnutls!801

Merge branch 'no-session-ticket' into 'master'

configure.ac: drop obsolete info line

Closes #616

See merge request gnutls/gnutls!804

configure.ac: drop obsolete info line

Since 4b567871 there is no `ac_enable_session_tickets` variable, so
let's drop obsolete remnants.

Closes #616

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Noted-by: Dilyan Palauzov

build: minor cleanup of mech-list.h generation

Signed-off-by: Daiki Ueno <dueno@redhat.com>

README-ci.freebsd.md: require autogen

Signed-off-by: Daiki Ueno <dueno@redhat.com>

build: remove autogen .bak files from the repository

While the .bak files are necessary for not requiring autogen on
deployment environment, they are not needed for development and may
cause conflict when other developers use different version of
autogen. This removes those files from the repository and require
autogen at make dist time.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

build: use suffix rules for generating .bak files

Signed-off-by: Daiki Ueno <dueno@redhat.com>

build: use AM_MISSING_PROG for autogen

That makes error message more friendly when autogen is not installed
on developing environment.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tpm12_fix_memory_leak' into 'master'

tpm: Fix memory leak in encode_tpmkey_url

See merge request gnutls/gnutls!800

tpm: Fix memory leak in encode_tpmkey_url

When returning the key URL in encode_tpm_key_url we do not need to allocate
a separate buffer for the URL since we return the allocated buffer from
_gnutls_buffer_to_datum().

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Merge branch 'tmp-0rtt' into 'master'

add support for 0-RTT

Closes #127

See merge request gnutls/gnutls!775

Merge branch 'tmp-f29' into 'master'

.gitlab-ci.yml: move to fedora29 for CI

Closes #607

See merge request gnutls/gnutls!794

doc: mention 0-RTT

Signed-off-by: Daiki Ueno <dueno@redhat.com>

serv: enable anti-replay when early data is used

Signed-off-by: Daiki Ueno <dueno@redhat.com>

TLS 1.3: implement anti-replay measure using ClientHello recording

This implements ClientHello recording outlined in section 8.2 of RFC
8446.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

db: introduce gnutls_db_set_add_function

This adds a way to store an entry if it is not found in the database,
so that the implementation can provide atomic test-and-set.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

db: introduce gnutls_db_check_entry_expire_time

This would be particularly useful when the same database is used to
store long-lived TLS 1.2 session data and short-lived TLS 1.3
anti-replay entries.  Note that the existing gnutls_db_check_entry
doesn't fit in this use-case, as it takes gnutls_session_t as the
argument.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tls13/session_ticket: record timestamp in ticket

This is needed for implementing freshness checks outlined in 8.3 of
RFC 8446.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

str: suppress compiler warning when time_t is 32-bit

Signed-off-by: Daiki Ueno <dueno@redhat.com>

testcompat-tls13-openssl: exercise early data transmission

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tests: add tests for early data

Signed-off-by: Daiki Ueno <dueno@redhat.com>

cli: add --earlydata option

Signed-off-by: Daiki Ueno <dueno@redhat.com>

serv: add --earlydata option

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: introduce new API functions for early data

This introduces gnutls_record_get_max_early_data_size(),
gnutls_record_send_early_data(), and gnutls_record_recv_early_data()
functions.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

handshake: handle early data

This plumbers early data handling in the handshake processes, which
consists of:
- traffic key updates taking into account of client_early_traffic_secret
- early data buffering in both server and client
- the EndOfEarlyData message handling
- making use of max_early_data_size extension in NewSessionTicket

Signed-off-by: Daiki Ueno <dueno@redhat.com>

session_pack: record max_early_data_size in session data

max_early_data_size sent as part of NST should be recorded and
restored when the session data is set back on the session.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: fix memleak when rejecting early data

The "discard" label previously used assumes that the decrypted record
is already added to record_recv_buffer.  It is not the case when
rejecting early data.  Release the allocated memory manually and
return early.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

constate: add epoch_rel argument to _gnutls_epoch_dup

This is necessary for handling early data.  Previously,
_gnutls_epoch_dup() copied the parameters from EPOCH_READ_CURRENT,
while the client only sets EPOCH_WRITE_CURRENT when sending early
data.  This allows caller to specify from which epoch the parameters
are copied.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

handshake: refactor early secret derivation

Signed-off-by: Daiki Ueno <dueno@redhat.com>

handshake: record transcript hash for ClientHello

This is necessary to compute client_early_traffic_secret and
early_exporter_master_secret in TLS 1.3.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

ext/pre_shared_key: use predefined macros for secret labels

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'args-std-def' into 'master'

src: args-std.def: substitute variables using configure

Closes #567

See merge request gnutls/gnutls!793

Merge branch 'tmp-remove-gl-memxor' into 'master'

Unconditionally include nettle/memxor.h

Closes #605

See merge request gnutls/gnutls!797

Unconditionally include nettle/memxor.h

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

gnutls-cli: use assert to mark impossible path

This avoids static analyzers from complaining.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

pkcs12: cleanups, and two memory leak fixes

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tls13: use system's openssl for interop testing

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Added checks to avoid false negatives reported by static analyzers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

src: update autogenerated .bak files

Update files to include proper year, version, etc.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

src: include .bak files in EXTRA_DIST

Including .bak files in EXTRA_DIST allows us to stop hand-generating
these files in distribution. Instead they are directly copied from the
source tree.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

src: update .bak files during -args.c/.h regeneration

To ease updating of .bak files, update them when regenerating
Autogen'erated source files.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

doc: fix texi generation in out-of-tree builds

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

src: mark autogen'ed sources as nodist_

Mark autogenerated sources as not distributable. We are distributing
.bak files instead.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Makefile.am: drop manpages regeneration from dist-hook

There is no need anymore to regenerate tools manpages, they will be
generated automatically from doc/manpages/Makefile.am.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

manpages: fix manpages distribution

It seems that dist_man_MANS does not work properly with Automake
conditionals. Automake will not distribute files which are conditionally
disabled at this make run. As released tarballs include all manpages
already, let's include them unconditionally.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

manpages: fix tools manpages generation

Pass additional include path to let autogen find common arguments
template.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

manpages: un-unroll the loop

Replace unrolled loop over header files with for-loop to simplify
Makefile.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

configure.ac: merge autogen/libopts checks

Move handling of autogen/libopts to a single place. Enforce usage of
local libopts if autogen is not found.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

doc: fix documentation generation in out-of-tree builds

gtk-doc will not process gnutls.h.in file, so we need to point it to
generated gnutls.h file, found inside builddir.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

cfg.mk: fix ChangeLog generation on out-of-tree builds

ChangeLog regeneration does not work for out-of-tree build, so let's fix
that.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

src: args-std.def: substitute variables using configure

Use standard way (configure script) to substiture variables in
args-std.def file, instead of manually replacing them in dist-hook.

Fixes #567

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Initialize output var to avoid false negative from static analyzers

This was identified by clang analyzer's on _gnutls_x509_dn_to_string
and _gnutls_x509_decode_string.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.gitlab-ci.yml: move to fedora29 for CI

This also moves the x86 CI builds to the debian cross infrastructure
as we have a more reliable way of generating a 32-bit image.

Resolves #607

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tpmtool: Support --srk-well-known for SRK with 20 zero bytes password

Implement --srk-well-known for SRK with 20 zero bytes password.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>