doc: few improvements over certificate validation text

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-persistent-id' into 'master'

resumption: keep persistent session identifiers

Closes #484

See merge request gnutls/gnutls!721

gnutls-serv: re-introduce the session identifier message

The message "If your browser supports session resuming, then you should
see the same session ID, when you press the reload button", is now printed
again even under TLS1.3.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

resume: keep persistent session identifiers

With the introduction of session ticket support (TLS1.2) and
TLS1.3, session identifiers have no persistency on server or
client side. Improve the situation by introducing persistent
session identifiers on server side in a backwards compatible
way.

Resolves #484

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-handshake-interleave' into 'master'

Fix interleaved handshake handling in TLS 1.3

Closes #272

See merge request gnutls/gnutls!708

.gitlab-ci.yml: include fuzz/*.log in artifacts

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tests: tls-fuzzer: enable tests relying on header fragmentation

Those tests were previously disabled because splitting of handshake
messages in a very short (< 4 bytes) fragments is not implemented.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: send unexpected_message upon empty unencrypted records

Signed-off-by: Daiki Ueno <dueno@redhat.com>

buffers: handle very short fragmentation of handshake messages

If the received record doesn't even complete the handshake
header (i.e., the record size < 4), keep it in a temporary buffer and
let the caller receive more records.  Once enough amount of data is
received, move the already received records back to record_buffer and
proceed to the normal processing.

Fixes: #272
Signed-off-by: Daiki Ueno <dueno@redhat.com>

mbuffers: introduce _mbuffer_head_push_first

This is similar to _mbuffer_enqueue, but adds an element to the
beginning of the buffer.

This is to make the incomplete header handling case easier.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

_gnutls_parse_record_buffered_msgs: eliminate local variable usage

If `remain > 0` is true, `recv_buf[0].length > 0` always holds.
Combine those conditions and remove the `remain` utilizing MIN().

This is to make the incomplete header handling case easier.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

buffers: avoid confusion in fragment length calculation

Previously, to calculate the fragment length, it added/subtracted one
to the ending offset back and forth; that was not easier to read and
couldn't handle empty payload messages in TLS.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tmp-skip-zero-rtt' into 'master'

TLS 1.3: ignore "early_data" extension

Closes #512

See merge request gnutls/gnutls!706

tlsfuzzer: update to the latest version

Also enable test-tls13-0rtt-garbage.py.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

TLS 1.3: ignore "early_data" extension

As 0-RTT is still not implemented in GnuTLS, the server responds with
1-RTT, by skipping decryption failure up to max_early_data_size, as
suggested in 4.2.10 Early Data Detection.

Resolves #512

Signed-off-by: Daiki Ueno <dueno@redhat.com>

p11tool: print expiration time on certificates

This is particularly useful when displaying information about a
certificate trust store.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-handshake-return-early' into 'master'

tls1.3: server returns early on handshake when no cert is provided by client

Closes #481 and #457

See merge request gnutls/gnutls!711

tls1.3: server returns early on handshake when no cert is provided by client

Under TLS1.3 the server knows the negotiated keys early, if no client
certificate is sent. In that case, the server is not only able to
transmit the session ticket immediately after its finished message,
but is also able to transmit data, similarly to false start.

Resolves #481
Resolves #457

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-serv: don't close connection properly when handshake is not yet complete

In the case handshake is not yet complete and we need
to terminate, it is because of an issue. As such prefer an
unclear termination at this stage. This addresses error detection
issues with tlsfuzzer.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: corrected input buffer null-termination

This was a regression in the previous cleanup at
f138ff85df69976badce44a5c46157cce091020f included in
3.6.3.

Resolves #534

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: added example of converting to DER in manpage

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-fix-wabi' into 'master'

Fix gcc-8 -Wabi warnings

Closes #531

See merge request gnutls/gnutls!720

Fix gcc-8 -Wabi warnings

Fixes #531

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Merge branch 'tmp-test-large-cert' into 'master'

tests: improved test suite

Closes #508 and #513

See merge request gnutls/gnutls!719

ext/key_share: check the validity of server key shares

That is, when generating the public key based on the server's
key share, ensure that the algorithms match completely with
the key shares the client initially sent. This was detected
by the updated traces for TLS1.3 fuzzying.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-serv: improve output under TLS1.3

That is, silence fields no longer applicable under TLS1.3
and make sure that newer functions like gnutls_session_get_desc()
get used when describing the session.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: updated traces for latest TLS1.3 draft

Relates #359

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: run tls-fuzzer PSK testsuite

Resolves #508

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test of handshake with large certificate

This checks whether handshake message fragmentation and de-fragmentation
is functional on server and client.

Resolves #513

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: eliminated limits in certificate export size

That allows printing an exporting certificates of size only bounded
by avail memory.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: eliminate maximum limit in fields read with READ_MULTI_LINE_TOKENIZED()

This allows to generate a certificate with an extension of arbitrary size.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-tls13-fixes' into 'master'

Fixes on TLS1.3 support

Closes #525

See merge request gnutls/gnutls!718

gnutls.h: corrected typo

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

send_client_hello: don't override version after HRR is received

When a Hello Retry Request is received, do not set our (transient)
version to TLS1.2 on the second client hello. That's because both
peers have already negotiated TLS1.3.

This addresses issue with peers which may send a changecipherspec
message at this stage, which is now allowed when our version is
set to be TLS1.2. Introduced test suite using openssl and resumption
using HRR which reproduces the issue.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

hello_ext_parse: apply the test for pre-shared key ext being last on client hello

We were incorrectly insisting on pre-shared key extension being last in
both client and server hello. That was incorrect, as only in client hello
it is required by TLS1.3 to be last.

Quoting:
   The "pre_shared_key" extension MUST be the last extension in the
   ClientHello (this facilitates implementation as described below).
   Servers MUST check that it is the last extension and otherwise fail
   the handshake with an "illegal_parameter" alert.

Resolves #525

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: automatically retry failed jobs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

allow no certificates to be reported by the gnutls_certificate_retrieve_function callbacks

In 9829ef9a we introduced a wrapper over the older callback functions
which didn't handle this case.

Resolves #528

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'fix-cert-callbacks' into 'master'

cert-cred: fix possible segfault when resetting cert retrieval function

Closes #528

See merge request gnutls/gnutls!714

cert-cred: fix possible segfault when resetting cert retrieval function

Reset get_cert_callback3 callback to NULL if provided callback is NULL.
Otherwise after the certificate request call_legacy_cert_cb1 /
call_legacy_cert_cb2 will try to unconditionally call legacy_cert_cb1 /
legacy_cert_cb2 callback (set to NULL) leading to segfault.

Fixes: 9829ef9a3ca06d60472599df7c74ebb9a53f1fe2
Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'misc-fixes' into 'master'

Few small patches

See merge request gnutls/gnutls!715

kx: for uniformity print master secret size

During keys setup phase debug log will contain sizes of all keys and
secrets, except master secret. Dump MS length (48) to log for
uniformity.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

constate: dump full key block to log

Include full key block to the debug log.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

constate: dump MAC keys to debug log

_gnutls_set_keys() can dump client/server write keys/ivs to debug log,
but it skips MAC keys. Add MAC keys to log.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

constate: drop unused variable in _gnutls_set_keys

_gnutls_set_keys() creates rrnd as client random + server random, but
does not use it (it was used before for export key generation, but was
not removed when dropping support for export cipher suites).

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Fixes: 8bdb8d53aa5b4c5d04255b6c9b5f2dac8b23d51b

cert auth: simplify certificate selection code

Merge pubkey_is_compat_with_cs() and select_sign_algorithm() functions
to ease extension of certificate selection code.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'tmp-fix-521' into 'master'

Remove trailing dot from hostname input

See merge request gnutls/gnutls!709

Remove trailing dot from hostname input

Fixes #532

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Merge branch 'tmp-fix-pkcs8-export' into 'master'

Addressed issue with ECDSA key export under PKCS#8

Closes #516

See merge request gnutls/gnutls!707

gnutls_x509_privkey_import_ecc_raw: encode parameters on import

That makes the structure fully usable after import. In _encode_privkey()
use the lower-level _gnutls_x509_export_int2() for key encoding as the
call to higher gnutls_x509_privkey_export2() could result to an infinite
recursion when keys are incomplete.

Introduced additional tests for PKCS#8 key import and export.

Resolves: #516

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'certtool-gost-paramset' into 'master'

certtool: use gnutls_gost_paramset_get_name

See merge request gnutls/gnutls!710

certtool: use gnutls_gost_paramset_get_name

gost_param_name() predates gnutls_gost_paramset_get_name() and
gnutls_gost_paramset_t. Use current API functions instead of hand-coding
new functions.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

gnutls-cli: do not fail if CKA_ID is too long

Increased the buffer needed to read reasonable-sized CKA_IDs
and avoid failure when the CKA_ID is too long.

Resolves #520

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: combined abi-check and TLS1.3 check runs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: handshake-timeout: reverted virt-time.h usage

The tests nature (waiting on a socket) didn't fit well with the virt-time
implementation. Reverted to original real-time wait and improved error
detection in child process.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_priority_init: fix err_pos on invalid strings

When the provided string would be resolved (e.g., due to a @ priority
being used), to a different string, then do not attempt to
detect the right location of the error. It will not be useful to the caller.

This addresses the issue of test suite failure when --with-system-priority-file
and --with-default-priority-string are provided. It also enhances the test suite
with these options being active.

Resolves #517

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

examples: tlsproxy: use snprintf instead of strncpy

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc: simplified documentation on threads

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

examples: tlsproxy: eliminated warnings

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: updated win32 targets

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls-cli: mark legacy options as deprecated

This removes the --ranges and --disable-extensions options from
the default listing of options. They are disfunctional and may
be removed in the future.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.travis.yml: update brew and use nettle 3.4

Resolves #480

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.gitlab-ci.yml: Werror build runs with -std=c99

This ensures that the errors reported will be relevant
for the required version of the standard.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

bumped versions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

_gnutls_resolve_priorities: avoid gnu extension for ?: construct

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

NEWS: doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle/rnd-fips: updated documentation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: improve error reporting with -l --priority option

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cipher-listings: use the sed found by configure script and make it portable

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: tls-fuzzer: separated SSL3.0 from TLS1.x tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: do not attempt SSL3.0 negotiation when not enabled

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

priorities: ensure that SSL3.0 enablement fails early when disabled

That is, that a priority string with only SSL3.0 present is discarded as
invalid.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

The SSL 3.0 protocol is disabled on compile time by default

It can be re-enabled by specifying --enable-ssl3-support on configure script.
This is the first step before removing support for the protocol completely.

Relates #103

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: gnutls-cli-debug.sh: corrected run under FIPS mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: minor text updates

Updated text for gnutls_session_ext_master_secret_status and for
GNUTLS_NO_EXTENSIONS flag which is defunc.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls-cli-debug: fix EtM and extended master secret discovery

In particular do not set the GNUTLS_NO_EXTENSIONS flag by default,
and only enable block ciphers for the EtM check.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: improved unit test of gnutls-cli-debug

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls-cli-debug: generalized cipher tests

That is, tests now check for either the 128-bit or the 256-bit
of the cipher consistently.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: removed legacy tests no longer applicable

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: detect TLS1.3 support

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: when testing servers enable all ciphers

Resolves #515

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc: update for TLS 1.3

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tmp-fix-multi-async-msg' into 'master'

Fix issue preventing the parsing of certain async messages

Closes #510 and #504

See merge request gnutls/gnutls!694

_gnutls13_recv_async_handshake: process multiple and split handshake messages

It is permitted to concatenate multiple async handshake messages in a single
record message as well as split large messages (NST) into multiple records.
Modified _gnutls13_recv_async_handshake() to process them correctly, instead
of assuming that they are formatted as one message per record.

Resolves #510
Resolves #504

Relates #511

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: check whether multiple tickets can be sent/received

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_session_ticket_send: allow sending multiple tickets in one go

This allows combining the tickets in a single record message when
possible.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-limit-ticket-age' into 'master'

limit the age of session tickets

Closes #476

See merge request gnutls/gnutls!697

tests: handshake-timeout: use virt_sec_sleep() to avoid long delays in test

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

generate_session_ticket: tickets cannot extend the original session time

That is, on a resumed session the server would not issue new tickets
that would have extended the lifetime of the originally issued ticket.

Resolves #476

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pre_shared_key: do not send extension when no identities are present

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: corrected priority strings in session-tickets-ok and other cleanups

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc: mention session ticket behavior under TLS1.3

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

generate_session_ticket: use a 4-byte nonce by default

It is not necessary to use large nonces.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pre_shared_key: use time_t type for ticket_age variable

This is guarranteed to allow negative values, and also be 32-bits.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

generate_session_ticket: fixed comment

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

lib: document digest and paramset in gost key import functions

Document behaviour of gnutls_pubkey_import_gost_raw,
gnutls_privkey_import_gost_raw and gnutls_x509_privkey_import_gost_raw.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

lib/x509: use new function to deduce default GOST paramset

Use new _gnutls_gost_paramset_default() function to deduce default GOST
paramset, instead of hardcoding if/else in several places.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

lib: remove undefined behaviour when handling GOST paramset

Initial version of GOST patchset used param < 0 to represent unknown
value. Later special enum entry GNUTLS_GOST_PARAMSET_UNKNOWN was
introduced. Fix several leftovers comparing params to 0 directly.

Closes #505.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'tmp-def-priority2' into 'master'

gnutls_set_default_priority2: introduced

See merge request gnutls/gnutls!680