nettle: add support for GOST 34.11 hash functions

Add support for GOST R 34.11-94 and Streebog (256/512) functions.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

nettle: support GOST28147-89 in CFB mode

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Add declarations for GOST 28147-89 cipher in CFB mode

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Add declarations for GOST R 34.11 (-94 and -2012) digest algorithms

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Import GOST-supporting part from Nettle pending patches

Nettle upstream takes significant time to accept GOST-related patches.
As per Nikos' suggestion, push relevant parts to GnuTLS, so that they
can be tested in wild at the same time supporting GOST ciphersuite code.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

.gitlab-ci.yml: disable gost in minimal build

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Add configure argument to disable GOST support

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'tmp-fix-order-extensions' into 'master'

extensions: corrected order of pre-shared-key and dumbfw

Closes #473

See merge request gnutls/gnutls!659

_gnutls_parse_hello_extensions: enforce that pre-shared-key extension is last

This is a requirement in draft-ietf-tls-tls13-28 4.2.11 section:
   The "pre_shared_key" extension MUST be the last extension in the
   ClientHello (this facilitates implementation as described below).
   Servers MUST check that it is the last extension and otherwise fail
   the handshake with an "illegal_parameter" alert.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: check whether we send the pre-shared key extension after dumbfw

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: corrected typo in comment

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: corrected order of pre-shared-key and dumbfw

The pre-shared-key MUST always be last under TLS1.3 while the
dumbfw extension should be last in order to do proper evaluation
of extension size (gnutls requirement). As such the protocol
requirement takes precedence.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'fix-warnings-in-testsuite' into 'master'

Fix test code for -Werror

See merge request gnutls/gnutls!675

Fix test code for -Werror

Merge branch 'tmp-supplemental-no-tls13' into 'master'

Disable TLS1.3 when supplemental data extensions are enabled

Closes #479

See merge request gnutls/gnutls!673

tests: updated supplemental tests for TLS1.3

This includes tests that verify that TLS1.3 is not negotiated
when supplemental data are set in client and/or server side.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_supplemental_register: disable TLS 1.3 globally

This allows using the registered supplemental data handlers, since
these are not used under TLS 1.3.

Resolves #479

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_session_supplemental_register: disable TLS1.3 when set

This allows using the registered supplemental data handlers, since
these are not used under TLS 1.3.

Resolves #479

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'exclude-fuzz-corpora' into 'master'

Remove oss-fuzz copora from tarball

Closes #461

See merge request gnutls/gnutls!671

Remove oss-fuzz copora from tarball

The size of the corpora is huge and not needed for normal builds.

This patch also fixes test run issues on Windows.

gnutls-cli: introduce the rekey1 inline command

That allows performing a rekey locally and with the
peer.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'tmp-safe-padding-removal-made-optional' into 'master'

Safe padding removal was made optional

Closes #466

See merge request gnutls/gnutls!669

document new behavior on safe padding removal

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

record: fail with invalid request when attempting to send no pad and no data

Previously we were returning an internal error which seems to be incorrect
in that case.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enhance padding check

This introduces tests for zero-data transfers with padding as well
as padding and de-padding with safe padding flag set.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: added CCM run under TLS1.2 in benchmark mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cipher: made TLS1.3 safe padding check optional

This patch introduces the gnutls_init() flag GNUTLS_SAFE_PADDING_CHECK
which makes the TLS1.3 safe padding check optional. That way applications
which do not utilize the TLS1.3 padding do not get penalized by the performance
drop in TLS1.3 packet processing. This addresses a regression in TLS1.3
packet processing performance.

Resolves: #466

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_session_get_id: document restrictions

This documents the fact that a TLS session ID cannot be relied
to be unique or to even have a meaningful value.

Resolves #484

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify that resumed session ID matches original

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'fix-files-update' into 'master'

Fix make files-update for out-of-tree builds

See merge request gnutls/gnutls!674

Makefile.am: move autogen files update to src/Makefile.am

Move autogen'ed files update to src/Makefile.am to simplify code and
support out-of-tree builds.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Makefile.am: files-update: support out-of-tree builds

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

symbol-check: fix typo to make it work for out-of-tree builds

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

aarch64: update elf files to correspond to the macosx version

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

macosx: include aarch64 asm files

Relates #475

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Merge branch 'tmp-fix-tags' into 'master'

Makefile.am: abi-check: fetch fresh tags

See merge request gnutls/gnutls!668

Makefile.am: abi-check: fetch fresh tags

This addresses the issue of failed abi-check CI runs on
forked repositories.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

drbg-aes: removed the continuous DRBG checks

These are no longer necessary for FIPS140-2 compliance.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'fix-autoreconf' into 'master'

Fix usage of 'autoreconf'

See merge request gnutls/gnutls!667

Fix usage of 'autoreconf'

'autoreconf' created a different configure script than ./bootstrap.
The result was a broken wchar.h that failed to compile.

The work-around was 'autoreconf -I gl/m4' which is not what a developer
expects. This patch moves gl/m4/* to m4/ which is the default include dir
for autoreconf.

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

configure: Check for clock_gettime and fmemopen using a proper test

Don't use AC_CHECK_FUNCS for these functions, but actually test by
including the real header that defines the functions. This allows
the macOS version selection work as intended, making the references
to these functions weak if targeting a version of macOS where these
functions aren't available. Thanks to -no_weak_imports, these weak
references end up in failed linker tests, marking the functions as
unavailable.

This fixes issue #142.

Signed-off-by: Martin Storsjo <martin@martin.st>

configure: Include sys/random.h before checking for getentropy on macOS

This function is available since macOS 10.12, but it's in
sys/random.h on macOS, contrary to the other platforms supporting
it where it is present in unistd.h.

If we don't include the right header that declares the function
and its availability, the configure check would succeed even if
targeting older versions of macOS that lacks the function.

Also include the same header in the source file that actually
uses getentropy.

Signed-off-by: Martin Storsjo <martin@martin.st>

configure: Pass -no_weak_imports to the linker, if supported

This avoids linking to functions that aren't available in the
lowest targeted macOS version.

If the proper header declaring a function is included, and
gnutls is built with -mmacosx-version-min or the
MACOSX_DEPLOYMENT_TARGET environment variable is set, each
reference to a function that doesn't exist in the minimum
targeted version will be made a weak reference, so that loading
the binary still works, but the function pointer will resolve
to NULL if running on a version of the platform that lacks it.

Since this project doesn't do such runtime checks for functions
it expects to have available, we should instead add this linker
option to fail on the weak references. This allows autoconf to
work as intended, detecting that these functions aren't usable.

This flag appeared in Xcode 8, so check for its availability
before using it. (Xcode 8 and the 10.12 SDK is coincidentally
the release where most relevant new functions appeared, so with
older Xcode versions, the modern platform functions we might want
to avoid don't exist.)

See issue #142.

Signed-off-by: Martin Storsjo <martin@martin.st>

configure: Remove a duplicate check for fmemopen

The duplicate was added in 5bb8a18b without any specific reasoning
as to why.

Signed-off-by: Martin Storsjo <martin@martin.st>

Merge branch 'tmp-tlsfuzzer-tls13-hrr' into 'master'

update tlsfuzzer with TLS 1.3 HRR test

Closes #469

See merge request gnutls/gnutls!664

tlsfuzzer: update to the latest version

Also enable test-tls13-hrr.py.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

_gnutls13_handshake_server: send CCS immediately after HRR

In the TLS 1.3 middlebox compatibility mode, CCS follows the first
handshake message sent from the server, that is either SH or HRR.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

_gnutls13_handshake_server: corrected transition when post_handshake callback is set

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_send_change_cipher_spec: don't cache under TLS 1.3

Under TLS 1.3, when the server sent HRR, CCS may be followed by
receiving ClientHello.  In that case, the messsage shouldn't be
cached.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tmp-iovec-api' into 'master'

Introduce an iovec API for encryption

Closes #458

See merge request gnutls/gnutls!653

abi-check skip session::set_transport_vec_push_function

This prevents an abi-compliance checker error when run under
gcc8 (though this error is not there under any other gcc).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

corrected check for iovec types in libc

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls-cli: benchmark for TLS1.3 and TLS1.2

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

cipher: use gnutls_aead_cipher_encryptv

This eliminates the need of a memory allocation during each
packet encryption when no padding is done.

Relates #458

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_aead_cipher_encryptv: introduced

This API allows encryption using a scatter input, by also
taking advantage of ciphers which are optimized for such input.
That is particularly useful under TLS1.3 since its encryption is
based on encryption of scattered data (data+pad).

Resolves #458

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

MAX_CIPHER_BLOCK_SIZE: increased to 64-bytes for CHACHA20

This was not necessary since that value was only used by block
(in TLS sense) ciphers, but that definition could also be used
for the CHACHA20.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

configure: reduce warnings about implicit-fallthrough [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_alert_send_appropriate: fix type

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

README-ci.freebsd.md: updated for new build method with gnulib [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'gnulib-bootstrap' into 'master'

Gnulib bootstrap, fix 'make distcheck' and more...

See merge request gnutls/gnutls!641

Use $(MAKE) instead of make

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

distclean temp. test files for 'make distcheck'

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Add DISTCLEANFILES to src/Makefile.am to fix 'make distcheck'

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix creation of ChangeLog for 'make distcheck'

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix 'compare-makefile' make target for 'make distcheck'

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix 'compare-exported' make target for 'make distcheck'

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix distcheck issues

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix gcc 8 warnings

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix CI testing -Werror

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Skip sc_prohibit_always_true_header_tests

We can't simply remove the checks for HAVE_SYS_SOCKET_H.
If we do, we have to make checks on real WIN32, which
is currently not an option.
So we skip sc_prohibit_always_true_header_tests.

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Fix sc_prohibit_always-defined_macros

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Avoid certain gnulib tests

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Update GTK-DOC check in configure.ac

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Use ./bootstrap in .gitlab-ci.yml

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Add bootstrap + bootstrap.conf

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Add gnulib submodule

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

Merge branch 'req-nettle-3_4' into 'master'

nettle: require Nettle library >= 3.4

See merge request gnutls/gnutls!662

nettle: require Nettle library >= 3.4

Nettle version 3.4 was released more than a half year ago, require it to
compile GnuTLS library. It allows us to remove bundled code that was
merged into that release.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

Merge branch 'tmp-tlsfuzzer-tls13' into 'master'

update tlsfuzzer with TLS 1.3

Closes #411

See merge request gnutls/gnutls!660

.gitlab-ci.yml: fix artifact paths for TLS1.3/interop

Signed-off-by: Daiki Ueno <dueno@redhat.com>

tlsfuzzer-tls13: use a random port for testing

That eliminates the need for locking and allows parallel runs.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: update to the latest version

Also enable the TLS 1.3 tests.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

buffers: remove redundant assignment

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: use correct alert type upon receiving empty Alert

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: improve empty message handling in TLS 1.3

Previously, _gnutls_recv_in_buffers() silently discarded empty
messages because such messages are used as a countermeasure to
vulnerabilities in the CBC mode.  In TLS 1.3, however, there are only
AEAD ciphers and such logic is meaningless.  Moreover, in the protocol
it is suggested to send "unexpected_message" alert when receiving
empty messages in certain occasions.  This change moves the empty
message handling to record_add_to_buffers().

Signed-off-by: Daiki Ueno <dueno@redhat.com>

record: fix padding removal when the payload is zero-length

Previoysly if TLSInnerPlaintext.content is zero-length, the loop
couldn't detect ContentType following the content.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Merge branch 'tmp-measure-record' into 'master'

Address issues in record layer decoding

Closes #472, #456, and #455

See merge request gnutls/gnutls!657

priorities: introduced %FORCE_ETM

This introduces a priority string option to force encrypt-then-mac
during negotiation, to prevent negotiating the legacy CBC ciphersuites.

Resolves #472

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

priorities: hmac-sha256 ciphersuites were removed from defaults

These ciphersuites are deprecated since the introduction of AEAD
ciphersuites, and are only necessary for compatibility with older
servers. Since older servers already support hmac-sha1 there is
no reason to keep these ciphersuites enabled by default, as they
increase our attack surface.

Relates #456

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

cbc_mac_verify: require minimum padding under SSL3.0

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cipher: separated CBC w/o EtM handling

This would allow to further modify for more invasive work-arounds.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

dummy_wait: always hash the same amount of blocks that would have been on minimum pad

This improves protection against lucky13-type of attacks when
encrypt-then-mac is not in use.

Resolves #456

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cbc-record-check.sh: introduced

That enhances the existing CBC check and adds sha384, uses PSK
to reduce handshake time, and other updates.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

dummy_wait: correctly account the length field in SHA384 HMAC

The existing lucky13 attack count-measures did not work correctly for
SHA384 HMAC.

The overall impact of that should not be significant as SHA384 is prioritized
lower than SHA256 or SHA1 and thus it is not typically negotiated, unless a
client prioritizes a SHA384 MAC, or a server only supports SHA384, and in both
cases the vulnerability is only present if Encrypt-then-MAC (RFC7366) is unsupported
by the peer.

Resolves #455

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Fix warnings seen on OpenCSW Solaris 10

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_session_get_data2: harmonize documentation with practice

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Merge branch 'fix-overflow' into 'master'

Fix variable overflow in TLS1.3 session ticket code

Closes #471

See merge request gnutls/gnutls!656

Fix variable overflow in TLS1.3 session ticket code

Merge branch 'tmp-session-ticket-incompatible' into 'master'

TLS 1.3 session ticket: don't send ticket when no common KE modes

See merge request gnutls/gnutls!652