constate: added _gnutls_epoch_dup

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

constate: indentation fixes

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: added basic support for TLS 1.3 handshake in client side

That does not include support for client certificates as it
requires extension handling improvements in order for extensions
to be context sensitive (now they cannot distinguish whether the
parsing routine is called during client hello or certificate request
reading)

This does not include proper parsing of extensions present in
the certificate message.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: added parsing of encrypted extensions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

crypto-api: introduce internal version of AEAD API

This allows to initialize the TLS 1.3 connection state without
additional allocations as required by the external API.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

record: added TLS 1.3 record parsing and key derivation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: introduced TLS 1.3 handshake client state machine outline

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: separate the hello extensions from others

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

hello_ext.h: removed non-existant function definition

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: files renamed to hello_ext

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: renamed hello extension handling functions appropriately

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: simplified semantics of store and check functions

That is, _gnutls_extension_list_check was made a boolean function,
and both were renamed to more appropriate names such as,
_gnutls_hello_ext_is_present, _gnutls_hello_ext_save.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extension: renamed functions to reflect purpose

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: use the low-level extension parsing code for hello parsing

That's a step towards unification of TLS-type extension handling
for TLS 1.3.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extv: introduced a low-level extension parsing code

This will simplify the parsing and handling of extensions throughout
the TLS 1.3 message contents.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: simplified the extension tracking

Instead of keep a list of the received TLS extension IDs, use the bits
in a variable to mark the received extensions. That reduces the
overall memory usage due to extension tracking.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: use an internal extension ID independent of the TLS id

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

str: rename _gnutls_buffer_pop_prefix to _gnutls_buffer_pop_prefix32

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

str: rename _gnutls_buffer_pop_datum_prefix to _gnutls_buffer_pop_datum_prefix32

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

security params: store PRF when packing session

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: simplify by storing a pointer to PRF mac entry

That way, we avoid multiple function calls to obtain information
such as hash size, and other MAC properties.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ext/signature: improved TLS 1.3 signature algorithm negotiation

That is, we introduce a simpler way to handle multiple versions
of a single signature algorithm.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

str: added helper functions to read prefixed data with 8 or 16-bit headers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ecc: do not warn on receiving extension on client side

This extension can be received used under TLS 1.3 on the client side.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added TLS 1.3 HKDF key derivation functionality

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: include extension number in debugging message

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: check behavior on the extension hello flags

That is, verify whether the various combinations of
GNUTLS_EXT_FLAG_CLIENT_HELLO,
GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO,
GNUTLS_EXT_FLAG_TLS13_SERVER_HELLO
work as expected with regards to sending and receiving
extensions.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: apply extension msg type restrictions

That is, on the extension parsing functions ensure that
no extension which are not valid for the currently
received message are parsed.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

extensions: mark the message validity of each supported extension

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

extensions: type renamed to id for clarity

We were previously using the variable named 'type' to indicate the
extension ID. With TLS 1.3, extensions are also given an applicability
type (which message the extension applies to), and thus renamed the
variable for clarity.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: guile: don't use VERS-TLS-ALL

That is, avoid enabling experimental protocols.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: abi-coverage: include guile logs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle: added HKDF functions

They are being included conditionally depending on the RSA-PSS feature
(RSA-PSS and HKDF are expected to be introduced at the same version).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: use explicit TLS versions rather than TLS-ALL

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_server_select_suite: don't set auth callbacks for TLS 1.3

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

supported_versions: print negotiated protocol

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Negotiate draft-TLS1.3

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: added the TLS 1.3 ciphersuites

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: print negotiated version after its negotiation (for TLS1.3)

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: fix TLS version to 1.2 for tests which used VERS-TLS-ALL

This allows the test suite to run, even when TLS1.3 is still
experimental.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Added support for key share extension

This enables TLS 1.3 key exchange based on the key share extension.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: always accept TLS 1.2 in client hello if we have later protocols enabled

That is because after TLS 1.3 there is no negotiation of the version using
the Client Hello field, but with an extension.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

require nettle 3.3 or later

This will simplify handling of the x25519 key exchange.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

str: added function to append fixed-size MPI

This is used in TLS 1.3 which introduces a new MPI over-the-wire
format.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: resumption tests were restricted to TLS 1.2

TLS 1.3 implements resumption is a different way, so we should
introduce new resumption tests once that support is in place.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ext/post_handshake: restrict the use of this extension to TLS 1.3 or later

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: optimizations and enhancements in session version handling

This introduces the following new functions:
const version_entry_st *_gnutls_legacy_version_max(gnutls_session_t session);
const version_entry_st *_gnutls_version_max(gnutls_session_t session);

which replace their previous counterparts.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: check for post-handshake extension in TLS 1.2-only sessions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit tests for post-handshake-auth extension

These test whether this extension is seen under TLS 1.3 in client
hello, and whether it is not present in server hello.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: send client and server hellos according to TLS 1.3

That is, when TLS 1.3 is negotiated the compression algorithms and
session ID fields are no longer sent.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added support for post handshake auth extension

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated for new behavior of disabling protocols on missing signature algorithms

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify that no signature algorithms with (D)TLS 1.2 will cause an error

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

priorities: when no signature algorithms eliminate (D)TLS 1.2 or later

If an application intentionally disables all signature algorithms, ensure
that we can operate by eliminating protocol options which require these
signature algorithms to be set.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: safer use of gnutls_bye in _test_cli_serv()

In addition make sure we check gnutls_priority_set() for errors.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added checks for special signature algorithms

This tests the behavior when signature algorithms only available
under TLS1.3 are present in a TLS 1.2 session.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify that +SIGN-ECDSA-SECP256R1-SHA256 has no effect when combined with TLS1.2

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added signature tests for ECDSA-SECP256R1-SHA256

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

priority: do not include signature algorithms that apply to different TLS version

That is, when a signature algorithm that is only applicable
to specific TLS protocol semantics (e.g., ECDSA-SECP256R1-SHA256)
is enabled, under TLS 1.2, it will result to no code points being
added. That prevents connection errors due to "wrong" code
points being added that do not correspond to a usable signature
algorithm under the protocol.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated for the new behavior of handshake

Previously at handshake we would negotiate a ciphersuite and certificate
and later figure out a signature algorithm. Now we negotiate all at once,
so we no longer reach situations where mid-way of handshake we figure we
have no signature algorithm to use. Update the test cases relying on that
behavior to account the new one.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pubkey: enforce TLS 1.3 signature restrictions on verification

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ext/signature: added TLS 1.3 signature algorithm negotiation

That patch adds the signature algorithms:
 - GNUTLS_SIGN_ECDSA_SECP256R1_SHA256
 - GNUTLS_SIGN_ECDSA_SECP384R1_SHA384
 - GNUTLS_SIGN_ECDSA_SECP521R1_SHA512

and enables them for the default TLS priority strings.
In addition it allows negotiating signature algorithms sharing
the same TLS IDs, but which have different semantics between TLS
versions (e.g., 6,4 maps to GNUTLS_SIGN_ECDSA_SHA512 under TLS 1.2
but to GNUTLS_SIGN_ECDSA_SECP521R1_SHA512 under TLS 1.3).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test for TLS 1.3 version negotiation

This checks whether the Client Hello and Server Hello packets
contain the expected values.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: added support for negotiating version using extension

That is, introduced the TLS 1.3 supported_versions extension. It is currently
only being used if negotiating TLS 1.3 or later.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: legacy version negotiation is not used for TLS 1.3

That is, ensure that the functions used for TLS 1.2 and earlier
negotiation cannot be used with TLS 1.3. That is because TLS 1.3
is negotiated using a TLS extension.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added TLS 1.3 Hello message random generation

That is, added check for TLS 1.3 random value requirements in client side,
and generation according to TLS 1.3 requirements for server and
client side.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Revert "priority: disable the enabled by default RSA-PSS signature algorithms"

This reverts commit ef44477127952c13e93d7ea88f7b549bf36602f5.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: check gnutls_fips140_set_mode operation per thread

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test of gnutls_fips140_set_mode

Also ensure that 512-bit keys cannot be generated
in FIPS140-2 mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: gnutls_hmac_fast: explicitly enable MD5 use under FIPS140-2 mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: gc.c -> gnutls_hmac_fast.c

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: documented gnutls_fips140_set_mode and gnutls_fips_mode_t

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fips140: added function for applications to switch the FIPS140-2 mode

That would allow FIPS140-2 compliant applications to use forbidden
algorithms by switching to a lax FIPS140-2 mode.

Resolves #352
Resolves #353

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fips140: enforcement of allowed ciphers moved to crypto-api.c and cipher_int.c

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fips140: enforcement of hash and MACs use moved to crypto-api.c and hash_int.c

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: srp: increased timeout to 40secs [ci skip]

Since we increased the maximum parameters to 8k, ensure
that slower systems have enough time to complete the handshake.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: updates NEWS entry for 3.6.2 adding ABI changes [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

latex: introduced functionWarning macro

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

bumped version

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: check whether gnutls_credentials_set() can be set in an hsk hook

This is useful when these are set during the handshake process
on the handshake hook before client hello is parsed.

Relates #382

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: documented how to set the credentials late in certain vhost scenarios

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: updated text on gnutls_handshake_set_hook_function

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

priority: disable the enabled by default RSA-PSS signature algorithms

They have been modified in the latest (yet unsupported) TLS 1.3
drafts, so prevent causes interoperability failures by keeping them
on.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: cipher-openssl-compat: extend to include CCM tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Improve documentation of gnutls_x509_trust_list_iter_get_ca [ci skip]

The documentation is confusing because it implies that
gnutls_x509_trust_list_iter_deinit() should be called after using this
function, but in fact it is generally not necessary.

Also, there was a typo here ("usin").

Signed-off-by: Michael Catanzaro <mcatanzaro@igalia.com>

.gitlab-ci.yml: run the fuzz testsuite under various CPU capabilities

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

accelerated: make explicit key size check to all accelerated ciphers

That is, do not rely on checks done on asm level, as they vary and
may change over updates. Also handle consistently invalid key sizes
by returning an error, and eliminate calls to abort().

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

accelerated: check keysize in SSSE3 cipher setkey

aes_ssse3_cipher_setkey() accepted any key size,
which could lead to invalid memory access.

Such as with the oss-fuzz corpora file
fuzz/gnutls_pkcs8_key_parser_fuzzer.in/da59d34eacdf50a0019a457fb7c4916be48c99a5

Signed-off-by: Vitezslav Cizek <vcizek@suse.com>

p11tool: updated documentation [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle: use the nettle_get_secp API when available

Resolves #380

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle base64_encode_raw: use cast to avoid warnings

Nettle switched prototypes for base64_encode_raw() as follows:
-base64_encode_raw(uint8_t *dst, size_t length, const uint8_t *src);
+base64_encode_raw(char *dst, size_t length, const uint8_t *src);

That means we need to cast fist param to void if we want to avoid
warnings on different platforms.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

accelerated: x86-common: do not use _xgetbv() with clang

Resolves #372

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

configure: treat solaris as ELF system

Resolves #376

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: repeat cipher test with multiple keys and nonces

In addition include chacha20-poly1305 into the tests.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

accelerated: aarch64: fix GCM counter increment

Ensure that we restrict the GCM counter to the 4 bytes assigned to it.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

accelerated: fix use of SSSE3 vpaes_encrypt

Previously we assumed that the nettle GCM internal functions
will use the provided ECB function for single block encryption.
Newer versions no longer operate that way. Ensure that we
are compatible with them.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

accelerated: fix use of aesni_ecb_encrypt()

Previously we assumed that the nettle GCM internal functions
will use the provided ECB function for single block encryption.
Newer versions no longer operate that way. Ensure that we
are compatible with them.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>