tests: windows: warning: function declaration isn't a prototype

Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>

tests: warning: implicit declaration of function

Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>

m4: updated ax_code_coverage.m4 [ci skip]

This version fixes a bug which prevented including the branch coverage
into output.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzzer: Enhance code coverage of gnutls_base64_encoder_fuzzer

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Add script 'view-coverage'

This helper script is for viewing the code coverage of
single (or combined) fuzzers running with all his corpora.

It helps optimizing the code coverage by hand-crafting corpora
and/or dictionaries.

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Change CFLAGS -O0 to -O1 in fuzz/README.md

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Update corpora from oss-fuzz

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

tlslite: updated to latest version

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: do not ask about RSA encryption in non-RSA keys

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: work-around libtool file name

fuzzers utilize argv[0] to discover the name the reproducers are stored
in. However libtool creates a script which later runs the executable.
Try to detect that situation and use the right paths.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

dh params: document DH param setting functions as deprecated

They are no longer useful after the RFC7919 DH parameter negotiation.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: introduced unit test of gnutls_memset()

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: removed -static ldflag completely

It is not necessary for building the fuzzer, and was causing
issues in MacOSX systems.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.gitlab-ci.yml: use the same flags in the tags and non-tags windows builds

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: p11-kit-trust is not compiled in windows

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: temporarily disable -static build of fuzz/ in MacOSX

This allows running the MacOSX CI tests on travis.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: verify the output size of gnutls_x509_privkey_export

That is, make sure that gnutls_x509_privkey_export() and
gnutls_x509_privkey_export2() agrees with the strlen()
value on the data.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.travis.yml: print failed log files in fuzz after failure

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

hooks.m4: reduce the gap between minor soversion of 3.5.x and 3.6.0

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: make mini-record more friendly for OSes with limited buffers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

pull/push backends: ECONNRESET is translated to GNUTLS_E_PREMATURE_TERMINATION

This returns a more reasonable error code on platforms where
this errno is set.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: gnutls_x509_privkey_import: address issue on error path

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

sed: use it in a portable way in makefiles

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

configure: disable hardware acceleration on aarch64/ilp32 mode

Our included assembly code for aarch64 is not suitable for that
data mode.

Resolves #252

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

create_tls_random: avoid warning in fuzzying mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

configure.ac: removed conditional FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

Instead rely only on the definition, to make fuzzying mode to be
enabled even if --enable-fuzzer-target is not specified, but defined
b the compiler.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

rnd-fuzzer: use ifdef instead of conditional compilation

This allows compiling in fuzzying mode even when --enable-fuzzer-target
is not specified on configure, but the definition is present.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzzer: Update base64 fuzzers + corpora

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Fix include path in run-clang.sh [skip ci]

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

gnutls_x509_privkey_export: use _gnutls_copy_string on PEM data

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Corrected argument names of functions to correspond to declaration

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

lib: use casts and be explicit on intentional enumeration use

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: do not run non-FIPS cipher tests when in FIPS mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added basic test for the operation of gnutls-cli-debug

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify the presence of GNUTLS_SFLAGS_RFC7919 flag in server and client mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: check whether RFC7919 is supported

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_session_get_flags: introduced GNUTLS_SFLAGS_RFC7919

This allows checking whether the DHE parameters used were negotiated
using RFC7919.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_auth_*: check cs parameter for validity prior to use

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: simplified certificate PEM printing

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: fixed bounds check on benchmark-tls

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

lib: removed legacy debugging code

That code was code from the initial versions of gnutls. It was neither
used nor updated for long time.

Relates #248

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: added missing files into dist [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added missing files in dist [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: do not suppress stderr errors on servers startup

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

abi-check: added check for 3.6.0 ABI compatibility

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_x509_crl_get_issuer_dn: removed unnecessary const

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

certtool: fixed documentation of sign-params

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

README.md: mention lockfile-progs dependency

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: tls-neg-ext4-key: explicitly restrict to TLS 1.2, 1.1 and 1.0

This allows testing all signature types used in the protocol.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

sign APIs: introduce RSA-RAW signing algorithm

This ensures that there is a signing algorithm for all the operations
we support. Previously, we required GNUTLS_SIGN_UNKNOWN to be acceptable
by signing functions to accomodate for raw RSA operations. Now we make
that explicit and in the process clean-up the API.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

removed devel/fuzz; functionality moved to fuzz/ [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzzer: Add 'make -C fuzz coverage' [ci skip]

This reports how much code is covered by fuzzing.

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

_gnutls_recv_server_certificate_status: use the same type in subtracted values

This ensures that there are no issues with subtracting those values.
Note that the second is read from an uint24_t and thus it is always
positive regardless its type.

Resolves #245

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_proc_srp_client_kx: use same type in subtracted values

This ensures that there are no issues with subtracting those values.
Note that the second is read from an uint16_t and thus it is always
positive regardless its type.

Resolves #244

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzzer: Move regression corpora from tests/ to fuzz/

See fuzz/README.md for the corresponding paths.

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Suppress leak in libgmp <= 6.1.2

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Suppress unsigned integer overflow in rnd-fuzzer.c

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: Initial check in for improved fuzzing

Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>

fuzzer: added a fuzzer target

This allows to compile the library with flags which will add predictable
random generation and eliminate some crypto checks, in order for the
library to be used for testing (fuzzying).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_privkey_export: made a wrapper over gnutls_x509_privkey_export2()

In addition, improved function description.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-http-serv: use RSA-PSS key

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: use certtool to check RSA-PSS to RSA conversion

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: introduced --to-rsa option

This allows converting an RSA-PSS key to raw RSA.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit tests for gnutls_privkey_import_ext4

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_privkey_import_ext4: introduced to allow signing with RSA-PSS or Ed25519 keys

That function allows a signing callback which passes the signature
algorithm, providing all the information to callback for signing.
It also introduces GNUTLS_PRIVKEY_INFO_HAVE_SIGN_ALGO flag which
allows the library to query the private key of the supported
signature algorithms.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

reduce common asserts to assist in debugging the library

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: algorithms.texi: include list of groups but skip compression methods

Compression methods are no longer relevant or supported, and groups
replace the elliptic curves.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: improved elliptic curve and group documentation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: mention the AES-DRBG random generator [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: improved detection of 64-bit systems

We now use the ${ac_cv_sizeof_unsigned_long_int} variable which
gives the numbers used in the host system, not the build one.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated for new x86 host

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: replaced the f23 x86 build with a f26 x86 build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: explicitly initialize and deinitialize the library [ci skip]

This enables the fuzzers to run even when statically linked.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: eliminated unnecessary function wrappers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_int.h: reduce memory occupied by ext_data

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_int.h: reduced the maximum number of epoch states we keep

There was no need to keep 16 epochs, as we typically we have only
one or two active.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_int.h: removed unused variable from state

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extensions: simplified requirements from send callback

The callback no longer needs to return the number of sent data;
they are now calculated by the caller.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ext/ecc: renamed Supported curves extension

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-serv: --require-client-cert no longer implies --verify-client-cert

That is, it is now possible to require a client certificate without
verifying it.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

CONTRIBUTING.md: corrected typo [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

CONTRIBUTING.md: added section on symbol versioning

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

libgnutls.map: separated symbols introduced in 3.6.0

This separation assists tools like rpm which can detect
the right version of the library to use, by using the
symbol version.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added reproducer for private key import leak

Issue found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=561

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

rnd: use time_t for prng_reseed_time

This ensures that all time comparisons are done
under the same type.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_privkey_import_pkcs8: fixed memory leak on incorrect key import

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added reproducer for memory leak in SRP server

Issue found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2859

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_srp_verifier: corrected memory leak

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added reproducer for memory leak in RSA-PSK

Issue found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2863

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

rsa-psk: corrected memory leak on invalid decrypt

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>