_gnutls_privkey_update_spki_params: use GNUTLS_E_CONSTRAINT_ERROR on mismatch of hash

That is a more specific error code for hash mismatch between
public key information and signature. In addition only override
the salt size, if it is set to zero without the proper flags.

That prevents the update function from setting an invalid (lower)
than the expected size.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cert-tests: use .tmp suffix for all tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: allow specifying RSA-PSS parameters for key generation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_x509_write_rsa_pss_params: refuse to write RSA-PSS parameters we cannot use

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: group together common options

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: modified to account new errors

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_*_get_signature_algorithm: simplified error handling

These functions were documented to return a negative error code
on failure, as well as GNUTLS_SIGN_UNKNOWN on unknown algorithms.
Simplify them by only returning GNUTLS_SIGN_UNKNOWN on all error
conditions.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_x509_get_signature_algorithm: return negative error code on unknown algorithm

This allows internal callers to quickly fail on errors.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

compare_sig_algorithm: modify to work even for certs with unsupported signature algorithm

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pubkey_verify_hashed_data: simplified and made static

That also removes its ability to operate with the 'unknown'
signature algorithm, and forces the TLS 1.0 key exchange to
supply the right algorithm or flags.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pubkey_verify_data: accept signature entry instead of PK and hash

That aligns better with current callers which know the signature
algorithm in use.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

NEWS: documented the SPKI handling functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added RSA and RSA PSS key unit tests

That is test:
 1. Whether RSA-PSS keys will refuse to sign with incompatible signature
 2. Whether RSA-PSS public keys cannot be used for encryption
 3. Whether RSA-PSS keys cannot be used for signing with PKCS#1 1.5
 4. Whether an RSA key can be converted to an RSA-PSS one with the public APIs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: do not print error on missing RSA-PSS parameters on key

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added convention for missing SubjectPublicKeyInfo params field

That is, when that field is missing, the spki_st structure field
pk will be set to GNUTLS_PK_UNKNOWN. In that case other fields
are undefined.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

*set_spki(): return error on incompatible algorithms

In addition update the public key algorithm field in the
respective structure.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_privkey_generate2: do not hardcode the RSA-PSS hash to SHA256

Instead use _gnutls_pk_bits_to_sha_hash() to set an appropriate hash
for the number of bits of the key. This matches better the "intention"
of RSA-PSS or tying the security parameter with the salt and hash.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_decode_pkcs8_rsa_pss_key: ensure we set the PSS PK identifier

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cleanup: removed duplicate parameter in gnutls_pubkey_st

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_privkey_int: eliminated duplicate pk_algorithm field

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cleanup: removed unnecessary/duplicate parameters in _dsa_q_to_hash

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cleanup: removed unnecessary/duplicate parameters in functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cleanup: removed unnecessary/duplicate parameters in functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

abstract.h: added functions to read and write SPKI information

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_privkey_set_spki: introduced function to update SPKI on a key

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test for the SPKI related functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509.h: Renamed SPKI related functions

This better reflects their purpose as providers of information
for subject public key. In addition use 'const' for fields that
should be left intact.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: introduced RSA-PSS key exchange with a key fixed to rsa-pss with sha256

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_pubkey_compatible_with_sig: enforce RSA-PSS requirements

That is require that parameters in an RSA-PSS key which has them
explicitly set, are respected with regards to signature algorithm
negotiation.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: eagain-common.h: remove superfluous information

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: renamed tests for uniformity

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test for RSA-PSS signing over PKCS#11

This requires a softhsm with support for RSA_PKCS_PSS mechanism.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_pubkey_verify*: use common function to set RSA-PSS parameters

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pkcs11: added support for signatures with RSA-PSS

Relates #209

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_pk_params_st: renamed sign field to spki

The name "sign" was ambiguous with regard to its intented
use, as it could refer to digital signature parameters
which was not exactly the case. That field contains parameters
present in the subject public key info (SPKI), which could
be used in a digital signature, but not necessarily.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Clarified the purpose of the spki params related functions

_gnutls_privkey_get_sign_params was renamed to _gnutls_privkey_get_spki_params,
_gnutls_privkey_update_sign_params to _gnutls_privkey_update_spki_params,
and the dig entry of gnutls_x509_spki_st was renamed to rsa_pss_dig.

The reason is that there could be a confusion on the purpose of
the 'dig' entry, as it could be assumed to be the signature's hash
algorithm in the general case. That could not be because the SPKI
parameters do not contain it for any other algorithm than RSA-PSS.
As such, make a logical separation from SPKI reading functions
with the signature reading functions and try to use the
gnutls_sign_entry_st when signature information is required.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Pass the signature algorithm lower in the verification stack

This will allow enhancing the back-ends (PKCS#11 and ext) for
signing with the new signature algorithms like RSA-PSS and Ed25519.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: introduced mem.h with common callbacks for mem access

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: added SRP server and client fuzzers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: introduced psk.h common header

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: added PSK server fuzzer

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: added PSK client fuzzer

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls-cli: introduced options to save client and server traces

This allows to easier obtain traces for use in fuzzers.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: ported libidn2's main.c taking advantage of afl-clang-fast

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_system_recv_timeout: doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tlsfuzzer: enabled EC tests for x25519

That includes tests for default curve.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tlsfuzzer: enabled test for ECDHE without the supported groups/EC extension

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Set a default supported curve

RFC4492 and draft-ietf-tls-rfc4492bis-17 mention:
"A client that proposes ECC cipher suites may choose not to include these
extensions.  In this case, the server is free to choose any one of
the elliptic curves or point formats listed in Section 5."

As such, we set a default curve to be used in the case the
server encounters a handshake with no supported groups/curves
extension.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: removed duplicate tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: fixed comment fields

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: use FFDHE3072 parameters for benchmarking

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_figure_dh_params: do not use have_ffdhe flag

This flag is intended to indicate whether the peer has advertized
at least one FFDHE group, and not whether we have negotiated FFDHE.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test for group listings in priority structure

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated cipher-listings.sh for the new groups listing

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: documented the use of RFC7919 and groups

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: enabled RFC7919 FFDHE tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enhanced server key exchange tests with explicit DH param setting

That is, not only check the DH parameter setting using the known_dh_params()
functions, but also with the explicit setting --set_server_dh_params().

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated for post-RFC7919 behavior of library

That is, it is no longer necessary to set DH parameters on a
credentials structure, and thus previously expected to fail
connections may succeed even without DH parameters.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added RFC7919 FFDHE unit tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cli,serv: do not print any information on compression

Compression is always NULL.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cli,serv: no longer print parameters when FFDHE groups are used

The negotiated RFC7919 group is now printed as part of the Description string,
and there is no reason to print more information on parameters defined by
the protocol.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: print the supported groups instead of curves

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_priority_ecc_curve_list: avoid including groups into elliptic curves list

This provides a mostly-compatible behavior of gnutls_priority_ecc_curve_list()
in order to avoid keeping additional information for elliptic curves in the
priority cache. This approach will always return the supported curves, if the set
groups are prioritized with the elliptic curve variants set first. This
is the default in the built-in priorities, and to most common setups.

Items which are non-valid curves will not be returned.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: moved group negotiation after ciphersuite selection

This allows to cope with situations where the peer prioritizes a
supported group which doesn't map to a supported ciphersuite.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

security_parameters: ease access to group information by keeping pointer to it

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

security_parameters: simplified contents by keeping pointer to cipher_suite_entry_st

That, in addition to simplifying the contents, it allows faster access
to ciphersuite's properties.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

TLS: introduced support for RFC7919 groups

That replaces the EC curve extension negotiation with
the negotiated groups extensions, introduces handling
for groups as priority strings, as well as using and
checking of RFC7919 DH parameters once negotiated.

Resolves: #37

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: use gnutls_priority_set

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: modified gnutls_priority_set2() tests for gnutls_priority_set()

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_priority_set: use reference counting

That eliminates the need for gnutls_priority_set2() which is now
removed.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Introduced atomic.h to simplify handling of atomic integers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Revert "Documented use gnutls_priority_set2()."

This reverts commit b4aed16ee30f76211c13b075149bb87c012f9bf6.

tlsfuzzer: enabled test-ecdsa-sig-flexibility.py

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

algorithms/mac: marked RIPEMD160 as insecure for certificates

This is an algorithm which is not really used in Internet PKI
and due to that has seen no public cryptanalysis. As such
we disable it for certificate verification to prevent it from
being used as an attack vector.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: partially reverted SHA1 broken tests

SHA1 is now considered broken only for certificates, hence
OCSP or raw signing tests no longer need to use GNUTLS_VERIFY_ALLOW_BROKEN
in the cases where certificate verification is not performed.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/verify: reject SHA1 in signature algorithms for certificate verification

That is, we now use gnutls_sign_is_secure2() with GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS
flag for checking the validity of the signature algorithm, when
verifying signatures in certificates.

Resolves #229

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit tests for gnutls_sign_is_secure2()

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_sign_is_secure2: introduced

This function exports the ability to check the validity of
a signature algorithm for signing certificates.

That also introduces the flag GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS
which when specified will cause the function to return whether
the algorithm is secure for signing certificates.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_digest_is_secure_for_certs: introduced

This is a macro to allow checking the security of a hash algorithm
with respect to signing certificates.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

mac: re-organized the hash algorithms table

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added reproducer with ed25519 private key

Found with oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2689

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Ensure that public key parameters are initialized on import

Previously we depended on initialization during the _init()
call, however, there can be cases where this re-initialization
is needed (e.g., on multiple tries to load a key).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_decode_pkcs8_eddsa_key: ensure that the key size read matches the curve size

That is, in the newly introduced ed25519 keys we didn't check
whether the input size in the PKCS#8 file matched the curve
size.

Found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2689

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: enabled SNI and other tests from master

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated to reflect the fact that invalid dns names are rejected

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

server_name: several simplifications of the code base

The existing code was written with the intention of supporting multiple
server names, however that was never happened, and this extension is
currently only used for DNS server names. Remove unneeded extensibility.

In addition, removed conversion of client provided server name (DNS) to
IDNA. Clients not providing valid names are violating the spec and
that conversion step not only wastes resources, but increases
the attack surface of a server.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

server_name: be strict in decoding errors

That is, return error when a malformed extension is seen.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: enabled RSA-PSS checks on certificate verify

Relates: #208

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tlsfuzzer: enabled test-extended-master-secret-extension.py

That allows testing the extended master secret behavior.

Resolves: #231

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ext_master_secret: return proper error code on decoding error

Proper meaning that it maps to the alert 'decode error' rather
than illegal parameter. According to tlsfuzzer the former is more
suitable.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: re-use priorities for both client and server on benchmarks

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: re-use priorities when measuring performance

This avoids measuring cache misses due to priority processing time.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: enhanced SSL3.0 openssl detection in testcompat-openssl

That disables SSL 3.0 testing in openssl versions which cannot negotiated
it (see https://bugzilla.redhat.com/show_bug.cgi?id=1471783 for rationale)
and corrects a typo in the variable name and printed message.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: document that the x86 build is our openssl 1.0.x compat testing as well

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>