tlsfuzzer: enabled test-extended-master-secret-extension.py

That allows testing the extended master secret behavior.

Resolves: #231

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ext_master_secret: return proper error code on decoding error

Proper meaning that it maps to the alert 'decode error' rather
than illegal parameter. According to tlsfuzzer the former is more
suitable.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: re-use priorities for both client and server on benchmarks

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: re-use priorities when measuring performance

This avoids measuring cache misses due to priority processing time.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: enhanced SSL3.0 openssl detection in testcompat-openssl

That disables SSL 3.0 testing in openssl versions which cannot negotiated
it (see https://bugzilla.redhat.com/show_bug.cgi?id=1471783 for rationale)
and corrects a typo in the variable name and printed message.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: document that the x86 build is our openssl 1.0.x compat testing as well

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: disable ARCFOUR interop tests if openssl doesn't support the cipher

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: testcompat-openssl: 3DES is explicitly enabled for SSL 3.0

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Use gcc's attribute to mark fallthrough statements

gcc7 is more verbose on fallthrough warnings, and this patch set
cleans up the current state by making use of the attribute when
necessary.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

configure: do not utilize the -Wno-format-truncation gcc warning

The warnings it produces have little value in our use of string functions.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.gitlab-ci.yml: switched to fedora 26 for CI builds

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: introduced tests on public key import-export

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added sign/verification test using rfc8080 keys

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify that a server with an ed25519 key will fail when client does not advertise it

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: privkey-keygen: added unit test for Ed25519 keys

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

privkey_sign_and_hash_data: in pre-hashed schemes, allow empty hash algorithm

In these schemes the hash algorithm is fixed in the signature algorithm
and thus the empty (unknown) value will act as a wildcard.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added private key parameter verification in key-import-export checks

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

nettle: wrap_nettle_pk_verify_priv_params: verify whether public key matches private

This enables gnutls_privkey_verify_params() for Ed25519 keys.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

CONTRIBUTING.md: specified rules on boolean functions

Based on suggestion by Hubert Kario.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

priority: enabled Ed25519 signature by default

As our implementation interoperates with boringssl's implementation
of Ed25519, we can now enable it.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: return better error code on unwanted algorithm

That is, when a signature algorithm is available which was not
asked by the peer, then return GNUTLS_E_UNWANTED_ALGORITHM
instead of the UNKNOWN_ALGORITHM.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added check on Ed25519 chain verification

This chain was generated using certtool, and passed verification
with OpenSSL's implementation (commit: db0f35dda18403accabe98e7780f3dfc516f49de)

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: added RSA-PSS signatures in benchmark

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

privkey_sign_and_hash_data: added sanity check on param validity

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: added benchmark on X25519-Ed25519 key exchange

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: pkcs7: added ed25519 basic signing and verification checks

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

privkey_sign_and_hash_data: handle prehashed signatures

This allows this function to handle ed25519, i.e., allows it
to operate for PKCS#7 signatures.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pkcs7: improved syntax in if-clause

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enhanced OID tests for Ed25519 OIDs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: key-import-export: added Ed25519 key import/export checks

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: replaced rsa-pss/eddsa certtool options with --key-type

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: introduced the --key-type option

This replaces the --rsa-pss and --eddsa options.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Renamed GNUTLS_PK_ECDHX to GNUTLS_PK_ECDH_X25519

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: parse and interpret an EdDSA public key

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added TLS handshake test with EdDSA25519 certificates

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Allowed Ed25519 signing in TLS handshakes

This follows draft-ietf-tls-rfc4492bis-17

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added tests on EdDSA signature validation using the sign/verify_data APIs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: Added unit test on EdDSA key parsing

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added Ed25519 key and certificate generation tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added support for EdDSA (Ed25519) curve keys

This adds support for draft-ietf-curdle-pkix-04.

Resolves #25

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

parse_pem_cert_mem: fixed issue resulting to accessing past the input data

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

supported_exts.h: make sure that the generated function is static

That avoids compiler warnings due to missing prototype.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tlsfuzzer: enabled chacha20 tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated tlsfuzzer

That fixes issue detecting connection termination from gnutls-serv
in chacha20 test.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: csr-invalid.der: modify the SPKI OID to use SECP384R1

That avoids false positives in error detection in 'crq' test due to
SECP224R1 not being supported in our CI platforms.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/output: do not attempt to print the key ID on unknown SPKI algorithms

On unknown algorithms, it is not always possible to parse the SPKI
field. Instead avoid printing errors.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: corrected location of artifacts in aarch64 build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: certtool-rsa-pss: use unique temp files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_buffer_append_data_prefix: cleanup

This eliminates a misleading code that assumed that the called functions
will return the appended size. Always return zero on success which is
what the existing callers assume.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: removed unnecessary options from minimal build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pubkey: print the failed signature algorithm when verification fails

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: added option to allow verification with broken algorithms

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tls sessions will not fail of insecure algorithms which are explicitly enabled

That is, if DSA-SHA1 is allowed, do not propagate errors from
gnutls_pubkey_verify_data2() due to SHA1 considered insecure, but rather
ignore such errors.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: mini-record-2: made more robust

It will no longer close the session prior to peer processing
all messages. This prevents the peer stopping processing
prior to all messages being received.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: mini-record: made more robust

It will no longer use a stream socket as this can does not work
well with damaged records (they may end up merged).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

record: reject 0-byte long ciphertext

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

record: added sanity checking in the record layer version copy

Previously we assumed that an active session had always a version
set, however there have been reports of evolution crashing in
that particular point. Although, this could have been due to
memory corruption, be careful and check for invalid input.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

record: more precise calculation of max recv size

Previously we were using a rough calculation of the max recv size
based on maximum values. Now we calculate the exact maximum value once
the epoch is initialized and enforce it throughout the session.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

decryption: use the same error code on all cases

This eases testing using tlsfuzzer.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-serv: allow receiving requests up to 16kb

This makes gnutls-serv useful for few tlsfuzzer test cases.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

max_record_recv_size: removed call to gnutls_compression_get()

We no longer support compression.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Print the requested CA names when in debug mode

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-http-serv: do not set the obsolete PGP options

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: updated documentation on client authentication [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: explicitly state intended usage of priorities on server-side

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: use the default priorities in server example

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit tests for gnutls_priority_set*()

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Documented use gnutls_priority_set2().

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

priorities: share priority structures across sessions

As the contents of the priority cache grows, it makes sense to shared
these structures across many sessions (in server side) rather than
copying them to a session. All overrides of the priority contents
were moved to session->internals. On client side where gnutls_priority_set_direct()
is more commonly used, ensure that the set priority is deinitialized.

That also introduces gnutls_priority_set2() which does not copy the priority
contents by default.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

set_client_ciphersuite: use the new internal APIs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitignore: ignore new tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: added unit testing for server/client cipher negotiation

This verifies that the expected algorithm (cipher) is negotiated.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: added unit testing for server ciphersuite/KX negotiation

This verifies whether the ciphersuite negotiation will detect and
reject incompatible data present in credentials.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc: corrected typo

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Renamed fields of sign_algorithm_st

The new names better reflect the reality with signature algorithms
in TLS 1.3, and correct the initial naming error.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: simplified signature algorithm list generation

Similarly to ciphersuites, that also utilizes a cache of signature algorithms
on the priority structure which is used to quickly generate the signature
algorithm list.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Eliminated access to obsolete priority cache fields

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: simplified the client-side ciphersuite negotiation

This takes advantage of the ciphersuite cache in priorities structure
while keeping the same ciphersuite selection checks in place.

The previous ciphersuite selection checks kept:
 * Removing SRP ciphersuites when no SRP credentials are set
 * Removing ciphersuites when no corresponding to KX credentials were set
 * SCSV addition in SSL 3.0 and fallback SCSV

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: simplified the server-side ciphersuite negotiation

This eliminates all the back and forth loops in the previous code
while keeping the same ciphersuite selection checks in place.

The ciphersuite selection tests that were kept:
 * Check if key exchange supports the server public key and key usage flags
 * Check if DH or other parameters required for the ciphersuite are present
 * Find appropriate certificate for the credentials and ciphersuite
 * Check whether a curve is negotiated for the ECDH ciphersuites

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

priority: include a cache of supported ciphersuites

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

removed unused cipher-suite and KX related functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

algorithm/kx: sorted key exchange algorithms based on current trends

That optimizes linear search for the common options.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Removed unused functions

These were identified using callcatcher.
  http://www.skynet.ie/~caolan/Packages/callcatcher.html

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: added make update command [ci skip]

This allows updating the fuzzer corpus from openssl using a single
command.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: added corpora from openssl [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: undid changes related to boringssl server/client corpus format [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: included verbatim corpus from boringssl

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: gnutls-client-fuzzer: read directly from memory [ci skip]

Also updated to read the prefixed boringssl corpus files.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

fuzz: gnutls-server-fuzzer: read directly from memory [ci skip]

Also updated to read the prefixed boring ssl corpus files.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

priority_options.gperf: modified for gperf 3.1

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tlsfuzzer: enabled ALPN tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated tlsfuzzer

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ext/alpn: added stricter checks on field lengths

That is, no longer tolerate empty fields, and error on invalid
lengths.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-serv: added the --alpn and --alpn-fatal options

This allows specifying ALPN protocols supported by server, allowing
to test the ALPN negotiation.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>