ext/alpn: added stricter checks on field lengths

That is, no longer tolerate empty fields, and error on invalid
lengths.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-serv: added the --alpn and --alpn-fatal options

This allows specifying ALPN protocols supported by server, allowing
to test the ALPN negotiation.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: updated server with multiple keys (ECDSA, RSA) and DH parameters [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

OCSP: find_signercert: improved DER length calculation

Previously we were assuming a fixed amount of length bytes which
is not correct for all possible lengths. Use libtasn1 to decode
the length field.

Resolves: #223

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

OCSP: check the subject public key identifier field to figure issuer

Normally when attempting to match the 'Responder Key ID' in an OCSP response
against the issuer certificate we check (according to RFC6960) against the
hash of the SPKI field. However, in few certificates (see commit:
"added ECDSA OCSP response verification"), that may not be the case. In that
certificate, that value matches the Subject Public Key identifier field
but not the hash.

To account for these certificates, we enhance the matching to also consider
the Subject Public Key identifier field.

Relates: #223

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

OCSP: added more verbose debug logging on verification

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added ECDSA OCSP response verification

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.travis.yml: do not fail on brew install failures

brew install seems to fail on several occasions when a newer package
is available than the installed. Ignore those errors rather than
failing build.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added check on saving certs and OCSP responses

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls-cli: save OCSP response at the time certificate is saved

That ensures that we always save the OCSP response, even when certificate
verification fails.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

moved compression-related APIs to compat.h

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: removed any references to compression and documented change

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: removed tests related to zlib support

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Removed support for compression mechanisms

They are not required for TLS 1.3, and are deprecated for TLS 1.2.
We eliminate them in order to reduce the complexity in the record
packet handling.

Resolves #212

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: be less verbose in OCSP error messages

Previously we were reporting "No issuer found" if any certificate
in a chain could not be verified. That was confusing information
and not strictly necessary. No longer print that.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli: improved error message of OCSP failure

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: ocsptool: added test of --verify-response with --load-chain

This utilizes the provided chain to find the signer of the
OCSP response.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocsp: print response's signature algorithm in compact listing

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ocsptool: verify_response will print information on the response

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ocsptool: doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ocsptool: allow combining --load-trust with --verify-response

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ocsptool: --load-chain will sort the input chain

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocsptool: introduced --verify-allow-broken option

This allows verification to succeed even when broken algorithms are
involved.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocsptool: the --verify-response can be combined with --load-chain

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_certificate_verification_status_print: mention OCSP in error messages

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

ocsptool: added --load-chain option

This option allows to directly verify all the members of a certificate
chain.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enabled X25519 interop tests with openssl 1.1.0

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

NORMAL priority: no longer enable the smaller curves by default

They are not widely enabled by web servers, and they provide no
advantage over X25519.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

NORMAL priority: enable X25519 curve

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

pkcs11: cleanups in pkcs11_login()

Use pkcs11_rv_to_err() to return the right error code map after
PKCS#11 calls; separate checks for already log in status for SO and
user login.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: pkcs11-mock: reset state when requesting reauth

That is, for the MOCK_FLAG_SAFENET_ALWAYS_AUTH flag we ensure that
GetSessionInfo() will return the right state when authentication
is required for the first time.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

pkcs11: improved handling of HSMs without CKU_CONTEXT_SPECIFIC support

That is, when the HSM returns CKR_USER_NOT_LOGGED_IN, switch
to CKU_USER, instead of relying to a fallback within pkcs11_login().
That simplifies login logic.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: added unit test for safenet protectserver HSM's PKCS#11 support

That is, detect whether the absence of C_Login will fallback to CKU_USER
after CKU_CONTEXT_SPECIFIC is tried.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

pkcs11: simplified pkcs11_login()

By cleanups, as well as including the reauth flag in the flags option.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pkcs11: the GNUTLS_PKCS11_OBJ_FLAG_LOGIN will force a login

That is, even in tokens which do not have a CKF_LOGIN_REQUIRED flag
a login will be forced. This allows operation on the safenet HSMs
which do not set that flag.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Handle specially safenet HSMs which cannot handle CKU_CONTEXT_SPECIFIC

These HSMs do not support CKA_ALWAYS_AUTHENTICATE, nor understand CKU_CONTEXT_SPECIFIC,
but rather return CKR_USER_NOT_LOGGED_IN on the first private key operation.
Try to discover that state by calling C_Login when CKR_USER_NOT_LOGGED_IN
is seen, and retrying with CKU_USER after CKU_CONTEXT_SPECIFIC login fails.
See discussion in https://github.com/OpenSC/libp11/issues/160

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

Added documentation to legacy openpgp functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Removed unnecessary certificate type functionality

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

NEWS: doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: removed references to openpgp

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

po: removed openpgp/output.c

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

guile: removed openpgp related tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: removed the openpgp certificate fuzzer

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tools: removed options for openpgp support

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Removed support for openpgp certificates and keys

Resolves #178

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: removed openpgp related tests

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added reproducer for assertion trigger

This relates to handshakes with support for RSA-PSS.
Found with oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2132

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle: ported fix for assertion failure in pss_verify_mgf1

Backport the upstream fix from:
https://git.lysator.liu.se/nettle/nettle/commit/b1252fedf6ee1dbb8468d1d3f177711a16e83e52

Signed-off-by: Daiki Ueno <dueno@redhat.com>

.gitlab-ci.yml: keep logs of tests in abi build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

doc: simplified the default client example

Removed optional paths.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added reproducer for OCSP response found test cases

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

fuzz: documented location for OCSP-related reproducers

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ocsp: added sanity check in returned length

This addresses:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1492

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: added/modernized text on AEAD ciphers [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: improved duplicate extension test

Instead of sending two duplicate extensions of which one is invalid,
send two valid ones instead. That way, we avoid the possibility of false
positives due to the validation code of the extension contents.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: verify that duplicate extensions are rejected

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

TLS extensions: added duplicate extension check on server side

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_init: better naming for internal function

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added unit test for overriding TLS extensions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

TLS extensions: mark each extension which cannot be overriden

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

TLS extensions: combined the extension data and resumed data structures

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

removed type extension_priv_data_t

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_int.h: groupped extension structures together

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

TLS extensions: several simplifications

This allows extensions set by the application to override some
of the internal ones.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: FreeBSD system is no longer available; disabling for CI [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: added reference to privkey export functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added basic unit tests for the export_*_raw2() functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

corrected typo in x962 functions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pkcs11: do not set leading zeros on integers

PKCS#11 defines integers as unsigned having most significant byte
first, e.g., 32768 = 0x80 0x00. This is interpreted literraly by
some HSMs which do not accept an integer with a leading zero.

Resolves: #215

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Introduced functions to export integers with no leading zero

That is introduced the flag GNUTLS_EXPORT_FLAG_NO_LZ and:
 * gnutls_pubkey_export_rsa_raw2
 * gnutls_pubkey_export_dsa_raw2
 * gnutls_pubkey_export_ecc_raw2
 * gnutls_privkey_export_rsa_raw2
 * gnutls_privkey_export_dsa_raw2
 * gnutls_privkey_export_ecc_raw2

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle: use older GMP macros for mpz_mod_2exp and mpz_div_2exp

These ensure that compilation will succeed even when building with gmp-mini.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_ucs2_to_utf8: use void* as pointer type to avoid compiler assumptions on alignment [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

ciphersuites: removed unused function

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle/cipher: document that ctx_ptr is 16-byte aligned, and use void* to avoid compiler assumptions

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: corrected typo in strcmp() use

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_x509_privkey_reinit: ensure fields will not be re-used

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: improved error message when public key cannot be figured [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files for new signing API

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

handshake: simplify handshake by using the new signing API

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: introduced unit tests of the new signing API

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

abstract API: introduced new signing functions

That is, the gnutls_privkey_sign_data2() and gnutls_privkey_sign_hash2().
The new functions perform signing with input the signature algorithm instead
of the hash algorithm; that allows to use algorithms where the hash algorithm
is not used, or the public key algorithm may be different than the key's.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pkix: removed unused definition

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_privkey_st: removed unused element

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_session_get_desc: improved ciphersuite description

That is, separated the key exchange from the signature algorithm
used by the server, and list them in different fields.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: key-import-export: use cert-common.h

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: simplified CPPFLAGS of tests using internal gnutls funcs

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: key-exchange: added error checking in gnutls_certificate_set_x509_key_mem

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_check_key_cert_match: account for RSA and RSA-PSS mismatches

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: fix DER export with --p7-info

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

psktool: minor documentation updates

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added basic functionality check for psktool

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>