Added _gnutls_idna_email_reverse_map

This allows printing the reverse map of an IDNA-encoded email.
Modified x509/output to include this decoding for RFC822Name.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/output: Cleanup in IDNA name printing

That also removes the incorrect mapping to IDNA punycode when the
input is not printable.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added test for interactive creation of a request

Relates #179

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: removed limits in interactive input

That removes the limits when reading most of the interactive input.
The read_str() function due to its dependence on static variable remains
with a limit, but will output an error if the input string exceeds size.

Resolves #179

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: increased buffer for reading from user

This allows reading longer than 128-byte fields interactively.
The new limit is 512-bytes.

Relates #179

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added certificate generation with very long DNS and CN name

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_crt_get_extension_info: fixed function to comply with documented approach

That is, do not include the trailing NULL byte size in the
size of the object identifier.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: store critical extensions even if no other extension are present

That is, fix a bug which prevented critical extensions to be stored
if no other free-form extensions were specified.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/name_constraints: documented return values and corrected return type

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_ocsp_resp_verify_direct, gnutls_ocsp_resp_verify: defined flags argument

That was defined to be gnutls_certificate_verify_flags, and
it allows passing verification flags, such as flags to allow
broken algorithms.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

is_level_acceptable: no longer checks for broken algorithms

This is done at is_broken_allowed(), and in fact checking them in
is_level_acceptable() creates a conflict when overrides like flag
GNUTLS_VERIFY_ALLOW_BROKEN is used.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_store_commitment: introduced flag GNUTLS_SCOMMIT_FLAG_ALLOW_BROKEN

This flag allows operation of the function even with broken algorithms.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

verify: is_broken_allowed: account for "new" flag GNUTLS_VERIFY_ALLOW_BROKEN

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

devel/fuzz: added necessary casts for compilation [ci skip]

Also added the IDNA targets to makefile's default target.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

devel/fuzz: include string.h for strlen() [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

devel/fuzz: IDNA fuzzers: removed printf [ci skip]

see request in:
  https://github.com/google/oss-fuzz/issues/417

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: added test case with invalid openpgp cert

This triggers an invalid memory access:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

opencdk: read_attribute: account buffer size

That ensures that there is no read past the end of buffer.

Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391

Relates: #159

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls-cli-debug: fixed protocol to port discovery

That is, if --starttls-proto is provided the default port
selected will be converted to host byte order as expected.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pk.c: fixed memory leak on DSS signature decoding

Detected using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=676

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added client reproducer for memory leak

That reproduces a memory leak detected in the client code path.
Detected using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=676

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: update to take into account the removal of random art

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/output: No longer include public key's random art

That is in order to reduce bloat in the output, which already
contains many identifiers for public key.

See mailing list discussion at:
https://lists.gnupg.org/pipermail/gnutls-devel/2017-February/008324.html
https://lists.gnupg.org/pipermail/gnutls-devel/2017-February/008329.html

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated to include the pin-sha256 in output

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: updated to take into account the pin-sha256 oneline output

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/output: print key PIN on oneline output

That is, instead of the public key ID. The key PIN due to HPKP
is now more widely used than hex-based key IDs.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/output: print the public key PIN of a certificate

That is, print the value used by the HPKP protocol as per
RFC7469.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

certtool: don't warn when 'uri' is specified on template

Reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=1425884

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: ubsan build: fixed artifacts path

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: split starttls.sh into multiple scripts

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

tests: pkcs11-import-with-pin: removed invalid conditional macro

tests: added PKCS#11 test for pin input

This introduces a test on PIN input to retrieve an object using
pin-value and pin-source (file).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

SECURITY.md: updated after comments from Daniel Berrange [ci skip]

Removed unnecessary entries in pkix.asn and gnutls.asn

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle/pk: corrected memcpy of Q in DSA params

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

crypto.h: improved documentation of randomness levels

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

nettle/pk: use the appropriate level of randomness for each operation

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

srp: use nonce level for SRP password randomization

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: document the use of assert()

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc: removed protocol/ directory

While it was used during the first years of development, today
it is way more easy to access protocol documents via the IETF
web site.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added SECURITY.md, a description of the security issue handling process

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: require clang analyzer build to be warning free

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

configure: no longer use -Wframe-larger-than

We do not require a specific stack size, and there is legacy
code which utilizes large stack sizes. As such remove the
warnings to allow for a warning free compilation.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

pkcs11: avoid calling memcpy will null options

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

preinitialize variables to work-around warnings with clang

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

eliminated dead code as indicated by clang scan-build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

pkcs7: corrected error checking in write_signer_id

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

preinitialize variables to work-around warnings with clang's scan-build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

eliminated various clang warnings with non-null arguments

That is, use assert() to ensure that known to be non-null
variables will be used as input to functions requiring non-null.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

make_printable_string: allow operation with null input

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: replaced clang's build with clang analyser's scan-build

This introduces a static analyser pass in the CI.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: added cppcheck run

This adds a basic static analysis of the source code.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

opencdk/read-packet.c: corrected typo in type cast

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

cdk_pkt_read: enforce packet limits

That ensures that there are no overflows in the subsequent
calculations.

Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420

Relates: #159

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: added test case with invalid openpgp cert

That triggers a heap buffer overflow:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Add LMTP, POP3, NNTP, Sieve and PostgreSQL support to gnutls-cli

Add LMTP (RFC 2033), POP3 (RFC 2595), NNTP (RFC 4642), Sieve (RFC 5804) and PostgreSQL support to gnutls-cli ("--starttls-proto").

Signed-off-by: Robert Scheck <robert@fedoraproject.org>

README.md: added CII best practices badge [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: Improve port-checking infrastructure.

The test suite unnecessarily failed on systems without netstat because
it was assumed to be present.  Instead of simply checking for its
presence and indicating an unsupported test, however, the ss utility
can be used as a drop-in replacement.  When netstat/net-tools is not
present, the ss utility from iproute2 still stands a fair chance of
existing, and they also have similar enough semantics that they can be
used interchangeably in the test suite.

The functions in tests/scripts/common.sh that used netstat
(wait_for_port, wait_for_free_port) now use new functions,
check_if_port_in_use and check_if_port_listening, to abstract the call
to netstat/ss.  The eval'd variable GETPORT also used netstat, and has
been updated accordingly.

The new port-checking functions use another new function,
have_port_finder, which takes care of the details of selecting ss
(preferred) or netstat, or fails otherwise.

Signed-off-by: Rical Jasan <ricaljasan@pacific.net>
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

build: doc: install images also into htmldir

images are required also by the html documentation.

Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>

.gitlab-ci.yml: corrected coverage build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: remove submodule update from main build

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

updated auto-generated files

Makefile: improved symbols extraction

That is, do not include non-function names.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

tests: ignore sanity checks in broken cert test

This allows the existing reproducers which contain certificates which
are rejected by sanity checks, to still be used to detect regressions.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Added gnutls_x509_crt_set_flags()

This functions allows specifying flags to the certificate object.
In particular it allows the single flag GNUTLS_X509_CRT_FLAG_IGNORE_SANITY
which allows to ignore sanity checks at the import of the certificate.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Introduced GNUTLS_E_CERTIFICATE_TIME_ERROR error code

This error code indicates an issue in the time fields of certificate.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/output: properly indicate error in Time fields

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509/time: refuse importing certificates with invalid Time fields

That will refuse to import certificates which their time field
is not in GMT, or contain fractional seconds.

Resolves: #169

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_gnutls_x509_generalTime2gtime: refuse to parse fractional seconds

Fractional seconds in GeneralizedTime are prohibited by RFC5280.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enhanced test suite to include invalid X509v3 cert

That certificate contains a GeneralizedTime with fractional
seconds.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_crt_list_import: fixed leak on import failure

tests: enhanced test suite to include creation of invalid certificates

That is, check whether the creation of invalid V2 or V1 certificates
will be detected, and that the correct error codes are returned.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_crt_sign2: refuse to sign invalid X.509 certificates

That is, do not sign X.509 certificates which have fields that
shouldn't be present on their corresponding version.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_x509_crt_import: reject X.509v1 certificates with invalid fields

Refuse to import X.509v1 certificates which have fields that didn't
exist in X.509v1 specification. That is the issuerUniqueID and
subjectUniqueID fields.

Resolves: #168
Resolves: #167

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enhanced test suite to include invalid V1 certs

That is, added X.509v1 certificates with attributes that shouldn't
have been presented (valid for X.509v2 only).

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls.pc: do not include libidn2 in Requires.private

The libidn2 versions available do not include libidn2.pc,
thus the inclusion was causing problems when using pkg-config.
Instead we include -lidn2 in Libs.private.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.gitlab-ci.yml: Re-organized stages

The less CPU intensive tasks were moved to earlier stage, and the
CPU intensive tasks are only spawned only after basic syntax and
ABI checks have succeeded.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls.h: corrected typo [ci skip]

<alloca.h> only if HAVE_ALLOCA_H

FreeBSD does know alloca() but has no such header

Signed-off-by: Marcin Cieślak <saper@SAPER.INFO>

doc: document the intention of the priority string usage [ci skip]

This documents the gnutls_set_default_priority() function, and
how it is intended to be combined with an application that utilizes
priority strings.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: modified tests for the disablement of 3DES

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Removed support for the 3DES cipher by default

That is a legacy cipher that is no longer needed to be
included as backup cipher.

Resolves #120

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

x509: optimize subject alternative name access

That reads SAN and IAN early on import, significantly reducing
the running time of functions which iterate over the alternative
names of a certificate, e.g., gnutls_x509_crt_check_hostname().

Relates #165

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

.travis.yml: list all logs on failure

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

tests: enable all IDNA tests when compiled with libidn2

Keep IDNA2003-only tests on the ifdef HAVE_LIBIDN.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.travis.yml: updated instructions for travis builds

Removed unbound and other minor fixes.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

extras/hex.h: do not use strlen as variable name

That is, do not utilize a standard C function name as variable name.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_pkcs11_obj_list_import_url4: always return an initialized pointer

When returning success, but no elements, gnutls_pkcs11_obj_list_import_url4,
could have returned zero number of elements with a pointer that was uninitialized.
Ensure that an initialized (i.e., null in that case), pointer is always returned.
Reported by Jeremy Harris.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

.gitlab-ci.yml: use libidn2 on windows builds

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

gnutls_heartbeat_allowed: corrected type on dummy wrapper

That is, when compiling without heartbeat support, compilation
could fail due to the dummy wrapper not returning the right
type.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Address test suite failure due to timezone differences.

Reported by Thorsten Glaser and Andreas Metzler.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

doc update [ci skip]

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

gnutls_heartbeat_allowed: corrected return type

This reflects better the fact that this function returns
a boolean.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

_idn2_to_unicode_8z8z: do not err on mixed IDNA domains

That is allow domains of the form 'großes.xn--fa-hia.de'. The
drawback is that we may not err early on invalid formatted
names. We however delegate any such decisions to libidn2.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>

README.md: added link to travis build for 3.5.x [ci skip]

In addition to adding a link to travis build for 3.5.x branch removed
link on 3.4.x branch. It is no longer active.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

heartbeat extension: doc update

Document how to calculate the total TLS data transmitted.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

str-idna: improved error handling

In addition to detecting input with invalid characters in _idn2_to_unicode_8z8z(),
we also add support for case insensitive punycode header.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>