Stefan Sørensen [Mon, 8 Aug 2016 11:31:15 +0000 (13:31 +0200)]
Fix gnutls_pkcs12_simple_parse to always extract the complete chain
gnutls_pkcs12_simple_parse was only collecting extra certificates that was
possible elements of the certificate chain when the extra_certs argument was
not NULL. Fix by allways collecting all the certificates, any unneeded
certificates are released before returning if extra_certs is NULL anyway.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Stefan Sørensen [Mon, 8 Aug 2016 11:31:14 +0000 (13:31 +0200)]
Fix invalid pointer operation in gnutls_certificate_get_x509_crt
The access to the allocated crt_list variable was missing a pointer
dereference, leading to memory corruption for any certificate list with more
than one element.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Previously we calculated the size of the key directly, but
by using the rsa_*_key_prepare we benefit from any checks that
may be introduced in the future. Specifically any checks for invalid
public keys (e.g., keys that may crash the underlying gmp functions).
This patch avoids calling rsa_private_key_prepare every time we construct
a nettle private key struct, because this function requires a bigint
multiplication. We call that function once on private key import.
tests: use gnutls_record_set_timeout instead of kill child processes
That way we avoid issues like #118 which are caused by killing the child
process, and we also avoid deadlocks by making sure that recv will terminate
after a long delay.
Previously we calculated the size of the key directly, but
by using the rsa_*_key_prepare we benefit from any checks that
may be introduced in the future. Specifically any checks for invalid
public keys (e.g., keys that may crash the underlying gmp functions).
Martin Ukrop [Wed, 27 Jul 2016 13:41:08 +0000 (15:41 +0200)]
x059: Fix asymmetry in name constraints intersection
- In _gnutls_name_constraints_intersect, if *_nc had a node of some type not present in _nc2, this was preserved. However, if it was vice versa (_nc2 having a type not present in *_nc), this node was discarded.
- This is now fixed.
- Removed redundant return value check that was accidentally left when refactoring from set_datum to explicit NULL setting.
Martin Ukrop [Tue, 26 Jul 2016 15:44:53 +0000 (17:44 +0200)]
tests: Add and improve chain tests
- Add a new chaintest testing the symmetry of merging name constraints of different types.
- Rename old name_constraints_but_no_name test to match other name constraints tests.
- Improve chain description of older name constraints tests.
tests: added checks for OCSP response file support
That is, check the usability of the APIs for setting and using
an ocsp response. This improves and makes more generic the
test suite API and test_cli_serv() in particular.
dtls: added a null pointer check in record_overhead
According to my reading this check is unnecessary as in
no case a null pointer can be encountered. However gcc6
warns about a null pointer derefence and thus adding it,
to be safe.
This error code is returned when the session resumption parameters
are requested during a handshake. That is, to increase the clarity
when requesting these parameters while false start is active and
the handshake is not complete even if gnutls_handshake() has returned.
Martin Ukrop [Wed, 20 Jul 2016 12:52:00 +0000 (14:52 +0200)]
x509: Fix DNS name constraints checking
- If the intersection of name constraints of the given type was empty, the results allowed all names instead of none.
- Fixed by adding an universal excluded name constraint in case the intersection for the particular type is empty.
- Moved the logic of creating a name constraint node copy from _gnutls_name_constraints_intersect to name_constraints_intersect_nodes (previously name_constraints_match), as intersecting IP addresses will require further processing (not just taking one of the compared nodes as was the implementation till now).
- GNUTLS_SAN_MAX added in order to comfortably iterate over SAN type enum.
Martin Ukrop [Wed, 20 Jul 2016 12:29:40 +0000 (14:29 +0200)]
tests: Add DNS name constraints tests
- One chaintest with empty permitted intersection.
- Merge testset with 2 permitted constraints with empty intersection (intersected list is completely empty).
- Merge testset with 3 permitted constraints, 2 of which have empty intersection.
- Merge testset with 2 permitted constraints with empty intersection and one constraints of different type that remains (intersected list is not empty).
- Enhance failing function with suite number for easier comprehension.
Martin Ukrop [Wed, 20 Jul 2016 12:28:20 +0000 (14:28 +0200)]
tests: Tidy up old X509 name constraints tests
- Use convenience functions for error checking and failure reporting.
- Drop explicit (de)initialization (prevents some not reed reachable memory due to PKCS11 subsystem not being deinitialized in the destructor).
- Use variables to count set permitted/excluded constraints instead of hard-coded numbers.
projects / thirdparty / gnutls.git / log
