Merge branch 'master' into 'tmp-mark-gost94-as-broken'

# Conflicts:
#   lib/crypto-selftests-pk.c

diff --cc lib/algorithms/mac.c
Simple merge

diff --cc lib/crypto-selftests-pk.c
index f336ddc06241efbf59c66543b417c47cff7c7872,6f66cd84dd0b0daafe0465fd35837842010fe651..70b0f618ffe811c15233bbe338e66daa549261a2
--- 1/lib/crypto-selftests-pk.c
--- 2/lib/crypto-selftests-pk.c
+++ b/lib/crypto-selftests-pk.c
@@@ -200,29 -316,11 +316,15 @@@ static int test_sig(gnutls_pk_algorithm
                    unsigned bits, gnutls_sign_algorithm_t sigalgo)
  {
        int ret;
-       gnutls_datum_t sig = { NULL, 0 };
-       gnutls_datum_t raw_rsa_key = { (void*)rsa_key2048, sizeof(rsa_key2048)-1 };
-       gnutls_datum_t raw_dsa_key = { (void*)dsa_key, sizeof(dsa_key)-1 };
-       gnutls_datum_t raw_ecc_key = { (void*)ecc_key, sizeof(ecc_key)-1 };
-       gnutls_datum_t raw_gost01_key = { (void*)gost01_key, sizeof(gost01_key)-1 };
-       gnutls_datum_t raw_gost12_256_key = { (void*)gost12_256_key, sizeof(gost12_256_key)-1 };
-       gnutls_datum_t raw_gost12_512_key = { (void*)gost12_512_key, sizeof(gost12_512_key)-1 };
        gnutls_privkey_t key;
+       gnutls_datum_t raw_key;
+       gnutls_datum_t sig = { NULL, 0 };
        gnutls_pubkey_t pub = NULL;
        char param_name[32];
-       if (pk == GNUTLS_PK_EC || pk == GNUTLS_PK_GOST_01 ||
-           pk == GNUTLS_PK_GOST_12_256 || pk == GNUTLS_PK_GOST_12_512) {
-               snprintf(param_name, sizeof(param_name), "%s",
-                        gnutls_ecc_curve_get_name(GNUTLS_BITS_TO_CURVE
-                                                  (bits)));
- 
-               if (sigalgo == GNUTLS_SIGN_GOST_94)
-                       vflags |= GNUTLS_VERIFY_ALLOW_BROKEN;
-       } else {
-               snprintf(param_name, sizeof(param_name), "%u", bits);
-       }
 +      unsigned vflags = 0;
 +
++      if (sigalgo == GNUTLS_SIGN_GOST_94)
++              vflags |= GNUTLS_VERIFY_ALLOW_BROKEN;
  
        ret = gnutls_privkey_init(&key);
        if (ret < 0)
@@@ -430,10 -475,12 +479,13 @@@ static int test_known_sig(gnutls_pk_alg
        gnutls_pubkey_t pub = NULL;
        gnutls_privkey_t key;
        char param_name[32];
 +      unsigned vflags = 0;
  
-       if (pk == GNUTLS_PK_EC || pk == GNUTLS_PK_GOST_01 ||
-           pk == GNUTLS_PK_GOST_12_256 || pk == GNUTLS_PK_GOST_12_512) {
+       if (pk == GNUTLS_PK_EC ||
+           pk == GNUTLS_PK_GOST_01 ||
+           pk == GNUTLS_PK_GOST_12_256 ||
+           pk == GNUTLS_PK_GOST_12_512)
+       {
                snprintf(param_name, sizeof(param_name), "%s",
                         gnutls_ecc_curve_get_name(GNUTLS_BITS_TO_CURVE
                                                   (bits)));
@@@ -510,8 -553,8 +560,8 @@@
        }
  
        ret =
 -          gnutls_pubkey_verify_data2(pub, gnutls_pk_to_sign(pk, dig), 0,
 +          gnutls_pubkey_verify_data2(pub, gnutls_pk_to_sign(pk, dig), vflags,
-                                      &signed_data, &ssig);
+                                      &signed_data, &sig);
        if (ret < 0) {
                ret = GNUTLS_E_SELF_TEST_ERROR;
                gnutls_assert();

diff --cc tests/cert-tests/data/grfc.crt
index 20f587ea6ed1a4a23b2b7f95dfe34ae7bfad74f9,0b06f778b859941428a1fd58bbbc9ed09a91131c..fe7700e3e1ec765d1d7f74e50133eeb9e4321d92
--- 1/tests/cert-tests/data/grfc.crt
--- 2/tests/cert-tests/data/grfc.crt
+++ b/tests/cert-tests/data/grfc.crt
@@@ -37,11 -37,10 +37,11 @@@ X.509 Certificate Information
                        ASCII: ...
                        Hexdump: 020100
                Certificate Policies (not critical):
-                       1.2.643.100.113.1
-                       1.2.643.100.113.2
-                       2.5.29.32.0
+                       1.2.643.100.113.1 (Russian security class KC1)
+                       1.2.643.100.113.2 (Russian security class KC2)
+                       2.5.29.32.0 (anyPolicy)
        Signature Algorithm: GOSTR341001
 +warning: signed using a broken signature algorithm that can be forged.
        Signature:
                bd:95:dd:5f:3a:2b:74:a5:29:62:20:c2:24:a8:8b:a0
                13:1a:21:f5:4a:d6:2e:b1:3f:f5:50:e9:96:a0:a2:c9

diff --cc tests/cert-tests/pkcs7
Simple merge

diff --cc tests/sign-is-secure.c
index 3c2d18d93a33a7ba1f09bd9a6c96c6d3ec9336a1,5f987e08b4925bf4a082af6d2389b2767b3ba203..64e083696335a2ae280a28f84f182741b176421e
--- 1/tests/sign-is-secure.c
--- 2/tests/sign-is-secure.c
+++ b/tests/sign-is-secure.c
@@@ -85,9 -85,8 +85,9 @@@ void doit(void
  
        CHECK_INSECURE_SIG(GNUTLS_SIGN_RSA_MD5);
        CHECK_INSECURE_SIG(GNUTLS_SIGN_RSA_MD2);
 +      CHECK_INSECURE_SIG(GNUTLS_SIGN_GOST_94);
  
-       for (i=1;i<GNUTLS_SIGN_MAX;i++) {
+       for (i=1;i<=GNUTLS_SIGN_MAX;i++) {
  #ifndef ALLOW_SHA1
                if (i==GNUTLS_SIGN_RSA_SHA1||i==GNUTLS_SIGN_DSA_SHA1||i==GNUTLS_SIGN_ECDSA_SHA1)
                        continue;

diff --cc tests/test-chains.h
Simple merge