handshake: clear HSK_PSK_SELECTED is when resetting binders
When a TLS 1.3 handshake involves HRR and resumption or PSK, and the
second Client Hello omits PSK, the server would result in a NULL
pointer dereference as the PSK binder information is cleared while the
HSK_PSK_SELECTED flag is still set. This makes sure that
HSK_PSK_SELECTED flag is always cleared when the PSK binders are
reset. This also makes it clear the HSK_PSK_SELECTED flag is valid
only during a handshake; after that, whether PSK is used can be
checked with gnutls_auth_client_get_type.
certtool: avoid 1-byte write buffer overrun when parsing template
Previously, when parsing a template file with a number of key value
pairs, certtool could write a NUL byte after the heap buffer, causing
a memory corruption. This fixes the issue by allocating the NUL byte.
Reported by David Aitel.
x509: avoid double free when exporting othernames in SAN
Previously, the _gnutls_write_new_othername function, called by
gnutls_x509_ext_export_subject_alt_names to export "otherName" in a
certificate's SAN extension, freed the caller allocated ASN.1
structure upon error, resulting in a potential double-free.
Andrew Hamilton [Mon, 7 Jul 2025 01:35:54 +0000 (10:35 +0900)]
x509: reject zero-length version in certificate request
Ensure zero size asn1 values are considered invalid in
gnutls_x509_crq_get_version, this ensures crq version is not used
uninitialized. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42536706
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com> Signed-off-by: Daiki Ueno <ueno@gnu.org>
Andrew Hamilton [Mon, 7 Jul 2025 01:31:55 +0000 (10:31 +0900)]
psk: fix read buffer overrun in the "pre_shared_key" extension
While processing the "pre_shared_key" extension in TLS 1.3, if there
are certain malformed data in the extension headers, then the code may
read uninitialized memory (2 bytes) beyond the received TLS extension
buffer. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42513990
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com> Signed-off-by: Daiki Ueno <ueno@gnu.org>
Andrew Hamilton [Mon, 7 Jul 2025 01:23:59 +0000 (10:23 +0900)]
x509: fix read buffer overrun in SCT timestamps
Prevent reading beyond heap buffer in call to _gnutls_parse_ct_sct
when processing x509 Signed Certificate Timestamps with certain
malformed data. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42530513
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com> Signed-off-by: Daiki Ueno <ueno@gnu.org>
As libminitasn1.la is always built a static library, linking it twice
makes linking fail because of duplicated symbols. This also stops
including <nettle/bignum.h> as it is unused and causing compile error
on macOS homebrew:
In file included from p11_pk.c:32:
/opt/homebrew/Cellar/nettle/3.10.2/include/nettle/bignum.h:50:11: fatal error: 'gmp.h' file not found
# include <gmp.h>
^~~~~~~
1 error generated.
x509: support encoding of ML-DSA private keys in CHOICE format
This enables to encode a generaeted ML-DSA private key in the three
formats defined in draft-ietf-lamps-dilithium-certificates-12,
indicated with the gnutls_pkcs_encrypt_flags_t enum as
GNUTLS_PKCS_MLDSA_SEED and/or GNUTLS_PKCS_MLDSA_EXPANDED values. The
default format ML-DSA keys has been changed to the "both" format.
algorithms: assign hash strength to ML-DSA signature algorithms
The _gnutls_sign_get_hash_strength function previously returned 0 for
ML-DSA algorithms, preventing the security level check in certificate
signatures. This assigns the collision strength for commitment hashes,
as defined in FIPS 204, section 4, table 1.
x509: support decoding of ML-DSA private keys in CHOICE format
This extends the acceptable formats of ML-DSA private keys to the
three formats defined in draft-ietf-lamps-dilithium-certificates-12,
section 6, namely: "seed", "expandedKey", and "both". The legacy
format compatible with liboqs/oqsprovider is still accepted and the
default output format for now.
doc: fix typo in docs about system profile fallback
Docs for the system profile fallback syntax accidentally repeated
the "@" marker before each keyword. The "@" marker only indicates
the start of the profile field, and individual names are merely
separated by a comma, per the impl in 6b6d9dd44e.
Jiasheng Jiang [Mon, 16 Jun 2025 05:24:14 +0000 (05:24 +0000)]
lib/accelerated/x86/hmac-padlock.c: Add gnutls_free() to avoid memory leak
Add gnutls_free() to free ctx if _hmac_ctx_init() fails to avoid memory leak.
Fixes: 38a089b67 ("Updates for padlock hashes in C7 nano. Requires a part of nettle to be included.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Jiasheng Jiang [Mon, 16 Jun 2025 05:22:53 +0000 (05:22 +0000)]
lib/accelerated/x86/sha-padlock.c: Free ctx on error to avoid memory leak
Call gnutls_free() to release ctx if _ctx_init() fails, preventing a memory leak.
Fixes: 38a089b67 ("Updates for padlock hashes in C7 nano. Requires a part of nettle to be included.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Jiasheng Jiang [Mon, 16 Jun 2025 05:21:09 +0000 (05:21 +0000)]
lib/pk.c: Free tmp_output on error to avoid memory leak
Call gnutls_free() to release tmp_output if asn1_der_coding() fails, preventing memory leak.
Fixes: 6f9bfaac9 ("Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
To minimize the number of dependencies on Gnulib, this migrates the
uses of the "hash" module to gl_linkedhash_list, which we extensively
use as a generic hash-table.
kTLS now returns -EKEYEXPIRED when the socket's keys aren't updated after
receiving a keyupdate (this is very unlikely). Currently when this
happens the ktls recv funtion returns GNUTLS_E_AGAIN and the receive
function is called again and again.
- ktls_utils.h has helper funtion to create standard sockets required
for ktls support testing.
- key_update test for kTLS is now a flavourt of the tls13/key_update
test instead of being standalone(broadens the testing cases).
- gnutls_ktls.c now uses the aformentioned ktls_utils.h
Daiki Ueno [Sun, 16 Feb 2025 00:02:46 +0000 (09:02 +0900)]
serv: fix detection of early data reception
Upon success, gnutls_record_recv_early_data returns the amount of data
received, so the application should treat positive numbers as an
indication of early data reception.
Daiki Ueno [Wed, 19 Mar 2025 09:29:55 +0000 (18:29 +0900)]
global: call lc_init at startup
When leancrypto is statically linked, their constructor will not be
called and which prevents some low-level algorithms being
functional. This adds a manual initialization with lc_init() at the
startup of the GnuTLS library.
Suggested-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: Daiki Ueno <ueno@gnu.org>
Daiki Ueno [Mon, 24 Mar 2025 07:06:11 +0000 (16:06 +0900)]
liboqs: fix shared secret assignment after decaps
Although we are removing liboqs support, this fixes the
_gnutls_pk_decaps implementation, where the returned shared_secret is
overridden with an empty shared secret.
Daiki Ueno [Fri, 21 Mar 2025 00:30:00 +0000 (09:30 +0900)]
.gitlab-ci.yml: use Nettle from release-3.10-fixes branch
The current Nettle master branch (for 4.0 release) contains
incompatible changes which GnuTLS hasn't yet accommodated. This sticks
to the latest 3.10 branch to work that around.
projects / thirdparty / gnutls.git / log
