3b5d1a9353
Stub only links with GNUTLS
...
And valgrind check includes DoT session
2020-03-02 15:12:33 +01:00
8609a35e5b
GnuTLS: Add support for TLS 1.3.
2019-01-15 11:31:22 +00:00
ccd6c3592d
GnuTLS: Can't set priority for SSL3.
2019-01-15 11:30:56 +00:00
3fe0c94357
Merge branch 'develop' into feature/abstract-tls
2019-01-14 19:09:20 +00:00
65f4fbbc81
Make sure all connection deinits are only called if there is something to deinit.
2018-12-14 15:38:32 +00:00
c1bf12c8a2
Update default GnuTLS cipher suite priority string to one that gives the same ciphers as the OpenSSL version.
...
Also fix deinit segfault.
./gnutls-ciphers "NONE:+AES-256-GCM:+AES-128-GCM:+CHACHA20-POLY1305:+ECDHE-RSA:+ECDHE-ECDSA:+SIGN-RSA-SHA384:+AEAD:+COMP-ALL:+VERS-TLS-ALL:+CURVE-ALL"
Cipher suites for NONE:+AES-256-GCM:+AES-128-GCM:+CHACHA20-POLY1305:+ECDHE-RSA:+ECDHE-ECDSA:+SIGN-RSA-SHA384:+AEAD:+COMP-ALL:+VERS-TLS-ALL:+CURVE-ALL
TLS_ECDHE_RSA_AES_256_GCM_SHA384 0xc0, 0x30 TLS1.2
TLS_ECDHE_RSA_AES_128_GCM_SHA256 0xc0, 0x2f TLS1.2
TLS_ECDHE_RSA_CHACHA20_POLY1305 0xcc, 0xa8 TLS1.2
TLS_ECDHE_ECDSA_AES_256_GCM_SHA384 0xc0, 0x2 TLS1.2
TLS_ECDHE_ECDSA_AES_128_GCM_SHA256 0xc0, 0x2b TLS1.2
TLS_ECDHE_ECDSA_CHACHA20_POLY1305 0xcc, 0xa9 TLS1.2
$ openssl ciphers -v TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:TLS13-CHACHA20-POLY1305-SHA256:EECDH+AESGCM:EECDH+CHACHA20
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=ChaCha20-Poly1305 Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=ChaCha20-Poly1305 Mac=AEAD
2018-12-14 15:24:13 +00:00
a4590bafcb
Implement reading CAs from file or dir.
...
I found gnutls_certificate_set_x509_trust_(file|dir)(), so it's a lot
easier than I feared. Plus a little diggiing shows that if you're
loading the system defaults, GnuTLS on Windows does load them from the
Windows certificate store.
2018-12-13 13:33:54 +00:00
e8f34d48fb
Adjust default cipher list so required authentication works with getdnsapi.
...
The previous default cipher string wouldn't connect with getdnsapi.
Selection of cipher strings requires some deep study, I think.
So, taking working with getdnsapi.net as our target, discover that we
need SECURE128 as well as SECURE192. And rather than disable everything
except TLS1.2, disable TLS1.0 and TLS1.1. This should mean it connects
to TLS1.3.
2018-12-13 12:04:01 +00:00
fa9d8885f0
Fix problems with GnuTLS pinset handling.
...
Pinset validation now seems to work.
2018-12-13 11:03:31 +00:00
45be26642b
Fix dane query handling and verify error reporting.
...
Verify error is flags, not values. And deiniting a dane_query that is
NULL segfaults.
2018-12-12 15:01:07 +00:00
35b4969216
Abstract out OpenSSL specific parts of getdns_pubkey_pin_create_from_string().
...
The only OpenSSL function is decoding Base64.
2018-12-11 18:03:00 +00:00
2c6ec5e0be
Implement setting up pinset for DANE. Verification to come.
2018-12-11 14:59:21 +00:00
ff7ffc246c
Rename TLS Interface DANE init to pinset init. That's what it's actually used for.
2018-12-11 12:46:05 +00:00
fee864c25c
Implement setting cipher/curve lists.
...
Set the priority string to a concatenation of the connection cipher and curve strings, falling back to the context ones if the connection value isn't specified. Also get context.c to specify NULL for default context list and the opportunistic list for the connection, moving these library-specific quantities into the specific implementation.
2018-12-07 16:55:17 +00:00
511dfc75ef
Implement _getdns_tls_context_set_min_proto_1_2().
...
Add a flag to the context (so, it's actually got something useful there!) and check the connection version on a successful handshake.
This means we need to access the context from a connection, so add a pointer to the context to the connection.
2018-12-07 11:11:33 +00:00
64f0d6aaa8
Rename _getdns_tls_connection_verify() to _getdns_tls_connection_certificate_verify().
...
I managed to mislead myself about what it did, which suggests the name should be clearer.
2018-12-07 11:09:20 +00:00
b2312aee12
Implement hostname authentication.
2018-12-05 17:20:28 +00:00
f64aa8703d
First pass at a mostly stubbed GnuTLS implementation.
...
This works enough to do a TLS lookup.
2018-12-05 11:25:32 +00:00
Willem Toorop
Jim Hague
Jim Hague