Commits · aaf71be1877c6b8d74e5c70e228f0249d339fef9 · mirror / openconnect

14 Jun, 2012 8 commits

Clean up handling of gnutls_pkcs12.c · aaf71be1
David Woodhouse authored Jun 14, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
aaf71be1
Fix BER encoding of hash in sign_dummy_data() · 456de5ff
David Woodhouse authored Jun 14, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
456de5ff

Cope with lack of gnutls_certificate_set_key() in GnuTLS 2.12 · 25d9be59

David Woodhouse authored Jun 14, 2012

We *can* use arbitrary privkeys, by using the cert_callback to provide
them on demand.

And even without gnutls_privkey_import_ext() to give us a constructed
privkey that represents the TPM key, we can cope by registering a
sign_callback on the TLS session.

This means that we can support the TPM, and also fix the lack of extra
supporting certs and expiry check when using PKCS#11 certs with GnuTLS 2.12.

It also means my code is an even bigger mess of #ifdefs than it was before.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

25d9be59

Fix memory leak of TPM key password · 6e4ce246
David Woodhouse authored Jun 14, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
6e4ce246

Fix wording of comment about string handling · 0d72e018

David Woodhouse authored Jun 14, 2012

The library *will* free them later. Honest! If we say "should", someone
might get confused and think we're saying the *caller* needs to do it.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

0d72e018

Document SHA1 buffer requirements more clearly · ce8df71d

David Woodhouse authored Jun 14, 2012

There's an inconsistency here; openconnect_set_xmlsha1() takes a redundant
'len' arg which serves no purpose except to check that the caller knows
how big a SHA1 is. If it's not 41, we bail.

Next time the soname is getting bumped, I'll add a similar redundant
check to openconnect_get_cert_sha1() too. I should have done that when
it was first converted from an internal function to a public-facing one
in commit 20840ab0. But I didn't, and it's not worth bumping the soname
again right now *just* for that.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

ce8df71d

Fix Solaris build, again · 4cbb1ce4

David Woodhouse authored Jun 14, 2012

I really ought to script a check for this.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

4cbb1ce4

Fix GnuTLS 2.12 library still referencing OpenSSL ERR_print_errors_cb() · bca3b64b
David Woodhouse authored Jun 14, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
bca3b64b

13 Jun, 2012 18 commits

Tag version 3.99 · 8d28ce58
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
8d28ce58
Make 'make tag' work out of source tree · dee661e9
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
dee661e9
$CISCO_SPLIT_DNS is separated by commas in vpnc, not spaces · 614424f4
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
614424f4
Link libopenconnect to trousers, not openconnect · 8bf9a24c
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
8bf9a24c
Move dtls1_stop_timer() declaration inside the OPENCONNECT_OPENSSL section · e3837159
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
e3837159
Update translations from Transifex · 10067a94
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
10067a94
Fix build with GnuTLS 2.12 · ca40f7c5
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
ca40f7c5

Allow GUI to distinguish between PIN/passphrase callbacks · 4af8c6cc

David Woodhouse authored Jun 13, 2012

The UI may cache user input by form->auth_id, opt->name. But those were
always the same (and auth_id was even NULL for OpenSSL UI callbacks from
the TPM engine), so it wasn't very helpful. Fix it.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

4af8c6cc

Handle TPM keys with their own authentication PIN · b60b88ad
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
b60b88ad
Give proper error reporting from tpm_sign_fn() TPM operations · 1ed7aa30
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
1ed7aa30
Try null SRK key (20 bytes of zero) first · 2248c803
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
2248c803

Fix error exits in GnuTLS load_certificate() function · e05f5cd8

David Woodhouse authored Jun 13, 2012

Having separate 'err' for GnuTLS errno, and 'ret' for the return value, has
caused me to sometimes return without setting 'ret'. Make it uninitialised
to start with, and then the compiler should warn if I 'goto out' again
without setting 'ret'.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

e05f5cd8

Implement certificate matching for TPM/PKCS#11 privkeys · 09bc6171
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
09bc6171
Fix GnuTLS PIN cache leak when only *key* is PKCS#11 and not certificate. · 9ce7f679
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
9ce7f679

Remove redundancy in code which 'matches' cert to privkey · 88d01c94

David Woodhouse authored Jun 13, 2012

Yes, it doesn't *actually* do any matching... yet.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

88d01c94

Add TPM support for GnuTLS · 63077480

David Woodhouse authored Jun 12, 2012

Based on GnuTLS TPM code by Carolin Latze <latze@angry-red-pla.net>
and Tobias Soder.

Like the OpenSSL TPM ENGINE, this only supports a key 'blob' rather than
using keys by UUID. That shouldn't be hard to fix if someone wants it.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

63077480

Clean up build options printout · 45d87529
David Woodhouse authored Jun 13, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
45d87529

Fix DTLS fallback to OpenSSL for old GnuTLS · 7c70b63c

David Woodhouse authored Jun 13, 2012

Due to a typo, it wasn't using OpenSSL for DTLS unless you specified
--without-openssl on the configure command line.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

7c70b63c

12 Jun, 2012 8 commits
- Explicitly check for gnutls_certificate_set_key(), separate it from p11-kit · d1094418
  David Woodhouse authored Jun 12, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  d1094418
- OpenSSL: Fix leak of cert_x509 · 97e77603
  David Woodhouse authored Jun 12, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  97e77603
- OpenSSL: Free BIO leak in reload_pem_cert() · 06137d45
  David Woodhouse authored Jun 12, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  06137d45
- OpenSSL: Clean up leaks in TPM ENGINE handling · 0a9919b5
  David Woodhouse authored Jun 12, 2012
```
The key, in the ctx, holds a reference on the engine. We should be dropping
our own.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  0a9919b5
- OpenSSL: Fix password memory leaks · 443e7e54
  David Woodhouse authored Jun 12, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  443e7e54
- Make authentication valgrind-friendly · 97d68d93
  David Woodhouse authored Jun 12, 2012
```
Not strictly needed to free stuff right before we exit, but it makes it
easier to find leaks in the library code.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  97d68d93
- Fix useragent leak · cc6957a3
  David Woodhouse authored Jun 12, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  cc6957a3
- GnuTLS: Fix password memory leaks · 1e70b733
  David Woodhouse authored Jun 12, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
  1e70b733
11 Jun, 2012 6 commits

Add openconnect_has_tss_blob_support() · d36cb523

David Woodhouse authored Jun 11, 2012

Turns out this might not be entirely OpenSSL-specific; we should be able
to support it in GnuTLS too.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

d36cb523

Fix const char * warnings in GnuTLS pin_helper on FreeBSD · ace861fc
David Woodhouse authored Jun 11, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
ace861fc
Add --authenticate option · aed7759d
David Woodhouse authored Jun 11, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
aed7759d

Add openconnect_has_pkcs11_support() · 1a394bce

David Woodhouse authored Jun 11, 2012

Theoretically, the OpenSSL side can (and should) gain PKCS#11 support at
some point. There *is* a PKCS#11 engine, although it seems somewhat unloved.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

1a394bce

Return error from OpenSSL load_certificate() for PKCS#11 URLs · 455c90b1
David Woodhouse authored Jun 11, 2012
```
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
```
455c90b1

Translate build option output · 150dc037

David Woodhouse authored Jun 11, 2012

Oops. The whole point in doing it this way with full sentences instead of
crap like ("with%s TPM support", tpm?"":"out") was to ease translation...
and then I forgot to mark the strings translatable :)
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

150dc037