gnutls:gnutls.git
2 years agowhen verifying account for all responses available via RFC6961 status request extension ocsp2
Nikos Mavrogiannopoulos [Thu, 5 Feb 2015 04:34:42 +0000 (05:34 +0100)]
when verifying account for all responses available via RFC6961 status request extension

2 years agognutls_ocsp_status_request_get_multi: properly detect an empty stats v2 request
Nikos Mavrogiannopoulos [Wed, 4 Feb 2015 11:30:33 +0000 (12:30 +0100)]
gnutls_ocsp_status_request_get_multi: properly detect an empty stats v2 request

2 years agodo not allow an index > 0 for plain status requests in gnutls_ocsp_status_request_get...
Nikos Mavrogiannopoulos [Wed, 4 Feb 2015 10:22:24 +0000 (11:22 +0100)]
do not allow an index > 0 for plain status requests in gnutls_ocsp_status_request_get_multi

2 years agoexported gnutls_ocsp_status_request_get_multi
Nikos Mavrogiannopoulos [Wed, 4 Feb 2015 09:58:15 +0000 (10:58 +0100)]
exported gnutls_ocsp_status_request_get_multi

2 years agognutls_ocsp_status_request_is_checked: use gnutls_ocsp_status_request_get_multi
Nikos Mavrogiannopoulos [Wed, 4 Feb 2015 09:53:20 +0000 (10:53 +0100)]
gnutls_ocsp_status_request_is_checked: use gnutls_ocsp_status_request_get_multi

2 years agocorrected the sending of status request v2
Nikos Mavrogiannopoulos [Wed, 4 Feb 2015 09:50:22 +0000 (10:50 +0100)]
corrected the sending of status request v2

2 years agoAdded support to read and send the RFC6961 status request.
Nikos Mavrogiannopoulos [Fri, 6 Jun 2014 11:56:01 +0000 (13:56 +0200)]
Added support to read and send the RFC6961 status request.

2 years agohandle differently OCSP responses that are revoked and of unknown status
Nikos Mavrogiannopoulos [Wed, 4 Feb 2015 09:14:55 +0000 (10:14 +0100)]
handle differently OCSP responses that are revoked and of unknown status

2 years agocompilation fix with return on void function; reported by David Marx
Nikos Mavrogiannopoulos [Sun, 1 Feb 2015 12:35:40 +0000 (13:35 +0100)]
compilation fix with return on void function; reported by David Marx

2 years agodoc update
Nikos Mavrogiannopoulos [Thu, 29 Jan 2015 13:31:08 +0000 (14:31 +0100)]
doc update

2 years agoset the appropriate direction when _gnutls_io_write_flush() is called
Nikos Mavrogiannopoulos [Thu, 29 Jan 2015 13:21:18 +0000 (14:21 +0100)]
set the appropriate direction when _gnutls_io_write_flush() is called

2 years agotests: added check for operation under different threads and DTLS
Nikos Mavrogiannopoulos [Wed, 28 Jan 2015 09:32:16 +0000 (10:32 +0100)]
tests: added check for operation under different threads and DTLS

2 years agotests: added check for operation under different processes and DTLS
Nikos Mavrogiannopoulos [Wed, 28 Jan 2015 09:22:37 +0000 (10:22 +0100)]
tests: added check for operation under different processes and DTLS

2 years agoRevert "doc update"
Nikos Mavrogiannopoulos [Wed, 28 Jan 2015 08:57:13 +0000 (09:57 +0100)]
Revert "doc update"

This reverts commit eabf1f27d255577bad60d302abf46a969848fcd7.

2 years agoRevert "Added gnutls_record_is_async()"
Nikos Mavrogiannopoulos [Wed, 28 Jan 2015 08:56:56 +0000 (09:56 +0100)]
Revert "Added gnutls_record_is_async()"

This reverts commit 2232822aabe473d124f924d64ff52981d685fd41.

2 years agodocumented using a session with fork or multiple threads
Nikos Mavrogiannopoulos [Wed, 28 Jan 2015 08:56:21 +0000 (09:56 +0100)]
documented using a session with fork or multiple threads

2 years agodoc update
Nikos Mavrogiannopoulos [Tue, 27 Jan 2015 12:07:19 +0000 (13:07 +0100)]
doc update

2 years agoAdded gnutls_record_is_async()
Nikos Mavrogiannopoulos [Tue, 27 Jan 2015 12:06:10 +0000 (13:06 +0100)]
Added gnutls_record_is_async()

That function indicates whether gnutls_record_recv() and
gnutls_record_send() can be used independently and in
parallel.

2 years agoprint errno in a more uniform way
Nikos Mavrogiannopoulos [Sun, 25 Jan 2015 09:17:06 +0000 (10:17 +0100)]
print errno in a more uniform way

2 years agodoc update
Nikos Mavrogiannopoulos [Sun, 25 Jan 2015 07:28:13 +0000 (08:28 +0100)]
doc update

2 years agoexported gnutls_system_recv_timeout()
Nikos Mavrogiannopoulos [Sun, 25 Jan 2015 07:27:08 +0000 (08:27 +0100)]
exported gnutls_system_recv_timeout()

2 years agosimplified _gnutls_writev() by requiring the total length
Nikos Mavrogiannopoulos [Sun, 25 Jan 2015 07:15:01 +0000 (08:15 +0100)]
simplified _gnutls_writev() by requiring the total length

2 years agoopencdk: small fixed to reduce warnings
Nikos Mavrogiannopoulos [Tue, 20 Jan 2015 08:39:44 +0000 (09:39 +0100)]
opencdk: small fixed to reduce warnings

2 years agodoc update
Nikos Mavrogiannopoulos [Mon, 19 Jan 2015 14:36:22 +0000 (15:36 +0100)]
doc update

2 years agodon't be so verbose about the OCSP nonce; it is universally unsupported
Nikos Mavrogiannopoulos [Mon, 19 Jan 2015 14:32:09 +0000 (15:32 +0100)]
don't be so verbose about the OCSP nonce; it is universally unsupported

2 years agoOCSP check the whole cert chain
Tim Ruehsen [Sat, 17 Jan 2015 13:32:35 +0000 (14:32 +0100)]
OCSP check the whole cert chain

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
2 years agoon certificate import check whether the two signature algorithms match
Nikos Mavrogiannopoulos [Mon, 19 Jan 2015 08:29:31 +0000 (09:29 +0100)]
on certificate import check whether the two signature algorithms match

2 years agocross.mk: use 3.3.12
Nikos Mavrogiannopoulos [Sat, 17 Jan 2015 08:49:17 +0000 (09:49 +0100)]
cross.mk: use 3.3.12

2 years agodoc update
Nikos Mavrogiannopoulos [Sat, 17 Jan 2015 08:01:37 +0000 (09:01 +0100)]
doc update

2 years agoAdded configure option --disable-tools
Luke Dashjr [Mon, 12 Jan 2015 19:32:38 +0000 (19:32 +0000)]
Added configure option --disable-tools

2 years agocorrected typos
Nikos Mavrogiannopoulos [Fri, 16 Jan 2015 14:54:53 +0000 (15:54 +0100)]
corrected typos

Reported by Guido Kroon.

2 years agoAdded the notion of obsolete versions
Nikos Mavrogiannopoulos [Fri, 16 Jan 2015 13:16:58 +0000 (14:16 +0100)]
Added the notion of obsolete versions

That prevents using these versions as record version numbers, unless
they are the only protocol supported. This avoids the issues with
servers that have banned SSL 3.0 record versions.

2 years agoocsptool: follow the documented process for gnutls_x509_crt_get_authority_info_access
Nikos Mavrogiannopoulos [Fri, 16 Jan 2015 09:16:47 +0000 (10:16 +0100)]
ocsptool: follow the documented process for gnutls_x509_crt_get_authority_info_access

2 years agognutls_x509_crt_get_authority_info_access: doc update
Nikos Mavrogiannopoulos [Fri, 16 Jan 2015 09:15:08 +0000 (10:15 +0100)]
gnutls_x509_crt_get_authority_info_access: doc update

2 years agoocsptool-common: iterate through all AIA items prior to decidig the OCSP server
Nikos Mavrogiannopoulos [Thu, 15 Jan 2015 14:49:53 +0000 (15:49 +0100)]
ocsptool-common: iterate through all AIA items prior to decidig the OCSP server

2 years agouse a FIPS key that agree's with fedora's fipshmac
Nikos Mavrogiannopoulos [Wed, 14 Jan 2015 07:11:17 +0000 (08:11 +0100)]
use a FIPS key that agree's with fedora's fipshmac

2 years agoDCO: Added Luke Dashjr
Nikos Mavrogiannopoulos [Wed, 14 Jan 2015 21:51:55 +0000 (22:51 +0100)]
DCO: Added Luke Dashjr

2 years agosimplified text for inline-commands-prefix
Nikos Mavrogiannopoulos [Tue, 13 Jan 2015 21:47:59 +0000 (22:47 +0100)]
simplified text for inline-commands-prefix

2 years agognutls-cli: added --starttls-proto option
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 22:14:35 +0000 (23:14 +0100)]
gnutls-cli: added --starttls-proto option

2 years agopkcs11: cleanup the name of types
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 16:28:50 +0000 (17:28 +0100)]
pkcs11: cleanup the name of types

2 years agotests: updates in softhsm detection
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 16:19:48 +0000 (17:19 +0100)]
tests: updates in softhsm detection

2 years agopkcs11: when importing a public key, import it's data as well (version 2 fix)
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 16:12:56 +0000 (17:12 +0100)]
pkcs11: when importing a public key, import it's data as well (version 2 fix)

2 years agodoc update
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 16:02:03 +0000 (17:02 +0100)]
doc update

2 years agotestpkcs11: do not ignore the failure to write a trusted CA
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 10:50:53 +0000 (11:50 +0100)]
testpkcs11: do not ignore the failure to write a trusted CA

2 years agoremoved gnutls_pubkey_get_pk_* from the exported function list
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 10:17:24 +0000 (11:17 +0100)]
removed gnutls_pubkey_get_pk_* from the exported function list

2 years agotests: key-import-export: enhanced to test gnutls_pubkey_*_ecc_x962
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 09:33:21 +0000 (10:33 +0100)]
tests: key-import-export: enhanced to test gnutls_pubkey_*_ecc_x962

2 years agognutls_pubkey_t: allow the import of another parameter set without a leak
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 09:32:13 +0000 (10:32 +0100)]
gnutls_pubkey_t: allow the import of another parameter set without a leak

2 years agoremoved ABI-compatibility functions
Nikos Mavrogiannopoulos [Mon, 12 Jan 2015 09:19:47 +0000 (10:19 +0100)]
removed ABI-compatibility functions

2 years agodoc update
Nikos Mavrogiannopoulos [Fri, 9 Jan 2015 12:59:34 +0000 (13:59 +0100)]
doc update

2 years agotestpkcs11: modified to support both softhsmv1 and v2
Nikos Mavrogiannopoulos [Sun, 11 Jan 2015 21:41:01 +0000 (22:41 +0100)]
testpkcs11: modified to support both softhsmv1 and v2

2 years agopkcs11: when importing a public key, import it's data as well
Nikos Mavrogiannopoulos [Sun, 11 Jan 2015 21:15:10 +0000 (22:15 +0100)]
pkcs11: when importing a public key, import it's data as well

2 years agotests: enhanced key-import-export to check output of pubkeys
Nikos Mavrogiannopoulos [Sun, 11 Jan 2015 17:00:38 +0000 (18:00 +0100)]
tests: enhanced key-import-export to check output of pubkeys

2 years agotests: eliminated leaks
Nikos Mavrogiannopoulos [Sun, 11 Jan 2015 15:25:01 +0000 (16:25 +0100)]
tests: eliminated leaks

2 years agodoc update
Nikos Mavrogiannopoulos [Sun, 11 Jan 2015 15:16:49 +0000 (16:16 +0100)]
doc update

2 years agotests: added checks for private key import/export functions
Nikos Mavrogiannopoulos [Sun, 11 Jan 2015 15:06:26 +0000 (16:06 +0100)]
tests: added checks for private key import/export functions

2 years agodoc update
Nikos Mavrogiannopoulos [Sat, 10 Jan 2015 20:56:21 +0000 (21:56 +0100)]
doc update

2 years agotests: Added test case for openpgp keys loaded by callback
Nikos Mavrogiannopoulos [Sat, 10 Jan 2015 11:13:29 +0000 (12:13 +0100)]
tests: Added test case for openpgp keys loaded by callback

2 years agoWhen setting up TLS with cert-type OpenPGP from a client,
Nikos Mavrogiannopoulos [Sat, 10 Jan 2015 11:12:25 +0000 (12:12 +0100)]
When setting up TLS with cert-type OpenPGP from a client,
the server verifies if it supports the extension’s contents
in _gnutls_session_cert_type_supported().  This function
checks for cred->get_cert_callback but not cred->get_cert_callback2.
As a result, servers setup for OpenPGP certificate credential
callback with gnutls_certificate_set_retrieve_function2() are
unable to use the OpenPGP certificate type.

The solution is to consider cred->get_cert_callback2 alongside
cred->get_cert_callback in _gnutls_session_cert_type_supported().

Patch by Rick van Rein.

2 years agognutls_privkey_import_openpgp_raw: do not release the cached value
Nikos Mavrogiannopoulos [Sat, 10 Jan 2015 10:56:48 +0000 (11:56 +0100)]
gnutls_privkey_import_openpgp_raw: do not release the cached value

2 years agoguile: Call 'load-extension' both during expansion and at run time.
Ludovic Courtès [Thu, 8 Jan 2015 09:18:07 +0000 (10:18 +0100)]
guile: Call 'load-extension' both during expansion and at run time.

Fixes <https://bugzilla.redhat.com/show_bug.cgi?id=1177847>.

* guile/modules/gnutls.in: Wrap '%libdir' definition and
  'load-extension' call in 'eval-when'.

2 years agoWhen receiving a TLS record with multiple handshake packets, parse them in one go
Nikos Mavrogiannopoulos [Thu, 8 Jan 2015 08:35:59 +0000 (09:35 +0100)]
When receiving a TLS record with multiple handshake packets, parse them in one go

That resolves:
https://savannah.gnu.org/support/?108712

2 years agotests: updated mini-dtls-record-asym
Nikos Mavrogiannopoulos [Thu, 8 Jan 2015 08:25:15 +0000 (09:25 +0100)]
tests: updated mini-dtls-record-asym

2 years agotests: better documentation of mini-dtls-record-asym purpose
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 20:36:33 +0000 (21:36 +0100)]
tests: better documentation of mini-dtls-record-asym purpose

2 years agotests: moved udp_socketpair to utils
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 20:27:14 +0000 (21:27 +0100)]
tests: moved udp_socketpair to utils

2 years agotests: corrected asymmetric MTU test for DTLS and added caching
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 20:22:02 +0000 (21:22 +0100)]
tests: corrected asymmetric MTU test for DTLS and added caching

2 years agoAdded test case for DTLS handshake packet reconstruction when it exceeds MTU
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 16:32:44 +0000 (17:32 +0100)]
Added test case for DTLS handshake packet reconstruction when it exceeds MTU

https://savannah.gnu.org/support/?108712

2 years agosimplified _gnutls_dgram_read()
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 16:18:57 +0000 (17:18 +0100)]
simplified _gnutls_dgram_read()

2 years agodanetool: only compile when dane is enabled
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 12:39:19 +0000 (13:39 +0100)]
danetool: only compile when dane is enabled

2 years agoin DTLS don't combine multiple packets which exceed MTU
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 09:17:14 +0000 (10:17 +0100)]
in DTLS don't combine multiple packets which exceed MTU

Resolves: https://savannah.gnu.org/support/?108715

2 years agoAdded more precise check of push functions availability
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 09:01:47 +0000 (10:01 +0100)]
Added more precise check of push functions availability

2 years agoRevert "in DTLS don't use writev() when multiple packets which exceed MTU are queued"
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 08:59:33 +0000 (09:59 +0100)]
Revert "in DTLS don't use writev() when multiple packets which exceed MTU are queued"

This reverts commit 43082a67c7514d65301d157fb567a133138a85ab.

2 years agoRevert "Give precedence to vector push function"
Nikos Mavrogiannopoulos [Tue, 6 Jan 2015 08:59:25 +0000 (09:59 +0100)]
Revert "Give precedence to vector push function"

This reverts commit cb4ea413569803cbbf291abb27d30d14bfa971c5.

2 years agoGive precedence to vector push function
Nikos Mavrogiannopoulos [Mon, 5 Jan 2015 14:08:28 +0000 (15:08 +0100)]
Give precedence to vector push function

2 years agoin DTLS don't use writev() when multiple packets which exceed MTU are queued
Nikos Mavrogiannopoulos [Mon, 5 Jan 2015 14:08:28 +0000 (15:08 +0100)]
in DTLS don't use writev() when multiple packets which exceed MTU are queued

That change requires the system_write() to be registered unconditionally,
even when writev() is available.
Resolves: https://savannah.gnu.org/support/?108715

2 years agotests: added check to ensure that DTLS handshake packets will not exceed MTU
Nikos Mavrogiannopoulos [Mon, 5 Jan 2015 15:28:58 +0000 (16:28 +0100)]
tests: added check to ensure that DTLS handshake packets will not exceed MTU

2 years agocerttool: warn when setting a certificate's expiration longer than the CA's expiration
Nikos Mavrogiannopoulos [Mon, 5 Jan 2015 15:21:57 +0000 (16:21 +0100)]
certtool: warn when setting a certificate's expiration longer than the CA's expiration

2 years agotestpkcs11: detect softhsm2
Nikos Mavrogiannopoulos [Mon, 5 Jan 2015 14:01:22 +0000 (15:01 +0100)]
testpkcs11: detect softhsm2

2 years agotests: account for disabling of ARCFOUR where needed
Nikos Mavrogiannopoulos [Mon, 5 Jan 2015 13:40:51 +0000 (14:40 +0100)]
tests: account for disabling of ARCFOUR where needed

2 years agocerttool: modified check for READ_NUMERIC
Nikos Mavrogiannopoulos [Sun, 4 Jan 2015 22:19:33 +0000 (23:19 +0100)]
certtool: modified check for READ_NUMERIC

2 years agocerttool: use 64-bit type for CRL serial number
Nikos Mavrogiannopoulos [Sun, 4 Jan 2015 21:46:16 +0000 (22:46 +0100)]
certtool: use 64-bit type for CRL serial number

2 years agocerttool: check for overflows when reading serial numbers
Nikos Mavrogiannopoulos [Sun, 4 Jan 2015 21:43:00 +0000 (22:43 +0100)]
certtool: check for overflows when reading serial numbers

2 years agocerttool: use int64_t as type for integers read
Nikos Mavrogiannopoulos [Sun, 4 Jan 2015 19:44:21 +0000 (20:44 +0100)]
certtool: use int64_t as type for integers read

2 years agognutls-cli-debug: more precise handling of SMTP protocol
Nikos Mavrogiannopoulos [Sun, 4 Jan 2015 19:30:39 +0000 (20:30 +0100)]
gnutls-cli-debug: more precise handling of SMTP protocol

Patch by Andreas Metzler.

2 years agoupdated gnulib
Nikos Mavrogiannopoulos [Sun, 4 Jan 2015 10:11:51 +0000 (11:11 +0100)]
updated gnulib

2 years agognutls-cli-debug: corrected the skip of ignored checks
Nikos Mavrogiannopoulos [Fri, 2 Jan 2015 10:49:55 +0000 (12:49 +0200)]
gnutls-cli-debug: corrected the skip of ignored checks

2 years agouse explicit casts in the dummy ip conversion functions
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 20:50:17 +0000 (22:50 +0200)]
use explicit casts in the dummy ip conversion functions

2 years agodoc update
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 20:41:24 +0000 (22:41 +0200)]
doc update

2 years agoARCFOUR-128 is disabled by default
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 20:40:55 +0000 (22:40 +0200)]
ARCFOUR-128 is disabled by default

2 years agodoc update
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 20:38:51 +0000 (22:38 +0200)]
doc update

2 years agodoc update
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 14:53:57 +0000 (16:53 +0200)]
doc update

2 years agosystem-keys-win: use LoadLibraryA to load ncrypt.dll
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:48:06 +0000 (12:48 +0200)]
system-keys-win: use LoadLibraryA to load ncrypt.dll

2 years agoUpdated abi-compliance-checker for 3.4 API
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:23:04 +0000 (12:23 +0200)]
Updated abi-compliance-checker for 3.4 API

2 years agoupdated export symbols list (due to ABI breakage)
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:17:51 +0000 (12:17 +0200)]
updated export symbols list (due to ABI breakage)

2 years agodoc: updated auto-generated files
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:15:16 +0000 (12:15 +0200)]
doc: updated auto-generated files

2 years agogenerate manpages for urls.h and system-keys.h
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:09:41 +0000 (12:09 +0200)]
generate manpages for urls.h and system-keys.h

2 years agotests: added check for gnutls_x509_trust_list_get_issuer_by_dn()
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:07:37 +0000 (12:07 +0200)]
tests: added check for gnutls_x509_trust_list_get_issuer_by_dn()

2 years agoupdated libgnutls.map for new functions
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 10:00:11 +0000 (12:00 +0200)]
updated libgnutls.map for new functions

2 years agodoc: updated auto-generated files and added urls.h
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 09:49:40 +0000 (11:49 +0200)]
doc: updated auto-generated files and added urls.h

2 years agotests: added checks for the new --key-id and --fingerprint certtool options
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 09:17:55 +0000 (11:17 +0200)]
tests: added checks for the new --key-id and --fingerprint certtool options

2 years agocerttool: Added --fingerprint and --key-id options
Nikos Mavrogiannopoulos [Wed, 31 Dec 2014 09:11:40 +0000 (11:11 +0200)]
certtool: Added --fingerprint and --key-id options