summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Generated.gnutls_2_11_3Simon Josefsson2010-10-141-6/+2526
|
* Version 2.11.3.Simon Josefsson2010-10-141-1/+1
|
* Bump versions.Simon Josefsson2010-10-145-4/+14
|
* Indent (using GNU indent 2.2.11).Simon Josefsson2010-10-14250-10497/+11997
|
* bumped versionNikos Mavrogiannopoulos2010-10-083-5/+5
|
* Revert "Applied last patch of Micah Anderson on IKE status."Nikos Mavrogiannopoulos2010-10-081-12/+9
| | | | This reverts commit a6b2f5ce7316b4774649ee9b421da2ee7fef461f.
* removed unneeded code.Nikos Mavrogiannopoulos2010-10-081-35/+0
|
* Applied last patch of Micah Anderson on IKE status.Nikos Mavrogiannopoulos2010-10-081-9/+12
|
* Applied patch on IKE extension by Micah AndersonNikos Mavrogiannopoulos2010-10-021-19/+24
|
* Updated cryptodev code to support the linux cryptodev extensions.Nikos Mavrogiannopoulos2010-10-025-83/+196
| | | | | | Removed the clone() capability from HMAC. It was never used and having it prevents using it with hardware accelerators that might not have this capability.
* Added MicahNikos Mavrogiannopoulos2010-10-021-0/+2
|
* Fix some syntax-check errors.Simon Josefsson2010-10-0117-18/+3
|
* Fix compiler warnings.Simon Josefsson2010-10-013-66/+67
|
* Mention new APIs.Simon Josefsson2010-10-012-1/+4
|
* Avoid bashism.Simon Josefsson2010-09-301-1/+1
| | | | | Reported by m.drochner@fz-juelich.de in <http://savannah.gnu.org/support/?107449>.
* Don't return from void functions.Simon Josefsson2010-09-301-2/+2
| | | | | Reported by Dagobert Michelsen <dam@opencsw.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4566>.
* Remove spurious comma.Simon Josefsson2010-09-301-2/+2
|
* Remove spurious comma.Simon Josefsson2010-09-301-2/+2
|
* Make pkcs8-decode test work on Windows.Simon Josefsson2010-09-302-1/+3
|
* updatedNikos Mavrogiannopoulos2010-09-291-0/+3
|
* treat absence of parameters the same as having them disabled.Nikos Mavrogiannopoulos2010-09-291-2/+1
|
* Corrected behavior on failure (don't crash).Nikos Mavrogiannopoulos2010-09-291-2/+1
|
* Corrected bugs when restoring extensions during session resumtion.Nikos Mavrogiannopoulos2010-09-292-12/+13
|
* Use more informative logging for extensions.Nikos Mavrogiannopoulos2010-09-291-0/+4
|
* Add new extended key usage ipsecIKEMicah Anderson2010-09-298-1/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to RFC 4945 § 5.1.3.12 section title "ExtendedKeyUsage"[0] the following extended key usage has been added: ... this document defines an ExtendedKeyUsage keyPurposeID that MAY be used to limit a certificate's use: id-kp-ipsecIKE OBJECT IDENTIFIER ::= { id-kp 17 } where id-kp is defined in RFC 3280 [5]. If a certificate is intended to be used with both IKE and other applications, and one of the other applications requires use of an EKU value, then such certificates MUST contain either the keyPurposeID id-kp-ipsecIKE or anyExtendedKeyUsage [5], as well as the keyPurposeID values associated with the other applications. Similarly, if a CA issues multiple otherwise-similar certificates for multiple applications including IKE, and it is intended that the IKE certificate NOT be used with another application, the IKE certificate MAY contain an EKU extension listing a keyPurposeID of id-kp-ipsecIKE to discourage its use with the other application. Recall, however, that EKU extensions in certificates meant for use in IKE are NOT RECOMMENDED. Conforming IKE implementations are not required to support EKU. If a critical EKU extension appears in a certificate and EKU is not supported by the implementation, then RFC 3280 requires that the certificate be rejected. Implementations that do support EKU MUST support the following logic for certificate validation: o If no EKU extension, continue. o If EKU present AND contains either id-kp-ipsecIKE or anyExtendedKeyUsage, continue. o Otherwise, reject cert. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* --pkcs11-* in certtool was renamed to --p11-*.Nikos Mavrogiannopoulos2010-09-273-104/+111
|
* Added some comments and removed unused code.Nikos Mavrogiannopoulos2010-09-251-4/+2
|
* Corrected advertizing issue for session tickets.Nikos Mavrogiannopoulos2010-09-252-1/+6
|
* cleanup of TODO list. Removed very old entries, entries already fixed and ↵Nikos Mavrogiannopoulos2010-09-241-15/+1
| | | | added new ones.
* IMED_RET parameters are easier to grasp.Nikos Mavrogiannopoulos2010-09-241-2/+2
|
* cipher,mac and digest priorities moved to crypto.cNikos Mavrogiannopoulos2010-09-245-12/+5
|
* changed the fatality level of some errors.Nikos Mavrogiannopoulos2010-09-231-3/+5
|
* No longer use is_fatal() during handshake. Explicitely treatNikos Mavrogiannopoulos2010-09-231-1/+6
| | | | | | EAGAIN and INTERRUPTED as non-fatal during handshake. If the check_fatal flag is set then GNUTLS_E_WARNING_ALERT_RECEIVED could interrupt a handshake as well.
* fflush stdout and stderr before the call to setbuf. This fixes issue in ↵Nikos Mavrogiannopoulos2010-09-231-0/+3
| | | | solaris where lines dissappeared from output. Reported and suggested fix by Knut Anders Hatlen.
* documented changeNikos Mavrogiannopoulos2010-09-201-0/+8
|
* Corrected bug in wrap_nettle_pk_fixup that was importing DSA keys are RSA ones.Nikos Mavrogiannopoulos2010-09-191-1/+1
|
* indented some codeNikos Mavrogiannopoulos2010-09-192-282/+314
|
* updated revisionNikos Mavrogiannopoulos2010-09-191-1/+1
|
* Add an OpenPGP authentication unit test.Ludovic Courtès2010-09-193-6/+290
| | | | | | | | | * tests/Makefile.am (ctests)[ENABLE_OPENPGP]: Add `openpgp-auth'. (TESTS_ENVIRONMENT): Add `srcdir'. * tests/openpgp-auth.c: New file. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Explicit symmetric cipher state versionning.Jonathan Bastien-Filiatrault2010-09-1717-774/+659
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This introduces the concept of a "cipher epoch". The epoch number is the number of successful handshakes and is incremented by one each time. This concept is native to DTLS and this patch makes the symmetric cipher state explicit for TLS in preparation for DTLS. This concept was implicit in plain TLS and ChangeCipherSpec messages triggered a "pending state copy". Now, we the current epoch number is simply incremented to the parameters negotiated by the handshake. The main side effects of this patch is a slightly more abstract internal API and, in some cases, simpler code. The session blob format is also changed a bit since this patch avoids storing information that is now redundant. If this breaks library users' expectations, this side effect can be negated. The cipher_specs structure has been removed. The conn_state has become record_state_st. Only symmetric cipher information is versioned. Things such as key exchange algorithm and the master secret are not versioned and their handling is unchanged. I have tested this patch as much as I could. It introduces no test suite regressions on my x64 Debian GNU/Linux system. Do not hesitate to point out shortcomings or suggest changes. Since this is a big diff, I am expecting this to be an iterative process. Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Add gnutls_assert_val idiom.Jonathan Bastien-Filiatrault2010-09-171-0/+17
| | | | | | | | | This warrants being made in an inline function or macro since it is used throughout the code. This converts 4 line repetitive blocks into 1 line. Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* updated for 2.11.1Nikos Mavrogiannopoulos2010-09-143-14/+14
|
* Added 3 levels of details in PKCS #11 URLs.Nikos Mavrogiannopoulos2010-09-108-150/+160
| | | | | | 1st level: Token level. Object is unique up to token. 2nd level: Object is unique up to token and module used to access it. 3rd level: Object is unique up to token and module and version of module used to access it.
* Documented changes.Nikos Mavrogiannopoulos2010-09-101-0/+3
|
* Be liberal in the PEM decoding. That is spaces and tabs are being skipped.Nikos Mavrogiannopoulos2010-09-101-8/+4
|
* Fully mbufferize _gnutls_read and _gnutls_read_buffered.Jonathan Bastien-Filiatrault2010-09-091-40/+37
| | | | | Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* mbuffers: Add _mbuffer_xfree operation.Jonathan Bastien-Filiatrault2010-09-091-1/+16
| | | | | Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* mbuffers: make _gnutls_io_read_buffered use mbuffers.Jonathan Bastien-Filiatrault2010-09-095-73/+65
| | | | | | | | This will be needed by the DTLS code to make sure reads are stored in segments that correspond to datagram boundaries. Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Parenthesize size calculations.Jonathan Bastien-Filiatrault2010-09-091-2/+2
| | | | | | | This is standard practice and the DTLS code got bit by this. Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* mbuffers: Add mbuffer_linearize.Jonathan Bastien-Filiatrault2010-09-092-0/+40
| | | | | Signed-off-by: Jonathan Bastien-Filiatrault <joe@x2a.org> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status