summaryrefslogtreecommitdiff
path: root/doc/manpages/Makefile.am
Commit message (Collapse)AuthorAgeFilesLines
* Update symbolsaja-certificate-transparencyAnder Juaristi2021-12-041-0/+6
| | | | Signed-off-by: Ander Juaristi <a@juaristi.eus>
* priority: support allowlisting in configuration fileDaiki Ueno2021-11-291-0/+5
| | | | | | | | | | | | This adds a new mode of interpreting the [overrides] section. If "override-mode" is set to "allowlisting" in the [global] section, all the algorithms (hashes, signature algorithms, curves, and versions) are initially marked as insecure/disabled. Then the user can enable them by specifying allowlisting keywords such as "secure-hash" in the [overrides] section. Signed-off-by: Daiki Ueno <ueno@gnu.org> Co-authored-by: Alexander Sosedkin <asosedkin@redhat.com>
* gnutls_early_{cipher,prf_hash}_get: new functionsDaiki Ueno2021-05-131-0/+2
| | | | Signed-off-by: Daiki Ueno <ueno@gnu.org>
* alert: add callback to intercept alert messagesDaiki Ueno2020-11-191-0/+1
| | | | | | | This adds gnutls_alert_set_read_function(), to allow QUIC implementations to be notified when an alert message is sent. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: add callback to get notified with traffic secret changeDaiki Ueno2020-11-191-0/+1
| | | | | | | | For the use with QUIC, the change of traffic secrets must be notified _after_ a new epoch is set up for reading or writing, and we can't simply reuse the keylog mechanism. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* handshake: add functions to read/write handshake messages directlyDaiki Ueno2020-11-191-0/+2
| | | | | | | | This adds a couple of functions, gnutls_handshake_set_read_function() and gnutls_handshake_write(), to allow QUIC implementations to directly interact with the TLS state machine. Signed-off-by: Daiki Ueno <ueno@gnu.org>
* Adds a new API gnutls_session_set_verify_output_function() that allows TLS ↵Sahana Prasad2020-11-101-0/+1
| | | | | | | | | applications to have a way to pass the gnutls_verify_output_function() as a callback so that the full path of the certificate chain to the trusted root can be avaiable as output. Signed-off-by: Sahana Prasad <sahana@redhat.com>
* src/cli: adds new option '--ca-auto-retrieve' that can be used with ↵Sahana Prasad2020-09-021-0/+2
| | | | | | | | | | gnutls-cli to automatically download missing intermediate CAs in a certificate chain lib/cred-cert.c : adds set and get APIs to get user data in the gnutls_x509_trust_list_set_getissuer_function() callback. Signed-off-by: Sahana Prasad <sahana@redhat.com>
* devel/libgnutls-latest-x86_64.abi, doc, NEWS, and manpage updatesSahana Prasad2020-06-031-0/+1
| | | | Signed-off-by: Sahana Prasad <sahana@redhat.com>
* pkcs7: add function to display signature informationDmitry Baryshkov2020-05-141-0/+1
| | | | | | | Basically export print_pkcs7_info() in a way usable by external applications. Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* gnutls_ext_get_name2: new functionDaiki Ueno2020-04-211-0/+1
| | | | | | | | This adds a generalized version of gnutls_ext_get_name, which can retrieve the name of the extension, even if it is registered per session. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-get-keylog-func' into 'master'Daiki Ueno2020-03-251-0/+1
|\ | | | | | | | | gnutls_session_get_keylog_function: new function See merge request gnutls/gnutls!1220
| * gnutls_session_get_keylog_function: new functiontmp-get-keylog-funcDaiki Ueno2020-03-221-0/+1
| | | | | | | | | | | | | | | | This adds a way to retrieve the keylog function set by gnutls_session_set_keylog_function() to allow application protocols to implement custom logging facility. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | psk: Allow non-NULL PSK usernamesAnder Juaristi2020-03-231-0/+4
|/ | | | | | | | | | | | | | | | | | | | | | | This commit closes #586. Two new functions are introduced: gnutls_psk_server_get_username2() and gnutls_psk_set_client_username2(), which are identical in behavior to those named similarly (without the final '2'), but allow arbitrary gnutls datums (not strings) to be used as usernames. Two new callback functions are also introduced, with their respective setters: gnutls_psk_set_server_credentials_function2() and gnutls_psk_set_client_credentials_function2(). In addition, the password file format is extended so that non-string usernames can be specified. A leading '#' character tells GnuTLS that the username should be interpreted as a raw byte string (encoded in HEX). Example: #deadbeef:9e32cf7786321a828ef7668f09fb35db Signed-off-by: Ander Juaristi's avatarAnder Juaristi <a@juaristi.eus>
* state: add function to get the current hash algorithmtmp-prf-getDaiki Ueno2020-03-191-0/+1
| | | | | | | | This is particularly useful when the application applies key derivation function by itself with the same underlying hash algorithm as the session. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* keylogfile: simplify the callback mechanismtmp-keylog-funcDaiki Ueno2020-02-221-1/+1
| | | | | | | | | | This partially reverts commit 97117556 with a simpler interface. The original intention of having the callback mechanism was to reuse it for monitoring QUIC encryption changes. However, it turned out to be insufficient because such changes must be emitted after a new epoch is ready. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* keylogfile: generalize with a callbacktmp-keylog-hookDaiki Ueno2020-02-071-0/+1
| | | | | | | | | This refactors the keylogfile mechanism by adding a callback to get notified when a new secret is derived and installed. That way, consumers can implement custom logging feature per session, which is particularly useful in QUIC implementation. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add generic crypto functions for KDFDaiki Ueno2020-02-041-0/+3
| | | | | | | | | | This exposes HKDF and PBKDF2 functions from the library. Instead of defining a single KDF interface as in PKCS #11, this patch defines 3 distinct functions for HKDF-Extract, HKDF-Expand, and PBKDF2 derivation, so that we can take advantage of compile time checking of necesssary parameters. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add gnutls_hmac_get_key_size() functionDmitry Eremin-Solenikov2019-12-271-0/+1
| | | | | | Add gnutls_hmac_get_key_size() to retrieve MAC key size. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* updated auto-generated filesNikos Mavrogiannopoulos2019-12-191-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* crypto-api: add gnutls_aead_cipher_{en,de}cryptv2tmp-encryptv2Daiki Ueno2019-08-091-0/+2
| | | | | | | This adds an in-place equivalent of gnutls_aead_cipher_encrypt() and gnutls_aead_cipher_decrypt(), that works on data buffers. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* lib: add support for gnutls_hash_copy()Dmitry Eremin-Solenikov2019-06-261-0/+1
| | | | | | Add gnutls_hash_copy() function for copying message digest context. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* api: add gnutls_hmac_copy() functionDmitry Eremin-Solenikov2019-06-261-0/+1
| | | | | | | | | Add gnutls_hmac_copy() API to duplicate MAC handler state, which is necessary for SMB3 support. Resolves: #787 Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* updated auto-generated filesNikos Mavrogiannopoulos2019-06-201-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Add plumbing to handle Q parameter in DH exchangesSimo Sorce2019-05-231-0/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* ext/record_size_limit: distinguish sending and receiving limitstmp-record-sizesDaiki Ueno2019-05-141-0/+1
| | | | | | | | | | | | | | | | The previous behavior was that both sending and receiving limits are negotiated to be the same value. It was problematic when: - client sends a record_size_limit with a large value in CH - server sends a record_size_limit with a smaller value in EE - client updates the limit for both sending and receiving, upon receiving EE - server sends a Certificate message larger than the limit With this patch, each peer maintains the sending / receiving limits separately so not to confuse with the contradicting settings. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* prf: add function to retrieve early keying materialDaiki Ueno2019-04-191-0/+1
| | | | | | | | | This adds a new function gnutls_prf_early, which shall be called in a handshake hook waiting for GNUTLS_HANDSHAKE_CLIENT_HELLO. The test needs to be run in a datefudge wrapper as the early secrets depend on the current time (through PSK). Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Use https:// for arbitrary files #1Tim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-151-0/+4
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* Constant time/cache PKCS#1 RSA decryptiontmp-fix-CVE-2018-16868Simo Sorce2018-11-301-0/+1
| | | | | | | | | | | This patch tries to make the code have the same time and memory access aptterns across all branches of the decryption function so that timining or cache side channels are minimized or neutralized. To do so it uses a new nettle rsa decryption function that is side-channel silent. Signed-off-by: Simo Sorce <simo@redhat.com>
* updated auto-generated-filestmp-anti-replay-updatesNikos Mavrogiannopoulos2018-11-151-1/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-121-0/+4
| | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_set_add_functionDaiki Ueno2018-11-121-0/+1
| | | | | | | This adds a way to store an entry if it is not found in the database, so that the implementation can provide atomic test-and-set. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_check_entry_expire_timeDaiki Ueno2018-11-121-0/+1
| | | | | | | | | | This would be particularly useful when the same database is used to store long-lived TLS 1.2 session data and short-lived TLS 1.3 anti-replay entries. Note that the existing gnutls_db_check_entry doesn't fit in this use-case, as it takes gnutls_session_t as the argument. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* record: introduce new API functions for early dataDaiki Ueno2018-11-111-0/+3
| | | | | | | | This introduces gnutls_record_get_max_early_data_size(), gnutls_record_send_early_data(), and gnutls_record_recv_early_data() functions. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* manpages: fix manpages distributionDmitry Eremin-Solenikov2018-11-101-7/+17
| | | | | | | | | It seems that dist_man_MANS does not work properly with Automake conditionals. Automake will not distribute files which are conditionally disabled at this make run. As released tarballs include all manpages already, let's include them unconditionally. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* manpages: fix tools manpages generationDmitry Eremin-Solenikov2018-11-101-11/+11
| | | | | | | Pass additional include path to let autogen find common arguments template. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* manpages: un-unroll the loopDmitry Eremin-Solenikov2018-11-101-214/+6
| | | | | | | Replace unrolled loop over header files with for-loop to simplify Makefile. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* manpages: do not generate any manpages for openpgp.htmp-cleanup-in-docsNikos Mavrogiannopoulos2018-09-261-14/+0
| | | | | | | This API is no longer functional and is only available as stubs for backwards binary compatibility. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* manpage generation: cleanupNikos Mavrogiannopoulos2018-09-261-17/+17
| | | | | | | | | | Recognize parameters of the form unsigned char name[8], and do not print obscure warnings. Furthermore gdoc will fail when a function parameter is not described or when no function is found. This addresses the generation of undetected errors in generated manpages. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Implemented RFC7250 certificate type negotiation extensions.Tom Vrancken2018-08-201-0/+2
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* TLS 1.3: ignore "early_data" extensionDaiki Ueno2018-08-061-0/+1
| | | | | | | | | | As 0-RTT is still not implemented in GnuTLS, the server responds with 1-RTT, by skipping decryption failure up to max_early_data_size, as suggested in 4.2.10 Early Data Detection. Resolves #512 Signed-off-by: Daiki Ueno <dueno@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2018-07-091-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Add support for importing/exporting GOST private keysDmitry Eremin-Solenikov2018-06-231-0/+4
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Support importing/exporting X.509 GOST public keysDmitry Eremin-Solenikov2018-06-231-0/+3
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Add few functions to support basic operations with GOST public keysDmitry Eremin-Solenikov2018-06-231-0/+5
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* updated auto-generated filesNikos Mavrogiannopoulos2018-06-141-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Fix 'compare-makefile' make target for 'make distcheck'Tim Rühsen2018-06-141-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* updated auto-generated filesNikos Mavrogiannopoulos2018-05-261-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2018-05-211-0/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status