summaryrefslogtreecommitdiff
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* algorithms: implement X448 key exchange and Ed448 signature schemeDaiki Ueno2020-01-236-3/+91
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'override-default-priority' into 'master'Nikos Mavrogiannopoulos2020-01-131-0/+16
|\ | | | | | | | | libgnutls: Add system-wide default-priority-string override. See merge request gnutls/gnutls!1158
| * libgnutls: Add system-wide default-priority-string override.Dimitri John Ledkov2020-01-131-0/+16
| | | | | | | | Signed-off-by: Dimitri John Ledkov <xnox@ubuntu.com>
* | Merge branch 'gost-priorities' into 'master'Dmitry Eremin-Solenikov2020-01-122-7/+28
|\ \ | |/ |/| | | | | Extend GOST priority settings and documentation See merge request gnutls/gnutls!1160
| * priority: add new GOST-ALL shortcutDmitry Eremin-Solenikov2020-01-101-0/+5
| | | | | | | | | | | | | | Add GOST-ALL as an alias for CIPHER-GOST-ALL, MAC-GOST-ALL, KX-GOST-ALL, SIGN-GOST-ALL and GROUP-GOST-ALL. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| * priority: add more GOST shortcutsDmitry Eremin-Solenikov2020-01-091-3/+6
| | | | | | | | | | | | | | | | Add shortcuts for GOST ciphers, MACs and KXes. For now they contain only one item, but this list will be expanded as support for GOST-CTR-ACPKM ciphersuites will be added. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| * lib/priority: add SIGN-GOST-ALL keywordDmitry Eremin-Solenikov2020-01-091-0/+1
| | | | | | | | | | | | | | Add SIGN-GOST-ALL keyword containing all defined GOST signature algorithms. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| * doc: document GOST priority optionsDmitry Eremin-Solenikov2020-01-081-4/+5
| | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
| * doc: document GOST cipher and MAC algorithmsDmitry Eremin-Solenikov2020-01-081-0/+11
| | | | | | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* | doc: clarify thread safeness in gnutls_global_init()Nikos Mavrogiannopoulos2020-01-091-1/+3
|/ | | | | | | | | This documents and clarifies the thread safeness of gnutls_global_init() and its constraints. Resolves: #900 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: updated epub.texi from gnutls.texiNikos Mavrogiannopoulos2020-01-031-3/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: updated copyrights for 2020tmp-update-copyrightNikos Mavrogiannopoulos2020-01-011-2/+2
| | | | | | | This updates the copyright year for documentation and excludes gnulib files from the copyright check. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* crypto-api: add gnutls_hmac_get_key_size() functionDmitry Eremin-Solenikov2019-12-272-0/+3
| | | | | | Add gnutls_hmac_get_key_size() to retrieve MAC key size. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* updated auto-generated filesNikos Mavrogiannopoulos2019-12-192-0/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: document GROUP-GOST-ALL keywordDmitry Eremin-Solenikov2019-12-181-3/+3
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* gnutls_session_get_data2: fix operation without a timeout callbackNikos Mavrogiannopoulos2019-09-261-1/+3
| | | | | | | | | | | | | When TLS1.3 was introduced, gnutls_session_get_data2 was modified to assume that the callbacks set included the timeout one which was not previously necessary except for some special cases. This corrects that issue and makes sure that gnutls_session_get_data2() does not fail (but not necessarily succeed), if that timeout callback is not set. Resolves: #823 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* guile: Add support for Guile 3.0.Ludovic Courtès2019-09-161-3/+3
| | | | | | | | | * configure.ac: Add 3.0 to 'GUILE_PKG', as well as the previously-supported versions. * doc/gnutls-guile.texi (Guile Preparations): Update list of supported versions. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* doc: Run guile with '-q'.Ludovic Courtès2019-09-161-2/+2
| | | | | | | | This makes sure we don't load the user's ~/.guile. * doc/Makefile.am (GUILE_FOR_BUILD): Pass '-q'. Signed-off-by: Ludovic Courtès <ludo@gnu.org>
* crypto-api: add gnutls_aead_cipher_{en,de}cryptv2tmp-encryptv2Daiki Ueno2019-08-092-0/+6
| | | | | | | This adds an in-place equivalent of gnutls_aead_cipher_encrypt() and gnutls_aead_cipher_decrypt(), that works on data buffers. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls.h: mark AEAD ciphers as such in gnutls_cipher_algorithm_t descriptionNikos Mavrogiannopoulos2019-07-221-6/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Align _gnutls_x86_cpuid_s as OPENSSL_ia32cap_P would beNikos Mavrogiannopoulos2019-06-271-0/+1
| | | | | | | | | | | | We were not setting the third array member correctly, though this didn't have any impact to previous implementations as they did not rely on it. This also moves away from the custom implementation of cpuid (which was limited), and we now rely on the compiler's version. This effectively enables support for SHA_NI. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* lib: add support for gnutls_hash_copy()Dmitry Eremin-Solenikov2019-06-262-0/+3
| | | | | | Add gnutls_hash_copy() function for copying message digest context. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* api: add gnutls_hmac_copy() functionDmitry Eremin-Solenikov2019-06-262-0/+3
| | | | | | | | | Add gnutls_hmac_copy() API to duplicate MAC handler state, which is necessary for SMB3 support. Resolves: #787 Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* updated auto-generated filesNikos Mavrogiannopoulos2019-06-202-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* config: added ability to override and mark algorithms as disabledNikos Mavrogiannopoulos2019-06-204-2/+163
| | | | | | | | | | | | | | | | | | | | | | | | | This allows the system administrator or the distributor to use the gnutls configuration file to mark hashes, signature algorithms, TLS versions, curves, groups, ciphers KX, and MAC algorithms as insecure (the last four only in the context of a TLS session). It also allows to set a minimum profile which the applications cannot fall below. The options intentionally do not allow marking algorithms as secure so that the configuration file cannot be used as an attack vector. This change also makes sure that unsupported and disabled protocols during compile time (e.g., SSL3.0), do not get listed by gnutls-cli. The configuration file feature can be disabled at compile time with an empty --with-system-priority-file. This patch it introduces the function gnutls_get_system_config_file() allowing applications to check whether a configuration file was used. Resolves: #587 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: updated p11-kit links [ci skip]Nikos Mavrogiannopoulos2019-06-163-4/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: do not distribute pdf filesNikos Mavrogiannopoulos2019-05-281-2/+2
| | | | | | | It compicates the 'make dist' phase and does not add much value as the files are available from the web site. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* minor updates in the latex version of the manual [ci skip]Nikos Mavrogiannopoulos2019-05-276-6/+15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Add plumbing to handle Q parameter in DH exchangesSimo Sorce2019-05-233-0/+8
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Added profile to correspond to the future security parameterNikos Mavrogiannopoulos2019-05-201-1/+1
| | | | | | | | | | It seems that the FUTURE security level parameter was added without a corresponding verification profile. This patch address the issue by introducing it. Resolves: #770 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Check all memory allocation in examples and certtooltmp-check-allocationsNikos Mavrogiannopoulos2019-05-143-0/+5
| | | | | | Resolves: #739 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* ext/record_size_limit: distinguish sending and receiving limitstmp-record-sizesDaiki Ueno2019-05-142-0/+3
| | | | | | | | | | | | | | | | The previous behavior was that both sending and receiving limits are negotiated to be the same value. It was problematic when: - client sends a record_size_limit with a large value in CH - server sends a record_size_limit with a smaller value in EE - client updates the limit for both sending and receiving, upon receiving EE - server sends a Certificate message larger than the limit With this patch, each peer maintains the sending / receiving limits separately so not to confuse with the contradicting settings. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* prf: add function to retrieve early keying materialDaiki Ueno2019-04-192-0/+3
| | | | | | | | | This adds a new function gnutls_prf_early, which shall be called in a handshake hook waiting for GNUTLS_HANDSHAKE_CLIENT_HELLO. The test needs to be run in a datefudge wrapper as the early secrets depend on the current time (through PSK). Signed-off-by: Daiki Ueno <dueno@redhat.com>
* handshake: increase the default number of tickets we send to 2tmp-increase-nr-of-ticketsNikos Mavrogiannopoulos2019-03-201-2/+2
| | | | | | | | | | | This makes it easier for clients which perform multiple connections to the server to use the tickets sent by a default server. That's because 2 tickets allow for 2 new connections (if one is using each ticket once as recommended), which in turn lead to 4 new and so on. Resolves: #596 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Update the GNU Free Documentation License (FDL)Tim Rühsen2019-03-131-8/+7
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use https:// for arbitrary files #1Tim Rühsen2019-03-1319-177/+177
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use https:// for www.iana.orgTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use https:// for csrc.nist.govTim Rühsen2019-03-132-2/+2
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-1312-22/+22
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* doc: removed cyclo subdirtmp-remove-doc-cycloNikos Mavrogiannopoulos2019-03-092-38/+1
| | | | | | | | | | This directory had a makefile which was intended to calculate the cyclomatic complexity, however that was not functional, and not related with gnutls' documentation. Resolves: #727 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: added more information on operation under multiple threadsNikos Mavrogiannopoulos2019-03-021-5/+15
| | | | | | Relates: #713 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* priorities: when %NO_EXTENSIONS is specified disable TLS1.3Nikos Mavrogiannopoulos2019-01-251-1/+1
| | | | | | | This makes the behavior of this priority string option well-defined even when TLS1.3 is enabled. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* The flag %NO_EXTENSIONS is disabling extension support while being functionaltmp-fix-no-extensionsNikos Mavrogiannopoulos2019-01-101-1/+2
| | | | | | | | | | | | | That is, the %NO_EXTENSIONS option is the only documented way to disable extensions completely from a session. Clarify that message, mention that its behavior is undefined when combine with TLS1.3, and make sure that it is functional. The latter makes sure that safe renegotiation and extended master secret extensions remain disabled when this flag is given. That simplifies testing certain scenarios under TLS1.0 or TLS1.1 when no extensions must be used. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Fix typos in doc/tmp-fix-typos-in-docTim Rühsen2019-01-039-15/+15
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Update copyright year in doc/gnutls.texiTim Rühsen2019-01-021-2/+2
| | | | | | | | | This fixes the following error of 'make syntax-check': maint.mk: out of date copyright in doc/gnutls.texi; update it make: *** [maint.mk:1201: sc_copyright_check] Error 1 Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* examples: ignore GNUTLS_E_AGAIN or INTERRUPTED errorstmp-fix-examplesNikos Mavrogiannopoulos2018-12-3010-43/+78
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* examples: use a valid DNS nameNikos Mavrogiannopoulos2018-12-304-12/+12
| | | | | | | | | This prevents a gnutls server from sending an unexpected message alert due to invalid DNS name encoding, if the example is not modified. Resolves: #663 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION: deprecatedtmp-no-well-definedNikos Mavrogiannopoulos2018-12-211-0/+5
| | | | | | | | | | | This removes the documented use of this macro. It was non-functional. Given the nature of the definition of the non-well defined date for certificates, it may be wise not to use a special macro at all. The reason is that the no-well defined date is a real date (~year 9999), and any approximation with seconds will be unstable due to irregular leap seconds. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-155-16/+90
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* doc: include PSK examples into documentationNikos Mavrogiannopoulos2018-12-121-0/+21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
View Lorry Controller Status