summaryrefslogtreecommitdiff
path: root/lib/libgnutls.map
Commit message (Collapse)AuthorAgeFilesLines
* Implements a callback function gnutls_x509_trust_list_set_getissuer_function()Sahana Prasad2020-06-031-0/+8
| | | | Signed-off-by: Sahana Prasad <sahana@redhat.com>
* pkcs7: add function to display signature informationDmitry Baryshkov2020-05-141-0/+1
| | | | | | | Basically export print_pkcs7_info() in a way usable by external applications. Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
* gnutls_ext_get_name2: new functionDaiki Ueno2020-04-211-0/+6
| | | | | | | | This adds a generalized version of gnutls_ext_get_name, which can retrieve the name of the extension, even if it is registered per session. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Merge branch 'tmp-get-keylog-func' into 'master'Daiki Ueno2020-03-251-0/+1
|\ | | | | | | | | gnutls_session_get_keylog_function: new function See merge request gnutls/gnutls!1220
| * gnutls_session_get_keylog_function: new functiontmp-get-keylog-funcDaiki Ueno2020-03-221-0/+1
| | | | | | | | | | | | | | | | This adds a way to retrieve the keylog function set by gnutls_session_set_keylog_function() to allow application protocols to implement custom logging facility. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* | psk: Allow non-NULL PSK usernamesAnder Juaristi2020-03-231-0/+4
|/ | | | | | | | | | | | | | | | | | | | | | | This commit closes #586. Two new functions are introduced: gnutls_psk_server_get_username2() and gnutls_psk_set_client_username2(), which are identical in behavior to those named similarly (without the final '2'), but allow arbitrary gnutls datums (not strings) to be used as usernames. Two new callback functions are also introduced, with their respective setters: gnutls_psk_set_server_credentials_function2() and gnutls_psk_set_client_credentials_function2(). In addition, the password file format is extended so that non-string usernames can be specified. A leading '#' character tells GnuTLS that the username should be interpreted as a raw byte string (encoded in HEX). Example: #deadbeef:9e32cf7786321a828ef7668f09fb35db Signed-off-by: Ander Juaristi's avatarAnder Juaristi <a@juaristi.eus>
* state: add function to get the current hash algorithmtmp-prf-getDaiki Ueno2020-03-191-0/+1
| | | | | | | | This is particularly useful when the application applies key derivation function by itself with the same underlying hash algorithm as the session. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* keylogfile: simplify the callback mechanismtmp-keylog-funcDaiki Ueno2020-02-221-1/+1
| | | | | | | | | | This partially reverts commit 97117556 with a simpler interface. The original intention of having the callback mechanism was to reuse it for monitoring QUIC encryption changes. However, it turned out to be insufficient because such changes must be emitted after a new epoch is ready. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* keylogfile: generalize with a callbacktmp-keylog-hookDaiki Ueno2020-02-071-0/+1
| | | | | | | | | This refactors the keylogfile mechanism by adding a callback to get notified when a new secret is derived and installed. That way, consumers can implement custom logging feature per session, which is particularly useful in QUIC implementation. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add generic crypto functions for KDFDaiki Ueno2020-02-041-0/+8
| | | | | | | | | | This exposes HKDF and PBKDF2 functions from the library. Instead of defining a single KDF interface as in PKCS #11, this patch defines 3 distinct functions for HKDF-Extract, HKDF-Expand, and PBKDF2 derivation, so that we can take advantage of compile time checking of necesssary parameters. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add gnutls_hmac_get_key_size() functionDmitry Eremin-Solenikov2019-12-271-0/+1
| | | | | | Add gnutls_hmac_get_key_size() to retrieve MAC key size. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Export profile ID/name handling functionsNikos Mavrogiannopoulos2019-12-191-0/+7
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests/buffer.c: Add unit test for _gnutls_buffer_unescape()Tim Rühsen2019-10-151-0/+4
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* iov: add _gnutls_iov_iter_sync to write back cached data to iovDaiki Ueno2019-10-061-0/+1
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto-api: add gnutls_aead_cipher_{en,de}cryptv2tmp-encryptv2Daiki Ueno2019-08-091-0/+7
| | | | | | | This adds an in-place equivalent of gnutls_aead_cipher_encrypt() and gnutls_aead_cipher_decrypt(), that works on data buffers. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* iov: add iterator interface for giovec_tDaiki Ueno2019-08-091-0/+3
| | | | | | | This adds an iterator interface over giovec_t array, extracting a fixed sized block. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* lib: add support for gnutls_hash_copy()Dmitry Eremin-Solenikov2019-06-261-0/+1
| | | | | | Add gnutls_hash_copy() function for copying message digest context. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* api: add gnutls_hmac_copy() functionDmitry Eremin-Solenikov2019-06-261-0/+1
| | | | | | | | | Add gnutls_hmac_copy() API to duplicate MAC handler state, which is necessary for SMB3 support. Resolves: #787 Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* config: added ability to override and mark algorithms as disabledNikos Mavrogiannopoulos2019-06-201-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | This allows the system administrator or the distributor to use the gnutls configuration file to mark hashes, signature algorithms, TLS versions, curves, groups, ciphers KX, and MAC algorithms as insecure (the last four only in the context of a TLS session). It also allows to set a minimum profile which the applications cannot fall below. The options intentionally do not allow marking algorithms as secure so that the configuration file cannot be used as an attack vector. This change also makes sure that unsupported and disabled protocols during compile time (e.g., SSL3.0), do not get listed by gnutls-cli. The configuration file feature can be disabled at compile time with an empty --with-system-priority-file. This patch it introduces the function gnutls_get_system_config_file() allowing applications to check whether a configuration file was used. Resolves: #587 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: prf-early fixes the global versionNikos Mavrogiannopoulos2019-05-241-0/+2
| | | | | | | | This allows having fixed data in the hello message involved. That required exposing the variable holding the global gnutls version number for testing. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Add plumbing to handle Q parameter in DH exchangesSimo Sorce2019-05-231-0/+6
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* tests: added unit tests of utc and generalTime convertorNikos Mavrogiannopoulos2019-05-201-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* ext/record_size_limit: distinguish sending and receiving limitstmp-record-sizesDaiki Ueno2019-05-141-1/+7
| | | | | | | | | | | | | | | | The previous behavior was that both sending and receiving limits are negotiated to be the same value. It was problematic when: - client sends a record_size_limit with a large value in CH - server sends a record_size_limit with a smaller value in EE - client updates the limit for both sending and receiving, upon receiving EE - server sends a Certificate message larger than the limit With this patch, each peer maintains the sending / receiving limits separately so not to confuse with the contradicting settings. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* crypto: add private API to retrieve internal IVDaiki Ueno2019-05-031-0/+1
| | | | | | | | | | For FIPS validation purposes, this adds a new function _gnutls_cipher_get_iv() that exposes internal IV after encryption and decryption. The function is not generally useful because the IV value can be easily calculated from the initial IV and the subsequent ciphertext but for FIPS validation purposes. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* prf: add function to retrieve early keying materialDaiki Ueno2019-04-191-0/+1
| | | | | | | | | This adds a new function gnutls_prf_early, which shall be called in a handshake hook waiting for GNUTLS_HANDSHAKE_CLIENT_HELLO. The test needs to be run in a datefudge wrapper as the early secrets depend on the current time (through PSK). Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-131-1/+1
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-151-0/+9
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* Constant time/cache PKCS#1 RSA decryptiontmp-fix-CVE-2018-16868Simo Sorce2018-11-301-0/+1
| | | | | | | | | | | This patch tries to make the code have the same time and memory access aptterns across all branches of the decryption function so that timining or cache side channels are minimized or neutralized. To do so it uses a new nettle rsa decryption function that is side-channel silent. Signed-off-by: Simo Sorce <simo@redhat.com>
* anti_replay: moved new add function into anti_replay structureNikos Mavrogiannopoulos2018-11-151-1/+2
| | | | | | | | | | The new function was not sharing anything with the existing gnutls_db_* backend, and moving it to anti_replay structure is more clean and allows for deviations from the old API conventions (e.g., now we can pass pointers for efficiency and pass the expiration time as part of the call). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-121-0/+6
| | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_set_add_functionDaiki Ueno2018-11-121-0/+1
| | | | | | | This adds a way to store an entry if it is not found in the database, so that the implementation can provide atomic test-and-set. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_check_entry_expire_timeDaiki Ueno2018-11-121-0/+1
| | | | | | | | | | This would be particularly useful when the same database is used to store long-lived TLS 1.2 session data and short-lived TLS 1.3 anti-replay entries. Note that the existing gnutls_db_check_entry doesn't fit in this use-case, as it takes gnutls_session_t as the argument. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* record: introduce new API functions for early dataDaiki Ueno2018-11-111-0/+8
| | | | | | | | This introduces gnutls_record_get_max_early_data_size(), gnutls_record_send_early_data(), and gnutls_record_recv_early_data() functions. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* system: provide a means to replace gettime implementationDaiki Ueno2018-10-261-0/+2
| | | | | | | | | While gettime() is extensively used in the code, the library previously hadn't provided a way to replace it for testing. This adds a new internal function _gnutls_global_set_gettime_function and makes use of it through virt-time.h. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Added session ticket key rotation with TOTPAnder Juaristi2018-09-191-0/+2
| | | | | | | | | | | This introduces session ticket key rotation on server side. The key set with gnutls_session_ticket_enable_server() is used as a master key to generate time-based keys for tickets. The rotation relates to the gnutls_db_set_cache_expiration() period. Resolves #184 Signed-off-by: Ander Juaristi <a@juaristi.eus>
* tls13/psk_ext_parser: simplify the iterator interfaceDaiki Ueno2018-08-231-2/+2
| | | | | | | | Previously it was unclear whether psk_ext_parser_st is stateful or not. This change introduces the simpler API to iterate over the immutable data (psk_ext_parser_st), following the iterator pattern. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Implemented RFC7250 certificate type negotiation extensions.Tom Vrancken2018-08-201-0/+2
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* algorithms: add support for FFDHE6144Daiki Ueno2018-08-081-0/+3
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* TLS 1.3: ignore "early_data" extensionDaiki Ueno2018-08-061-0/+6
| | | | | | | | | | As 0-RTT is still not implemented in GnuTLS, the server responds with 1-RTT, by skipping decryption failure up to max_early_data_size, as suggested in 4.2.10 Early Data Detection. Resolves #512 Signed-off-by: Daiki Ueno <dueno@redhat.com>
* gnutls_priority_init: fix err_pos on invalid stringsNikos Mavrogiannopoulos2018-07-191-0/+1
| | | | | | | | | | | | | | When the provided string would be resolved (e.g., due to a @ priority being used), to a different string, then do not attempt to detect the right location of the error. It will not be useful to the caller. This addresses the issue of test suite failure when --with-system-priority-file and --with-default-priority-string are provided. It also enhances the test suite with these options being active. Resolves #517 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_priority_init2,gnutls_set_default_priority_append: introducedNikos Mavrogiannopoulos2018-07-091-0/+2
| | | | | | | | This allows enhancing the default priority with additional options, allowing an application to introduce stricter (or weaker) settings without requiring it to override all settings. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Add support for importing/exporting GOST private keysDmitry Eremin-Solenikov2018-06-231-0/+4
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Support importing/exporting X.509 GOST public keysDmitry Eremin-Solenikov2018-06-231-0/+3
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Add few functions to support basic operations with GOST public keysDmitry Eremin-Solenikov2018-06-231-0/+5
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* tests: updated supplemental tests for TLS1.3tmp-supplemental-no-tls13Nikos Mavrogiannopoulos2018-06-211-0/+1
| | | | | | | This includes tests that verify that TLS1.3 is not negotiated when supplemental data are set in client and/or server side. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_aead_cipher_encryptv: introducedNikos Mavrogiannopoulos2018-06-141-0/+1
| | | | | | | | | | | This API allows encryption using a scatter input, by also taking advantage of ciphers which are optimized for such input. That is particularly useful under TLS1.3 since its encryption is based on encryption of scattered data (data+pad). Resolves #458 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls_session_ticket_send: new functionNikos Mavrogiannopoulos2018-05-261-0/+1
| | | | | | | Introduced in order for a server to be able to send an arbitrary amount of tickets, at any time. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_pkcs11_token_get_ptr, gnutls_pkcs11_obj_get_ptr: introducedNikos Mavrogiannopoulos2018-05-211-0/+2
| | | | | | | | | This allows an application to open a PKCS#11 token using a URI, and use it directly, bypassing gnutls. That is useful to take advantage of PKCS#11 functionality not wrapped by gnutls but still use PKCS#11 URIs to identify the token. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pcert: added functionality to retrieve listsNikos Mavrogiannopoulos2018-05-121-0/+2
| | | | | | | | | That introduces gnutls_pcert_list_import_x509_file() and gnutls_x509_crt_list_import_url(). Resolves #373 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Simplified the _gnutls13_psk_ext_parser interface and added unit testsNikos Mavrogiannopoulos2018-04-061-0/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
View Lorry Controller Status