delta/gnutls.git/lib/priority.c, branch tmp-cli-buffer-term

gnutls_priority_init: fix err_pos on invalid strings

2018-07-19T03:55:14+00:00

When the provided string would be resolved (e.g., due to a @ priority
being used), to a different string, then do not attempt to
detect the right location of the error. It will not be useful to the caller.

This addresses the issue of test suite failure when --with-system-priority-file
and --with-default-priority-string are provided. It also enhances the test suite
with these options being active.

Resolves #517

Signed-off-by: Nikos Mavrogiannopoulos

_gnutls_resolve_priorities: avoid gnu extension for ?: construct

2018-07-14T06:27:26+00:00

Signed-off-by: Nikos Mavrogiannopoulos

priorities: ensure that SSL3.0 enablement fails early when disabled

2018-07-13T06:52:22+00:00

That is, that a priority string with only SSL3.0 present is discarded as
invalid.

Signed-off-by: Nikos Mavrogiannopoulos

gnutls_priority_init2,gnutls_set_default_priority_append: introduced

2018-07-09T10:40:39+00:00

This allows enhancing the default priority with additional
options, allowing an application to introduce stricter (or weaker)
settings without requiring it to override all settings.

Signed-off-by: Nikos Mavrogiannopoulos

configure: added option --enable-tls13-support

2018-07-07T06:26:47+00:00

The new option enables TLS1.3 draft-28 support unconditionally.
Updated the test suite to run when TLS1.3 is enabled by default,
and added a CI run with TLS1.3 enabled.

Resolves #424

Signed-off-by: Nikos Mavrogiannopoulos

priorities: introduced %FORCE_ETM

2018-06-12T07:32:27+00:00

This introduces a priority string option to force encrypt-then-mac
during negotiation, to prevent negotiating the legacy CBC ciphersuites.

Resolves #472

Signed-off-by: Nikos Mavrogiannopoulos

priorities: hmac-sha256 ciphersuites were removed from defaults

2018-06-12T07:31:03+00:00

These ciphersuites are deprecated since the introduction of AEAD
ciphersuites, and are only necessary for compatibility with older
servers. Since older servers already support hmac-sha1 there is
no reason to keep these ciphersuites enabled by default, as they
increase our attack surface.

Relates #456

Signed-off-by: Nikos Mavrogiannopoulos

session tickets: expose {encrypt,decrypt}_ticket as internal API

2018-05-26T04:12:03+00:00

To reuse the same ticket construction in any TLS versions, expose the
private functions in ext/session_ticket.c.

Signed-off-by: Ander Juaristi 
Signed-off-by: Nikos Mavrogiannopoulos

priority: handle RSA-PSK ciphersuites similar to SRP

2018-04-30T06:58:29+00:00

That is, when specified disable TLS1.3.

Signed-off-by: Nikos Mavrogiannopoulos

priority: document the reasons for the order of supported groups [ci skip]

2018-04-16T13:35:38+00:00

Signed-off-by: Nikos Mavrogiannopoulos