summaryrefslogtreecommitdiff
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-155-16/+90
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* doc: include PSK examples into documentationNikos Mavrogiannopoulos2018-12-121-0/+21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Constant time/cache PKCS#1 RSA decryptiontmp-fix-CVE-2018-16868Simo Sorce2018-11-302-0/+3
| | | | | | | | | | | This patch tries to make the code have the same time and memory access aptterns across all branches of the decryption function so that timining or cache side channels are minimized or neutralized. To do so it uses a new nettle rsa decryption function that is side-channel silent. Signed-off-by: Simo Sorce <simo@redhat.com>
* doc: suggest to check max_early_data_size before sending early dataDaiki Ueno2018-11-261-5/+11
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* updated auto-generated-filestmp-anti-replay-updatesNikos Mavrogiannopoulos2018-11-152-3/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* anti_replay: moved new add function into anti_replay structureNikos Mavrogiannopoulos2018-11-151-6/+7
| | | | | | | | | | The new function was not sharing anything with the existing gnutls_db_* backend, and moving it to anti_replay structure is more clean and allows for deviations from the old API conventions (e.g., now we can pass pointers for efficiency and pass the expiration time as part of the call). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: mention 0-RTTtmp-0rttDaiki Ueno2018-11-121-0/+142
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* TLS 1.3: implement anti-replay measure using ClientHello recordingDaiki Ueno2018-11-122-0/+12
| | | | | | | This implements ClientHello recording outlined in section 8.2 of RFC 8446. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_set_add_functionDaiki Ueno2018-11-123-1/+4
| | | | | | | This adds a way to store an entry if it is not found in the database, so that the implementation can provide atomic test-and-set. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* db: introduce gnutls_db_check_entry_expire_timeDaiki Ueno2018-11-122-0/+3
| | | | | | | | | | This would be particularly useful when the same database is used to store long-lived TLS 1.2 session data and short-lived TLS 1.3 anti-replay entries. Note that the existing gnutls_db_check_entry doesn't fit in this use-case, as it takes gnutls_session_t as the argument. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* record: introduce new API functions for early dataDaiki Ueno2018-11-112-0/+9
| | | | | | | | This introduces gnutls_record_get_max_early_data_size(), gnutls_record_send_early_data(), and gnutls_record_recv_early_data() functions. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* doc: fix texi generation in out-of-tree buildsDmitry Eremin-Solenikov2018-11-101-10/+10
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* manpages: fix manpages distributionDmitry Eremin-Solenikov2018-11-101-7/+17
| | | | | | | | | It seems that dist_man_MANS does not work properly with Automake conditionals. Automake will not distribute files which are conditionally disabled at this make run. As released tarballs include all manpages already, let's include them unconditionally. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* manpages: fix tools manpages generationDmitry Eremin-Solenikov2018-11-101-11/+11
| | | | | | | Pass additional include path to let autogen find common arguments template. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* manpages: un-unroll the loopDmitry Eremin-Solenikov2018-11-101-214/+6
| | | | | | | Replace unrolled loop over header files with for-loop to simplify Makefile. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* doc: fix documentation generation in out-of-tree buildsDmitry Eremin-Solenikov2018-11-101-1/+1
| | | | | | | gtk-doc will not process gnutls.h.in file, so we need to point it to generated gnutls.h file, found inside builddir. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* doc/credentials: increased key size in RSA client certNikos Mavrogiannopoulos2018-11-072-30/+202
| | | | | | | This is used by the test suite and recent openssl in debian requires a larger certificates. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'ajuaristi-update-docs' into 'master'Nikos Mavrogiannopoulos2018-11-011-4/+15
|\ | | | | | | | | | | | | Update docs for session ticket key rotation Closes #581 See merge request gnutls/gnutls!768
| * Update docs for session ticket key rotation [ci skip]ajuaristi-update-docsAnder Juaristi2018-11-011-4/+15
| | | | | | | | | | | | Fix #581. Signed-off-by: Ander Juaristi <a@juaristi.eus>
* | fips140: aligned code with documentationtmp-fix-fips-modeNikos Mavrogiannopoulos2018-10-231-7/+9
| | | | | | | | | | | | | | That is, we introduce the documented but unimplemented macros GNUTLS_FIPS140_SET_LAX_MODE() and GNUTLS_FIPS140_SET_STRICT_MODE(). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | gnutls_init: added flag for automatic re-authenticationNikos Mavrogiannopoulos2018-10-161-0/+12
|/ | | | | | | | | This introduces the GNUTLS_AUTO_REAUTH gnutls_init() flag and makes re-authentication under TLS simpler to enable and use. Resolves #571 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: fix use of gnutls_ext_raw_parse callback [ci skip]Nikos Mavrogiannopoulos2018-10-041-0/+1
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Merge branch 'tmp-fix-buffer-t' into 'master'Nikos Mavrogiannopoulos2018-09-282-4/+4
|\ | | | | | | | | | | | | Make tlsproxy/buffer.c compilable by gcc 4.4.7 Closes #577 See merge request gnutls/gnutls!763
| * Make tlsproxy/buffer.c compilable by gcc 4.4.7Tim Rühsen2018-09-262-4/+4
| | | | | | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* | manpages: do not generate any manpages for openpgp.htmp-cleanup-in-docsNikos Mavrogiannopoulos2018-09-261-14/+0
| | | | | | | | | | | | | | This API is no longer functional and is only available as stubs for backwards binary compatibility. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* | manpage generation: cleanupNikos Mavrogiannopoulos2018-09-264-36/+48
|/ | | | | | | | | | Recognize parameters of the form unsigned char name[8], and do not print obscure warnings. Furthermore gdoc will fail when a function parameter is not described or when no function is found. This addresses the generation of undetected errors in generated manpages. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: fix reference to invocation nodesAndreas Schwab2018-09-141-6/+6
| | | | Signed-off-by: Andreas Schwab <schwab@suse.de>
* priority: be backwards compatible with priority strings starting with NONENikos Mavrogiannopoulos2018-09-121-4/+4
| | | | | | | | | | | That is, we allow priority strings which do not enable any groups to work, by disabling TLS1.3. For example 'NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-GCM:+SIGN-ALL:+COMP-NULL' is still operational, but no TLS1.3 is enabled when specified. Resolves: #549 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Implemented RFC7250 certificate type negotiation extensions.Tom Vrancken2018-08-203-0/+19
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* doc: document the non-portability of NONE priority stringNikos Mavrogiannopoulos2018-08-151-1/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* algorithms: add support for FFDHE6144Daiki Ueno2018-08-082-1/+5
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* doc: improved text on certificationsNikos Mavrogiannopoulos2018-08-071-7/+4
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: few improvements over certificate validation textNikos Mavrogiannopoulos2018-08-072-5/+8
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* resume: keep persistent session identifiersNikos Mavrogiannopoulos2018-08-071-0/+4
| | | | | | | | | | | | With the introduction of session ticket support (TLS1.2) and TLS1.3, session identifiers have no persistency on server or client side. Improve the situation by introducing persistent session identifiers on server side in a backwards compatible way. Resolves #484 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* TLS 1.3: ignore "early_data" extensionDaiki Ueno2018-08-062-0/+3
| | | | | | | | | | As 0-RTT is still not implemented in GnuTLS, the server responds with 1-RTT, by skipping decryption failure up to max_early_data_size, as suggested in 4.2.10 Early Data Detection. Resolves #512 Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tls1.3: server returns early on handshake when no cert is provided by clientNikos Mavrogiannopoulos2018-08-031-0/+9
| | | | | | | | | | | | Under TLS1.3 the server knows the negotiated keys early, if no client certificate is sent. In that case, the server is not only able to transmit the session ticket immediately after its finished message, but is also able to transmit data, similarly to false start. Resolves #481 Resolves #457 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* examples: tlsproxy: use snprintf instead of strncpyNikos Mavrogiannopoulos2018-07-171-4/+2
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* doc: simplified documentation on threadsNikos Mavrogiannopoulos2018-07-171-14/+13
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* examples: tlsproxy: eliminated warningsNikos Mavrogiannopoulos2018-07-171-9/+15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* The SSL 3.0 protocol is disabled on compile time by defaultNikos Mavrogiannopoulos2018-07-132-1/+6
| | | | | | | | | It can be re-enabled by specifying --enable-ssl3-support on configure script. This is the first step before removing support for the protocol completely. Relates #103 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* doc: update for TLS 1.3Daiki Ueno2018-07-123-22/+53
| | | | Signed-off-by: Daiki Ueno <dueno@redhat.com>
* doc: mention session ticket behavior under TLS1.3Nikos Mavrogiannopoulos2018-07-111-0/+3
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* updated auto-generated filesNikos Mavrogiannopoulos2018-07-092-0/+6
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* gnutls_priority_init2,gnutls_set_default_priority_append: introducedNikos Mavrogiannopoulos2018-07-095-16/+40
| | | | | | | | This allows enhancing the default priority with additional options, allowing an application to introduce stricter (or weaker) settings without requiring it to override all settings. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tlsproxy: included but not as submoduleNikos Mavrogiannopoulos2018-07-029-3/+1432
| | | | | | | This allows updating the example when necessary within the repository and reduces the amount of external dependencies for CI. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tlsproxy: removed submoduleNikos Mavrogiannopoulos2018-07-021-0/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Update .gitignore files according to bootstrapDmitry Eremin-Solenikov2018-06-271-0/+1
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* convert from milliseconds to timespec without loopRolf Eike Beer2018-06-261-7/+2
| | | | Signed-off-by: Rolf Eike Beer <eike@sf-mail.de>
* Add generated GOST credentials for testsDmitry Eremin-Solenikov2018-06-2310-1/+258
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Add support for importing/exporting GOST private keysDmitry Eremin-Solenikov2018-06-232-0/+12
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
View Lorry Controller Status