diff options
author | wiz <wiz> | 2005-12-31 00:02:58 +0000 |
---|---|---|
committer | wiz <wiz> | 2005-12-31 00:02:58 +0000 |
commit | e596fda20a3eca59481d3915adfad1fef162eb2e (patch) | |
tree | b7be2bfaf323e1b02979fa4197e57e25254e2918 | |
parent | ca98c646e3b67fb9de03e1d6021594a49bca9d0f (diff) | |
download | pkgsrc-e596fda20a3eca59481d3915adfad1fef162eb2e.tar.gz |
Update to 1.3.2:
* Version 1.3.2 (released 2005-12-15)
** GnuTLS now support TLS Inner application (TLS/IA).
This is per draft-funk-tls-inner-application-extension-01. This
functionality is added to libgnutls-extra, so it is licensed under the
GNU General Public License.
** New APIs to access the TLS Pseudo-Random-Function (PRF).
The PRF is used by some protocols building on TLS, such as EAP-PEAP
and EAP-TTLS. One function to access the raw PRF and one to access
the PRF seeded with the client/server random fields are provided.
Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
** New APIs to acceess the client and server random fields in a session.
These fields can be useful by protocols using TLS. Note that these
fields are typically used as input to the TLS PRF, and if this is your
intended use, you should use the TLS PRF API that use the
client/server random field directly. Suggested by Jouni Malinen
<jkmaline@cc.hut.fi>.
** Internal type cleanups.
The uint8, uint16, uint32 types have been replaced by uint8_t,
uint16_t, uint32_t. Gnulib is used to guarantee the presence of
correct types on platforms that lack them. The uint type have been
replaced by unsigned.
** API and ABI modifications:
New functions to invoke the TLS Pseudo-Random-Function (PRF):
gnutls_prf
gnutls_prf_raw
New functions to retrieve the session's client and server random values:
gnutls_session_get_server_random
gnutls_session_get_client_random
New function, to perform TLS/IA handshake:
gnutls_ia_handshake
New function to decide whether to do a TLS/IA handshake:
gnutls_ia_handshake_p
New functions to allocate a TLS/IA credential:
gnutls_ia_allocate_client_credentials
gnutls_ia_free_client_credentials
gnutls_ia_allocate_server_credentials
gnutls_ia_free_server_credentials
New functions to handle the AVP callback:
gnutls_ia_set_client_avp_function
gnutls_ia_set_client_avp_ptr
gnutls_ia_get_client_avp_ptr
gnutls_ia_set_server_avp_function
gnutls_ia_set_server_avp_ptr
gnutls_ia_get_server_avp_ptr
New functions, to toggle TLS/IA application phases:
gnutls_ia_require_inner_phase
New function to mix session keys with inner secret:
gnutls_ia_permute_inner_secret
Low-level API (used internally by gnutls_ia_handshake):
gnutls_ia_endphase_send
gnutls_ia_send
gnutls_ia_recv
New functions that can be used after successful TLS/IA negotiation:
gnutls_ia_generate_challenge
gnutls_ia_extract_inner_secret
Enum type with TLS/IA modes:
gnutls_ia_mode_t
Enum type with TLS/IA packet types:
gnutls_ia_apptype_t
Enum values for TLS/IA alerts:
GNUTLS_A_INNER_APPLICATION_FAILURE
GNUTLS_A_INNER_APPLICATION_VERIFICATION
New error codes, to signal when an application phase has finished:
GNUTLS_E_WARNING_IA_IPHF_RECEIVED
GNUTLS_E_WARNING_IA_FPHF_RECEIVED
New error code to signal TLS/IA verify failure:
GNUTLS_E_IA_VERIFY_FAILED
* Version 1.3.1 (released 2005-12-08)
** Support for DHE-PSK cipher suites has been added.
This method offers perfect forward secrecy.
** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
** Corrected a bug in certtool for 64 bit machines. Reported
by Max Kellermann <max@duempel.org>.
** New function to set a X.509 private key and certificate pairs, and/or
CRLs, from an PKCS#12 file, suggested by Emile van Bergen
<emile@e-advies.nl>.
The integrity of the PKCS#12 file is protected through a password
based MAC; public-key based signatures for integrity protection are
not supported. PKCS#12 bags may be encrypted using password derived
symmetric keys, public-key based encryption is not supported. The
PKCS#8 keys may be encrypted using passwords. The API use the same
password for all operations. We believe that any more flexibility
create too much complexity that would hurt overall security, but may
add more PKCS#12 related APIs if real-world experience indicate
otherwise.
** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys,
reported by Emile van Bergen <emile@e-advies.nl>.
This will enable "certtool -k -8" to parse those keys.
** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords.
Use "certtool -p -8" and press press enter at the prompt. Earlier,
certtool would have encrypted the key using an empty password.
** Certtool now accept --password for --key-info and encrypted PKCS#8 keys.
Earlier it would have prompted the user for it, even if --password was
supplied.
** Added self test of PKCS#8 parsing.
Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and
pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in
tests/pkcs8.
** API and ABI modifications:
New function to set X.509 credentials from a PKCS#12 file:
gnutls_certificate_set_x509_simple_pkcs12_file
New gnutls_kx_algorithm_t enum type:
GNUTLS_KX_DHE_PSK
New API to return session data (better data types than
gnutls_session_get_data):
gnutls_session_get_data2
New API to set PSK Diffie-Hellman parameters:
gnutls_psk_set_server_dh_params
* Version 1.3.0 (2005-11-15)
** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added.
This add several new APIs, see below. Read the updated manual for
more information. A new self test "pskself" has been added, that will
test this functionality.
** The session resumption data are now system independent.
** The code has been re-indented to conform to the GNU coding style.
** Removed the RIPEMD ciphersuites.
** Added a discussion of the internals of gnutls in manual.
** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin.
** Remove trailing comma in enums, for IBM C v6, from Albert Chin.
** Make sure config.h is included first in a few files, from Albert Chin.
** Don't use C++ comments ("//") as they are invalid, from Albert Chin.
** Don't install SRP programs and man pages if --disable-srp-authentication,
from Albert Chin.
** API and ABI modifications:
New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK
New gnutls_credentials_type_t credential type:
GNUTLS_CRD_PSK
New credential types:
gnutls_psk_server_credentials_t
gnutls_psk_client_credentials_t
New functions to allocate PSK credentials:
gnutls_psk_allocate_client_credentials
gnutls_psk_free_client_credentials
gnutls_psk_free_server_credentials
gnutls_psk_allocate_server_credentials
New enum type for PSK key flags:
gnutls_psk_key_flags
New function prototypes for credential callback:
gnutls_psk_client_credentials_function
gnutls_psk_server_credentials_function
New function to set PSK username and key:
gnutls_psk_set_client_credentials
New function to set PSK passwd file:
gnutls_psk_set_server_credentials_file
New function to extract PSK user in server:
gnutls_psk_server_get_username
New functions to set PSK callback:
gnutls_psk_set_server_credentials_function
gnutls_psk_set_client_credentials_function
Use size_t instead of int for output size parameter:
gnutls_srp_base64_encode
gnutls_srp_base64_decode
-rw-r--r-- | security/gnutls/Makefile | 4 | ||||
-rw-r--r-- | security/gnutls/PLIST | 46 | ||||
-rw-r--r-- | security/gnutls/distinfo | 8 |
3 files changed, 51 insertions, 7 deletions
diff --git a/security/gnutls/Makefile b/security/gnutls/Makefile index 0b31b090d12..6f2718a4023 100644 --- a/security/gnutls/Makefile +++ b/security/gnutls/Makefile @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.37 2005/12/05 20:50:56 rillig Exp $ +# $NetBSD: Makefile,v 1.38 2005/12/31 00:02:58 wiz Exp $ -DISTNAME= gnutls-1.2.9 +DISTNAME= gnutls-1.3.2 CATEGORIES= security devel MASTER_SITES= http://josefsson.org/gnutls/releases/ \ ftp://ftp.gnutls.org/pub/gnutls/ \ diff --git a/security/gnutls/PLIST b/security/gnutls/PLIST index b1d2727f7ef..5d3e6bec024 100644 --- a/security/gnutls/PLIST +++ b/security/gnutls/PLIST @@ -1,10 +1,11 @@ -@comment $NetBSD: PLIST,v 1.15 2005/09/30 13:11:34 wiz Exp $ +@comment $NetBSD: PLIST,v 1.16 2005/12/31 00:02:58 wiz Exp $ bin/certtool bin/gnutls-cli bin/gnutls-cli-debug bin/gnutls-serv bin/libgnutls-config bin/libgnutls-extra-config +bin/psktool bin/srptool include/gnutls/compat.h include/gnutls/extra.h @@ -22,6 +23,7 @@ man/man1/certtool.1 man/man1/gnutls-cli-debug.1 man/man1/gnutls-cli.1 man/man1/gnutls-serv.1 +man/man1/psktool.1 man/man1/srptool.1 man/man3/gnutls_alert_get.3 man/man3/gnutls_alert_get_name.3 @@ -33,6 +35,7 @@ man/man3/gnutls_anon_free_client_credentials.3 man/man3/gnutls_anon_free_server_credentials.3 man/man3/gnutls_anon_set_params_function.3 man/man3/gnutls_anon_set_server_dh_params.3 +man/man3/gnutls_anon_set_server_params_function.3 man/man3/gnutls_auth_client_get_type.3 man/man3/gnutls_auth_get_type.3 man/man3/gnutls_auth_server_get_type.3 @@ -70,6 +73,7 @@ man/man3/gnutls_certificate_set_x509_crl_mem.3 man/man3/gnutls_certificate_set_x509_key.3 man/man3/gnutls_certificate_set_x509_key_file.3 man/man3/gnutls_certificate_set_x509_key_mem.3 +man/man3/gnutls_certificate_set_x509_simple_pkcs12_file.3 man/man3/gnutls_certificate_set_x509_trust.3 man/man3/gnutls_certificate_set_x509_trust_file.3 man/man3/gnutls_certificate_set_x509_trust_mem.3 @@ -128,6 +132,28 @@ man/man3/gnutls_handshake_get_last_in.3 man/man3/gnutls_handshake_get_last_out.3 man/man3/gnutls_handshake_set_max_packet_length.3 man/man3/gnutls_handshake_set_private_extensions.3 +man/man3/gnutls_hex_decode.3 +man/man3/gnutls_hex_encode.3 +man/man3/gnutls_ia_allocate_client_credentials.3 +man/man3/gnutls_ia_allocate_server_credentials.3 +man/man3/gnutls_ia_endphase_send.3 +man/man3/gnutls_ia_extract_inner_secret.3 +man/man3/gnutls_ia_free_client_credentials.3 +man/man3/gnutls_ia_free_server_credentials.3 +man/man3/gnutls_ia_generate_challenge.3 +man/man3/gnutls_ia_get_client_avp_ptr.3 +man/man3/gnutls_ia_get_server_avp_ptr.3 +man/man3/gnutls_ia_handshake.3 +man/man3/gnutls_ia_handshake_p.3 +man/man3/gnutls_ia_permute_inner_secret.3 +man/man3/gnutls_ia_recv.3 +man/man3/gnutls_ia_require_inner_phase.3 +man/man3/gnutls_ia_send.3 +man/man3/gnutls_ia_set_client_avp_function.3 +man/man3/gnutls_ia_set_client_avp_ptr.3 +man/man3/gnutls_ia_set_server_avp_function.3 +man/man3/gnutls_ia_set_server_avp_ptr.3 +man/man3/gnutls_ia_verify_endphase.3 man/man3/gnutls_init.3 man/man3/gnutls_kx_get.3 man/man3/gnutls_kx_get_name.3 @@ -208,9 +234,23 @@ man/man3/gnutls_pkcs7_set_crl.3 man/man3/gnutls_pkcs7_set_crl_raw.3 man/man3/gnutls_pkcs7_set_crt.3 man/man3/gnutls_pkcs7_set_crt_raw.3 +man/man3/gnutls_prf.3 +man/man3/gnutls_prf_raw.3 man/man3/gnutls_protocol_get_name.3 man/man3/gnutls_protocol_get_version.3 man/man3/gnutls_protocol_set_priority.3 +man/man3/gnutls_psk_allocate_client_credentials.3 +man/man3/gnutls_psk_allocate_server_credentials.3 +man/man3/gnutls_psk_free_client_credentials.3 +man/man3/gnutls_psk_free_server_credentials.3 +man/man3/gnutls_psk_server_get_username.3 +man/man3/gnutls_psk_set_client_credentials.3 +man/man3/gnutls_psk_set_client_credentials_function.3 +man/man3/gnutls_psk_set_params_function.3 +man/man3/gnutls_psk_set_server_credentials_file.3 +man/man3/gnutls_psk_set_server_credentials_function.3 +man/man3/gnutls_psk_set_server_dh_params.3 +man/man3/gnutls_psk_set_server_params_function.3 man/man3/gnutls_record_check_pending.3 man/man3/gnutls_record_get_direction.3 man/man3/gnutls_record_get_max_size.3 @@ -230,9 +270,12 @@ man/man3/gnutls_rsa_params_import_raw.3 man/man3/gnutls_rsa_params_init.3 man/man3/gnutls_server_name_get.3 man/man3/gnutls_server_name_set.3 +man/man3/gnutls_session_get_client_random.3 man/man3/gnutls_session_get_data.3 +man/man3/gnutls_session_get_data2.3 man/man3/gnutls_session_get_id.3 man/man3/gnutls_session_get_ptr.3 +man/man3/gnutls_session_get_server_random.3 man/man3/gnutls_session_is_resumed.3 man/man3/gnutls_session_set_data.3 man/man3/gnutls_session_set_ptr.3 @@ -386,6 +429,7 @@ share/examples/gnutls/ex-alert.c share/examples/gnutls/ex-cert-select.c share/examples/gnutls/ex-client-resume.c share/examples/gnutls/ex-client-srp.c +share/examples/gnutls/ex-client-tlsia.c share/examples/gnutls/ex-client1.c share/examples/gnutls/ex-client2.c share/examples/gnutls/ex-crq.c diff --git a/security/gnutls/distinfo b/security/gnutls/distinfo index a4f9f31cfbc..b49b73cd2b9 100644 --- a/security/gnutls/distinfo +++ b/security/gnutls/distinfo @@ -1,6 +1,6 @@ -$NetBSD: distinfo,v 1.22 2005/11/14 18:17:49 wiz Exp $ +$NetBSD: distinfo,v 1.23 2005/12/31 00:02:58 wiz Exp $ -SHA1 (gnutls-1.2.9.tar.bz2) = 7229d094de83cabd572fcaab806ab3afc6b58959 -RMD160 (gnutls-1.2.9.tar.bz2) = 4df467450ee2a3eaa509fb1f58dde41b81fcbb81 -Size (gnutls-1.2.9.tar.bz2) = 2720067 bytes +SHA1 (gnutls-1.3.2.tar.bz2) = f0bc87bb29591b710d63699896cb26f539a47e6b +RMD160 (gnutls-1.3.2.tar.bz2) = 0b482d2fd835fb48b223bf5c9ef0c7fdae4f0b4f +Size (gnutls-1.3.2.tar.bz2) = 3173209 bytes SHA1 (patch-ab) = df9d588891ff88c41f297fa595d618c31dc8ef97 |