Development of GNU's TLS library

Re: [PATCH v2 gnutls] introduce gnutls_certificate_set_x509_system_trust

On 05/08/2012 04:28 PM, Ludwig Nussel wrote:

> gnutls_certificate_set_x509_system_trust() imports the trusted root CA's
> from a compile time defined location. That way applications don't
> need to know.

Applied, thank you.

headers

Toby Inkster | 8 May 14:43

[sr #108051] certtool

URL:
  <http://savannah.gnu.org/support/?108051>

                 Summary: certtool
                 Project: GnuTLS
            Submitted by: tobyink
            Submitted on: Tue 08 May 2012 12:43:26 GMT
                Category: Included programs
                Priority: 5 - Normal
                Severity: 1 - Wish
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
        Operating System: None

    _______________________________________________________

Details:

I'm trying to port a certificate generation script from OpenSSL to GnuTLS. It
would be useful if certtool supported (via the certtool.cfg file) more types
of subjectAltName.

Currently it supports e-mail addresses, domain names and IP addresses. I need
support for URIs, and it would also be nice to have support for OIDs.

    _______________________________________________________

(Continue reading)

headers

Nitin A Kamble | 7 May 21:20

[patch] fix gnutls build with automake 1.12

Attached patch fixes a build issuw of gnutls with automake 1.12

-- 
Nitin A Kamble
www.yoctoproject.org

Upstream-Status: Pending

This patch fixes following kind of issue with automake 1.12

| automake: warnings are treated as errors
|
/srv/home/nitin/builds/build-gcc47/tmp/sysroots/x86_64-linux/usr/share/automake-1.12/am/ltlibrary.am:
warning: 'libgnutls.la': linking libtool libraries using a non-POSIX
|
/srv/home/nitin/builds/build-gcc47/tmp/sysroots/x86_64-linux/usr/share/automake-1.12/am/ltlibrary.am:
archiver requires 'AM_PROG_AR' in 'configure.ac'

Signed-Off-By: Nitin A Kamble <nitin.a.kamble <at> intel.com>
2012/05/03

Index: gnutls-2.12.18/configure.ac
===================================================================
--- gnutls-2.12.18.orig/configure.ac
+++ gnutls-2.12.18/configure.ac
@@ -36,6 +36,9 @@ AC_MSG_RESULT([***

 dnl Checks for programs.

(Continue reading)

headers

Nikos Mavrogiannopoulos | 5 May 19:33

gnutls 2.12.19

Hello,
 I've just released gnutls 2.12.19. It includes several
bug fixes.

Version 2.12.19 (released 2012-05-05)

** libgnutls: When decoding a PKCS #11 URL the pin-source field
is assumed to be a file that stores the pin. Based on patch
by David Smith.

** libgnutls: Added strict tests in Diffie-Hellman and
SRP key exchange public keys.

** minitasn1: Upgraded to libtasn1 version 2.13 (pre-release).

** API and ABI modifications:
No changes since last version.

Getting the Software
====================

GnuTLS may be downloaded from one of the GNU mirror sites or directly
From <ftp://ftp.gnu.org/gnu/gnutls/≥.  The list of GNU mirrors can be
found at <http://www.gnu.org/prep/ftp.html> and a list of GnuTLS mirrors
can be found at <http://www.gnu.org/software/gnutls/download.html>.

Here are the BZIP2 compressed sources:

  ftp://ftp.gnu.org/gnu/gnutls/gnutls-2.12.19.tar.bz2
  http://ftp.gnu.org/gnu/gnutls/gnutls-2.12.19.tar.bz2

(Continue reading)

headers

Francesco Viscomi | 30 Apr 00:10

help me pleasssse

Hi,
i'm trying to install GnuTLS but i'm going to get crazy.

in the directory, where i download the package gnutls-3.0.8, i run ./configure
then
run make
and then
as root run make install

everything seems to goes well, but in the directory -usr/local/bin i not find the script libgnutls-config

--
Ing. Viscomi Francesco

_______________________________________________
Gnutls-devel mailing list
Gnutls-devel <at> gnu.org
https://lists.gnu.org/mailman/listinfo/gnutls-devel

headers

Bjørn Christensen | 25 Apr 15:19

[sr #108038] version 3.0.18 for windows 64 bit crashes during initialisation.

URL:
  <http://savannah.gnu.org/support/?108038>

                 Summary: version 3.0.18 for windows 64 bit crashes during
initialisation.   
                 Project: GnuTLS
            Submitted by: cybear
            Submitted on: Wed 25 Apr 2012 13:19:29 GMT
                Category: Extra library
                Priority: 5 - Normal
                Severity: 3 - Normal
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
        Operating System: Microsoft Windows

    _______________________________________________________

Details:

I have build gnutls version 3.0.18 using nettle version 2.4 and when I call
gnutls_global_init() it calls _gnutls_rnd_init()  and deep down in
--nettle_aes_encrypt() in file aes-encrypt-internal.s:123 I get a segmentation
fault.

If I choose to build libnettle with the option --disable-assembler it works
fine.

I have no clue what is wrong but I am fairly sure it is the assembler code,
probably the calling convention.

I do not know if this is the right place to report this problem.

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/support/?108038>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/

headers

Mann Ern Kang | 25 Apr 05:25

[sr #108037] gnutls_cpuid assembler code follows incorrect calling convention on Windows x64

URL:
  <http://savannah.gnu.org/support/?108037>

                 Summary: gnutls_cpuid assembler code follows incorrect
calling convention on Windows x64
                 Project: GnuTLS
            Submitted by: mannern
            Submitted on: Wed 25 Apr 2012 03:25:56 AM GMT
                Category: Core library
                Priority: 5 - Normal
                Severity: 3 - Normal
                  Status: None
                 Privacy: Public
             Assigned to: None
        Originator Email: 
             Open/Closed: Open
         Discussion Lock: Any
        Operating System: Microsoft Windows

    _______________________________________________________

Details:

The gnutls_cpuid function in file lib\accelerated\x86\coff\cpuid-x86-64-coff.s
follows the Linux parameter passing convention instead of the Windows x64 one,
resulting in a crash (access violation) if hardware acceleration is enabled on
a Windows x64 build of gnutls.

Attaching a patch. This is my first time submitting to gnutls so please let me
know if I missed out anything :)

    _______________________________________________________

File Attachments:

-------------------------------------------------------
Date: Wed 25 Apr 2012 03:25:56 AM GMT  Name: cpuid-x86-64-coff.s  Size: 1kB  
By: mannern

<http://savannah.gnu.org/support/download.php?file_id=25725>

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/support/?108037>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/

headers

Ludovic Courtès | 23 Apr 00:42

Incompatibilities between 3.0.8 and 3.0.18

Hello,

While upgrading libchop from GnuTLS 3.0.8 to 3.0.18, I noticed a few
quirks.

First, compat.h lacks:

    typedef gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_fmt_t
      _GNUTLS_GCC_ATTR_DEPRECATED;

Second, when using OpenPGP mutual authentication,
‘gnutls_certificate_get_peers’ (when called on the server side) now
returns a raw certificate, whereas it previously returned a base64
certificate.

This is in agreement with the doc of that function (dated 2008), but
different from what 3.0.8 and earlier did.

I couldn’t find it in NEWS, nor did I find the commit that changes this,
so I thought it may be worth raising it here.

Thanks,
Ludo’.

_______________________________________________
Gnutls-devel mailing list
Gnutls-devel <at> gnu.org
https://lists.gnu.org/mailman/listinfo/gnutls-devel

headers

Nikos Mavrogiannopoulos | 22 Apr 17:21

gnutls 3.0.19

Hello,
 I've just released gnutls 3.0.19. This is a bug-fix release on the
current stable branch.

* Version 3.0.19 (released 2012-04-22)

** libgnutls: When decoding a PKCS #11 URL the pin-source field
is assumed to be a file that stores the pin. Based on patch
by David Smith.

** libgnutls: gnutls_record_check_pending() no longer
returns unprocessed data, and thus ensure the non-blocking
of the next call to gnutls_record_recv().

** libgnutls: Added strict tests in Diffie-Hellman and
SRP key exchange public keys.

** libgnutls: in ECDSA and DSA TLS 1.2 authentication be less
strict in hash selection, and allow a stronger hash to
be used than the appropriate, to improve interoperability
with openssl.

** tests: Disabled floating point test, and corrections
in pkcs12 decoding tests.

** API and ABI modifications:
No changes since last version.

Getting the Software
====================

GnuTLS may be downloaded from one of the GNU mirror sites or directly
From <ftp://ftp.gnu.org/gnu/gnutls/≥.  The list of GNU mirrors can be
found at <http://www.gnu.org/prep/ftp.html> and a list of GnuTLS mirrors
can be found at <http://www.gnu.org/software/gnutls/download.html>.

Here are the XZ compressed sources:

  ftp://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.xz
  http://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.xz
  ftp://ftp.gnutls.org/pub/gnutls/gnutls-3.0.19.tar.xz

Here are the LZIP compressed sources:

  ftp://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.lz
  http://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.lz
  ftp://ftp.gnutls.org/pub/gnutls/gnutls-3.0.19.tar.lz

Here are OpenPGP detached signatures signed using key 0x96865171:

  ftp://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.xz.sig
  http://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.xz.sig
  ftp://ftp.gnutls.org/pub/gnutls/gnutls-3.0.19.tar.xz.sig

  ftp://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.lz.sig
  http://ftp.gnu.org/gnu/gnutls/gnutls-3.0.19.tar.lz.sig
  ftp://ftp.gnutls.org/pub/gnutls/gnutls-3.0.19.tar.lz.sig

Note that it has been signed with my openpgp key:
pub   3104R/96865171 2008-05-04 [expires: 2028-04-29]
uid                  Nikos Mavrogiannopoulos <nmav <at> gnutls.org>
uid                  Nikos Mavrogiannopoulos <n.mavrogiannopoulos <at>
gmail.com>
sub   2048R/9013B842 2008-05-04 [expires: 2018-05-02]
sub   2048R/1404A91D 2008-05-04 [expires: 2018-05-02]

regards,
Nikos

headers

Patrick Pelletier | 22 Apr 00:53

patch: some more documentation fixes

Here is a commit with some various documentation and comment  
nitpicks.  I've attached the output of "git format-patch" as an  
attachment to this message; I think that worked successfully the last  
time I submitted one of these.

--Patrick

Attachment (0001-documentation-and-comment-fixes.patch): application/octet-stream, 8 KiB

_______________________________________________
Gnutls-devel mailing list
Gnutls-devel <at> gnu.org
https://lists.gnu.org/mailman/listinfo/gnutls-devel

headers

Patrick Pelletier | 21 Apr 06:13

fast compressors for TLS (was lzip vs. xz)

nmav <at> gnutls.org wrote:

LZ4, at http://code.google.com/p/lz4/, although I have not tested it
a all, I'd be interested to see its interaction with TLS. The code looks
x86-centric though.

Snappy is another possible option. (Although at least according to the lz4 benchmarks, snappy doesn't perform quite as well as lz4.) I mention it because a co-worker of mine is using snappy to compress some real-time data between two machines on the same LAN, and he seems very happy with it.

https://code.google.com/p/snappy/

The license should be compatible, although Snappy might not be a good fit for gnutls, because Snappy is written in C++. The Snappy page links to an independent Snappy implementation in C, but I can't speak for that one; my coworker is using the C++ version.

https://github.com/andikleen/snappy-c

I'm afraid I missed the beginning of the conversation. Are you guys planning on standardizing this new compression method in an RFC? (i. e. in the 0-63 "standards action" or 64-223 "specification required" compression methods) Or is this just going to be in the "private use" area (224-255), only for when one gnutls instance is talking to another gnutls instance? It would be nice to have a standardized, fast compression method implemented by more than one TLS library. (Compression seems to be rarely used in TLS; I assume because people feel zlib is too slow.)

--Patrick

_______________________________________________
Gnutls-devel mailing list
Gnutls-devel <at> gnu.org
https://lists.gnu.org/mailman/listinfo/gnutls-devel

15	May 2012
100	April 2012
103	March 2012
140	February 2012
114	January 2012
20	December 2011
43	November 2011
115	October 2011
134	September 2011
76	August 2011
34	July 2011
74	June 2011
55	May 2011
74	April 2011
64	March 2011
87	February 2011
6	January 2011
52	December 2010
134	November 2010
66	October 2010
73	September 2010
51	August 2010
51	July 2010
52	June 2010
46	May 2010
28	April 2010
80	March 2010
47	February 2010
54	January 2010
36	December 2009
76	November 2009
30	October 2009
45	September 2009
132	August 2009
49	July 2009
53	June 2009
98	May 2009
59	April 2009
27	March 2009
36	February 2009
65	January 2009
28	December 2008
113	November 2008
64	October 2008
85	September 2008
64	August 2008
30	July 2008
108	June 2008
90	May 2008
65	April 2008
65	March 2008
65	February 2008
97	January 2008
22	December 2007
71	November 2007
28	October 2007
37	September 2007
58	August 2007
29	July 2007
99	June 2007
140	May 2007
119	April 2007
19	March 2007
50	February 2007
24	January 2007
24	December 2006
46	November 2006
17	October 2006
43	September 2006
35	August 2006
19	July 2006
34	June 2006
20	May 2006
1	April 2006
25	March 2006
20	February 2006
71	January 2006
34	December 2005
20	November 2005
18	October 2005
5	September 2005
7	August 2005
6	July 2005
11	June 2005
15	May 2005
16	April 2005
17	March 2005
10	February 2005
14	January 2005
8	December 2004
8	November 2004
52	October 2004
1	September 2004
36	August 2004
22	July 2004
4	June 2004
11	May 2004
16	April 2004
8	March 2004
13	February 2004
6	January 2004
34	December 2003
23	November 2003
42	October 2003
11	September 2003
11	August 2003
2	July 2003
5	June 2003
9	May 2003
17	April 2003
46	March 2003
8	February 2003
7	January 2003
5	December 2002
13	November 2002
25	October 2002
8	September 2002
13	August 2002
14	July 2002
9	June 2002
8	May 2002
5	April 2002
20	March 2002
31	February 2002
19	January 2002
19	December 2001
35	November 2001
18	October 2001
2	September 2001
24	August 2001
1	July 2001
10	June 2001
8	May 2001
1	March 2001
2	January 2001
3	December 2000
8	November 2000
2	October 2000
2	August 2000
3	July 2000
2	June 2000
6	May 2000
6	April 2000
8	March 2000
12	February 2000

Mon	Tue	Wed	Thu	Fri	Sat	Sun

	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31