2012-05-21 14:00:42 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon May 21 11:33:29 UTC 2012 - meissner@suse.com
|
|
|
|
|
|
|
|
|
|
- let libgnutls-devel also provide gnutls-devel
|
|
|
|
|
|
2012-05-21 10:25:22 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sun May 13 02:44:30 UTC 2012 - Nico.Laus.2001@gmx.de
|
|
|
|
|
|
|
|
|
|
- Update to version 3.0.19:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- When decoding a PKCS #11 URL the pin-source field
|
|
|
|
|
is assumed to be a file that stores the pin. Based on patch
|
|
|
|
|
by David Smith.
|
|
|
|
|
- gnutls_record_check_pending() no longer
|
|
|
|
|
returns unprocessed data, and thus ensure the non-blocking
|
|
|
|
|
of the next call to gnutls_record_recv().
|
|
|
|
|
- Added strict tests in Diffie-Hellman and
|
|
|
|
|
SRP key exchange public keys.
|
|
|
|
|
- in ECDSA and DSA TLS 1.2 authentication be less
|
|
|
|
|
strict in hash selection, and allow a stronger hash to
|
|
|
|
|
be used than the appropriate, to improve interoperability
|
|
|
|
|
with openssl.
|
|
|
|
|
+ tests:
|
|
|
|
|
- Disabled floating point test, and corrections
|
|
|
|
|
in pkcs12 decoding tests.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.18:
|
|
|
|
|
+ certtool:
|
|
|
|
|
- Avoid a Y2K38 bug when generating certificates.
|
|
|
|
|
Patch by Robert Millan.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Make sure that GNUTLS_E_PREMATURE_TERMINATION
|
|
|
|
|
- is returned on premature termination (and added unit test).
|
|
|
|
|
- Fixes for W64 API. Patch by B. Scott Michel.
|
|
|
|
|
- Corrected VIA padlock detection for old
|
|
|
|
|
VIA processors. Reported by Kris Karas.
|
|
|
|
|
- Updated assembler files.
|
|
|
|
|
- Time in generated certificates is stored
|
|
|
|
|
as GeneralizedTime instead of UTCTime (which only stores
|
|
|
|
|
2 digits of a year).
|
|
|
|
|
+ minitasn1:
|
|
|
|
|
- Upgraded to libtasn1 version 2.13 (pre-release).
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_x509_crt_set_private_key_usage_period: Added
|
|
|
|
|
- gnutls_x509_crt_get_private_key_usage_period: Added
|
|
|
|
|
- gnutls_x509_crq_set_private_key_usage_period: Added
|
|
|
|
|
- gnutls_x509_crq_get_private_key_usage_period: Added
|
|
|
|
|
- gnutls_session_get_random: Added
|
|
|
|
|
- Changes from version 3.0.17:
|
|
|
|
|
+ command line apps:
|
|
|
|
|
- Always link with local libopts.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.16:
|
|
|
|
|
+ minitasn1:
|
|
|
|
|
- Upgraded to libtasn1 version 2.12 (pre-release).
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Corrected SRP-RSA ciphersuites when used under TLS 1.2.
|
|
|
|
|
- included assembler files for MacOSX.
|
|
|
|
|
+ p11tool:
|
|
|
|
|
- Small fixes in handling of the --private command
|
|
|
|
|
line option.
|
|
|
|
|
+ certtool:
|
|
|
|
|
- The template option allows for setting the domain
|
|
|
|
|
component (DC) option of the distinguished name, and the ocsp_uri
|
|
|
|
|
as well as the ca_issuers_uri options.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_x509_crt_set_authority_info_access: Added
|
|
|
|
|
- Changes from version 3.0.15:
|
|
|
|
|
+ test suite:
|
|
|
|
|
- Only run under valgrind in the development
|
|
|
|
|
system (the full git repository)
|
|
|
|
|
+ command line apps:
|
|
|
|
|
- Link with local libopts if the installed is an old one.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Eliminate double free during SRP
|
|
|
|
|
authentication. Reported by Peter Penzov.
|
|
|
|
|
- Corrections in record packet parsing.
|
|
|
|
|
Reported by Matthew Hall.
|
|
|
|
|
- Cryptodev updates and fixes.
|
|
|
|
|
- Corrected issue with select() that affected
|
|
|
|
|
FreeBSD. This prevented establishing DTLS sessions.
|
|
|
|
|
Reported by Andreas Metzler.
|
|
|
|
|
- Corrected rehandshake and resumption
|
|
|
|
|
operations in DTLS. Reported by Sean Buckheister.
|
|
|
|
|
- PKCS #11 objects that do not have ID
|
|
|
|
|
no longer crash listing. Reported by Sven Geggus.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.14:
|
|
|
|
|
+ command line apps:
|
|
|
|
|
- Included libopts doesn't get installed by default.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Eliminate double free on wrongly formatted
|
|
|
|
|
certificate list. Reported by Remi Gacogne.
|
|
|
|
|
- cryptodev code corrected, updated to account
|
|
|
|
|
for hashes and GCM mode.
|
|
|
|
|
Eliminated memory leak in PCKS #11 initialization.
|
|
|
|
|
Report and fix by Sam Varshavchik.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.13:
|
|
|
|
|
+ gnutls-cli:
|
|
|
|
|
- added the --ocsp option which will verify
|
|
|
|
|
the peer's certificate with OCSP.
|
|
|
|
|
- added the --tofu and if specified, gnutls-cli
|
|
|
|
|
will use an ssh-style authentication method.
|
|
|
|
|
- if no --x509cafile is provided a default is
|
|
|
|
|
assumed (/etc/ssl/certs/ca-certificates.crt), if it exists.
|
|
|
|
|
+ ocsptool:
|
|
|
|
|
- Added --ask parameter, to verify a certificate's
|
|
|
|
|
status from an ocsp server.
|
|
|
|
|
+ command line apps:
|
|
|
|
|
- Use gnu autogen (libopts) to parse command
|
|
|
|
|
line arguments and template files.
|
|
|
|
|
+ tests:
|
|
|
|
|
- Added stress test for DTLS packet losses and
|
|
|
|
|
out-of-order receival. Contributed by Sean Buckheister.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Several updates and corrections in the DTLS
|
|
|
|
|
DTLS lost packet handling and retransmission timeouts.
|
|
|
|
|
Report and patches by Sean Buckheister.
|
|
|
|
|
- Added new functions to easily allow the usage of
|
|
|
|
|
a trust on first use (SSH-style) authentication.
|
|
|
|
|
- SUITEB128 and SUITEB192 priority strings account
|
|
|
|
|
for the RFC6460 requirements.
|
|
|
|
|
- Added new security parameter GNUTLS_SEC_PARAM_LEGACY
|
|
|
|
|
to account for security level of 96-bits.
|
|
|
|
|
- In client side if server does not advertise any
|
|
|
|
|
known CAs and only a single certificate is set in the credentials,
|
|
|
|
|
sent that one.
|
|
|
|
|
- Added functions to parse authority key identifiers
|
|
|
|
|
when stored as a 'general name' and serial combo.
|
|
|
|
|
- Added function to force explicit reinitialization
|
|
|
|
|
of PKCS #11 modules. This is required on the child process after
|
|
|
|
|
a fork (if PKCS #11 functionality is desirable).
|
|
|
|
|
- Depend on p11-kit 0.11.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_dtls_get_timeout: Added
|
|
|
|
|
- gnutls_verify_stored_pubkey: Added
|
|
|
|
|
- gnutls_store_pubkey: Added
|
|
|
|
|
- gnutls_store_commitment: Added
|
|
|
|
|
- gnutls_x509_crt_get_authority_key_gn_serial: Added
|
|
|
|
|
- gnutls_x509_crl_get_authority_key_gn_serial: Added
|
|
|
|
|
- gnutls_pkcs11_reinit: Added
|
|
|
|
|
- gnutls_ecc_curve_list: Added
|
|
|
|
|
- gnutls_priority_certificate_type_list: Added
|
|
|
|
|
- gnutls_priority_sign_list: Added
|
|
|
|
|
- gnutls_priority_protocol_list: Added
|
|
|
|
|
- gnutls_priority_compression_list: Added
|
|
|
|
|
- gnutls_priority_ecc_curve_list: Added
|
|
|
|
|
- gnutls_tdb_init: Added
|
|
|
|
|
- gnutls_tdb_set_store_func: Added
|
|
|
|
|
- gnutls_tdb_set_store_commitment_func: Added
|
|
|
|
|
- gnutls_tdb_set_verify_func: Added
|
|
|
|
|
- gnutls_tdb_deinit: Added
|
|
|
|
|
- Changes from version 3.0.12:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Added OCSP support.
|
|
|
|
|
There is a new header file gnutls/ocsp.h and a set of new functions
|
|
|
|
|
under the gnutls_ocsp namespace. Currently the functionality provided
|
|
|
|
|
is to parse and extract information from OCSP requests/responses, to
|
|
|
|
|
generate OCSP requests and to verify OCSP responses. See the manual
|
|
|
|
|
for more information. Run ./configure with --disable-ocsp to build
|
|
|
|
|
GnuTLS without OCSP support.
|
|
|
|
|
This work was sponsored by Smoothwall <http://smoothwall.net/>.
|
|
|
|
|
+ ocsptool:
|
|
|
|
|
- Added new command line tool.
|
|
|
|
|
The tool can parse OCSP request/responses, generate OCSP requests and
|
|
|
|
|
verify OCSP responses. See the manual for more information.
|
|
|
|
|
+ certtool:
|
|
|
|
|
- --outder option now works for private
|
|
|
|
|
and public keys as well.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Added error code GNUTLS_E_NO_PRIORITIES_WERE_SET
|
|
|
|
|
to warn when no or insufficient priorities were set.
|
|
|
|
|
- Corrected an alignment issue in ECDH
|
|
|
|
|
key generation which prevented some keys from being
|
|
|
|
|
correctly aligned in rare circumstances.
|
|
|
|
|
- Corrected memory leaks in DH parameter
|
|
|
|
|
generation and ecc_projective_check_point().
|
|
|
|
|
- Added gnutls_x509_dn_oid_name() to
|
|
|
|
|
return a descriptive name of a DN OID.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_pubkey_encrypt_data: Added
|
|
|
|
|
- gnutls_x509_dn_oid_name: Added
|
|
|
|
|
- gnutls_session_resumption_requested: Added
|
|
|
|
|
- gnutls/ocsp.h: Added new header file.
|
|
|
|
|
- gnutls_ocsp_print_formats_t: Added new type.
|
|
|
|
|
- gnutls_ocsp_resp_status_t: Added new type.
|
|
|
|
|
- gnutls_ocsp_cert_status_t: Added new type.
|
|
|
|
|
- gnutls_x509_crl_reason_t: Added new type.
|
|
|
|
|
- gnutls_ocsp_req_add_cert: Added.
|
|
|
|
|
- gnutls_ocsp_req_add_cert_id: Added.
|
|
|
|
|
- gnutls_ocsp_req_deinit: Added.
|
|
|
|
|
- gnutls_ocsp_req_export: Added.
|
|
|
|
|
- gnutls_ocsp_req_get_cert_id: Added.
|
|
|
|
|
- gnutls_ocsp_req_get_extension: Added.
|
|
|
|
|
- gnutls_ocsp_req_get_nonce: Added.
|
|
|
|
|
- gnutls_ocsp_req_get_version: Added.
|
|
|
|
|
- gnutls_ocsp_req_import: Added.
|
|
|
|
|
- gnutls_ocsp_req_init: Added.
|
|
|
|
|
- gnutls_ocsp_req_print: Added.
|
|
|
|
|
- gnutls_ocsp_req_randomize_nonce: Added.
|
|
|
|
|
- gnutls_ocsp_req_set_extension: Added.
|
|
|
|
|
- gnutls_ocsp_req_set_nonce: Added.
|
|
|
|
|
- gnutls_ocsp_resp_deinit: Added.
|
|
|
|
|
- gnutls_ocsp_resp_export: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_certs: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_extension: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_nonce: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_produced: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_responder: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_response: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_signature: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_signature_algorithm: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_single: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_status: Added.
|
|
|
|
|
- gnutls_ocsp_resp_get_version: Added.
|
|
|
|
|
- gnutls_ocsp_resp_import: Added.
|
|
|
|
|
- gnutls_ocsp_resp_init: Added.
|
|
|
|
|
- gnutls_ocsp_resp_print: Added.
|
|
|
|
|
- gnutls_ocsp_resp_verify: Added.
|
|
|
|
|
- Changes from version 3.0.11:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Corrected functionality of
|
|
|
|
|
gnutls_record_get_direction(). Reported by Philip Allison.
|
|
|
|
|
- Provide less timing information when decoding
|
|
|
|
|
TLS/DTLS record packets. Patch by Nadhem Alfardan.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.10:
|
|
|
|
|
+ gnutls-cli/serv:
|
|
|
|
|
- Set don't fragment bit in DTLS sessions
|
|
|
|
|
in Linux as well as in BSD.
|
|
|
|
|
+ gnutls-cli:
|
|
|
|
|
- Fixed reading from windows terminals.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- When GNUTLS_OPENPGP_FMT_BASE64 is specified
|
|
|
|
|
the stream is assumed to be base64 encoded (previously
|
|
|
|
|
the encoding was auto-detected). This avoids a decoding
|
|
|
|
|
issue in windows systems.
|
|
|
|
|
- Corrected ciphersuite GNUTLS_ECDHE_PSK_AES_256_CBC_SHA384
|
|
|
|
|
- Added ciphersuites: GNUTLS_PSK_WITH_AES_256_GCM_SHA384
|
|
|
|
|
and GNUTLS_DHE_PSK_WITH_AES_256_GCM_SHA384.
|
|
|
|
|
- Added function gnutls_random_art() to convert
|
|
|
|
|
fingerprints to images (currently ascii-art).
|
|
|
|
|
- Corrected bug in DSA private key parsing, which
|
|
|
|
|
prevented the verification of the key.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_random_art: Added
|
|
|
|
|
- Changes from version 3.0.09:
|
|
|
|
|
+ certtool:
|
|
|
|
|
- Added new parameter --dh-info.
|
|
|
|
|
- -l option was overloaded so if combined with --priority
|
|
|
|
|
it will only list the ciphersuites that are enabled by the given
|
|
|
|
|
priority string.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Added new priority string %SERVER_PRECEDENCE, which
|
|
|
|
|
changes the ciphersuite selection procedure. If specified the server
|
|
|
|
|
priorities will be used for selection instead of the client's.
|
|
|
|
|
- Optimizations in Diffie-Hellman parameters generation
|
|
|
|
|
and key exchange.
|
|
|
|
|
- When session tickets are negotiated and used in a
|
|
|
|
|
session, a server will not store that session data into its cache.
|
|
|
|
|
- Added the SECP192R1 curve.
|
|
|
|
|
- Added gnutls_priority_get_cipher_suite_index() to
|
|
|
|
|
allow listing the ciphersuites enabled in a priority structure.
|
|
|
|
|
It outputs an index to be used in gnutls_get_cipher_suite_info().
|
|
|
|
|
- Optimizations in the elliptic curve code --timing
|
|
|
|
|
attacks resistant code is only used in ECDSA private key operations.
|
|
|
|
|
+ doc:
|
|
|
|
|
- man pages for API functions generation was fixed and are
|
|
|
|
|
now added again in the distribution.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- GNUTLS_ECC_CURVE_SECP192R1: New curve definition
|
|
|
|
|
- gnutls_priority_get_cipher_suite_index: Added
|
|
|
|
|
- Changes from version 3.0.08:
|
|
|
|
|
+ certtool:
|
|
|
|
|
- Certtool -e returns error code on verification failure.
|
|
|
|
|
- Verifies parameters of generated keys.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Corrected ECC key generation (introduced in 3.0.6)
|
|
|
|
|
- Provide less timing information when decoding
|
|
|
|
|
TLS/DTLS record packets.
|
|
|
|
|
+ doc:
|
|
|
|
|
- man pages for API functions were removed.
|
|
|
|
|
The reason was that the code that auto-generated the man pages missed
|
|
|
|
|
many APIs and we couldn't fix it (volunteers welcome). See the info
|
|
|
|
|
manual or the GTK-DOC manual instead.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_x509_privkey_verify_params: Added
|
|
|
|
|
- Changes from version 3.0.07:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Corrected fix in gnutls_session_get_data()
|
|
|
|
|
to report the actual session size when the provided buffer
|
|
|
|
|
is not enough.
|
|
|
|
|
- Fixed ciphersuite GNUTLS_ECDHE_RSA_AES_128_CBC_SHA256,
|
|
|
|
|
which was using a wrong MAC algorithm. Reported by Fabrice Gautier.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.06:
|
|
|
|
|
+ gnutls-guile:
|
|
|
|
|
- Compilation fixes.
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Fixed possible buffer overflow in
|
|
|
|
|
gnutls_session_get_data(). Reported and fix by Alban Crequy.
|
|
|
|
|
- Bug fixes in the ciphersuites with NULL cipher.
|
|
|
|
|
Reported by Fabrice Gautier.
|
|
|
|
|
- Bug fixes in ECC code for 64-bit MIPS systems.
|
|
|
|
|
Thanks to Joseph Graham for providing access to such a system.
|
|
|
|
|
- Correctly report ECC private key parsing errors.
|
|
|
|
|
Reported by Fabrice Gautier.
|
|
|
|
|
- In ECDHE verify that the received point lies on
|
|
|
|
|
the selected curve. The ECDHE ciphersuites now take precendence
|
|
|
|
|
to plain DHE.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.05:
|
|
|
|
|
+ libgnutls-extra:
|
|
|
|
|
- is no more
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Corrections in order to compile with mingw32.
|
|
|
|
|
- Corrections in VIA padlock code for VIA C5 processor
|
|
|
|
|
and new detection of PHE with support for partial hashing.
|
|
|
|
|
- Corrected bug in gnutls_x509_data2hex. Report and fix
|
|
|
|
|
by Vincent Untz.
|
|
|
|
|
+ minitasn1:
|
|
|
|
|
- Upgraded to libtasn1 version 2.10.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- No changes since last version.
|
|
|
|
|
- Changes from version 3.0.04:
|
|
|
|
|
+ gnutls-cli-debug:
|
|
|
|
|
- Added more tests including AES-GCM, SHA256 and elliptic curves.
|
|
|
|
|
+ gnutls-cli:
|
|
|
|
|
- Added --benchmark-soft-ciphers to benchmark
|
|
|
|
|
the software version of the ciphers instead of hw accelerated
|
|
|
|
|
(where available)
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Public key ID calculation is consistent among
|
|
|
|
|
all structures. It uses a SHA-1 hash of the subjectPublicKeyInfo.
|
|
|
|
|
- gnutls_privkey_t allows setting external callback
|
|
|
|
|
to perform signing or decryption. Can be set using
|
|
|
|
|
gnutls_privkey_import_ext()
|
|
|
|
|
- A certificate credentials structure can be
|
|
|
|
|
used with a gnutls_privkey_t and a gnutls_pcert_st
|
|
|
|
|
structure using gnutls_certificate_set_key().
|
|
|
|
|
- Fixes to enable external signing callback to
|
|
|
|
|
operate with TLS 1.2.
|
|
|
|
|
- Fixed crash when printing ECDSA certificate key
|
|
|
|
|
ID. Reported by Erik Jensen.
|
|
|
|
|
- Corrected VIA padlock code for C3. In C3 benchmarks
|
|
|
|
|
show a 2x increase in AES speed and a 14x increase in VIA nano. Added
|
|
|
|
|
support for hashes and HMACs.
|
|
|
|
|
- Compilation fixed when p11-kit is not detected.
|
|
|
|
|
- Fixed the deflate compression code.
|
|
|
|
|
- Added gnutls_x509_crt_get_authority_info_access.
|
|
|
|
|
Used to get the PKIX Authority Information Access (AIA) field.
|
|
|
|
|
- gnutls_x509_crt_print supports printing AIA fields.
|
|
|
|
|
- Added ability to gnutls_privkey_t to operate with
|
|
|
|
|
signing callback function.
|
|
|
|
|
+ API and ABI modifications:
|
|
|
|
|
- gnutls_x509_crt_get_authority_info_access (x509.h): Added function.
|
|
|
|
|
- gnutls_privkey_import_ext: Added function.
|
|
|
|
|
- gnutls_certificate_set_key: Added function.
|
|
|
|
|
- gnutls_info_access_what_t (x509.h): Added enum.
|
|
|
|
|
- GNUTLS_OID_AIA (x509.h): Added symbol.
|
|
|
|
|
- GNUTLS_OID_AD_OCSP (x509.h): Added symbol.
|
|
|
|
|
- GNUTLS_OID_AD_CAISSUERS (x509.h): Added symbol.
|
|
|
|
|
- Drop CVE-2011-4128.patch, CVE-2012-0390.patch, CVE-2012-1569.patch,
|
|
|
|
|
CVE-2012-1573.patch, gnutls-fix-compression.patch,
|
|
|
|
|
gnutls-fix-crash-on-strcat.patch: all fixed upstream.
|
|
|
|
|
|
2012-04-20 15:16:38 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Apr 12 05:17:04 UTC 2012 - gjhe@suse.com
|
|
|
|
|
|
|
|
|
|
- fix bug[bnc#753301] - VUL-0: gnutls/libtasn1
|
|
|
|
|
"asn1_get_length_der()" DER decoding issue
|
|
|
|
|
CVE-2012-1569
|
|
|
|
|
and bug[bnc#754223] - GenericBlockCipher heap corruption DoS
|
|
|
|
|
CVE-2012-1573
|
|
|
|
|
|
2012-02-21 12:38:08 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Feb 13 06:09:57 UTC 2012 - gjhe@suse.com
|
|
|
|
|
|
|
|
|
|
- fix Bug[bnc#739898] - VUL-1: CVE-2012-0390: GnuTLS DTLS plaintext
|
|
|
|
|
recovery attack.
|
|
|
|
|
|
2011-12-02 16:25:49 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Nov 30 12:43:57 UTC 2011 - vuntz@opensuse.org
|
|
|
|
|
|
|
|
|
|
- Fix licenses (bnc#733661): the applications as well as
|
|
|
|
|
gnutls-extra and gnutls-openssl libraries are under GPL-3.0+
|
|
|
|
|
while the library is LGPL-3.0+.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Nov 30 09:57:27 UTC 2011 - coolo@suse.com
|
|
|
|
|
|
|
|
|
|
- add automake as buildrequire to avoid implicit dependency
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Nov 14 07:29:29 UTC 2011 - gjhe@suse.com
|
|
|
|
|
|
|
|
|
|
- fix #Bug 729486 - gnutls: buffer overflow
|
|
|
|
|
CVE-2011-4128
|
|
|
|
|
|
2011-10-18 14:08:55 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Oct 17 13:21:57 UTC 2011 - vuntz@opensuse.org
|
|
|
|
|
|
|
|
|
|
- Add gnutls-fix-crash-on-strcat.patch: make sure a string is
|
|
|
|
|
nul-terminated before using strcat on it. Fix bnc#724421.
|
|
|
|
|
|
2011-10-11 17:16:18 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Sep 30 15:16:51 UTC 2011 - uli@suse.com
|
|
|
|
|
|
|
|
|
|
- cross-build fix: configure with sysroot
|
|
|
|
|
|
2011-09-26 10:05:51 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sat Sep 24 13:10:41 UTC 2011 - vuntz@opensuse.org
|
|
|
|
|
|
|
|
|
|
- Add gnutls-fix-compression.patch: fix some
|
|
|
|
|
decompression/compression issues that caused connection failures
|
|
|
|
|
to some XMPP servers. Patch taken from git.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Sep 23 10:38:45 CEST 2011 - meissner@suse.de
|
|
|
|
|
|
|
|
|
|
- added libgnutls-devel to baselibs.conf for 32bit Wine on 64bit build
|
|
|
|
|
|
2011-09-22 10:45:50 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Sep 20 16:03:50 UTC 2011 - vuntz@opensuse.org
|
|
|
|
|
|
|
|
|
|
- Update to version 3.0.3:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- Added gnutls_record_get_discarded() to return the number of
|
|
|
|
|
discarded records in a DTLS session.
|
|
|
|
|
- All functions related to RSA-EXPORT were deprecated.
|
|
|
|
|
- Memory leak fixes in credentials private key
|
|
|
|
|
deinitialization.
|
|
|
|
|
- Memory leak fixes in ECC ciphersuites.
|
|
|
|
|
- Do not send an empty extension structure in server hello.
|
|
|
|
|
This affected old implementations that do not support
|
|
|
|
|
extensions.
|
|
|
|
|
- Allow CA importing of 0 certificates to succeed.
|
|
|
|
|
- Added support for VIA padlock AES optimizations. (disabled by
|
|
|
|
|
default)
|
|
|
|
|
- Added support for elliptic curves in PKCS #11.
|
|
|
|
|
- Added gnutls_pkcs11_privkey_generate() to allow generating a
|
|
|
|
|
key in a token.
|
|
|
|
|
- gnutls_transport_set_lowat dummy macro was removed.
|
|
|
|
|
+ p11tool: Added generate-rsa, generate-dsa and generate-ecc
|
|
|
|
|
options to allow generating private keys in the token.
|
|
|
|
|
- Changes from version 3.0.2:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- OpenPGP certificate type is not enabled by default.
|
|
|
|
|
- Added %NO_EXTENSIONS priority string.
|
|
|
|
|
- Corrected issue in gnutls_record_recv() triggered on
|
|
|
|
|
encryption or compression error.
|
|
|
|
|
- Compatibility fixes in CPU ID detection for i386 and old GCC.
|
|
|
|
|
- Corrected parsing of XMPP subject alternative names.
|
|
|
|
|
- Allow for out-of-order ChangeCipherSpec message in DTLS.
|
|
|
|
|
- gnutls_certificate_set_x509_key() and
|
|
|
|
|
gnutls_certificate_set_openpgp_key() operate as in 2.10.x and
|
|
|
|
|
allow the release of the private key during the lifetime of
|
|
|
|
|
the certificate structure.
|
|
|
|
|
+ gnutls-cli: Benchmark applications were incorporated with it.
|
|
|
|
|
- Changes from version 3.0.1:
|
|
|
|
|
+ libgnutls:
|
|
|
|
|
- gnutls_certificate_set_x509_key_file() and friends support
|
|
|
|
|
server name indication. If multiple certificates are set
|
|
|
|
|
using these functions the proper one will be selected during
|
|
|
|
|
a handshake.
|
|
|
|
|
- Added AES-256-GCM which was left out from the previous
|
|
|
|
|
release.
|
|
|
|
|
- When asking for a PKCS# 11 PIN multiple times, the flags in
|
|
|
|
|
the callback were not being updated to reflect for PIN low
|
|
|
|
|
count or final try.
|
|
|
|
|
- Do not allow second instances of PKCS #11 modules.
|
|
|
|
|
- Fixed alignment issue in AES-NI code.
|
|
|
|
|
- The config file at gnutls_pkcs11_init() is being read if
|
|
|
|
|
provided.
|
|
|
|
|
- Ensure that a certificate list specified using
|
|
|
|
|
gnutls_certificate_set_x509_key() and friends, is sorted
|
|
|
|
|
according to TLS specification (from subject to issuer).
|
|
|
|
|
- Added GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED flag for
|
|
|
|
|
gnutls_x509_crt_list_import. It checks whether the list to be
|
|
|
|
|
imported is properly sorted.
|
|
|
|
|
+ crywrap: Added to the distribution. It is an application that
|
|
|
|
|
proxies TLS session to a port using a plaintext service.
|
|
|
|
|
+ Many GTK-DOC improvements.
|
|
|
|
|
+ Updated translations.
|
|
|
|
|
- Drop 0001-Included-appro-s-updates-to-AES-NI.patch,
|
|
|
|
|
0002-Added-note.GNU-stack-to-prevent-marking-the-library-.patch,
|
|
|
|
|
0003-Force-alignment-for-AES-NI-to-the-runtime-rather-tha.patch,
|
|
|
|
|
0006-Added-AES-256-GCM.-Reported-by-Benjamin-Hof.patch: all fixed
|
|
|
|
|
upstream.
|
|
|
|
|
- Drop call to autoreconf: it was only needed for the patches.
|
|
|
|
|
- Add libidn-devel BuildRequires for the new crywrap tool.
|
|
|
|
|
|
2011-08-29 16:45:41 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Aug 29 08:00:03 UTC 2011 - coolo@novell.com
|
|
|
|
|
|
|
|
|
|
- update baselibs.conf
|
|
|
|
|
|
2011-08-24 13:44:12 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Aug 17 22:29:31 UTC 2011 - crrodriguez@opensuse.org
|
|
|
|
|
|
|
|
|
|
- Update to version 3.0.0. many fixes see NEWS for details This
|
|
|
|
|
changelog only describes important package changes or features.
|
|
|
|
|
* Main reason for update is to support Intel AES-NI CPU extensions.
|
|
|
|
|
* Bump sonames in the library package accordingly
|
|
|
|
|
* C++ apps must now buildrequire libgnutls++-devel
|
|
|
|
|
* Software using the openssl emulation must buildrequire
|
|
|
|
|
libgnutls-openssl-devel or better use openssl directly.
|
|
|
|
|
* Upstream no longer uses libgcrypt but libnettle.
|
|
|
|
|
* Upstream now requires the use of p11-kit
|
|
|
|
|
* Add post-release upstream patches critical for improving AES-NI
|
|
|
|
|
support.
|
|
|
|
|
|
2011-06-28 10:10:15 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jun 23 07:09:28 UTC 2011 - gjhe@novell.com
|
|
|
|
|
|
|
|
|
|
- update to stable version 2.10.5
|
|
|
|
|
** libgnutls: Corrected verification of finished messages.
|
|
|
|
|
|
|
|
|
|
** libgnutls: Corrected signature generation and verification
|
|
|
|
|
in the Certificate Verify message when in TLS 1.2. Reported
|
|
|
|
|
by Todd A. Ouska.
|
|
|
|
|
|
|
|
|
|
** pkg-config gnutls.pc improvements.
|
|
|
|
|
The file uses 'Requires.private' for libtasn1 and libz when needed,
|
|
|
|
|
instead of Libs.private. From Andreas Metzler.
|
|
|
|
|
|
|
|
|
|
** gnutls-serv: Corrected a buffer overflow. Reported and patch by Tomas Mraz.
|
|
|
|
|
|
|
|
|
|
** libgnutls: Use ASN1_NULL when writing parameters for RSA signatures.
|
|
|
|
|
This makes us comply with RFC3279. Reported by Michael Rommel.
|
|
|
|
|
|
|
|
|
|
** libgnutls: Reverted default behavior for verification and
|
|
|
|
|
introduced GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT. Thus by default
|
|
|
|
|
V1 trusted CAs are allowed, unless the new flag is specified.
|
|
|
|
|
|
|
|
|
|
** minitasn1: Updated to Libtasn1 2.9.
|
|
|
|
|
|
|
|
|
|
** bgnutls: Correctly add leading zero to PKCS #8 encoded DSA key.
|
|
|
|
|
Reported by Jeffrey Walton.
|
|
|
|
|
|
|
|
|
|
** libgnutls: Corrected memory leak in extension data calculation.
|
|
|
|
|
Reported by Mike Blumenkrantz.
|
|
|
|
|
|
|
|
|
|
** libgnutls: Remove trailing comma in enums in gnutls.h and x509.h.
|
|
|
|
|
|
|
|
|
|
** API and ABI modifications:
|
|
|
|
|
No changes since last version.
|
|
|
|
|
|
2011-06-16 09:56:52 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Oct 11 03:05:58 UTC 2010 - gjhe@novell.com
|
|
|
|
|
|
|
|
|
|
- update to latest stable version 2.10.2
|
|
|
|
|
* tons of changes, see NEWS
|
|
|
|
|
|
2010-04-24 17:22:37 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sat Apr 24 11:38:17 UTC 2010 - coolo@novell.com
|
|
|
|
|
|
|
|
|
|
- buildrequire pkg-config to fix provides
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Apr 15 16:47:31 CEST 2010 - meissner@suse.de
|
|
|
|
|
|
|
|
|
|
- updated to stable 2.8.6
|
|
|
|
|
** libgnutls: For CSRs, don't null pad integers for RSA/DSA value.
|
|
|
|
|
VeriSign rejected CSRs with this padding.
|
|
|
|
|
|
|
|
|
|
Note: As a side effect of this change, the "public key identifier"
|
|
|
|
|
value computed for a certificate using this version of GnuTLS will be
|
|
|
|
|
different from values computed using earlier versions of GnuTLS.
|
|
|
|
|
|
|
|
|
|
** libgnutls: For CSRs on DSA keys, don't add DSA parameters to the
|
|
|
|
|
optional SignatureAlgorithm parameter field.
|
|
|
|
|
VeriSign rejected these CSRs. They are stricly speaking not needed
|
|
|
|
|
since you need the signer's certificate to verify the certificate
|
|
|
|
|
signature anyway.
|
|
|
|
|
|
|
|
|
|
** libgnutls: When checking openpgp self signature also check the signatures
|
|
|
|
|
of all subkeys.
|
|
|
|
|
Ilari Liusvaara noticed and reported the issue and provided test
|
|
|
|
|
vectors as well.
|
|
|
|
|
|
|
|
|
|
** libgnutls: Cleanups and several bug fixes.
|
|
|
|
|
Found by Steve Grubb and Tomas Mraz.
|
|
|
|
|
|
|
|
|
|
** Link libgcrypt explicitly to certtool, gnutls-cli, gnutls-serv.
|
|
|
|
|
|
|
|
|
|
** Fix --disable-valgrind-tests.
|
|
|
|
|
|
|
|
|
|
** examples: Use the new APIs for printing X.509 certificate information.
|
|
|
|
|
|
|
|
|
|
** i18n: Updated Czech, Dutch, French, Polish, Swedish and Vietnamese
|
|
|
|
|
translations. Added Simplified Chinese translation.
|
|
|
|
|
|
2010-04-16 00:22:15 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Apr 6 19:15:22 UTC 2010 - crrodriguez@opensuse.org
|
|
|
|
|
|
|
|
|
|
- use system libtasn1 instead of the bundled copy
|
|
|
|
|
|
2010-02-05 14:05:07 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 4 16:46:45 CET 2010 - meissner@suse.de
|
|
|
|
|
|
|
|
|
|
- some build fixes.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 4 16:44:52 CET 2010 - per@osbeck.com
|
|
|
|
|
|
|
|
|
|
- updated to stable 2.8.5
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Dec 25 22:11:03 CET 2009 - jengelh@medozas.de
|
|
|
|
|
|
|
|
|
|
- add baselibs.conf as a source
|
|
|
|
|
- enable parallel building
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Sep 2 05:52:45 CEST 2009 - gjhe@novell.com
|
|
|
|
|
|
|
|
|
|
- update to lastest stable version 2.8.3
|
|
|
|
|
[bnc#532750]
|
|
|
|
|
|
2009-03-20 19:25:39 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Mar 13 13:37:15 CET 2009 - jshi@suse.de
|
|
|
|
|
|
|
|
|
|
- fix security bug [bnc#457938]
|
|
|
|
|
new CVE-2008-4989
|
|
|
|
|
|
2008-12-15 12:34:16 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Dec 10 12:34:56 CET 2008 - olh@suse.de
|
|
|
|
|
|
|
|
|
|
- use Obsoletes: -XXbit only for ppc64 to help solver during distupgrade
|
|
|
|
|
(bnc#437293)
|
|
|
|
|
|
2008-11-28 15:06:02 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Nov 28 06:53:37 CET 2008 - jshi@suse.de
|
|
|
|
|
|
|
|
|
|
- fix security bug [bnc#441856]
|
|
|
|
|
CVE-2008-4989
|
|
|
|
|
|
2008-11-02 15:41:35 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Oct 30 12:34:56 CET 2008 - olh@suse.de
|
|
|
|
|
|
|
|
|
|
- obsolete old -XXbit packages (bnc#437293)
|
|
|
|
|
|
2008-07-25 00:38:45 +02:00
|
|
|
-------------------------------------------------------------------
|
2008-08-04 00:36:13 +02:00
|
|
|
Sat Aug 2 10:28:21 CEST 2008 - meissner@suse.de
|
|
|
|
|
|
|
|
|
|
- run testsuite
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
2008-07-25 00:38:45 +02:00
|
|
|
Thu Jul 17 15:27:42 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 2.4.1
|
|
|
|
|
* libgnutls: Fix local crash in gnutls_handshake
|
|
|
|
|
* libgnutls: Fix memory leaks when doing a re-handshake
|
|
|
|
|
* Fix compiler warnings
|
|
|
|
|
* Fix ordering of -I's to avoid opencdk.h conflict with
|
|
|
|
|
system headers
|
|
|
|
|
* srptool: Fix a problem where --verify check does not succeed
|
|
|
|
|
- remove C++ wrapper lib, it is not usable without SRP
|
|
|
|
|
- remove patch
|
|
|
|
|
gnutls-1.6.1-srptool.patch
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jul 2 15:49:50 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- remove gnutls main package from baselibs.conf
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jun 26 15:08:38 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 2.4.0
|
|
|
|
|
* The OpenPGP sub-system has been improved and now supports subkeys
|
|
|
|
|
* The PSK sub-system has been improved and now supports password
|
|
|
|
|
derivation and PSK identity hints
|
|
|
|
|
* The certtool --inder and --outder has been replaced
|
|
|
|
|
by --inraw and --outraw
|
|
|
|
|
* New APIs to access the raw X.509 Subject and Issuer DN's and
|
|
|
|
|
elements from the certificate credentials structure
|
|
|
|
|
* New APIs to improve working with username/passwords and PSK
|
|
|
|
|
* Names of constants to affect certificate printing changed
|
|
|
|
|
* The function gnutls_openpgp_privkey_get_id has been renamed to
|
|
|
|
|
gnutls_openpgp_privkey_get_key_id
|
|
|
|
|
* API/ABI changes in GnuTLS 2.4
|
|
|
|
|
All OpenPGP related functions have been moved from
|
|
|
|
|
libgnutls-extra to libgnutls, and several new functions have
|
|
|
|
|
been added
|
|
|
|
|
- remove SRP functionality from C++ wrapper, otherwise it cannot
|
|
|
|
|
be linked against it
|
|
|
|
|
- removed patches
|
|
|
|
|
gnutls-2.2.2-uninitialized.patch
|
|
|
|
|
gnutls-char-signedness.patch
|
|
|
|
|
gnutls-GNUTLS_SA_2008_1.patch
|
|
|
|
|
|
2008-06-25 19:25:04 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Jun 23 10:53:20 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- disable SRP [bnc#65192]
|
|
|
|
|
|
2008-06-03 16:13:23 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed May 21 16:32:26 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- fix three security bugs [bnc#392947]
|
|
|
|
|
CVE-2008-1948 GNUTLS-SA-2008-1-1
|
|
|
|
|
Fix crash when sending invalid server name
|
|
|
|
|
CVE-2008-1949 GNUTLS-SA-2008-1-2
|
|
|
|
|
Fix crash when sending repeated client hellos
|
|
|
|
|
CVE-2008-1950 GNUTLS-SA-2008-1-3
|
|
|
|
|
Fix crash in cipher padding decoding for invalid record lengths
|
|
|
|
|
|
2008-05-08 23:13:43 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu May 8 14:17:41 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- fix build
|
|
|
|
|
|
2008-04-29 23:32:26 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Apr 29 17:43:46 CEST 2008 - cthiel@suse.de
|
|
|
|
|
|
|
|
|
|
- obsolete gnutls-<arch> via baselibs.conf
|
|
|
|
|
|
2008-04-10 14:17:31 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Apr 10 12:54:45 CEST 2008 - ro@suse.de
|
|
|
|
|
|
|
|
|
|
- added baselibs.conf file to build xxbit packages
|
|
|
|
|
for multilib support
|
|
|
|
|
|
2008-04-06 05:50:25 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Apr 3 17:40:32 CEST 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 2.2.2
|
|
|
|
|
* Cipher priority string handling now handle strings that
|
|
|
|
|
starts with NULL
|
|
|
|
|
* Corrected memory leaks in session resuming and DHE ciphersuites
|
|
|
|
|
* Increased the default certificate verification chain limits and
|
|
|
|
|
allowed for checks without limitation
|
|
|
|
|
* Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name()
|
|
|
|
|
and gnutls_x509_crt_get_subject_alt_name() to not null terminate
|
|
|
|
|
binary strings and return the proper size
|
|
|
|
|
|
2008-02-28 01:56:17 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jan 31 11:12:46 CET 2008 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 2.2.1
|
|
|
|
|
* Fixes the post_client_hello_function()
|
|
|
|
|
* Fix for certificate selection in servers with certificate callbacks
|
|
|
|
|
* certtool: Fixed data corruption when using --outder
|
|
|
|
|
* TLS authorization support removed.
|
|
|
|
|
* Corrected bug which did not allow a server to run without
|
|
|
|
|
supporting certificates
|
|
|
|
|
* Introduced gnutls_session_enable_compatibility_mode()
|
|
|
|
|
* Added gnutls_record_disable_padding() to allow servers talking to
|
|
|
|
|
buggy clients
|
|
|
|
|
* Fixed PKCS #3 parameter export
|
|
|
|
|
* Added support for Camellia cipher
|
|
|
|
|
* certtool: Add option --quick-random
|
|
|
|
|
* Added capability to set a callback after the client hello is
|
|
|
|
|
received by the server in order to adjust parameters before
|
|
|
|
|
the handshake
|
|
|
|
|
* certtool: Fixed data corruption when using --outder
|
|
|
|
|
* SRP was corrected to adhere to the latest draft
|
|
|
|
|
* Updated the DN parser
|
|
|
|
|
* Added support for DSA2 using libgcrypt 1.3.0
|
|
|
|
|
* Removed all the trustdb code from openpgp authentication.
|
|
|
|
|
We now use only the well-specified keyrings
|
|
|
|
|
* The gnutls_certificate_set_openpgp_* functions were modified
|
|
|
|
|
to include the format. This makes the interface consistent with
|
|
|
|
|
the x509 functions
|
|
|
|
|
* Introduced gnutls_session_enable_compatibility_mode()
|
|
|
|
|
* Added gnutls_set_default_priority2()
|
|
|
|
|
* Added priority functions that accept strings
|
|
|
|
|
* certtool: Add option --disable-quick-random to enable the
|
|
|
|
|
old behaviour of using /dev/random to generate keys
|
|
|
|
|
* Added the --v1 option to certtool, to allow generating X.509
|
|
|
|
|
version 1 certificates
|
|
|
|
|
* Fix PKCS#3 parameter export problem
|
|
|
|
|
* Fixed GNUTLS_E_UNKNOWN_ALGORITHM vs GNUTLS_E_UNKNOWN_HASH_ALGORITHM
|
|
|
|
|
* gnutls_certificate_set_x509_key_* can now read PKCS #8 unencrypted
|
|
|
|
|
private keys
|
|
|
|
|
* Introduced the GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR error code
|
|
|
|
|
* Added the --to-p8 option to certtool to convert private keys
|
|
|
|
|
to PKCS #8 keys
|
|
|
|
|
* Corrected bug in decompression of expanded compression data
|
|
|
|
|
* The gnutls_*_convert_priority() functions were deprecated
|
|
|
|
|
* gnutls-cli and gnutls-serv now have a --priority option
|
|
|
|
|
* PKCS #8 parser can now encode/decode DSA keys
|
|
|
|
|
* Corrected a segfault when setting an empty gnutls_priority_t
|
|
|
|
|
at gnutls_priority_set()
|
|
|
|
|
* Added gnutls_x509_crt_get_subject_alt_name2()
|
|
|
|
|
* The GPL version has been changed from version 2 to version 3.
|
|
|
|
|
This affects the self-tests, command-line tools, the libgnutls-extra
|
|
|
|
|
library, the relevant guile parts, and the build environment
|
|
|
|
|
- API and ABI modifications, library soname switch from 13 to 26
|
|
|
|
|
- change package structure:
|
|
|
|
|
* branch off libgnutls-extra
|
|
|
|
|
since this is now GPLv3 or later while libgnutls remains
|
|
|
|
|
LGPLv2.1 or later
|
|
|
|
|
* gnutls license change to GPLv3
|
|
|
|
|
- build without lzo support to avoid license problems
|
|
|
|
|
since lzo is currently GPLv2 only
|
|
|
|
|
- removed merged patches:
|
|
|
|
|
gnutls-fix_size_t.patch
|
|
|
|
|
|
2007-10-25 18:10:26 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Oct 23 13:59:25 CEST 2007 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 2.0.1
|
|
|
|
|
- change package layout to conform shlib policy:
|
|
|
|
|
rename gnutls-devel -> libgnutls-devel
|
|
|
|
|
new subpackage libgnutls13
|
|
|
|
|
- removed patches:
|
|
|
|
|
gnutls-1.4.4-sign-callback.patch
|
|
|
|
|
gnutls-1.6.1-compiler_warnings.patch
|
|
|
|
|
|
2007-08-30 22:52:13 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Aug 30 12:35:34 CEST 2007 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- fix srptool [#208227]
|
|
|
|
|
- fix some compiler warnings
|
|
|
|
|
|
2007-08-03 16:29:06 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Aug 3 13:54:37 CEST 2007 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- Some additions for evolution smart card support
|
|
|
|
|
|
2007-05-11 10:36:22 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu May 10 17:21:59 CEST 2007 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- Fix segfault on s390x [#97441]
|
|
|
|
|
gnutls-fix_size_t.patch
|
|
|
|
|
|
2007-04-17 00:33:13 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jan 23 17:29:00 CET 2007 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to new stable branch 1.6.1:
|
|
|
|
|
* Fix the list of trusted CAs that server's send to clients.
|
|
|
|
|
* Fix gnutls_certificate_set_x509_crl to initialize the CRL
|
|
|
|
|
before using it.
|
|
|
|
|
* Encode UID fields in DN's as DirectoryString.
|
|
|
|
|
* Fix ./configure failure with non-GCC compilers.
|
|
|
|
|
* A GnuTLS C++ library is part of the official distribution.
|
|
|
|
|
* New APIs for custom push/pull function error reporting.
|
|
|
|
|
|
2007-01-16 00:15:20 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Oct 24 19:08:36 CEST 2006 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- move developer related docs to devel package and remove
|
|
|
|
|
binary stuff from docs [#212454]
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Sep 19 11:06:39 CEST 2006 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.4.4:
|
|
|
|
|
* bugfix release
|
|
|
|
|
* fixes security vulnerability [#206636] (CVE-2006-4790)
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Aug 31 17:40:43 CEST 2006 - mkoenig@suse.de
|
|
|
|
|
|
|
|
|
|
- update to new stable branch 1.4.1:
|
|
|
|
|
* The command line tools now use getaddrinfo and support IPv6.
|
|
|
|
|
* gnutls-cli can now recognize services and port numbers with
|
|
|
|
|
the -p option.
|
|
|
|
|
* Error messages are now translated using GNU Gettext.
|
|
|
|
|
* GnuTLS now support TLS Inner application (TLS/IA).
|
|
|
|
|
* API and ABI modifications:
|
|
|
|
|
+ Support for DHE-PSK cipher suites has been added.
|
|
|
|
|
+ Removed the RIPEMD ciphersuites.
|
|
|
|
|
+ Remove GnuTLS 0.8.x compatibility functions.
|
|
|
|
|
+ Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have
|
|
|
|
|
been added.
|
|
|
|
|
+ Certtool now generate keys in unencrypted PKCS#8 format for
|
|
|
|
|
empty passwords.
|
|
|
|
|
+ Certtool now accept --password for --key-info and encrypted
|
|
|
|
|
PKCS#8 keys.
|
|
|
|
|
+ gnutls_x509_privkey_import_pkcs8 now accept unencrypted
|
|
|
|
|
PEM PKCS#8 keys,
|
|
|
|
|
+ New function to set a X.509 private key and certificate
|
|
|
|
|
pairs, and/or CRLs, from an PKCS#12 file.
|
|
|
|
|
+ New APIs to acceess the client and server random fields in
|
|
|
|
|
a session.
|
|
|
|
|
+ New APIs to access the TLS Pseudo-Random-Function (PRF).
|
|
|
|
|
+ New API to access the TLS master secret.
|
|
|
|
|
+ The function gnutls_x509_crt_to_xml now return an internal
|
|
|
|
|
error.
|
|
|
|
|
* Several bugfixes:
|
|
|
|
|
+ Corrected a bug in certtool for 64 bit machines.
|
|
|
|
|
+ Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly.
|
|
|
|
|
+ Fix crash in TLS resume code, caused by TLS/IA changes.
|
|
|
|
|
+ Corrected bugs in gnutls_certificate_set_x509_crl() and
|
|
|
|
|
gnutls_certificate_set_x509_trust().
|
|
|
|
|
+ Fixed bug in non-blocking gnutls_bye().
|
|
|
|
|
+ Fix read of out bounds bug in DER parser.
|
|
|
|
|
+ Fixed bug in OpenPGP authentication handshake.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sat Feb 18 00:18:33 CET 2006 - ro@suse.de
|
|
|
|
|
|
|
|
|
|
- cleanup doc directory (.deps,.libs)
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Feb 10 13:01:55 CET 2006 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- Update to version 1.2.10. This release fixes several serious
|
|
|
|
|
bugs that would make the DER decoder in libtasn1 crash on
|
|
|
|
|
invalid input [#149897]. Including:
|
|
|
|
|
|
|
|
|
|
* Corrected a bug in certtool for 64 bit machines.
|
|
|
|
|
|
|
|
|
|
* Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly
|
|
|
|
|
|
|
|
|
|
* Corrected bugs in gnutls_certificate_set_x509_crl() and
|
|
|
|
|
gnutls_certificate_set_x509_trust(), that caused memory
|
|
|
|
|
corruption if more than one certificates were added.
|
|
|
|
|
|
|
|
|
|
* Fixed bug in non-blocking gnutls_bye(). gnutls_record_send()
|
|
|
|
|
will no longer invalidate a session if the underlying send
|
|
|
|
|
fails, but it will prevent future writes.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 25 21:36:17 CET 2006 - mls@suse.de
|
|
|
|
|
|
|
|
|
|
- converted neededforbuild to BuildRequires
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Dec 20 15:04:31 CET 2005 - ro@suse.de
|
|
|
|
|
|
|
|
|
|
- do not package /usr/share/info/dir
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Dec 9 14:26:44 CET 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.2.9
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Oct 25 13:50:11 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.2.8
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Aug 22 12:12:39 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- fix data type comparison [Bug #104617]
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sun Jul 3 16:06:29 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.2.5
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jun 29 10:30:02 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- patch from mrueckert to use external lzo again
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jun 23 16:17:31 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- use %install_info/%install_info_delete
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jun 7 12:50:53 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.2.4
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Jun 3 01:13:12 CEST 2005 - ro@suse.de
|
|
|
|
|
|
|
|
|
|
- fix specfile (don't apply non-existant patch1)
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jun 2 18:03:17 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- use included minilzo
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed May 25 13:09:39 CEST 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- Update to version 1.2.3 (fixes gnutls DOS Bug #83481)
|
|
|
|
|
- Include defines.h before gnutls.h, to pull in config.h, to make
|
|
|
|
|
sure memmem.h prototype memmem properly
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sat Jan 29 23:42:13 CET 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- Update to version 1.2.0
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 19 20:43:20 CET 2005 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.1.23
|
|
|
|
|
- get rid of prebuild html/ps docu again, the devel packages has
|
|
|
|
|
man-pages now
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Dec 13 20:07:38 CET 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.0.23
|
|
|
|
|
- make build of postscript/html docu configureable
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Sat Oct 23 19:41:07 CEST 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- move config script to the devel package
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Oct 14 17:08:56 CEST 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- Update to version 1.0.21
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Sep 28 18:04:28 CEST 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- add doc subpackage with prebuild html/ps docu (Bug #44496)
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Sep 27 14:38:19 CEST 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- fix ac-quotation patch to include libgnutls-extra.m4 (Bug #46035)
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Aug 31 14:13:40 CEST 2004 - kukuk@suse.de
|
|
|
|
|
|
|
|
|
|
- Update to version 1.0.20
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Aug 30 14:22:43 CEST 2004 - kukuk@suse.de
|
|
|
|
|
|
|
|
|
|
- Add libopencdk-devel to neededforbuild
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Jul 15 18:54:57 CEST 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- add libgcrypt-devel and lipgpg-error-devel to nfb
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed May 19 14:58:13 CEST 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.0.13
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri May 14 08:48:26 CEST 2004 - mmj@suse.de
|
|
|
|
|
|
|
|
|
|
- Add C++ compiler to build
|
|
|
|
|
- Don't remove buildroot when installing
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Mar 1 18:44:58 CET 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.0.8
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Feb 17 15:57:15 CET 2004 - hvogel@suse.de
|
|
|
|
|
|
|
|
|
|
- update to version 1.0.6
|
|
|
|
|
- fix autoconf quotations
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed May 14 18:31:12 CEST 2003 - schubi@suse.de
|
|
|
|
|
|
|
|
|
|
- initial; Sourcecode received from XIMIAN
|
|
|
|
|
|
