* Version 1.2.3
- Corrected bug in record packet parsing that could lead
to a denial of service attack.
- Corrected bug in RSA key export. Previously exported keys
can be fixed using certtool. Use certtool -k <infile >outfile
- API and ABI modifications:
gnutls_x509_privkey_fix(): Add.
* Version 1.2.2 (2005-04-25)
- gnutls_error_to_alert() now considers
GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET.
- Fixed error in session resuming that could cause a crash in a session.
- Fixed pkcs12 friendly name and local key identifier decoding.
- Internal cleanups, removed duplicate typedef/struct definitions,
and made source code include external include file, to check
function prototypes during compile time.
- API and ABI modifications:
No changes since last version. At least not intentional, but due
to the include header changes, there may be inadvertant changes,
please let us know if you find any.
* Version 1.2.1 (2005-04-04)
- gnutls_bye() will no longer fail when RDWR is used and application
data are available for reading.
- Added more strict checks for the SRP parameters (g,n), when they
are not in the included list.
- Added warning to certtool when MD5 is being used for digital
signatures.
- Optimizations ("-O2 -finline-functions") are not enabled by default,
instead the standard autoconf defaults are used. Use `./configure
CFLAGS="-O2 -finline-functions"' to get the old optimizations.
- Added the option --get-dh-params to certtool, in order to get the
included in the library primes and generators.
- Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to
allow only trusted Version 1 CAs and introduced
GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics.
- Nettle self tests now build properly, reported by Pierre
- Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites.
Reported by Yoann Vandoorselaere
- Added the functions:
gnutls_x509_crt_list_import(),
gnutls_x509_crq_get_attribute_by_oid(),
gnutls_x509_crq_set_attribute_by_oid() and
gnutls_x509_crt_set_extension_by_oid().
- If the library has been compiled with features disabled, a warning is
issued during the compilation of any program.
We are pleased to announce the availability of GnuTLS 1.2.0!
This release is the result of the 23 development releases made on the
development branch (1.1.x).
Major changes compared to the 1.0 branch include:
* Moved SRP password authentication from the GnuTLS-extra library
(licensed under GPL) to the core library (licensed under LGPL).
* The API has been cleaned up, and data types now use a '_t' suffix.
* Fixes to handle denial of service problem when verifying long
certificate chains.
* The manual has been converted to Texinfo and is consequently
available in many formats, see:
<http://josefsson.org/gnutls/manual/>
* A reference API manual has been added, and is available in HTML and
DevHelp formats, thanks to GTK-DOC, see:
<http://josefsson.org/gnutls/reference/gnutls-gnutls.html>
The 1.2.0 version is intended to be stable, and to be a drop-in
replacement of the stable 1.0.x branch.
We encourage developers to move to the 1.2 branch as soon as possible,
since we will now spend less time improving version 1.0.x.
We are not planning to open a 1.3 development branch soon, because
there are no plans to start work on any major new feature today.
Instead, we will continue to carefully improve the quality of this
release over time.
Improving GnuTLS is costly, but you can help! We are looking for
organizations that find GnuTLS useful and wish to contribute back.
You can contribute by reporting bugs, improve the software, or donate
money or equipment.
Noteworthy changes since the last release:
- Replace GNU LD version script with Libtool -export-symbols-regex,
from Joe Orton <joe at manyfish.co.uk>.
- Copy libtasn1 has been updated to version 0.2.11.
- Corrected the write of CRL distribution points.
- It is now possible to generate PKCS#12 structures without private
keys using "certtool --to-p12", suggested by Fabian Fagerholm
<fabbe at paniq.net>.
Version 1.0.22 (28/10/2004)
- Print DN of certificates with unknown characters in them, but in hexform
only.
- Corrected bug in _gnutls_x509_get_dn_oid(), and returns the actual OID.
- Added second precision to the X.509 parsing functions.
- Add parameter --la-file to libgnutls-config and libgnutls-extra-config,
tiny patch contributed by Joe Orton <joe@manyfish.co.uk>.
- Add pkg-config meta files, suggested by Stéphane LOEUILLET
<stephane.loeuillet@tiscali.fr>.
- Fix memory initializaion bug in gnutls_certificate_set_x509_trust,
tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>.
- Fix certtool --password for PKCS #12, back ported from 1.1.x branch.
- Fix library order in libgnutls*-config --libs output, to permit
static linking, reported by Yoann Vandoorselaere
<yoann@prelude-ids.org>.
Version 1.0.21 (07/10/2004)
- Fix memory leak in gnutls_certificate_verify_peers and
gnutls_certificate_free_credentials, report and patch by Simon
Posnjak <simon.posnjak@cetrtapot.si>.
- Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting
a key and no certificate to PKCS#12.
- Fix objdir != srcdir builds, reported by "Gerrit P. Haase"
<gp@familiehaase.de>.
- Avoid redefining getpass if system already has it, reported by
Yoann Vandoorselaere <yoann@prelude-ids.org>.
- Add new example "ex-rfc2818" for certificate verification, from Nikos.
- Known bug: the library require snprintf.
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
All library names listed by *.la files no longer need to be listed
in the PLIST, e.g., instead of:
lib/libfoo.a
lib/libfoo.la
lib/libfoo.so
lib/libfoo.so.0
lib/libfoo.so.0.1
one simply needs:
lib/libfoo.la
and bsd.pkg.mk will automatically ensure that the additional library
names are listed in the installed package +CONTENTS file.
Also make LIBTOOLIZE_PLIST default to "yes".
- Some complilation fixes.
- Added the --xml parameter to the certtool utility.
Changes 1.0.12:
- Corrected bug in OpenPGP key loading using a callback.
- Renamed gnutls-srpcrypt to srptool
- Allow handshake requests by the client.
* Things backported from the development branch:
- Added support for authority key identifier and the extended key usage
X.509 extension fields. The certtoool was updated to support them.
- Added batch support to certtool. Now it can use templates.
- The RC2 cipher is no more included. The one in libgcrypt is now used.
Changes 1.0.11:
- Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name()
- Corrected bug in TLS renegotiation.
Changes 1.0.10:
- Corrected bug in RSA parameters handling which could cause
unexpected crashes.
- Corrected bug in SSL 3.0 authentication.
by moving the inclusion of buildlink3.mk files outside of the protected
region. This bug would be seen by users that have set PREFER_PKGSRC
or PREFER_NATIVE to non-default values.
BUILDLINK_PACKAGES should be ordered so that for any package in the
list, that package doesn't depend on any packages to the left of it
in the list. This ordering property is used to check for builtin
packages in the correct order. The problem was that including a
buildlink3.mk file for <pkg> correctly ensured that <pkg> was removed
from BUILDLINK_PACKAGES and appended to the end. However, since the
inclusion of any other buildlink3.mk files within that buildlink3.mk
was in a region that was protected against multiple inclusion, those
dependencies weren't also moved to the end of BUILDLINK_PACKAGES.
Version 1.0.8 (28/02/2004)
- Corrected bug in mutual certificate authentication in SSL 3.0.
- Several other minor bugfixes.
Version 1.0.7 (25/02/2004)
- Implemented TLS 1.1 (and also obsoleted the TLS 1.0 CBC protection hack).
- Some updates in the documentation.
Version 1.0.4 (04/01/2004)
- Changed handshake behaviour to send the lowest TLS version
when an unsupported version was advertized. The current behaviour
is to send the maximum version we support.
- certtool no longer asks the password in unencrypted private
keys.
- The source is now compiled to use the reentrant libc functions.
- Corrected bug in gnutls_bye() which made it return an error code
of INVALID_REQUEST instead of success.
- Corrected a bug in the GNUTLS_KEY key usage definitions.
Changes since 1.0.0:
- Some minor fixes in the makefiles. They now include CFLAGS
from libgcrypt or opencdk if installed in a non standard directory.
- Fixed the SRP detection test in gnutls-cli-debug.
- Added gnutls_rsa_params_export_pkcs1() and
gnutls_rsa_params_import_pkcs1().
Changes:
- Exported the static SRP group parameters.
- Some fixes in the certificate authenticated SRP ciphersuites.
- Improved the support for draft-ietf-tls-srp-05. The two-phase
handshake is now fully supported without any interaction with
the application layer (except for a callback).
- Some fixes in the openpgp authentication.
- Removed the Twofish cipher.
- The openssl compatibility layer was moved to gnutls-openssl
library instead of being included in the gnutls-extra library.
- Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04.
- Building with openpgp support is now mandatory.
- gnutls4 compatibility header is no longer included by default in
gnutls.h.
- gnutls8 function usage yelds a deprecation warning in gcc3.
- gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid()
functions have a raw_flag parameter added.
- The certtool utility can now generate PKCS #12 structures
without specifying a certificate.
- Added capability to read CRLs to certtool.
- Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER
to properly set the required buffer size.
- Corrected a bug in libgcrypt detection.
And more...
own security/libtasn1 package, which is too new to work fine with gnutls.
While here, add missing dependency on devel/zlib.
Fixes PR pkg/23172; reviewed by wiz@. Bump PKGREVISION to 1.
GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL
3.0 protocols. The library does not include any patented algorithms and is
available under the GNU Lesser GPL license.
Important features of the GnuTLS library include:
- Thread safety
- Support for both TLS 1.0 and SSL 3.0 protocols
- Support for both X.509 and OpenPGP certificates
- Support for basic parsing and verification of certificates
- Support for SRP for TLS authentication
- Support for TLS Extension mechanism
- Support for TLS Compression Methods
Additionaly GnuTLS provides an emulation API for the widely used OpenSSL
library, to ease integration with existing applications.
Package provided by Juan RP via pkgsrc-wip with modifications by me.
