libdane: fix typo in Makefile.am

See merge request !1595

Signed-off-by: Asad Mehmood <asad78611@googlemail.com>

Fix out-of-bounds memcpy in gnutls_realloc_zero()

Closes #1367, #1368, and #1369

See merge request !1592

Add release steps for windows builds

See merge request !1590

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Co-authored-by: Tobias Heider <tobias.heider@canonical.com>
Co-authored-by: Daiki Ueno <ueno@gnu.org>
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Disable test scripts on windows

See merge request !1594

This is a temporary solution to avoid failures
of test scripts when ran on windows
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Release 3.7.5

See merge request !1589

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

tests/cmocka-common.h: include <stdarg.h> before <cmocka.h>

Closes #1360

See merge request !1586

Fix psk_ke_modes_recv_params() wrongly setting HSK_PSK_KE_MODE_INVALID

Closes #1303

See merge request !1563

crypto-api: support SIV ciphers with encryptv2 functions

Closes #1217 and #1312

See merge request !1515

cligen: update git submodule

Closes #1363

See merge request !1588

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Improve certificate sanity checks

Closes #1218

See merge request !1583

configure.ac: check if compiler supports -Wa,-march=all

Closes #1317 and #1347

See merge request !1579

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Tim Kosse authored Mar 28, 2022 and Daiki Ueno committed May 08, 2022

If the preferred side (as per session->internals.priorities->server_precedence)
only supports one algorithm and if it is not the first in the other side's list
of algorithms, then psk_ke_modes_recv_params did wrongly set
session->internals.hsk_flags to HSK_PSK_KE_MODE_INVALID.

Fixes #1303

This issue was originally discovered while analyzing
https://forum.filezilla-project.org/viewtopic.php?t=54333

Signed-off-by: Tim Kosse <tim.kosse@filezilla-project.org>
Co-authored-by: Daiki Ueno <ueno@gnu.org>

As documented in <https://api.cmocka.org/group__cmocka.html#details>,
<stdarg.h> must be included before <cmocka.h>.

Suggested by Brad Smith in:
#1360

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Clang from LLVM 13.0.0 caused a segumentation fault if an unknown
architecture is supplied through -march.  While this has been fixed in
13.0.1, until it is widely deployed this adds a configure check as a
safeguard:
https://github.com/llvm/llvm-project/commit/d31f8cc6884ba3cc3e088fd57c4c533868e8a8b2

Signed-off-by: Daiki Ueno <ueno@gnu.org>

This adds gnutls_aead_cipher_set_key, which enables to reuse the same
handle but reset the context and key, without releasing the memory.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

This replaces copy_from_iov to more generic append_from_iov.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

These _encryptv, _encryptv2, and _decryptv2 functions take orthogonal
code paths depending on whether the underlying AEAD implementation
supports message based API.  This patch split the implementation to
dedicated helper functions.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

tests/cert-tests/pkcs12.sh: use portable sed invocations

See merge request !1584

Extend fipshmac to take a path to libgnutls.so

Closes #1359

See merge request !1585

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

The BSD sed doesn't recognize '\|' as the alternative operator, and
the last '}' must be preceded with a newline.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

tls: add flag to disable session ticket in TLS 1.2

Closes #477

See merge request !1475

The existing GNUTLS_NO_TICKETS flag affects all versions of TLS, where
PFS is assured in TLS 1.3, while it is not in TLS 1.2.  This adds a
new flag GNUTLS_NO_TICKETS_TLS12 to allow applications to disable
session tickets only in TLS 1.2.

As the only means of resumption in TLS 1.3 is using session tickets,
we could repurpose the GNUTLS_NO_TICKETS flag make it no-op in TLS
1.3.  However it would break backward compatibility, so we defer it to
the next major release.
Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>

.github/workflows/macos.yml: pull in gtk-doc

See merge request !1580

Signed-off-by: Daiki Ueno <ueno@gnu.org>

Signed-off-by: Daiki Ueno <ueno@gnu.org>