Added 32-bit overflow protection in _gnutls_buffer_append_data()

Remove redundant condition in align_allocd_with_data().

At all call-sites of align_allocd_with_data() dest->data is non-NULL.

Signed-off-by: Jaak Ristioja <jaak.ristioja@cyber.ee>

Deduplicated some code in _gnutls_buffer_append_data().

Signed-off-by: Jaak Ristioja <jaak.ristioja@cyber.ee>

Explicitly marked some variables const in _gnutls_buffer_append_data().

Signed-off-by: Jaak Ristioja <jaak.ristioja@cyber.ee>

DCO: added Jaak Ristioja

test-ciphers: do not fail on processor which don't have the AES-NI instructions

_gnutls_buffer_*: moved common operations to function

_gnutls_buffer_append_data: moved common code outside the if-clause

tests: disable SSL 3.0 checks with polarssl

It seems that SSL 3.0 is disabled in Debian's polarssl.

testdane: removed www.vulcano.cl from good hosts

tests: enhanced x509cert-tl

Verify gnutls_x509_trust_list_verify_crt2() in combination with
gnutls_x509_trust_list_add_named_crt().

use gnutls_x509_trust_list_verify_named_crt in gnutls_x509_trust_list_verify_crt2

Update 'NEWS'.

gnutls_rnd: doc update

gnutls_pkcs12_simple_parse: doc update

improved documentation on dane

guile: Open binary file in binary mode, for the sake of MinGW.

Reported by Eli Zaretskii <eliz@gnu.org>.

* guile/tests/openpgp-keyring.scm: Use 'open-file' with "rb" instead of
  'open-input-file'.

guile: Link with '-no-undefined'.

Fixes builds on MinGW.
Reported by Eli Zaretskii <eliz@gnu.org>.

* guile/src/Makefile.am (guile_gnutls_v_2_la_LDFLAGS): Add
  -no-undefined.

p11tool: use Sleep() in windows

certtool: ensure that default_serial_int is 64-bits or more

use select() instead of alarm for better portability

Based on patch by Eli Zaretskii.

cross.mk: updated for 3.3.11

Allow a random generator with the same priority to re-register

That corrects an issue where the library is deinitialized, and
reinitialization wouldn't register the same rnd module.
Reported by Stanislav Zidek.

tests: x509cert: verify that length returned from gnutls_x509_crt_get_dn matches strlen

testcompat: corrected usage of null cipher

added the .check function in FIPS140-2 code

corrected typo

configure: added option --without-idn

accelerated: added required casts

doc update

the priority string EXPORT is no more

aesni-ccm: removed unused struct entries

added AESNI accelerated CCM

more nettle3 related changes

dane: use the new _gnutls_buffer_to_datum

tests: corrected the expected lengths in ocsp

_gnutls_buffer_to_datum: includes code for exporting strings

when the trusted list contains a non-CA certificate warn via the audit log

modified the CCM ciphersuite's name to match the one in the IANA registry

ciphersuite test: enhanced check for correct ciphersuites

ciphersuites tests: add missing includes

ciphersuite tests: define HAVE_CONFIG_H

guile: Build with warnings.

* guile/src/Makefile.am (AM_CFLAGS) [HAVE_GCC]: Add -Wall -Wextra
  -Wno-unused-parameter.

guile: Remove the deprecated priority API.

* guile/modules/gnutls/build/priorities.scm: Remove.
* guile/src/make-session-priorities.scm: Remove.
* guile/modules/Makefile.am (EXTRA_DIST): Adjust accordingly.
* guile/src/Makefile.am (EXTRA_DIST): Likewise.
  (GENERATED_BINDINGS): Remove 'priorities.i.c'.
  (priorities.i.c): Remove target.
* guile/src/core.c: Don't include it.
  (scm_gnutls_set_default_priority_x): Remove.
* guile/modules/gnutls.in (gnutls): Adjust export list.
* guile/tests/session-record-port.scm: Use 'set-session-priorities!'.
* guile/tests/x509-auth.scm: Likewise.

guile: Remove RSA parameters and related procedures.

* guile/modules/gnutls/build/smobs.scm (%rsa-parameters-smob): Remove.
  (%gnutls-smobs): Remove it.
* guile/src/core.c (scm_gnutls_make_rsa_parameters,
  scm_gnutls_pkcs1_import_rsa_parameters,
  scm_gnutls_pkcs1_export_rsa_parameters,
  scm_gnutls_set_certificate_credentials_rsa_export_params_x): Remove.
* guile/modules/gnutls.in: Adjust export list.
* guile/tests/openpgp-auth.scm (import-rsa-params): Remove.
  Remove references to it and to
  'set-certificate-credentials-rsa-export-parameters!'.
* guile/tests/x509-auth.scm: Likewise.
* doc/gnutls-guile.texi (Representation of Binary Data): Remove
  references to RSA parameters.  Adjust example accordingly.
  (OpenPGP Authentication Guile Example): Likewise.

updated TODO list

removed several of the unneeded exported internal symbols

doc update

doc: corrected typo

use unsigned long in gcm_cast_st

corrected issue in AES-256-GCM

tests: enhanced cipher check to include all ciphers.

simplified abstractions over nettle based on Niels' comments.

API doc update

Added test vectors for CCM mode

CCM: corrected AEAD decryption

CCM mode moved to the lowest priority

aes-gcm-aead.h: generalized

gnutls-cli: added benchmark for CCM

tests: updated for AES-128-CCM ciphersuites

use the new AEAD API in gnutls_cipher.c

Added definitions for CCM ciphersuites

Modified crypto backend to accomodate for the CCM ciphersuites

More nettle2 updates (in FIPS140-2 mode)

ported to nettle 3.0

reduced current soversion

documented the removal of deprecated functions

corrected comparison

removed the old gnutls_retr_st compatibility functions

Removed binary compatibility with RSA-EXPORT using applications

removed the old priority functions

That is:
gnutls_cipher_set_priority
gnutls_mac_set_priority
gnutls_compression_set_priority
gnutls_kx_set_priority
gnutls_protocol_set_priority
gnutls_certificate_type_set_priority

removed gnutls_x509_crt_verify_hash() and gnutls_x509_crt_verify_data()

gnutls_sign_callback_set() and gnutls_sign_callback_get() were removed

renumbered fields in gnutls.h

increased gnutls' soversion

if the rnd structure doesn't provide check, _gnutls_rnd_check() will succeed

tests: Added check for verification using CRLs

Reorganized, and eliminated memory leak in _gnutls_x509_crt_check_revocation()

Reported by Tim Rühsen.

systemkey: updated for new gnutls_system_key_iter_get_info

gnutls_system_key_iter_get_info() allows restricting results to a specific certificate type

removed unneeded variable

doc update

doc: added recommendation to use the higher level functions to load keys

certtool: avoid gcc warnings

gnutls-cli-debug: Added check for whether %NO_EXTENSIONS is required

gnutls_session_get_desc: allow proper printing of the NULL KX

gnutls_session_get_desc will return NULL if initial negotiation is not complete

doc update

tests: small fix in mini-chain-unsorted

GNUTLS_E_CERTIFICATE_LIST_UNSORTED can be returned from gnutls_pcert_import_x509_list

That is when it cannot sort the list and GNUTLS_X509_CRT_LIST_SORT is specified.

gnutls_pcert_import_x509_list: only sort the lists it can sort

doc update

simplified windows URLs

system-keys-win: include urls.h

tests: added mini-chain-unsorted

Added flag GNUTLS_X509_CRT_LIST_SORT for gnutls_x509_crt_list_import*

That also allows automatically sorting input chains to the
gnutls_certificate_credentials_t structure.

tests: Added check for memory leaks when a file cannot be loaded.

gnutls_certificate_set_x509_key_*: eliminated memory leak when certificate could not be parsed

Reported by Georg Richter.

libdane: undef gnutls_assert() before redefining it

gnutls-cli-debug: do not print error on unknown protocols