gnutls/gnutls-3.7.2-config-allowlisting.patch

8353 lines
350 KiB
Diff
Raw Normal View History

diff -ruN gnutls-3.7.2/aminclude_static.am gnutls-3.7.2-bootstrapped/aminclude_static.am
--- gnutls-3.7.2/aminclude_static.am 2021-05-29 10:11:18.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/aminclude_static.am 2021-06-28 09:11:35.000000000 +0200
@@ -1,6 +1,6 @@
# aminclude_static.am generated automatically by Autoconf
-# from AX_AM_MACROS_STATIC on Sat May 29 10:11:18 CEST 2021
+# from AX_AM_MACROS_STATIC on Mon Jun 28 09:11:35 CEST 2021
# Code coverage
diff -ruN gnutls-3.7.2/AUTHORS gnutls-3.7.2-bootstrapped/AUTHORS
--- gnutls-3.7.2/AUTHORS 2021-05-29 10:22:59.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/AUTHORS 2021-06-28 09:56:13.000000000 +0200
@@ -37,8 +37,8 @@
Kevin Cernekee <cernekee at gmail.com>
Nikolay Sivov <nsivov at codeweavers.com>
Sahana Prasad <sahana at redhat.com>
-Michael Catanzaro <mcatanzaro at gnome.org>
Alexander Sosedkin <asosedkin at redhat.com>
+Michael Catanzaro <mcatanzaro at gnome.org>
Daniel Lenski <dlenski at gmail.com>
JonasZhou <JonasZhou at zhaoxin.com>
Stefan Sørensen <stefan.sorensen at spectralink.com>
diff -ruN gnutls-3.7.2/ChangeLog gnutls-3.7.2-bootstrapped/ChangeLog
--- gnutls-3.7.2/ChangeLog 2021-05-29 10:23:25.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/ChangeLog 2021-06-28 09:56:40.000000000 +0200
@@ -1,4 +1,63 @@
Author: Daiki Ueno <ueno@gnu.org>
+Date: Mon Jun 28 07:04:55 2021 +0200
+
+ tests: set SH_LOG_COMPILER so sh tests run under $(SHELL)
+
+ This omits the need of setting executable bits on shell script tests.
+
+ Signed-off-by: Daiki Ueno <ueno@gnu.org>
+
+Author: Daiki Ueno <ueno@gnu.org>
+Date: Thu May 6 12:41:40 2021 +0200
+
+ priority: support allowlisting in configuration file
+
+ This adds a new mode of interpreting the [overrides] section. If
+ "override-mode" is set to "allowlisting" in the [global] section, all
+ the algorithms (hashes, signature algorithms, curves, and versions)
+ are initially marked as insecure/disabled. Then the user can enable
+ them by specifying allowlisting keywords such as "secure-hash" in the
+ [overrides] section.
+
+ Signed-off-by: Daiki Ueno <ueno@gnu.org>
+ Co-authored-by: Alexander Sosedkin <asosedkin@redhat.com>
+
+Author: Daiki Ueno <ueno@gnu.org>
+Date: Wed May 5 16:27:55 2021 +0200
+
+ priority: refactor config file parsing
+
+ This adds the following refactoring:
+
+ - avoid side-effects during parsing the config file, by separating
+ application phase; the parsed configuration can be applied globally
+ with cfg_apply, after validation
+ - make _gnutls_*_mark_{disabled,insecure} take an ID instead of the
+ name
+
+ Signed-off-by: Daiki Ueno <ueno@gnu.org>
+
+Author: Daiki Ueno <ueno@gnu.org>
+Date: Fri Jun 11 06:58:43 2021 +0200
+
+ priority: reflect system wide config when constructing sigalgs
+
+ Otherwise the client would advertise signature algorithms which it
+ cannot use and cause handshake to fail.
+
+ Reported by Philip Schaten in:
+ https://lists.gnupg.org/pipermail/gnutls-help/2021-June/004711.html
+
+ Signed-off-by: Daiki Ueno <ueno@gnu.org>
+
+Author: Daiki Ueno <ueno@gnu.org>
+Date: Wed Jun 9 14:29:11 2021 +0200
+
+ p11tool: mention how CKA_IDs of certs are calculated upon --write
+
+ Signed-off-by: Daiki Ueno <ueno@gnu.org>
+
+Author: Daiki Ueno <ueno@gnu.org>
Date: Sat May 29 07:18:17 2021 +0200
Release 3.7.2
@@ -49224,3 +49283,13 @@
Date: Fri Nov 7 10:22:11 2014 +0100
doc: corrected values for INSECURE level
+
+Author: Nikos Mavrogiannopoulos <nmav@gnutls.org>
+Date: Fri Nov 7 08:55:40 2014 +0100
+
+ pkcs11: support the CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE flags
+
+Author: Nikos Mavrogiannopoulos <nmav@gnutls.org>
+Date: Fri Nov 7 08:44:46 2014 +0100
+
+ pkcs11: added the flag GNUTLS_PKCS11_OBJ_FLAG_MARK_ALWAYS_AUTH
diff -ruN gnutls-3.7.2/doc/cha-config.texi gnutls-3.7.2-bootstrapped/doc/cha-config.texi
--- gnutls-3.7.2/doc/cha-config.texi 2021-05-10 16:34:47.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/cha-config.texi 2021-06-28 09:09:14.000000000 +0200
@@ -74,6 +74,7 @@
@item @code{insecure-sig-for-cert}: to mark the signature algorithm as insecure when used in certificates.
@item @code{insecure-sig}: to mark the signature algorithm as insecure for any use.
@item @code{insecure-hash}: to mark the hash algorithm as insecure for digital signature use (provides a more generic way to disable digital signatures for broken hash algorithms).
+@item @code{disabled-curve}: to disable the specified elliptic curve.
@item @code{disabled-version}: to disable the specified TLS versions.
@item @code{tls-disabled-cipher}: to disable the specified ciphers for use in the TLS or DTLS protocols.
@item @code{tls-disabled-mac}: to disable the specified MAC algorithms for use in the TLS or DTLS protocols.
@@ -82,11 +83,39 @@
@end itemize
Each of the options can be repeated multiple times when multiple values need
-to be disabled.
+to be disabled or enabled.
The valid values for the options above can be found in the 'Protocols', 'Digests'
'PK-signatures', 'Protocols', 'Ciphrers', and 'MACs' fields of the output of @code{gnutls-cli --list}.
+Sometimes the system administrator wants to enable only specific
+algorithms, despite the library defaults. GnuTLS provides an
+alternative mode of overriding: allowlisting.
+
+In the allowlisting mode, all the algorithms are initially marked as
+insecure or disabled, and shall be explicitly turned on by the options
+in the @code{[overrides]} section. Those options are mutually
+exclusive to the above ones for the blocklisting mode (the default)
+@itemize
+@item @code{secure-sig-for-cert}: to mark the signature algorithm as secure when used in certificates.
+@item @code{secure-sig}: to mark the signature algorithm as secure for any use.
+@item @code{secure-hash}: to mark the hash algorithm as secure for digital signature use (provides a more generic way to enable digital signatures for broken hash algorithms).
+@item @code{enabled-curve}: to enable the specified elliptic curve.
+@item @code{enabled-version}: to enable the specified TLS versions.
+@item @code{tls-enabled-cipher}: to enable the specified ciphers for use in the TLS or DTLS protocols.
+@item @code{tls-enabled-mac}: to enable the specified MAC algorithms for use in the TLS or DTLS protocols.
+@item @code{tls-enabled-group}: to enable the specified group for use in the TLS or DTLS protocols.
+@item @code{tls-enabled-kx}: to enable the specified key exchange algorithms for use in the TLS or DTLS protocols (applies to TLS1.2 or earlier).
+@end itemize
+
+The allowlisting mode can be enabled by adding @code{override-mode =
+allowlist} in the @code{[global]} section.
+
+When the allowlisting mode is in effect, it is also possible for the applications to modify the setting through the API.
+
+@showfuncD{gnutls_ecc_curve_mark_enabled,gnutls_sign_mark_secure,gnutls_digest_mark_secure,gnutls_protocol_mark_enabled}
+@showfuncD{gnutls_ecc_curve_mark_disabled,gnutls_sign_mark_insecure,gnutls_digest_mark_insecure,gnutls_protocol_mark_disabled}
+
@subsection Examples
The following example marks as insecure all digital signature algorithms
@@ -120,6 +149,20 @@
tls-disabled-group = group-ffdhe8192
@end example
+The following example demonstrates the use of the allowlisting
+mode. It disables all the signature algorithms but
+@code{RSA-SHA256}. Note that the hash algorithm @code{SHA256} also
+needs to be explicitly enabled.
+
+@example
+[global]
+override-mode = allowlist
+
+[overrides]
+secure-hash = sha256
+secure-sig = rsa-sha256
+@end example
+
@node Querying for disabled algorithms and protocols
@section Querying for disabled algorithms and protocols
diff -ruN gnutls-3.7.2/doc/functions/gnutls_digest_mark_insecure gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_insecure
--- gnutls-3.7.2/doc/functions/gnutls_digest_mark_insecure 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_insecure 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,12 @@
+
+
+
+
+@deftypefun {int} {gnutls_digest_mark_insecure} (gnutls_digest_algorithm_t @var{dig})
+@var{dig}: is a digest algorithm
+
+Mark @code{dig} as insecure system wide. This only works if the allowlisting mode
+is used in the configuration file.
+
+@strong{Since:} 3.7.3
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_digest_mark_insecure.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_insecure.short
--- gnutls-3.7.2/doc/functions/gnutls_digest_mark_insecure.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_insecure.short 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_digest_mark_insecure} (gnutls_digest_algorithm_t @var{dig})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_digest_mark_secure gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_secure
--- gnutls-3.7.2/doc/functions/gnutls_digest_mark_secure 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_secure 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,12 @@
+
+
+
+
+@deftypefun {int} {gnutls_digest_mark_secure} (gnutls_digest_algorithm_t @var{dig})
+@var{dig}: is a digest algorithm
+
+Invalidate previous system wide setting that marked @code{dig} as insecure. This
+only works if the allowlisting mode is used in the configuration file.
+
+@strong{Since:} 3.7.3
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_digest_mark_secure.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_secure.short
--- gnutls-3.7.2/doc/functions/gnutls_digest_mark_secure.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_digest_mark_secure.short 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_digest_mark_secure} (gnutls_digest_algorithm_t @var{dig})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_disabled gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_disabled
--- gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_disabled 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_disabled 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,15 @@
+
+
+
+
+@deftypefun {int} {gnutls_ecc_curve_mark_disabled} (gnutls_ecc_curve_t @var{curve})
+@var{curve}: is an ECC curve
+
+Mark @code{curve} as disabled system wide. This setting can be reverted with
+@code{gnutls_ecc_curve_mark_enabled()} . This only works if the configuration file
+uses the allowlisting mode.
+
+@strong{Returns:} 0 on success or negative error code otherwise.
+
+@strong{Since:} 3.7.3
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_disabled.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_disabled.short
--- gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_disabled.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_disabled.short 2021-06-28 09:39:51.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_ecc_curve_mark_disabled} (gnutls_ecc_curve_t @var{curve})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_enabled gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_enabled
--- gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_enabled 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_enabled 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,15 @@
+
+
+
+
+@deftypefun {int} {gnutls_ecc_curve_mark_enabled} (gnutls_ecc_curve_t @var{curve})
+@var{curve}: is an ECC curve
+
+Invalidate previous system wide setting that marked @code{curve} as disabled. This
+only works if the curve is disabled with @code{gnutls_ecc_curve_mark_disabled()} or
+through the allowlisting mode in the configuration file.
+
+@strong{Returns:} 0 on success or negative error code otherwise.
+
+@strong{Since:} 3.7.3
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_enabled.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_enabled.short
--- gnutls-3.7.2/doc/functions/gnutls_ecc_curve_mark_enabled.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_ecc_curve_mark_enabled.short 2021-06-28 09:39:51.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_ecc_curve_mark_enabled} (gnutls_ecc_curve_t @var{curve})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_protocol_mark_disabled gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_disabled
--- gnutls-3.7.2/doc/functions/gnutls_protocol_mark_disabled 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_disabled 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,10 @@
+
+
+
+
+@deftypefun {int} {gnutls_protocol_mark_disabled} (gnutls_protocol_t @var{version})
+@var{version}: is a (gnutls) version number
+
+Mark @code{version} as disabled system wide. This only works if the allowlisting
+mode is used in the configuration file.
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_protocol_mark_disabled.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_disabled.short
--- gnutls-3.7.2/doc/functions/gnutls_protocol_mark_disabled.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_disabled.short 2021-06-28 09:39:51.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_protocol_mark_disabled} (gnutls_protocol_t @var{version})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_protocol_mark_enabled gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_enabled
--- gnutls-3.7.2/doc/functions/gnutls_protocol_mark_enabled 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_enabled 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,11 @@
+
+
+
+
+@deftypefun {int} {gnutls_protocol_mark_enabled} (gnutls_protocol_t @var{version})
+@var{version}: is a (gnutls) version number
+
+Invalidate previous system wide setting that marked @code{version} as
+disabled. This only works if the allowlisting mode is used in the
+configuration file.
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_protocol_mark_enabled.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_enabled.short
--- gnutls-3.7.2/doc/functions/gnutls_protocol_mark_enabled.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_protocol_mark_enabled.short 2021-06-28 09:39:51.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_protocol_mark_enabled} (gnutls_protocol_t @var{version})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_sign_mark_insecure gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_insecure
--- gnutls-3.7.2/doc/functions/gnutls_sign_mark_insecure 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_insecure 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,18 @@
+
+
+
+
+@deftypefun {int} {gnutls_sign_mark_insecure} (gnutls_sign_algorithm_t @var{sign}, unsigned @var{flags})
+@var{sign}: the sign algorithm
+
+@var{flags}: @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} or 0
+
+Mark @code{sign} as insecure system wide. This only works if the
+allowlisting mode is used in the configuration file.
+
+If @code{flags} has @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} bit set,
+and the algorithm was previously considered secure for all purposes,
+it only marks the algorithm as insecure for the use with certificates.
+
+@strong{Since:} 3.7.3
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_sign_mark_insecure.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_insecure.short
--- gnutls-3.7.2/doc/functions/gnutls_sign_mark_insecure.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_insecure.short 2021-06-28 09:39:51.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_sign_mark_insecure} (gnutls_sign_algorithm_t @var{sign}, unsigned @var{flags})
diff -ruN gnutls-3.7.2/doc/functions/gnutls_sign_mark_secure gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_secure
--- gnutls-3.7.2/doc/functions/gnutls_sign_mark_secure 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_secure 2021-06-28 09:39:50.000000000 +0200
@@ -0,0 +1,22 @@
+
+
+
+
+@deftypefun {int} {gnutls_sign_mark_secure} (gnutls_sign_algorithm_t @var{sign}, unsigned @var{flags})
+@var{sign}: the sign algorithm
+
+@var{flags}: @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} or 0
+
+Invalidate previous system wide setting that marked @code{sign} as
+insecure. This only works if the algorithm is marked as insecure
+with @code{gnutls_sign_mark_insecure()} or through the allowlisting mode
+in the configuration file.
+
+If @code{flags} has @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} bit set,
+it marks it the algorithm as secure for all purposes.
+If the absence of this flag, it will mark it as
+"secure, but not for certificates" at most,
+but it won't restrict anything either.
+
+@strong{Since:} 3.7.3
+@end deftypefun
diff -ruN gnutls-3.7.2/doc/functions/gnutls_sign_mark_secure.short gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_secure.short
--- gnutls-3.7.2/doc/functions/gnutls_sign_mark_secure.short 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/functions/gnutls_sign_mark_secure.short 2021-06-28 09:39:51.000000000 +0200
@@ -0,0 +1 @@
+@item @var{int} @ref{gnutls_sign_mark_secure} (gnutls_sign_algorithm_t @var{sign}, unsigned @var{flags})
diff -ruN gnutls-3.7.2/doc/gnutls-api.texi gnutls-3.7.2-bootstrapped/doc/gnutls-api.texi
--- gnutls-3.7.2/doc/gnutls-api.texi 2021-05-29 10:19:28.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/gnutls-api.texi 2021-06-28 09:39:50.000000000 +0200
@@ -2706,6 +2706,28 @@
integers indicating the available digests.
@end deftypefun
+@subheading gnutls_digest_mark_insecure
+@anchor{gnutls_digest_mark_insecure}
+@deftypefun {int} {gnutls_digest_mark_insecure} (gnutls_digest_algorithm_t @var{dig})
+@var{dig}: is a digest algorithm
+
+Mark @code{dig} as insecure system wide. This only works if the allowlisting mode
+is used in the configuration file.
+
+@strong{Since:} 3.7.3
+@end deftypefun
+
+@subheading gnutls_digest_mark_secure
+@anchor{gnutls_digest_mark_secure}
+@deftypefun {int} {gnutls_digest_mark_secure} (gnutls_digest_algorithm_t @var{dig})
+@var{dig}: is a digest algorithm
+
+Invalidate previous system wide setting that marked @code{dig} as insecure. This
+only works if the allowlisting mode is used in the configuration file.
+
+@strong{Since:} 3.7.3
+@end deftypefun
+
@subheading gnutls_early_cipher_get
@anchor{gnutls_early_cipher_get}
@deftypefun {gnutls_cipher_algorithm_t} {gnutls_early_cipher_get} (gnutls_session_t @var{session})
@@ -2820,6 +2842,34 @@
integers indicating the available curves.
@end deftypefun
+@subheading gnutls_ecc_curve_mark_disabled
+@anchor{gnutls_ecc_curve_mark_disabled}
+@deftypefun {int} {gnutls_ecc_curve_mark_disabled} (gnutls_ecc_curve_t @var{curve})
+@var{curve}: is an ECC curve
+
+Mark @code{curve} as disabled system wide. This setting can be reverted with
+@code{gnutls_ecc_curve_mark_enabled()} . This only works if the configuration file
+uses the allowlisting mode.
+
+@strong{Returns:} 0 on success or negative error code otherwise.
+
+@strong{Since:} 3.7.3
+@end deftypefun
+
+@subheading gnutls_ecc_curve_mark_enabled
+@anchor{gnutls_ecc_curve_mark_enabled}
+@deftypefun {int} {gnutls_ecc_curve_mark_enabled} (gnutls_ecc_curve_t @var{curve})
+@var{curve}: is an ECC curve
+
+Invalidate previous system wide setting that marked @code{curve} as disabled. This
+only works if the curve is disabled with @code{gnutls_ecc_curve_mark_disabled()} or
+through the allowlisting mode in the configuration file.
+
+@strong{Returns:} 0 on success or negative error code otherwise.
+
+@strong{Since:} 3.7.3
+@end deftypefun
+
@subheading gnutls_error_is_fatal
@anchor{gnutls_error_is_fatal}
@deftypefun {int} {gnutls_error_is_fatal} (int @var{error})
@@ -5026,6 +5076,25 @@
indicating the available protocols.
@end deftypefun
+@subheading gnutls_protocol_mark_disabled
+@anchor{gnutls_protocol_mark_disabled}
+@deftypefun {int} {gnutls_protocol_mark_disabled} (gnutls_protocol_t @var{version})
+@var{version}: is a (gnutls) version number
+
+Mark @code{version} as disabled system wide. This only works if the allowlisting
+mode is used in the configuration file.
+@end deftypefun
+
+@subheading gnutls_protocol_mark_enabled
+@anchor{gnutls_protocol_mark_enabled}
+@deftypefun {int} {gnutls_protocol_mark_enabled} (gnutls_protocol_t @var{version})
+@var{version}: is a (gnutls) version number
+
+Invalidate previous system wide setting that marked @code{version} as
+disabled. This only works if the allowlisting mode is used in the
+configuration file.
+@end deftypefun
+
@subheading gnutls_psk_allocate_client_credentials
@anchor{gnutls_psk_allocate_client_credentials}
@deftypefun {int} {gnutls_psk_allocate_client_credentials} (gnutls_psk_client_credentials_t * @var{sc})
@@ -7027,6 +7096,44 @@
integers indicating the available ciphers.
@end deftypefun
+@subheading gnutls_sign_mark_insecure
+@anchor{gnutls_sign_mark_insecure}
+@deftypefun {int} {gnutls_sign_mark_insecure} (gnutls_sign_algorithm_t @var{sign}, unsigned @var{flags})
+@var{sign}: the sign algorithm
+
+@var{flags}: @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} or 0
+
+Mark @code{sign} as insecure system wide. This only works if the
+allowlisting mode is used in the configuration file.
+
+If @code{flags} has @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} bit set,
+and the algorithm was previously considered secure for all purposes,
+it only marks the algorithm as insecure for the use with certificates.
+
+@strong{Since:} 3.7.3
+@end deftypefun
+
+@subheading gnutls_sign_mark_secure
+@anchor{gnutls_sign_mark_secure}
+@deftypefun {int} {gnutls_sign_mark_secure} (gnutls_sign_algorithm_t @var{sign}, unsigned @var{flags})
+@var{sign}: the sign algorithm
+
+@var{flags}: @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} or 0
+
+Invalidate previous system wide setting that marked @code{sign} as
+insecure. This only works if the algorithm is marked as insecure
+with @code{gnutls_sign_mark_insecure()} or through the allowlisting mode
+in the configuration file.
+
+If @code{flags} has @code{GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS} bit set,
+it marks it the algorithm as secure for all purposes.
+If the absence of this flag, it will mark it as
+"secure, but not for certificates" at most,
+but it won't restrict anything either.
+
+@strong{Since:} 3.7.3
+@end deftypefun
+
@subheading gnutls_sign_supports_pk_algorithm
@anchor{gnutls_sign_supports_pk_algorithm}
@deftypefun {unsigned} {gnutls_sign_supports_pk_algorithm} (gnutls_sign_algorithm_t @var{sign}, gnutls_pk_algorithm_t @var{pk})
diff -ruN gnutls-3.7.2/doc/gnutls.html gnutls-3.7.2-bootstrapped/doc/gnutls.html
--- gnutls-3.7.2/doc/gnutls.html 2021-05-29 10:23:25.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/gnutls.html 2021-06-28 09:56:40.000000000 +0200
@@ -8018,8 +8018,9 @@
</p><span id="write-option_002e"></span><h4 class="subsubheading">write option.</h4>
<span id="p11tool-write"></span>
<p>This is the &ldquo;writes the loaded objects to a pkcs #11 token&rdquo; option.
-It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with
- one of &ndash;load-privkey, &ndash;load-pubkey, &ndash;load-certificate option.
+It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with one of &ndash;load-privkey, &ndash;load-pubkey, &ndash;load-certificate option.
+</p>
+<p>When writing a certificate object, its CKA_ID is set to the same CKA_ID of the corresponding public key, if it exists on the token; otherwise it will be derived from the X.509 Subject Key Identifier of the certificate. If this behavior is undesired, write the public key to the token beforehand.
</p><span id="id-option_002e"></span><h4 class="subsubheading">id option.</h4>
<span id="p11tool-id"></span>
<p>This is the &ldquo;sets an id for the write operation&rdquo; option.
@@ -16992,6 +16993,7 @@
<li> <code>insecure-sig-for-cert</code>: to mark the signature algorithm as insecure when used in certificates.
</li><li> <code>insecure-sig</code>: to mark the signature algorithm as insecure for any use.
</li><li> <code>insecure-hash</code>: to mark the hash algorithm as insecure for digital signature use (provides a more generic way to disable digital signatures for broken hash algorithms).
+</li><li> <code>disabled-curve</code>: to disable the specified elliptic curve.
</li><li> <code>disabled-version</code>: to disable the specified TLS versions.
</li><li> <code>tls-disabled-cipher</code>: to disable the specified ciphers for use in the TLS or DTLS protocols.
</li><li> <code>tls-disabled-mac</code>: to disable the specified MAC algorithms for use in the TLS or DTLS protocols.
@@ -17000,11 +17002,49 @@
</li></ul>
<p>Each of the options can be repeated multiple times when multiple values need
-to be disabled.
+to be disabled or enabled.
</p>
<p>The valid values for the options above can be found in the &rsquo;Protocols&rsquo;, &rsquo;Digests&rsquo;
&rsquo;PK-signatures&rsquo;, &rsquo;Protocols&rsquo;, &rsquo;Ciphrers&rsquo;, and &rsquo;MACs&rsquo; fields of the output of <code>gnutls-cli --list</code>.
</p>
+<p>Sometimes the system administrator wants to enable only specific
+algorithms, despite the library defaults. GnuTLS provides an
+alternative mode of overriding: allowlisting.
+</p>
+<p>In the allowlisting mode, all the algorithms are initially marked as
+insecure or disabled, and shall be explicitly turned on by the options
+in the <code>[overrides]</code> section. Those options are mutually
+exclusive to the above ones for the blocklisting mode (the default)
+</p><ul>
+<li> <code>secure-sig-for-cert</code>: to mark the signature algorithm as secure when used in certificates.
+</li><li> <code>secure-sig</code>: to mark the signature algorithm as secure for any use.
+</li><li> <code>secure-hash</code>: to mark the hash algorithm as secure for digital signature use (provides a more generic way to enable digital signatures for broken hash algorithms).
+</li><li> <code>enabled-curve</code>: to enable the specified elliptic curve.
+</li><li> <code>enabled-version</code>: to enable the specified TLS versions.
+</li><li> <code>tls-enabled-cipher</code>: to enable the specified ciphers for use in the TLS or DTLS protocols.
+</li><li> <code>tls-enabled-mac</code>: to enable the specified MAC algorithms for use in the TLS or DTLS protocols.
+</li><li> <code>tls-enabled-group</code>: to enable the specified group for use in the TLS or DTLS protocols.
+</li><li> <code>tls-enabled-kx</code>: to enable the specified key exchange algorithms for use in the TLS or DTLS protocols (applies to TLS1.2 or earlier).
+</li></ul>
+
+<p>The allowlisting mode can be enabled by adding <code>override-mode =
+allowlist</code> in the <code>[global]</code> section.
+</p>
+<p>When the allowlisting mode is in effect, it is also possible for the applications to modify the setting through the API.
+</p>
+<dl compact="compact">
+<dt><code><var>int</var> <a href="#gnutls_005fecc_005fcurve_005fmark_005fenabled">gnutls_ecc_curve_mark_enabled</a> (gnutls_ecc_curve_t <var>curve</var>)</code></dt>
+<dt><code><var>int</var> <a href="#gnutls_005fsign_005fmark_005fsecure">gnutls_sign_mark_secure</a> (gnutls_sign_algorithm_t <var>sign</var>, unsigned <var>flags</var>)</code></dt>
+<dt><code><var>int</var> <a href="#gnutls_005fdigest_005fmark_005fsecure">gnutls_digest_mark_secure</a> (gnutls_digest_algorithm_t <var>dig</var>)</code></dt>
+<dt><code><var>int</var> <a href="#gnutls_005fprotocol_005fmark_005fenabled">gnutls_protocol_mark_enabled</a> (gnutls_protocol_t <var>version</var>)</code></dt>
+</dl>
+<dl compact="compact">
+<dt><code><var>int</var> <a href="#gnutls_005fecc_005fcurve_005fmark_005fdisabled">gnutls_ecc_curve_mark_disabled</a> (gnutls_ecc_curve_t <var>curve</var>)</code></dt>
+<dt><code><var>int</var> <a href="#gnutls_005fsign_005fmark_005finsecure">gnutls_sign_mark_insecure</a> (gnutls_sign_algorithm_t <var>sign</var>, unsigned <var>flags</var>)</code></dt>
+<dt><code><var>int</var> <a href="#gnutls_005fdigest_005fmark_005finsecure">gnutls_digest_mark_insecure</a> (gnutls_digest_algorithm_t <var>dig</var>)</code></dt>
+<dt><code><var>int</var> <a href="#gnutls_005fprotocol_005fmark_005fdisabled">gnutls_protocol_mark_disabled</a> (gnutls_protocol_t <var>version</var>)</code></dt>
+</dl>
+
<span id="Examples"></span><h4 class="subsection">8.2.1 Examples</h4>
<p>The following example marks as insecure all digital signature algorithms
@@ -17038,6 +17078,20 @@
tls-disabled-group = group-ffdhe8192
</pre></div>
+<p>The following example demonstrates the use of the allowlisting
+mode. It disables all the signature algorithms but
+<code>RSA-SHA256</code>. Note that the hash algorithm <code>SHA256</code> also
+needs to be explicitly enabled.
+</p>
+<div class="example">
+<pre class="example">[global]
+override-mode = allowlist
+
+[overrides]
+secure-hash = sha256
+secure-sig = rsa-sha256
+</pre></div>
+
<hr>
<span id="Querying-for-disabled-algorithms-and-protocols"></span><div class="header">
<p>
@@ -23658,6 +23712,28 @@
integers indicating the available digests.
</p></dd></dl>
+<span id="gnutls_005fdigest_005fmark_005finsecure-1"></span><h4 class="subheading">gnutls_digest_mark_insecure</h4>
+<span id="gnutls_005fdigest_005fmark_005finsecure"></span><dl>
+<dt id="index-gnutls_005fdigest_005fmark_005finsecure">Function: <em>int</em> <strong>gnutls_digest_mark_insecure</strong> <em>(gnutls_digest_algorithm_t <var>dig</var>)</em></dt>
+<dd><p><var>dig</var>: is a digest algorithm
+</p>
+<p>Mark <code>dig</code> as insecure system wide. This only works if the allowlisting mode
+is used in the configuration file.
+</p>
+<p><strong>Since:</strong> 3.7.3
+</p></dd></dl>
+
+<span id="gnutls_005fdigest_005fmark_005fsecure-1"></span><h4 class="subheading">gnutls_digest_mark_secure</h4>
+<span id="gnutls_005fdigest_005fmark_005fsecure"></span><dl>
+<dt id="index-gnutls_005fdigest_005fmark_005fsecure">Function: <em>int</em> <strong>gnutls_digest_mark_secure</strong> <em>(gnutls_digest_algorithm_t <var>dig</var>)</em></dt>
+<dd><p><var>dig</var>: is a digest algorithm
+</p>
+<p>Invalidate previous system wide setting that marked <code>dig</code> as insecure. This
+only works if the allowlisting mode is used in the configuration file.
+</p>
+<p><strong>Since:</strong> 3.7.3
+</p></dd></dl>
+
<span id="gnutls_005fearly_005fcipher_005fget-1"></span><h4 class="subheading">gnutls_early_cipher_get</h4>
<span id="gnutls_005fearly_005fcipher_005fget"></span><dl>
<dt id="index-gnutls_005fearly_005fcipher_005fget">Function: <em>gnutls_cipher_algorithm_t</em> <strong>gnutls_early_cipher_get</strong> <em>(gnutls_session_t <var>session</var>)</em></dt>
@@ -23772,6 +23848,34 @@
integers indicating the available curves.
</p></dd></dl>
+<span id="gnutls_005fecc_005fcurve_005fmark_005fdisabled-1"></span><h4 class="subheading">gnutls_ecc_curve_mark_disabled</h4>
+<span id="gnutls_005fecc_005fcurve_005fmark_005fdisabled"></span><dl>
+<dt id="index-gnutls_005fecc_005fcurve_005fmark_005fdisabled">Function: <em>int</em> <strong>gnutls_ecc_curve_mark_disabled</strong> <em>(gnutls_ecc_curve_t <var>curve</var>)</em></dt>
+<dd><p><var>curve</var>: is an ECC curve
+</p>
+<p>Mark <code>curve</code> as disabled system wide. This setting can be reverted with
+<code>gnutls_ecc_curve_mark_enabled()</code> . This only works if the configuration file
+uses the allowlisting mode.
+</p>
+<p><strong>Returns:</strong> 0 on success or negative error code otherwise.
+</p>
+<p><strong>Since:</strong> 3.7.3
+</p></dd></dl>
+
+<span id="gnutls_005fecc_005fcurve_005fmark_005fenabled-1"></span><h4 class="subheading">gnutls_ecc_curve_mark_enabled</h4>
+<span id="gnutls_005fecc_005fcurve_005fmark_005fenabled"></span><dl>
+<dt id="index-gnutls_005fecc_005fcurve_005fmark_005fenabled">Function: <em>int</em> <strong>gnutls_ecc_curve_mark_enabled</strong> <em>(gnutls_ecc_curve_t <var>curve</var>)</em></dt>
+<dd><p><var>curve</var>: is an ECC curve
+</p>
+<p>Invalidate previous system wide setting that marked <code>curve</code> as disabled. This
+only works if the curve is disabled with <code>gnutls_ecc_curve_mark_disabled()</code> or
+through the allowlisting mode in the configuration file.
+</p>
+<p><strong>Returns:</strong> 0 on success or negative error code otherwise.
+</p>
+<p><strong>Since:</strong> 3.7.3
+</p></dd></dl>
+
<span id="gnutls_005ferror_005fis_005ffatal-1"></span><h4 class="subheading">gnutls_error_is_fatal</h4>
<span id="gnutls_005ferror_005fis_005ffatal"></span><dl>
<dt id="index-gnutls_005ferror_005fis_005ffatal-1">Function: <em>int</em> <strong>gnutls_error_is_fatal</strong> <em>(int <var>error</var>)</em></dt>
@@ -25978,6 +26082,25 @@
indicating the available protocols.
</p></dd></dl>
+<span id="gnutls_005fprotocol_005fmark_005fdisabled-1"></span><h4 class="subheading">gnutls_protocol_mark_disabled</h4>
+<span id="gnutls_005fprotocol_005fmark_005fdisabled"></span><dl>
+<dt id="index-gnutls_005fprotocol_005fmark_005fdisabled">Function: <em>int</em> <strong>gnutls_protocol_mark_disabled</strong> <em>(gnutls_protocol_t <var>version</var>)</em></dt>
+<dd><p><var>version</var>: is a (gnutls) version number
+</p>
+<p>Mark <code>version</code> as disabled system wide. This only works if the allowlisting
+mode is used in the configuration file.
+</p></dd></dl>
+
+<span id="gnutls_005fprotocol_005fmark_005fenabled-1"></span><h4 class="subheading">gnutls_protocol_mark_enabled</h4>
+<span id="gnutls_005fprotocol_005fmark_005fenabled"></span><dl>
+<dt id="index-gnutls_005fprotocol_005fmark_005fenabled">Function: <em>int</em> <strong>gnutls_protocol_mark_enabled</strong> <em>(gnutls_protocol_t <var>version</var>)</em></dt>
+<dd><p><var>version</var>: is a (gnutls) version number
+</p>
+<p>Invalidate previous system wide setting that marked <code>version</code> as
+disabled. This only works if the allowlisting mode is used in the
+configuration file.
+</p></dd></dl>
+
<span id="gnutls_005fpsk_005fallocate_005fclient_005fcredentials-1"></span><h4 class="subheading">gnutls_psk_allocate_client_credentials</h4>
<span id="gnutls_005fpsk_005fallocate_005fclient_005fcredentials"></span><dl>
<dt id="index-gnutls_005fpsk_005fallocate_005fclient_005fcredentials">Function: <em>int</em> <strong>gnutls_psk_allocate_client_credentials</strong> <em>(gnutls_psk_client_credentials_t * <var>sc</var>)</em></dt>
@@ -27979,6 +28102,44 @@
integers indicating the available ciphers.
</p></dd></dl>
+<span id="gnutls_005fsign_005fmark_005finsecure-1"></span><h4 class="subheading">gnutls_sign_mark_insecure</h4>
+<span id="gnutls_005fsign_005fmark_005finsecure"></span><dl>
+<dt id="index-gnutls_005fsign_005fmark_005finsecure">Function: <em>int</em> <strong>gnutls_sign_mark_insecure</strong> <em>(gnutls_sign_algorithm_t <var>sign</var>, unsigned <var>flags</var>)</em></dt>
+<dd><p><var>sign</var>: the sign algorithm
+</p>
+<p><var>flags</var>: <code>GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS</code> or 0
+</p>
+<p>Mark <code>sign</code> as insecure system wide. This only works if the
+allowlisting mode is used in the configuration file.
+</p>
+<p>If <code>flags</code> has <code>GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS</code> bit set,
+and the algorithm was previously considered secure for all purposes,
+it only marks the algorithm as insecure for the use with certificates.
+</p>
+<p><strong>Since:</strong> 3.7.3
+</p></dd></dl>
+
+<span id="gnutls_005fsign_005fmark_005fsecure-1"></span><h4 class="subheading">gnutls_sign_mark_secure</h4>
+<span id="gnutls_005fsign_005fmark_005fsecure"></span><dl>
+<dt id="index-gnutls_005fsign_005fmark_005fsecure">Function: <em>int</em> <strong>gnutls_sign_mark_secure</strong> <em>(gnutls_sign_algorithm_t <var>sign</var>, unsigned <var>flags</var>)</em></dt>
+<dd><p><var>sign</var>: the sign algorithm
+</p>
+<p><var>flags</var>: <code>GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS</code> or 0
+</p>
+<p>Invalidate previous system wide setting that marked <code>sign</code> as
+insecure. This only works if the algorithm is marked as insecure
+with <code>gnutls_sign_mark_insecure()</code> or through the allowlisting mode
+in the configuration file.
+</p>
+<p>If <code>flags</code> has <code>GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS</code> bit set,
+it marks it the algorithm as secure for all purposes.
+If the absence of this flag, it will mark it as
+&quot;secure, but not for certificates&quot; at most,
+but it won&rsquo;t restrict anything either.
+</p>
+<p><strong>Since:</strong> 3.7.3
+</p></dd></dl>
+
<span id="gnutls_005fsign_005fsupports_005fpk_005falgorithm-1"></span><h4 class="subheading">gnutls_sign_supports_pk_algorithm</h4>
<span id="gnutls_005fsign_005fsupports_005fpk_005falgorithm"></span><dl>
<dt id="index-gnutls_005fsign_005fsupports_005fpk_005falgorithm">Function: <em>unsigned</em> <strong>gnutls_sign_supports_pk_algorithm</strong> <em>(gnutls_sign_algorithm_t <var>sign</var>, gnutls_pk_algorithm_t <var>pk</var>)</em></dt>
@@ -45743,6 +45904,8 @@
<tr><td></td><td valign="top"><a href="#index-gnutls_005fdigest_005fget_005fname"><code>gnutls_digest_get_name</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fdigest_005fget_005foid"><code>gnutls_digest_get_oid</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fdigest_005flist"><code>gnutls_digest_list</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fdigest_005fmark_005finsecure"><code>gnutls_digest_mark_insecure</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fdigest_005fmark_005fsecure"><code>gnutls_digest_mark_secure</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fdtls_005fcookie_005fsend"><code>gnutls_dtls_cookie_send</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Datagram-TLS-API">Datagram TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fdtls_005fcookie_005fverify"><code>gnutls_dtls_cookie_verify</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Datagram-TLS-API">Datagram TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fdtls_005fget_005fdata_005fmtu"><code>gnutls_dtls_get_data_mtu</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Datagram-TLS-API">Datagram TLS API</a></td></tr>
@@ -45762,6 +45925,8 @@
<tr><td></td><td valign="top"><a href="#index-gnutls_005fecc_005fcurve_005fget_005fpk"><code>gnutls_ecc_curve_get_pk</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fecc_005fcurve_005fget_005fsize"><code>gnutls_ecc_curve_get_size</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fecc_005fcurve_005flist"><code>gnutls_ecc_curve_list</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fecc_005fcurve_005fmark_005fdisabled"><code>gnutls_ecc_curve_mark_disabled</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fecc_005fcurve_005fmark_005fenabled"><code>gnutls_ecc_curve_mark_enabled</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fencode_005fber_005fdigest_005finfo"><code>gnutls_encode_ber_digest_info</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Cryptographic-API">Cryptographic API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fencode_005fgost_005frs_005fvalue"><code>gnutls_encode_gost_rs_value</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Cryptographic-API">Cryptographic API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fencode_005frs_005fvalue"><code>gnutls_encode_rs_value</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Cryptographic-API">Cryptographic API</a></td></tr>
@@ -46151,6 +46316,8 @@
<tr><td></td><td valign="top"><a href="#index-gnutls_005fprotocol_005fget_005fname"><code>gnutls_protocol_get_name</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fprotocol_005fget_005fversion"><code>gnutls_protocol_get_version</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fprotocol_005flist"><code>gnutls_protocol_list</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fprotocol_005fmark_005fdisabled"><code>gnutls_protocol_mark_disabled</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fprotocol_005fmark_005fenabled"><code>gnutls_protocol_mark_enabled</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fpsk_005fallocate_005fclient_005fcredentials"><code>gnutls_psk_allocate_client_credentials</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fpsk_005fallocate_005fserver_005fcredentials"><code>gnutls_psk_allocate_server_credentials</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fpsk_005fclient_005fget_005fhint"><code>gnutls_psk_client_get_hint</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
@@ -46325,6 +46492,8 @@
<tr><td></td><td valign="top"><a href="#index-gnutls_005fsign_005fis_005fsecure"><code>gnutls_sign_is_secure</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fsign_005fis_005fsecure2"><code>gnutls_sign_is_secure2</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fsign_005flist"><code>gnutls_sign_list</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fsign_005fmark_005finsecure"><code>gnutls_sign_mark_insecure</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
+<tr><td></td><td valign="top"><a href="#index-gnutls_005fsign_005fmark_005fsecure"><code>gnutls_sign_mark_secure</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fsign_005fsupports_005fpk_005falgorithm"><code>gnutls_sign_supports_pk_algorithm</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fsrp_005fallocate_005fclient_005fcredentials"><code>gnutls_srp_allocate_client_credentials</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
<tr><td></td><td valign="top"><a href="#index-gnutls_005fsrp_005fallocate_005fserver_005fcredentials"><code>gnutls_srp_allocate_server_credentials</code></a>:</td><td>&nbsp;</td><td valign="top"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
diff -ruN gnutls-3.7.2/doc/gnutls.info gnutls-3.7.2-bootstrapped/doc/gnutls.info
--- gnutls-3.7.2/doc/gnutls.info 2021-05-29 10:23:25.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/gnutls.info 2021-06-28 09:56:40.000000000 +0200
@@ -29,12 +29,12 @@

Indirect:
gnutls.info-1: 1291
-gnutls.info-2: 322163
-gnutls.info-3: 605942
-gnutls.info-4: 1147244
-gnutls.info-5: 1463965
-gnutls.info-6: 1515571
-gnutls.info-7: 1896190
+gnutls.info-2: 322461
+gnutls.info-3: 606240
+gnutls.info-4: 1153831
+gnutls.info-5: 1470552
+gnutls.info-6: 1522158
+gnutls.info-7: 1903361

Tag Table:
(Indirect)
@@ -324,1507 +324,1515 @@
Ref: p11tool set-id312425
Ref: p11tool set-label312850
Ref: p11tool write313198
-Ref: p11tool id313462
-Ref: p11tool mark-wrap313719
-Ref: p11tool mark-trusted313966
-Ref: p11tool mark-distrusted314330
-Ref: p11tool mark-decrypt314784
-Ref: p11tool mark-sign315061
-Ref: p11tool mark-ca315338
-Ref: p11tool mark-private315611
-Ref: p11tool ca315909
-Ref: p11tool private316043
-Ref: p11tool secret-key316198
-Ref: p11tool other-options316361
-Ref: p11tool debug316463
-Ref: p11tool so-login316604
-Ref: p11tool admin-login316848
-Ref: p11tool test-sign316989
-Ref: p11tool sign-params317283
-Ref: p11tool hash317623
-Ref: p11tool generate-random317919
-Ref: p11tool inder318093
-Ref: p11tool inraw318318
-Ref: p11tool outder318444
-Ref: p11tool outraw318696
-Ref: p11tool provider318829
-Ref: p11tool provider-opts319038
-Ref: p11tool batch319311
-Ref: p11tool exit status319464
-Ref: p11tool See Also319694
-Ref: p11tool Examples319742
-Node: Trusted Platform Module322163
-Ref: Trusted Platform Module-Footnote-1323956
-Ref: Trusted Platform Module-Footnote-2324004
-Node: Keys in TPM324061
-Node: Key generation325545
-Node: Using keys327813
-Node: tpmtool Invocation331458
-Ref: tpmtool usage331884
-Ref: tpmtool debug335196
-Ref: tpmtool generate-rsa335337
-Ref: tpmtool user335608
-Ref: tpmtool system335967
-Ref: tpmtool test-sign336321
-Ref: tpmtool sec-param336604
-Ref: tpmtool inder336930
-Ref: tpmtool outder337231
-Ref: tpmtool srk-well-known337450
-Ref: tpmtool exit status337606
-Ref: tpmtool See Also337836
-Ref: tpmtool Examples337897
-Node: How to use GnuTLS in applications338514
-Node: Introduction to the library339083
-Node: General idea339682
-Ref: fig-gnutls-design340531
-Ref: General idea-Footnote-1341836
-Node: Error handling341881
-Node: Common types344108
-Node: Debugging and auditing345442
-Ref: tab:environment346313
-Node: Thread safety349180
-Ref: Thread safety-Footnote-1351326
-Node: Running in a sandbox351538
-Node: Sessions and fork352932
-Node: Callback functions353484
-Node: Preparation354452
-Node: Headers354871
-Node: Initialization355160
-Ref: Initialization-Footnote-1356154
-Node: Version check356447
-Node: Building the source357322
-Node: Session initialization359433
-Ref: gnutls_init_flags_t360910
-Node: Associating the credentials367923
-Ref: tab:key-exchange-cred368699
-Node: Certificate credentials369830
-Node: Raw public-key credentials385415
-Node: SRP credentials386715
-Node: PSK credentials391613
-Node: Anonymous credentials395548
-Node: Setting up the transport layer396394
-Node: Asynchronous operation405947
-Node: Reducing round-trips410248
-Node: Zero-roundtrip mode413688
-Node: Anti-replay protection415893
-Node: DTLS sessions419538
-Ref: DTLS sessions-Footnote-1421842
-Node: DTLS and SCTP421919
-Node: TLS handshake422939
-Node: Data transfer and termination426857
-Node: Buffered data transfer435999
-Node: Handling alerts437800
-Node: Priority Strings441182
-Ref: tab:prio-keywords443782
-Ref: tab:prio-algorithms450860
-Ref: tab:prio-special1456290
-Ref: tab:prio-special2460137
-Ref: Priority Strings-Footnote-1466758
-Node: Selecting cryptographic key sizes466980
-Ref: tab:key-sizes467629
-Node: Advanced topics472378
-Node: Virtual hosts and credentials472876
-Node: Session resumption476201
-Node: Certificate verification484108
-Ref: dane_verify_status_t493829
-Node: TLS 1.2 re-authentication494234
-Node: TLS 1.3 re-authentication and re-key499091
-Node: Parameter generation500750
-Node: Deriving keys for other applications/protocols503397
-Node: Channel Bindings506627
-Node: Interoperability508166
-Node: Compatibility with the OpenSSL library509484
-Node: GnuTLS application examples510211
-Ref: examples510430
-Node: Client examples510723
-Node: Client example with X.509 certificate support511250
-Ref: ex-verify511488
-Node: Datagram TLS client example516532
-Node: Client using a smart card with TLS520937
-Ref: ex-pkcs11-client521174
-Node: Client with Resume capability example526469
-Ref: ex-resume-client526753
-Node: Client example with SSH-style certificate verification531940
-Node: Server examples536147
-Node: Echo server with X.509 authentication536501
-Node: DTLS echo server with X.509 authentication544225
-Node: More advanced client and servers558636
-Node: Client example with anonymous authentication559493
-Node: Using a callback to select the certificate to use563417
-Node: Obtaining session information569800
-Node: Advanced certificate verification example574013
-Ref: ex-verify2574289
-Node: Client example with PSK authentication579719
-Node: Client example with SRP authentication584085
-Node: Legacy client example with X.509 certificate support588369
-Ref: ex-verify-legacy588686
-Node: Client example in C++594639
-Node: Echo server with PSK authentication597211
-Node: Echo server with SRP authentication605942
-Node: Echo server with anonymous authentication612860
-Node: Helper functions for TCP connections618188
-Node: Helper functions for UDP connections619780
-Node: OCSP example621685
-Ref: Generate OCSP request621868
-Node: Miscellaneous examples631475
-Node: Checking for an alert631801
-Node: X.509 certificate parsing example633250
-Ref: ex-x509-info633507
-Node: Listing the ciphersuites in a priority string637536
-Node: PKCS12 structure generation example639853
-Node: System-wide configuration of the library644058
-Node: Application-specific priority strings645885
-Node: Disabling algorithms and protocols647333
-Node: Querying for disabled algorithms and protocols650217
-Node: Overriding the parameter verification profile651339
-Node: Overriding the default priority string652341
-Node: Using GnuTLS as a cryptographic library652958
-Ref: Using GnuTLS as a cryptographic library-Footnote-1653814
-Node: Symmetric algorithms653871
-Ref: gnutls_cipher_algorithm_t654631
-Ref: Symmetric algorithms-Footnote-1663061
-Node: Public key algorithms663146
-Node: Cryptographic Message Syntax / PKCS7667868
-Ref: gnutls_pkcs7_sign_flags671307
-Node: Hash and MAC functions672775
-Ref: gnutls_mac_algorithm_t673387
-Ref: gnutls_digest_algorithm_t676759
-Node: Random number generation677810
-Ref: gnutls_rnd_level_t678172
-Node: Overriding algorithms679279
-Node: Other included programs685597
-Node: gnutls-cli Invocation686168
-Ref: gnutls-cli usage686730
-Ref: gnutls-cli debug694480
-Ref: gnutls-cli tofu694621
-Ref: gnutls-cli strict-tofu695084
-Ref: gnutls-cli dane695486
-Ref: gnutls-cli local-dns695829
-Ref: gnutls-cli ca-verification696144
-Ref: gnutls-cli ocsp696499
-Ref: gnutls-cli resume696741
-Ref: gnutls-cli rehandshake696887
-Ref: gnutls-cli sni-hostname697054
-Ref: gnutls-cli verify-hostname697580
-Ref: gnutls-cli starttls697813
-Ref: gnutls-cli app-proto697997
-Ref: gnutls-cli starttls-proto698159
-Ref: gnutls-cli save-ocsp-multi698670
-Ref: gnutls-cli dh-bits699127
-Ref: gnutls-cli priority699478
-Ref: gnutls-cli rawpkkeyfile699856
-Ref: gnutls-cli rawpkfile700313
-Ref: gnutls-cli ranges700854
-Ref: gnutls-cli benchmark-ciphers701104
-Ref: gnutls-cli benchmark-tls-ciphers701422
-Ref: gnutls-cli list701741
-Ref: gnutls-cli priority-list702108
-Ref: gnutls-cli noticket702354
-Ref: gnutls-cli alpn702515
-Ref: gnutls-cli disable-extensions702824
-Ref: gnutls-cli single-key-share703056
-Ref: gnutls-cli post-handshake-auth703272
-Ref: gnutls-cli inline-commands703469
-Ref: gnutls-cli inline-commands-prefix703789
-Ref: gnutls-cli provider704192
-Ref: gnutls-cli logfile704389
-Ref: gnutls-cli waitresumption704746
-Ref: gnutls-cli ca-auto-retrieve705003
-Ref: gnutls-cli exit status705407
-Ref: gnutls-cli See Also705643
-Ref: gnutls-cli Examples705720
-Node: gnutls-serv Invocation709927
-Ref: gnutls-serv usage710404
-Ref: gnutls-serv debug715924
-Ref: gnutls-serv sni-hostname716065
-Ref: gnutls-serv alpn716397
-Ref: gnutls-serv require-client-cert716684
-Ref: gnutls-serv verify-client-cert716928
-Ref: gnutls-serv heartbeat717157
-Ref: gnutls-serv priority717308
-Ref: gnutls-serv x509keyfile717677
-Ref: gnutls-serv x509certfile718194
-Ref: gnutls-serv x509dsakeyfile718711
-Ref: gnutls-serv x509dsacertfile718875
-Ref: gnutls-serv x509ecckeyfile719042
-Ref: gnutls-serv x509ecccertfile719204
-Ref: gnutls-serv rawpkkeyfile719371
-Ref: gnutls-serv rawpkfile720190
-Ref: gnutls-serv ocsp-response721045
-Ref: gnutls-serv ignore-ocsp-response-errors721362
-Ref: gnutls-serv list721609
-Ref: gnutls-serv provider721847
-Ref: gnutls-serv exit status722044
-Ref: gnutls-serv See Also722282
-Ref: gnutls-serv Examples722360
-Node: gnutls-cli-debug Invocation727668
-Ref: gnutls-cli-debug usage728490
-Ref: gnutls-cli-debug debug730745
-Ref: gnutls-cli-debug app-proto730886
-Ref: gnutls-cli-debug starttls-proto731054
-Ref: gnutls-cli-debug exit status731433
-Ref: gnutls-cli-debug See Also731681
-Ref: gnutls-cli-debug Examples731764
-Node: Internal architecture of GnuTLS735261
-Node: The TLS Protocol735867
-Ref: fig-client-server736343
-Node: TLS Handshake Protocol736433
-Ref: fig-gnutls-handshake736875
-Ref: fig-gnutls-handshake-sequence737384
-Node: TLS Authentication Methods737482
-Ref: TLS Authentication Methods-Footnote-1739786
-Node: TLS Hello Extension Handling739852
-Node: Cryptographic Backend752954
-Ref: fig-crypto-layers753637
-Ref: Cryptographic Backend-Footnote-1756919
-Ref: Cryptographic Backend-Footnote-2757004
-Node: Random Number Generators-internals757112
-Node: FIPS140-2 mode764476
-Ref: gnutls_fips_mode_t767112
-Node: Upgrading from previous versions769259
-Node: Support783253
-Node: Getting help783501
-Node: Commercial Support784089
-Node: Bug Reports784360
-Node: Contributing785724
-Node: Certification787750
-Node: Error codes788214
-Node: Supported ciphersuites812847
-Ref: ciphersuites813020
-Node: API reference828064
-Node: Core TLS API828474
-Ref: gnutls_alert_get828701
-Ref: gnutls_alert_get_name829320
-Ref: gnutls_alert_get_strname829705
-Ref: gnutls_alert_send830040
-Ref: gnutls_alert_send_appropriate830918
-Ref: gnutls_alert_set_read_function831885
-Ref: gnutls_alpn_get_selected_protocol832269
-Ref: gnutls_alpn_set_protocols832933
-Ref: gnutls_anon_allocate_client_credentials833770
-Ref: gnutls_anon_allocate_server_credentials834155
-Ref: gnutls_anon_free_client_credentials834532
-Ref: gnutls_anon_free_server_credentials834821
-Ref: gnutls_anon_set_params_function835102
-Ref: gnutls_anon_set_server_dh_params835778
-Ref: gnutls_anon_set_server_known_dh_params836438
-Ref: gnutls_anon_set_server_params_function837347
-Ref: gnutls_anti_replay_deinit838010
-Ref: gnutls_anti_replay_enable838324
-Ref: gnutls_anti_replay_init838672
-Ref: gnutls_anti_replay_set_add_function839200
-Ref: gnutls_anti_replay_set_ptr840218
-Ref: gnutls_anti_replay_set_window840553
-Ref: gnutls_auth_client_get_type841321
-Ref: gnutls_auth_get_type841948
-Ref: gnutls_auth_server_get_type842760
-Ref: gnutls_base64_decode2843389
-Ref: gnutls_base64_encode2843945
-Ref: gnutls_buffer_append_data844565
-Ref: gnutls_bye844963
-Ref: gnutls_certificate_activation_time_peers846564
-Ref: gnutls_certificate_allocate_credentials846982
-Ref: gnutls_certificate_client_get_request_status847379
-Ref: gnutls_certificate_expiration_time_peers847787
-Ref: gnutls_certificate_free_ca_names848191
-Ref: gnutls_certificate_free_cas848860
-Ref: gnutls_certificate_free_credentials849263
-Ref: gnutls_certificate_free_crls849697
-Ref: gnutls_certificate_free_keys849997
-Ref: gnutls_certificate_get_crt_raw850431
-Ref: gnutls_certificate_get_issuer851502
-Ref: gnutls_certificate_get_ocsp_expiration852585
-Ref: gnutls_certificate_get_ours853756
-Ref: gnutls_certificate_get_peers854586
-Ref: gnutls_certificate_get_peers_subkey_id855709
-Ref: gnutls_certificate_get_verify_flags856065
-Ref: gnutls_certificate_get_x509_crt856478
-Ref: gnutls_certificate_get_x509_key858122
-Ref: gnutls_certificate_send_x509_rdn_sequence859437
-Ref: gnutls_certificate_server_set_request860144
-Ref: gnutls_certificate_set_dh_params860934
-Ref: gnutls_certificate_set_flags861753
-Ref: gnutls_certificate_set_known_dh_params862278
-Ref: gnutls_certificate_set_ocsp_status_request_file863206
-Ref: gnutls_certificate_set_ocsp_status_request_file2865112
-Ref: gnutls_certificate_set_ocsp_status_request_function866630
-Ref: gnutls_certificate_set_ocsp_status_request_function2868118
-Ref: gnutls_certificate_set_ocsp_status_request_mem870084
-Ref: gnutls_certificate_set_params_function871859
-Ref: gnutls_certificate_set_pin_function872556
-Ref: gnutls_certificate_set_rawpk_key_file873209
-Ref: gnutls_certificate_set_rawpk_key_mem876513
-Ref: gnutls_certificate_set_retrieve_function879660
-Ref: gnutls_certificate_set_verify_flags881790
-Ref: gnutls_certificate_set_verify_function882283
-Ref: gnutls_certificate_set_verify_limits883347
-Ref: gnutls_certificate_set_x509_crl884028
-Ref: gnutls_certificate_set_x509_crl_file884856
-Ref: gnutls_certificate_set_x509_crl_mem885637
-Ref: gnutls_certificate_set_x509_key886414
-Ref: gnutls_certificate_set_x509_key_file888082
-Ref: gnutls_certificate_set_x509_key_file2890318
-Ref: gnutls_certificate_set_x509_key_mem892852
-Ref: gnutls_certificate_set_x509_key_mem2894500
-Ref: gnutls_certificate_set_x509_simple_pkcs12_file896313
-Ref: gnutls_certificate_set_x509_simple_pkcs12_mem898443
-Ref: gnutls_certificate_set_x509_system_trust900543
-Ref: gnutls_certificate_set_x509_trust901113
-Ref: gnutls_certificate_set_x509_trust_dir902093
-Ref: gnutls_certificate_set_x509_trust_file902831
-Ref: gnutls_certificate_set_x509_trust_mem904007
-Ref: gnutls_certificate_type_get904950
-Ref: gnutls_certificate_type_get2905797
-Ref: gnutls_certificate_type_get_id907182
-Ref: gnutls_certificate_type_get_name907579
-Ref: gnutls_certificate_type_list907962
-Ref: gnutls_certificate_verification_status_print908316
-Ref: gnutls_certificate_verify_peers909074
-Ref: gnutls_certificate_verify_peers2911870
-Ref: gnutls_certificate_verify_peers3913785
-Ref: gnutls_check_version916095
-Ref: gnutls_cipher_get916837
-Ref: gnutls_cipher_get_id917142
-Ref: gnutls_cipher_get_key_size917524
-Ref: gnutls_cipher_get_name917888
-Ref: gnutls_cipher_list918235
-Ref: gnutls_cipher_suite_get_name918795
-Ref: gnutls_cipher_suite_info919663
-Ref: gnutls_credentials_clear920846
-Ref: gnutls_credentials_get921074
-Ref: gnutls_credentials_set922029
-Ref: gnutls_db_check_entry923393
-Ref: gnutls_db_check_entry_expire_time923850
-Ref: gnutls_db_check_entry_time924256
-Ref: gnutls_db_get_default_cache_expiration924647
-Ref: gnutls_db_get_ptr924842
-Ref: gnutls_db_remove_session925154
-Ref: gnutls_db_set_cache_expiration925691
-Ref: gnutls_db_set_ptr926112
-Ref: gnutls_db_set_remove_function926447
-Ref: gnutls_db_set_retrieve_function926950
-Ref: gnutls_db_set_store_function927636
-Ref: gnutls_deinit928103
-Ref: gnutls_dh_get_group928442
-Ref: gnutls_dh_get_peers_public_bits929294
-Ref: gnutls_dh_get_prime_bits929738
-Ref: gnutls_dh_get_pubkey930378
-Ref: gnutls_dh_get_secret_bits931076
-Ref: gnutls_dh_params_cpy931508
-Ref: gnutls_dh_params_deinit932016
-Ref: gnutls_dh_params_export2_pkcs3932257
-Ref: gnutls_dh_params_export_pkcs3933078
-Ref: gnutls_dh_params_export_raw934097
-Ref: gnutls_dh_params_generate2934850
-Ref: gnutls_dh_params_import_dsa936104
-Ref: gnutls_dh_params_import_pkcs3936581
-Ref: gnutls_dh_params_import_raw937320
-Ref: gnutls_dh_params_import_raw2937950
-Ref: gnutls_dh_params_import_raw3938664
-Ref: gnutls_dh_params_init939364
-Ref: gnutls_dh_set_prime_bits939695
-Ref: gnutls_digest_get_id940798
-Ref: gnutls_digest_get_name941224
-Ref: gnutls_digest_get_oid941570
-Ref: gnutls_digest_list941961
-Ref: gnutls_early_cipher_get942332
-Ref: gnutls_early_prf_hash_get942705
-Ref: gnutls_ecc_curve_get943123
-Ref: gnutls_ecc_curve_get_id943524
-Ref: gnutls_ecc_curve_get_name943905
-Ref: gnutls_ecc_curve_get_oid944239
-Ref: gnutls_ecc_curve_get_pk944584
-Ref: gnutls_ecc_curve_get_size944888
-Ref: gnutls_ecc_curve_list945117
-Ref: gnutls_error_is_fatal945440
-Ref: gnutls_error_to_alert946242
-Ref: gnutls_est_record_overhead_size946974
-Ref: gnutls_ext_get_current_msg947882
-Ref: gnutls_ext_get_data948573
-Ref: gnutls_ext_get_name949088
-Ref: gnutls_ext_get_name2949406
-Ref: gnutls_ext_raw_parse949916
-Ref: gnutls_ext_register951066
-Ref: gnutls_ext_set_data952701
-Ref: gnutls_fingerprint953212
-Ref: gnutls_fips140_mode_enabled954218
-Ref: gnutls_fips140_set_mode954772
-Ref: gnutls_get_system_config_file955825
-Ref: gnutls_global_deinit956201
-Ref: gnutls_global_init956651
-Ref: gnutls_global_set_audit_log_function957926
-Ref: gnutls_global_set_log_function958633
-Ref: gnutls_global_set_log_level959141
-Ref: gnutls_global_set_mutex959629
-Ref: gnutls_global_set_time_function960731
-Ref: gnutls_gost_paramset_get_name961168
-Ref: gnutls_gost_paramset_get_oid961544
-Ref: gnutls_group_get961921
-Ref: gnutls_group_get_id962291
-Ref: gnutls_group_get_name962638
-Ref: gnutls_group_list962958
-Ref: gnutls_handshake963280
-Ref: gnutls_handshake_description_get_name965385
-Ref: gnutls_handshake_get_last_in965773
-Ref: gnutls_handshake_get_last_out966398
-Ref: gnutls_handshake_set_hook_function967030
-Ref: gnutls_handshake_set_max_packet_length968422
-Ref: gnutls_handshake_set_post_client_hello_function969207
-Ref: gnutls_handshake_set_private_extensions970533
-Ref: gnutls_handshake_set_random971212
-Ref: gnutls_handshake_set_read_function971932
-Ref: gnutls_handshake_set_secret_function972333
-Ref: gnutls_handshake_set_timeout972712
-Ref: gnutls_handshake_write973402
-Ref: gnutls_heartbeat_allowed974103
-Ref: gnutls_heartbeat_enable974577
-Ref: gnutls_heartbeat_get_timeout975415
-Ref: gnutls_heartbeat_ping975954
-Ref: gnutls_heartbeat_pong977086
-Ref: gnutls_heartbeat_set_timeouts977493
-Ref: gnutls_hex2bin978264
-Ref: gnutls_hex_decode978983
-Ref: gnutls_hex_decode2979709
-Ref: gnutls_hex_encode980138
-Ref: gnutls_hex_encode2980735
-Ref: gnutls_idna_map981250
-Ref: gnutls_idna_reverse_map982380
-Ref: gnutls_init983145
-Ref: gnutls_key_generate983973
-Ref: gnutls_kx_get984390
-Ref: gnutls_kx_get_id984976
-Ref: gnutls_kx_get_name985320
-Ref: gnutls_kx_list985665
-Ref: gnutls_load_file985993
-Ref: gnutls_mac_get986765
-Ref: gnutls_mac_get_id987070
-Ref: gnutls_mac_get_key_size987483
-Ref: gnutls_mac_get_name987820
-Ref: gnutls_mac_list988139
-Ref: gnutls_memcmp988527
-Ref: gnutls_memset989087
-Ref: gnutls_ocsp_status_request_enable_client989481
-Ref: gnutls_ocsp_status_request_get990492
-Ref: gnutls_ocsp_status_request_get2991154
-Ref: gnutls_ocsp_status_request_is_checked992149
-Ref: gnutls_oid_to_digest993537
-Ref: gnutls_oid_to_ecc_curve993946
-Ref: gnutls_oid_to_gost_paramset994272
-Ref: gnutls_oid_to_mac994683
-Ref: gnutls_oid_to_pk995096
-Ref: gnutls_oid_to_sign995468
-Ref: gnutls_openpgp_send_cert995872
-Ref: gnutls_packet_deinit996174
-Ref: gnutls_packet_get996448
-Ref: gnutls_pem_base64_decode996953
-Ref: gnutls_pem_base64_decode2997808
-Ref: gnutls_pem_base64_encode998803
-Ref: gnutls_pem_base64_encode2999632
-Ref: gnutls_perror1000568
-Ref: gnutls_pk_algorithm_get_name1000864
-Ref: gnutls_pk_bits_to_sec_param1001220
-Ref: gnutls_pk_get_id1001694
-Ref: gnutls_pk_get_name1002212
-Ref: gnutls_pk_get_oid1002580
-Ref: gnutls_pk_list1002979
-Ref: gnutls_pk_to_sign1003312
-Ref: gnutls_prf1003723
-Ref: gnutls_prf_early1005718
-Ref: gnutls_prf_hash_get1007373
-Ref: gnutls_prf_raw1007905
-Ref: gnutls_prf_rfc57051009789
-Ref: gnutls_priority_certificate_type_list1011466
-Ref: gnutls_priority_certificate_type_list21012162
-Ref: gnutls_priority_cipher_list1012778
-Ref: gnutls_priority_deinit1013165
-Ref: gnutls_priority_ecc_curve_list1013408
-Ref: gnutls_priority_get_cipher_suite_index1013940
-Ref: gnutls_priority_group_list1014856
-Ref: gnutls_priority_init1015237
-Ref: gnutls_priority_init21016317
-Ref: gnutls_priority_kx_list1020691
-Ref: gnutls_priority_mac_list1021096
-Ref: gnutls_priority_protocol_list1021501
-Ref: gnutls_priority_set1021903
-Ref: gnutls_priority_set_direct1022558
-Ref: gnutls_priority_sign_list1023491
-Ref: gnutls_priority_string_list1023907
-Ref: gnutls_protocol_get_id1024539
-Ref: gnutls_protocol_get_name1024855
-Ref: gnutls_protocol_get_version1025214
-Ref: gnutls_protocol_list1025512
-Ref: gnutls_psk_allocate_client_credentials1025882
-Ref: gnutls_psk_allocate_server_credentials1026302
-Ref: gnutls_psk_client_get_hint1026698
-Ref: gnutls_psk_free_client_credentials1027325
-Ref: gnutls_psk_free_server_credentials1027608
-Ref: gnutls_psk_server_get_username1027883
-Ref: gnutls_psk_server_get_username21028590
-Ref: gnutls_psk_set_client_credentials1029284
-Ref: gnutls_psk_set_client_credentials21030307
-Ref: gnutls_psk_set_client_credentials_function1031087
-Ref: gnutls_psk_set_client_credentials_function21032090
-Ref: gnutls_psk_set_params_function1033247
-Ref: gnutls_psk_set_server_credentials_file1033927
-Ref: gnutls_psk_set_server_credentials_function1034788
-Ref: gnutls_psk_set_server_credentials_function21035742
-Ref: gnutls_psk_set_server_credentials_hint1036865
-Ref: gnutls_psk_set_server_dh_params1037489
-Ref: gnutls_psk_set_server_known_dh_params1038174
-Ref: gnutls_psk_set_server_params_function1039071
-Ref: gnutls_random_art1039712
-Ref: gnutls_range_split1040574
-Ref: gnutls_reauth1041656
-Ref: gnutls_record_can_use_length_hiding1043758
-Ref: gnutls_record_check_corked1044509
-Ref: gnutls_record_check_pending1044892
-Ref: gnutls_record_cork1045303
-Ref: gnutls_record_disable_padding1045717
-Ref: gnutls_record_discard_queued1046325
-Ref: gnutls_record_get_direction1046942
-Ref: gnutls_record_get_max_early_data_size1047923
-Ref: gnutls_record_get_max_size1048475
-Ref: gnutls_record_get_state1048842
-Ref: gnutls_record_overhead_size1049864
-Ref: gnutls_record_recv1050251
-Ref: gnutls_record_recv_early_data1051701
-Ref: gnutls_record_recv_packet1052763
-Ref: gnutls_record_recv_seq1053642
-Ref: gnutls_record_send1054628
-Ref: gnutls_record_send21056686
-Ref: gnutls_record_send_early_data1057838
-Ref: gnutls_record_send_range1058894
-Ref: gnutls_record_set_max_early_data_size1060073
-Ref: gnutls_record_set_max_recv_size1060719
-Ref: gnutls_record_set_max_size1061423
-Ref: gnutls_record_set_state1062602
-Ref: gnutls_record_set_timeout1063260
-Ref: gnutls_record_uncork1063861
-Ref: gnutls_rehandshake1064801
-Ref: gnutls_safe_renegotiation_status1066583
-Ref: gnutls_sec_param_get_name1066998
-Ref: gnutls_sec_param_to_pk_bits1067372
-Ref: gnutls_sec_param_to_symmetric_bits1068042
-Ref: gnutls_server_name_get1068426
-Ref: gnutls_server_name_set1069898
-Ref: gnutls_session_channel_binding1071056
-Ref: gnutls_session_enable_compatibility_mode1071774
-Ref: gnutls_session_etm_status1072481
-Ref: gnutls_session_ext_master_secret_status1072884
-Ref: gnutls_session_ext_register1073375
-Ref: gnutls_session_force_valid1075637
-Ref: gnutls_session_get_data1076058
-Ref: gnutls_session_get_data21076718
-Ref: gnutls_session_get_desc1078991
-Ref: gnutls_session_get_flags1079513
-Ref: gnutls_session_get_id1080051
-Ref: gnutls_session_get_id21081574
-Ref: gnutls_session_get_keylog_function1083044
-Ref: gnutls_session_get_master_secret1083451
-Ref: gnutls_session_get_ptr1083935
-Ref: gnutls_session_get_random1084330
-Ref: gnutls_session_get_verify_cert_status1084951
-Ref: gnutls_session_is_resumed1085624
-Ref: gnutls_session_key_update1085994
-Ref: gnutls_session_resumption_requested1086942
-Ref: gnutls_session_set_data1087324
-Ref: gnutls_session_set_id1088165
-Ref: gnutls_session_set_keylog_function1088840
-Ref: gnutls_session_set_premaster1089239
-Ref: gnutls_session_set_ptr1090334
-Ref: gnutls_session_set_verify_cert1090734
-Ref: gnutls_session_set_verify_cert21092078
-Ref: gnutls_session_set_verify_function1093262
-Ref: gnutls_session_supplemental_register1094374
-Ref: gnutls_session_ticket_enable_client1095632
-Ref: gnutls_session_ticket_enable_server1096125
-Ref: gnutls_session_ticket_key_generate1096919
-Ref: gnutls_session_ticket_send1097347
-Ref: gnutls_set_default_priority1097931
-Ref: gnutls_set_default_priority_append1099016
-Ref: gnutls_sign_algorithm_get1100358
-Ref: gnutls_sign_algorithm_get_client1100801
-Ref: gnutls_sign_algorithm_get_requested1101268
-Ref: gnutls_sign_get_hash_algorithm1102295
-Ref: gnutls_sign_get_id1102707
-Ref: gnutls_sign_get_name1103070
-Ref: gnutls_sign_get_oid1103402
-Ref: gnutls_sign_get_pk_algorithm1103788
-Ref: gnutls_sign_is_secure1104395
-Ref: gnutls_sign_is_secure21104665
-Ref: gnutls_sign_list1105001
-Ref: gnutls_sign_supports_pk_algorithm1105361
-Ref: gnutls_srp_allocate_client_credentials1105945
-Ref: gnutls_srp_allocate_server_credentials1106346
-Ref: gnutls_srp_base64_decode1106719
-Ref: gnutls_srp_base64_decode21107424
-Ref: gnutls_srp_base64_encode1108092
-Ref: gnutls_srp_base64_encode21108893
-Ref: gnutls_srp_free_client_credentials1109624
-Ref: gnutls_srp_free_server_credentials1109907
-Ref: gnutls_srp_server_get_username1110182
-Ref: gnutls_srp_set_client_credentials1110636
-Ref: gnutls_srp_set_client_credentials_function1111526
-Ref: gnutls_srp_set_prime_bits1112773
-Ref: gnutls_srp_set_server_credentials_file1113458
-Ref: gnutls_srp_set_server_credentials_function1114184
-Ref: gnutls_srp_set_server_fake_salt_seed1115899
-Ref: gnutls_srp_verifier1117402
-Ref: gnutls_srtp_get_keys1118330
-Ref: gnutls_srtp_get_mki1119724
-Ref: gnutls_srtp_get_profile_id1120293
-Ref: gnutls_srtp_get_profile_name1120751
-Ref: gnutls_srtp_get_selected_profile1121172
-Ref: gnutls_srtp_set_mki1121616
-Ref: gnutls_srtp_set_profile1122065
-Ref: gnutls_srtp_set_profile_direct1122597
-Ref: gnutls_store_commitment1123320
-Ref: gnutls_store_pubkey1124619
-Ref: gnutls_strerror1126406
-Ref: gnutls_strerror_name1126891
-Ref: gnutls_supplemental_get_name1127360
-Ref: gnutls_supplemental_recv1127782
-Ref: gnutls_supplemental_register1128252
-Ref: gnutls_supplemental_send1129364
-Ref: gnutls_system_recv_timeout1129809
-Ref: gnutls_tdb_deinit1130551
-Ref: gnutls_tdb_init1130766
-Ref: gnutls_tdb_set_store_commitment_func1131125
-Ref: gnutls_tdb_set_store_func1131806
-Ref: gnutls_tdb_set_verify_func1132395
-Ref: gnutls_transport_get_int1133139
-Ref: gnutls_transport_get_int21133547
-Ref: gnutls_transport_get_ptr1134050
-Ref: gnutls_transport_get_ptr21134466
-Ref: gnutls_transport_set_errno1135000
-Ref: gnutls_transport_set_errno_function1135987
-Ref: gnutls_transport_set_int1136524
-Ref: gnutls_transport_set_int21137078
-Ref: gnutls_transport_set_ptr1137807
-Ref: gnutls_transport_set_ptr21138220
-Ref: gnutls_transport_set_pull_function1138864
-Ref: gnutls_transport_set_pull_timeout_function1139644
-Ref: gnutls_transport_set_push_function1141347
-Ref: gnutls_transport_set_vec_push_function1142192
-Ref: gnutls_url_is_supported1142888
-Ref: gnutls_utf8_password_normalize1143308
-Ref: gnutls_verify_stored_pubkey1144097
-Node: Datagram TLS API1147244
-Ref: gnutls_dtls_cookie_send1147520
-Ref: gnutls_dtls_cookie_verify1148775
-Ref: gnutls_dtls_get_data_mtu1149719
-Ref: gnutls_dtls_get_mtu1150162
-Ref: gnutls_dtls_get_timeout1150605
-Ref: gnutls_dtls_prestate_set1151148
-Ref: gnutls_dtls_set_data_mtu1151732
-Ref: gnutls_dtls_set_mtu1152706
-Ref: gnutls_dtls_set_timeouts1153313
-Ref: gnutls_record_get_discarded1154317
-Node: X509 certificate API1154591
-Ref: gnutls_certificate_get_trust_list1154940
-Ref: gnutls_certificate_set_trust_list1155588
-Ref: gnutls_certificate_verification_profile_get_id1156363
-Ref: gnutls_certificate_verification_profile_get_name1156910
-Ref: gnutls_pkcs8_info1157293
-Ref: gnutls_pkcs_schema_get_name1158811
-Ref: gnutls_pkcs_schema_get_oid1159216
-Ref: gnutls_session_set_verify_output_function1159643
-Ref: gnutls_subject_alt_names_deinit1160800
-Ref: gnutls_subject_alt_names_get1161079
-Ref: gnutls_subject_alt_names_init1162089
-Ref: gnutls_subject_alt_names_set1162469
-Ref: gnutls_x509_aia_deinit1163288
-Ref: gnutls_x509_aia_get1163522
-Ref: gnutls_x509_aia_init1164681
-Ref: gnutls_x509_aia_set1165016
-Ref: gnutls_x509_aki_deinit1165811
-Ref: gnutls_x509_aki_get_cert_issuer1166075
-Ref: gnutls_x509_aki_get_id1167141
-Ref: gnutls_x509_aki_init1167680
-Ref: gnutls_x509_aki_set_cert_issuer1168029
-Ref: gnutls_x509_aki_set_id1169144
-Ref: gnutls_x509_cidr_to_rfc52801169573
-Ref: gnutls_x509_crl_check_issuer1170471
-Ref: gnutls_x509_crl_deinit1170919
-Ref: gnutls_x509_crl_dist_points_deinit1171151
-Ref: gnutls_x509_crl_dist_points_get1171446
-Ref: gnutls_x509_crl_dist_points_init1172420
-Ref: gnutls_x509_crl_dist_points_set1172816
-Ref: gnutls_x509_crl_export1173519
-Ref: gnutls_x509_crl_export21174402
-Ref: gnutls_x509_crl_get_authority_key_gn_serial1175122
-Ref: gnutls_x509_crl_get_authority_key_id1176436
-Ref: gnutls_x509_crl_get_crt_count1177499
-Ref: gnutls_x509_crl_get_crt_serial1177857
-Ref: gnutls_x509_crl_get_dn_oid1178761
-Ref: gnutls_x509_crl_get_extension_data1179567
-Ref: gnutls_x509_crl_get_extension_data21180684
-Ref: gnutls_x509_crl_get_extension_info1181563
-Ref: gnutls_x509_crl_get_extension_oid1182827
-Ref: gnutls_x509_crl_get_issuer_dn1183679
-Ref: gnutls_x509_crl_get_issuer_dn21184680
-Ref: gnutls_x509_crl_get_issuer_dn31185514
-Ref: gnutls_x509_crl_get_issuer_dn_by_oid1186492
-Ref: gnutls_x509_crl_get_next_update1188003
-Ref: gnutls_x509_crl_get_number1188437
-Ref: gnutls_x509_crl_get_raw_issuer_dn1189162
-Ref: gnutls_x509_crl_get_signature1189616
-Ref: gnutls_x509_crl_get_signature_algorithm1190163
-Ref: gnutls_x509_crl_get_signature_oid1190725
-Ref: gnutls_x509_crl_get_this_update1191386
-Ref: gnutls_x509_crl_get_version1191711
-Ref: gnutls_x509_crl_import1192019
-Ref: gnutls_x509_crl_init1192643
-Ref: gnutls_x509_crl_iter_crt_serial1193232
-Ref: gnutls_x509_crl_iter_deinit1194378
-Ref: gnutls_x509_crl_list_import1194623
-Ref: gnutls_x509_crl_list_import21195625
-Ref: gnutls_x509_crl_print1196491
-Ref: gnutls_x509_crl_set_authority_key_id1197140
-Ref: gnutls_x509_crl_set_crt1197793
-Ref: gnutls_x509_crl_set_crt_serial1198366
-Ref: gnutls_x509_crl_set_next_update1198998
-Ref: gnutls_x509_crl_set_number1199615
-Ref: gnutls_x509_crl_set_this_update1200192
-Ref: gnutls_x509_crl_set_version1200596
-Ref: gnutls_x509_crl_sign1201139
-Ref: gnutls_x509_crl_sign21201832
-Ref: gnutls_x509_crl_verify1203068
-Ref: gnutls_x509_crq_deinit1204312
-Ref: gnutls_x509_crq_export1204550
-Ref: gnutls_x509_crq_export21205547
-Ref: gnutls_x509_crq_get_attribute_by_oid1206321
-Ref: gnutls_x509_crq_get_attribute_data1207346
-Ref: gnutls_x509_crq_get_attribute_info1208458
-Ref: gnutls_x509_crq_get_basic_constraints1209655
-Ref: gnutls_x509_crq_get_challenge_password1210908
-Ref: gnutls_x509_crq_get_dn1211520
-Ref: gnutls_x509_crq_get_dn21212469
-Ref: gnutls_x509_crq_get_dn31213326
-Ref: gnutls_x509_crq_get_dn_by_oid1214334
-Ref: gnutls_x509_crq_get_dn_oid1215795
-Ref: gnutls_x509_crq_get_extension_by_oid1216582
-Ref: gnutls_x509_crq_get_extension_by_oid21217739
-Ref: gnutls_x509_crq_get_extension_data1218821
-Ref: gnutls_x509_crq_get_extension_data21219951
-Ref: gnutls_x509_crq_get_extension_info1220830
-Ref: gnutls_x509_crq_get_key_id1222091
-Ref: gnutls_x509_crq_get_key_purpose_oid1223158
-Ref: gnutls_x509_crq_get_key_rsa_raw1224173
-Ref: gnutls_x509_crq_get_key_usage1224797
-Ref: gnutls_x509_crq_get_pk_algorithm1225883
-Ref: gnutls_x509_crq_get_pk_oid1226604
-Ref: gnutls_x509_crq_get_private_key_usage_period1227261
-Ref: gnutls_x509_crq_get_signature_algorithm1227976
-Ref: gnutls_x509_crq_get_signature_oid1228615
-Ref: gnutls_x509_crq_get_spki1229276
-Ref: gnutls_x509_crq_get_subject_alt_name1229836
-Ref: gnutls_x509_crq_get_subject_alt_othername_oid1231394
-Ref: gnutls_x509_crq_get_tlsfeatures1232874
-Ref: gnutls_x509_crq_get_version1234003
-Ref: gnutls_x509_crq_import1234349
-Ref: gnutls_x509_crq_init1235031
-Ref: gnutls_x509_crq_print1235379
-Ref: gnutls_x509_crq_set_attribute_by_oid1236035
-Ref: gnutls_x509_crq_set_basic_constraints1236900
-Ref: gnutls_x509_crq_set_challenge_password1237644
-Ref: gnutls_x509_crq_set_dn1238095
-Ref: gnutls_x509_crq_set_dn_by_oid1238713
-Ref: gnutls_x509_crq_set_extension_by_oid1239843
-Ref: gnutls_x509_crq_set_key1240622
-Ref: gnutls_x509_crq_set_key_purpose_oid1241085
-Ref: gnutls_x509_crq_set_key_rsa_raw1241865
-Ref: gnutls_x509_crq_set_key_usage1242441
-Ref: gnutls_x509_crq_set_private_key_usage_period1242945
-Ref: gnutls_x509_crq_set_spki1243450
-Ref: gnutls_x509_crq_set_subject_alt_name1244321
-Ref: gnutls_x509_crq_set_subject_alt_othername1245147
-Ref: gnutls_x509_crq_set_tlsfeatures1245985
-Ref: gnutls_x509_crq_set_version1246535
-Ref: gnutls_x509_crq_sign1247020
-Ref: gnutls_x509_crq_sign21247791
-Ref: gnutls_x509_crq_verify1249123
-Ref: gnutls_x509_crt_check_email1249716
-Ref: gnutls_x509_crt_check_hostname1250244
-Ref: gnutls_x509_crt_check_hostname21250956
-Ref: gnutls_x509_crt_check_ip1252707
-Ref: gnutls_x509_crt_check_issuer1253321
-Ref: gnutls_x509_crt_check_key_purpose1254059
-Ref: gnutls_x509_crt_check_revocation1254753
-Ref: gnutls_x509_crt_cpy_crl_dist_points1255402
-Ref: gnutls_x509_crt_deinit1255991
-Ref: gnutls_x509_crt_equals1256209
-Ref: gnutls_x509_crt_equals21256591
-Ref: gnutls_x509_crt_export1257015
-Ref: gnutls_x509_crt_export21257926
-Ref: gnutls_x509_crt_get_activation_time1258624
-Ref: gnutls_x509_crt_get_authority_info_access1259002
-Ref: gnutls_x509_crt_get_authority_key_gn_serial1262476
-Ref: gnutls_x509_crt_get_authority_key_id1263917
-Ref: gnutls_x509_crt_get_basic_constraints1265048
-Ref: gnutls_x509_crt_get_ca_status1266262
-Ref: gnutls_x509_crt_get_crl_dist_points1267261
-Ref: gnutls_x509_crt_get_dn1268586
-Ref: gnutls_x509_crt_get_dn21269781
-Ref: gnutls_x509_crt_get_dn31270590
-Ref: gnutls_x509_crt_get_dn_by_oid1271550
-Ref: gnutls_x509_crt_get_dn_oid1273319
-Ref: gnutls_x509_crt_get_expiration_time1274347
-Ref: gnutls_x509_crt_get_extension_by_oid1274713
-Ref: gnutls_x509_crt_get_extension_by_oid21275840
-Ref: gnutls_x509_crt_get_extension_data1276913
-Ref: gnutls_x509_crt_get_extension_data21278002
-Ref: gnutls_x509_crt_get_extension_info1278867
-Ref: gnutls_x509_crt_get_extension_oid1280279
-Ref: gnutls_x509_crt_get_fingerprint1281242
-Ref: gnutls_x509_crt_get_inhibit_anypolicy1282130
-Ref: gnutls_x509_crt_get_issuer1283099
-Ref: gnutls_x509_crt_get_issuer_alt_name1283737
-Ref: gnutls_x509_crt_get_issuer_alt_name21285537
-Ref: gnutls_x509_crt_get_issuer_alt_othername_oid1287119
-Ref: gnutls_x509_crt_get_issuer_dn1288768
-Ref: gnutls_x509_crt_get_issuer_dn21289889
-Ref: gnutls_x509_crt_get_issuer_dn31290736
-Ref: gnutls_x509_crt_get_issuer_dn_by_oid1291727
-Ref: gnutls_x509_crt_get_issuer_dn_oid1293514
-Ref: gnutls_x509_crt_get_issuer_unique_id1294550
-Ref: gnutls_x509_crt_get_key_id1295645
-Ref: gnutls_x509_crt_get_key_purpose_oid1296668
-Ref: gnutls_x509_crt_get_key_usage1297829
-Ref: gnutls_x509_crt_get_name_constraints1298889
-Ref: gnutls_x509_crt_get_pk_algorithm1300297
-Ref: gnutls_x509_crt_get_pk_dsa_raw1301086
-Ref: gnutls_x509_crt_get_pk_ecc_raw1301754
-Ref: gnutls_x509_crt_get_pk_gost_raw1302567
-Ref: gnutls_x509_crt_get_pk_oid1303411
-Ref: gnutls_x509_crt_get_pk_rsa_raw1304037
-Ref: gnutls_x509_crt_get_policy1304615
-Ref: gnutls_x509_crt_get_private_key_usage_period1305561
-Ref: gnutls_x509_crt_get_proxy1306313
-Ref: gnutls_x509_crt_get_raw_dn1307334
-Ref: gnutls_x509_crt_get_raw_issuer_dn1307927
-Ref: gnutls_x509_crt_get_serial1308506
-Ref: gnutls_x509_crt_get_signature1309246
-Ref: gnutls_x509_crt_get_signature_algorithm1309801
-Ref: gnutls_x509_crt_get_signature_oid1310414
-Ref: gnutls_x509_crt_get_spki1311072
-Ref: gnutls_x509_crt_get_subject1311558
-Ref: gnutls_x509_crt_get_subject_alt_name1312201
-Ref: gnutls_x509_crt_get_subject_alt_name21313960
-Ref: gnutls_x509_crt_get_subject_alt_othername_oid1315525
-Ref: gnutls_x509_crt_get_subject_key_id1317165
-Ref: gnutls_x509_crt_get_subject_unique_id1317997
-Ref: gnutls_x509_crt_get_tlsfeatures1319082
-Ref: gnutls_x509_crt_get_version1320194
-Ref: gnutls_x509_crt_import1320521
-Ref: gnutls_x509_crt_import_url1321222
-Ref: gnutls_x509_crt_init1321943
-Ref: gnutls_x509_crt_list_import1322290
-Ref: gnutls_x509_crt_list_import21323657
-Ref: gnutls_x509_crt_list_import_url1324729
-Ref: gnutls_x509_crt_list_verify1325953
-Ref: gnutls_x509_crt_print1327533
-Ref: gnutls_x509_crt_set_activation_time1328425
-Ref: gnutls_x509_crt_set_authority_info_access1328892
-Ref: gnutls_x509_crt_set_authority_key_id1329787
-Ref: gnutls_x509_crt_set_basic_constraints1330369
-Ref: gnutls_x509_crt_set_ca_status1331068
-Ref: gnutls_x509_crt_set_crl_dist_points1331666
-Ref: gnutls_x509_crt_set_crl_dist_points21332318
-Ref: gnutls_x509_crt_set_crq1333017
-Ref: gnutls_x509_crt_set_crq_extension_by_oid1333734
-Ref: gnutls_x509_crt_set_crq_extensions1334370
-Ref: gnutls_x509_crt_set_dn1334836
-Ref: gnutls_x509_crt_set_dn_by_oid1335719
-Ref: gnutls_x509_crt_set_expiration_time1336836
-Ref: gnutls_x509_crt_set_extension_by_oid1337381
-Ref: gnutls_x509_crt_set_flags1338156
-Ref: gnutls_x509_crt_set_inhibit_anypolicy1338664
-Ref: gnutls_x509_crt_set_issuer_alt_name1339174
-Ref: gnutls_x509_crt_set_issuer_alt_othername1340196
-Ref: gnutls_x509_crt_set_issuer_dn1341172
-Ref: gnutls_x509_crt_set_issuer_dn_by_oid1341811
-Ref: gnutls_x509_crt_set_issuer_unique_id1343090
-Ref: gnutls_x509_crt_set_key1343595
-Ref: gnutls_x509_crt_set_key_purpose_oid1344175
-Ref: gnutls_x509_crt_set_key_usage1344943
-Ref: gnutls_x509_crt_set_name_constraints1345402
-Ref: gnutls_x509_crt_set_pin_function1346024
-Ref: gnutls_x509_crt_set_policy1346692
-Ref: gnutls_x509_crt_set_private_key_usage_period1347545
-Ref: gnutls_x509_crt_set_proxy1348052
-Ref: gnutls_x509_crt_set_proxy_dn1348866
-Ref: gnutls_x509_crt_set_serial1349885
-Ref: gnutls_x509_crt_set_spki1350945
-Ref: gnutls_x509_crt_set_subject_alt_name1351800
-Ref: gnutls_x509_crt_set_subject_alt_othername1353040
-Ref: gnutls_x509_crt_set_subject_alternative_name1354048
-Ref: gnutls_x509_crt_set_subject_key_id1354946
-Ref: gnutls_x509_crt_set_subject_unique_id1355466
-Ref: gnutls_x509_crt_set_tlsfeatures1355989
-Ref: gnutls_x509_crt_set_version1356513
-Ref: gnutls_x509_crt_sign1357336
-Ref: gnutls_x509_crt_sign21358031
-Ref: gnutls_x509_crt_verify1359264
-Ref: gnutls_x509_crt_verify_data21360313
-Ref: gnutls_x509_dn_deinit1361317
-Ref: gnutls_x509_dn_export1361579
-Ref: gnutls_x509_dn_export21362473
-Ref: gnutls_x509_dn_get_rdn_ava1363134
-Ref: gnutls_x509_dn_get_str1364166
-Ref: gnutls_x509_dn_get_str21364762
-Ref: gnutls_x509_dn_import1365624
-Ref: gnutls_x509_dn_init1366240
-Ref: gnutls_x509_dn_oid_known1366661
-Ref: gnutls_x509_dn_oid_name1367330
-Ref: gnutls_x509_dn_set_str1367859
-Ref: gnutls_x509_ext_deinit1368458
-Ref: gnutls_x509_ext_export_aia1368702
-Ref: gnutls_x509_ext_export_authority_key_id1369296
-Ref: gnutls_x509_ext_export_basic_constraints1369952
-Ref: gnutls_x509_ext_export_crl_dist_points1370649
-Ref: gnutls_x509_ext_export_inhibit_anypolicy1371317
-Ref: gnutls_x509_ext_export_key_purposes1371985
-Ref: gnutls_x509_ext_export_key_usage1372604
-Ref: gnutls_x509_ext_export_name_constraints1373220
-Ref: gnutls_x509_ext_export_policies1373861
-Ref: gnutls_x509_ext_export_private_key_usage_period1374524
-Ref: gnutls_x509_ext_export_proxy1375189
-Ref: gnutls_x509_ext_export_subject_alt_names1376175
-Ref: gnutls_x509_ext_export_subject_key_id1376824
-Ref: gnutls_x509_ext_export_tlsfeatures1377446
-Ref: gnutls_x509_ext_import_aia1378064
-Ref: gnutls_x509_ext_import_authority_key_id1378769
-Ref: gnutls_x509_ext_import_basic_constraints1379437
-Ref: gnutls_x509_ext_import_crl_dist_points1380063
-Ref: gnutls_x509_ext_import_inhibit_anypolicy1380691
-Ref: gnutls_x509_ext_import_key_purposes1381606
-Ref: gnutls_x509_ext_import_key_usage1382240
-Ref: gnutls_x509_ext_import_name_constraints1383256
-Ref: gnutls_x509_ext_import_policies1384594
-Ref: gnutls_x509_ext_import_private_key_usage_period1385201
-Ref: gnutls_x509_ext_import_proxy1385816
-Ref: gnutls_x509_ext_import_subject_alt_names1386902
-Ref: gnutls_x509_ext_import_subject_key_id1387660
-Ref: gnutls_x509_ext_import_tlsfeatures1388295
-Ref: gnutls_x509_ext_print1389187
-Ref: gnutls_x509_key_purpose_deinit1389898
-Ref: gnutls_x509_key_purpose_get1390152
-Ref: gnutls_x509_key_purpose_init1390880
-Ref: gnutls_x509_key_purpose_set1391241
-Ref: gnutls_x509_name_constraints_add_excluded1391696
-Ref: gnutls_x509_name_constraints_add_permitted1392637
-Ref: gnutls_x509_name_constraints_check1393512
-Ref: gnutls_x509_name_constraints_check_crt1394349
-Ref: gnutls_x509_name_constraints_deinit1395219
-Ref: gnutls_x509_name_constraints_get_excluded1395519
-Ref: gnutls_x509_name_constraints_get_permitted1396590
-Ref: gnutls_x509_name_constraints_init1397644
-Ref: gnutls_x509_othername_to_virtual1398027
-Ref: gnutls_x509_policies_deinit1398646
-Ref: gnutls_x509_policies_get1398926
-Ref: gnutls_x509_policies_init1399712
-Ref: gnutls_x509_policies_set1400077
-Ref: gnutls_x509_policy_release1400544
-Ref: gnutls_x509_privkey_cpy1400908
-Ref: gnutls_x509_privkey_deinit1401378
-Ref: gnutls_x509_privkey_export1401619
-Ref: gnutls_x509_privkey_export21402654
-Ref: gnutls_x509_privkey_export2_pkcs81403532
-Ref: gnutls_x509_privkey_export_dsa_raw1404808
-Ref: gnutls_x509_privkey_export_ecc_raw1405548
-Ref: gnutls_x509_privkey_export_gost_raw1406431
-Ref: gnutls_x509_privkey_export_pkcs81407516
-Ref: gnutls_x509_privkey_export_rsa_raw1409021
-Ref: gnutls_x509_privkey_export_rsa_raw21409882
-Ref: gnutls_x509_privkey_fix1410868
-Ref: gnutls_x509_privkey_generate1411253
-Ref: gnutls_x509_privkey_generate21412778
-Ref: gnutls_x509_privkey_get_key_id1414937
-Ref: gnutls_x509_privkey_get_pk_algorithm1415956
-Ref: gnutls_x509_privkey_get_pk_algorithm21416384
-Ref: gnutls_x509_privkey_get_seed1416875
-Ref: gnutls_x509_privkey_get_spki1417699
-Ref: gnutls_x509_privkey_import1418234
-Ref: gnutls_x509_privkey_import21419029
-Ref: gnutls_x509_privkey_import_dsa_raw1420102
-Ref: gnutls_x509_privkey_import_ecc_raw1420834
-Ref: gnutls_x509_privkey_import_gost_raw1421650
-Ref: gnutls_x509_privkey_import_openssl1422926
-Ref: gnutls_x509_privkey_import_pkcs81423800
-Ref: gnutls_x509_privkey_import_rsa_raw1425247
-Ref: gnutls_x509_privkey_import_rsa_raw21426101
-Ref: gnutls_x509_privkey_init1427097
-Ref: gnutls_x509_privkey_sec_param1427442
-Ref: gnutls_x509_privkey_set_flags1427861
-Ref: gnutls_x509_privkey_set_pin_function1428411
-Ref: gnutls_x509_privkey_set_spki1429029
-Ref: gnutls_x509_privkey_sign_data1429576
-Ref: gnutls_x509_privkey_verify_params1430797
-Ref: gnutls_x509_privkey_verify_seed1431133
-Ref: gnutls_x509_rdn_get1431962
-Ref: gnutls_x509_rdn_get21432780
-Ref: gnutls_x509_rdn_get_by_oid1433688
-Ref: gnutls_x509_rdn_get_oid1434670
-Ref: gnutls_x509_spki_deinit1435415
-Ref: gnutls_x509_spki_get_rsa_pss_params1435697
-Ref: gnutls_x509_spki_init1436258
-Ref: gnutls_x509_spki_set_rsa_pss_params1436774
-Ref: gnutls_x509_tlsfeatures_add1437287
-Ref: gnutls_x509_tlsfeatures_check_crt1437743
-Ref: gnutls_x509_tlsfeatures_deinit1438343
-Ref: gnutls_x509_tlsfeatures_get1438621
-Ref: gnutls_x509_tlsfeatures_init1439181
-Ref: gnutls_x509_trust_list_add_cas1439566
-Ref: gnutls_x509_trust_list_add_crls1440751
-Ref: gnutls_x509_trust_list_add_named_crt1442129
-Ref: gnutls_x509_trust_list_add_system_trust1443344
-Ref: gnutls_x509_trust_list_add_trust_dir1444106
-Ref: gnutls_x509_trust_list_add_trust_file1444969
-Ref: gnutls_x509_trust_list_add_trust_mem1446116
-Ref: gnutls_x509_trust_list_deinit1447035
-Ref: gnutls_x509_trust_list_get_issuer1447661
-Ref: gnutls_x509_trust_list_get_issuer_by_dn1448711
-Ref: gnutls_x509_trust_list_get_issuer_by_subject_key_id1449440
-Ref: gnutls_x509_trust_list_get_ptr1450248
-Ref: gnutls_x509_trust_list_init1450761
-Ref: gnutls_x509_trust_list_iter_deinit1451266
-Ref: gnutls_x509_trust_list_iter_get_ca1451575
-Ref: gnutls_x509_trust_list_remove_cas1452755
-Ref: gnutls_x509_trust_list_remove_trust_file1453610
-Ref: gnutls_x509_trust_list_remove_trust_mem1454311
-Ref: gnutls_x509_trust_list_set_getissuer_function1454969
-Ref: gnutls_x509_trust_list_set_ptr1456602
-Ref: gnutls_x509_trust_list_verify_crt1457140
-Ref: gnutls_x509_trust_list_verify_crt21458303
-Ref: gnutls_x509_trust_list_verify_named_crt1461237
-Node: PKCS 7 API1463965
-Ref: gnutls_pkcs7_add_attr1464261
-Ref: gnutls_pkcs7_attrs_deinit1465067
-Ref: gnutls_pkcs7_deinit1465302
-Ref: gnutls_pkcs7_delete_crl1465507
-Ref: gnutls_pkcs7_delete_crt1465936
-Ref: gnutls_pkcs7_export1466382
-Ref: gnutls_pkcs7_export21467282
-Ref: gnutls_pkcs7_get_attr1467943
-Ref: gnutls_pkcs7_get_crl_count1468830
-Ref: gnutls_pkcs7_get_crl_raw1469178
-Ref: gnutls_pkcs7_get_crl_raw21469953
-Ref: gnutls_pkcs7_get_crt_count1470584
-Ref: gnutls_pkcs7_get_crt_raw1470959
-Ref: gnutls_pkcs7_get_crt_raw21471859
-Ref: gnutls_pkcs7_get_embedded_data1472713
-Ref: gnutls_pkcs7_get_embedded_data_oid1473713
-Ref: gnutls_pkcs7_get_signature_count1474273
-Ref: gnutls_pkcs7_get_signature_info1474680
-Ref: gnutls_pkcs7_import1475353
-Ref: gnutls_pkcs7_init1475974
-Ref: gnutls_pkcs7_print1476398
-Ref: gnutls_pkcs7_print_signature_info1477143
-Ref: gnutls_pkcs7_set_crl1477948
-Ref: gnutls_pkcs7_set_crl_raw1478349
-Ref: gnutls_pkcs7_set_crt1478739
-Ref: gnutls_pkcs7_set_crt_raw1479223
-Ref: gnutls_pkcs7_sign1479636
-Ref: gnutls_pkcs7_signature_info_deinit1481075
-Ref: gnutls_pkcs7_verify1481428
-Ref: gnutls_pkcs7_verify_direct1482593
-Node: OCSP API1484053
-Ref: gnutls_ocsp_req_add_cert1484337
-Ref: gnutls_ocsp_req_add_cert_id1485297
-Ref: gnutls_ocsp_req_deinit1486617
-Ref: gnutls_ocsp_req_export1486834
-Ref: gnutls_ocsp_req_get_cert_id1487259
-Ref: gnutls_ocsp_req_get_extension1488851
-Ref: gnutls_ocsp_req_get_nonce1490267
-Ref: gnutls_ocsp_req_get_version1490921
-Ref: gnutls_ocsp_req_import1491308
-Ref: gnutls_ocsp_req_init1491804
-Ref: gnutls_ocsp_req_print1492132
-Ref: gnutls_ocsp_req_randomize_nonce1492868
-Ref: gnutls_ocsp_req_set_extension1493301
-Ref: gnutls_ocsp_req_set_nonce1493985
-Ref: gnutls_ocsp_resp_check_crt1494572
-Ref: gnutls_ocsp_resp_deinit1495156
-Ref: gnutls_ocsp_resp_export1495380
-Ref: gnutls_ocsp_resp_export21495806
-Ref: gnutls_ocsp_resp_get_certs1496326
-Ref: gnutls_ocsp_resp_get_extension1497451
-Ref: gnutls_ocsp_resp_get_nonce1498875
-Ref: gnutls_ocsp_resp_get_produced1499541
-Ref: gnutls_ocsp_resp_get_responder1499888
-Ref: gnutls_ocsp_resp_get_responder21500993
-Ref: gnutls_ocsp_resp_get_responder_raw_id1502256
-Ref: gnutls_ocsp_resp_get_response1503087
-Ref: gnutls_ocsp_resp_get_signature1504313
-Ref: gnutls_ocsp_resp_get_signature_algorithm1504802
-Ref: gnutls_ocsp_resp_get_single1505280
-Ref: gnutls_ocsp_resp_get_status1507222
-Ref: gnutls_ocsp_resp_get_version1507651
-Ref: gnutls_ocsp_resp_import1508059
-Ref: gnutls_ocsp_resp_import21508627
-Ref: gnutls_ocsp_resp_init1509255
-Ref: gnutls_ocsp_resp_list_import21509604
-Ref: gnutls_ocsp_resp_print1510795
-Ref: gnutls_ocsp_resp_verify1511521
-Ref: gnutls_ocsp_resp_verify_direct1513138
-Node: PKCS 12 API1515571
-Ref: gnutls_pkcs12_bag_decrypt1515861
-Ref: gnutls_pkcs12_bag_deinit1516293
-Ref: gnutls_pkcs12_bag_enc_info1516531
-Ref: gnutls_pkcs12_bag_encrypt1517904
-Ref: gnutls_pkcs12_bag_get_count1518409
-Ref: gnutls_pkcs12_bag_get_data1518720
-Ref: gnutls_pkcs12_bag_get_friendly_name1519326
-Ref: gnutls_pkcs12_bag_get_key_id1519963
-Ref: gnutls_pkcs12_bag_get_type1520582
-Ref: gnutls_pkcs12_bag_init1520952
-Ref: gnutls_pkcs12_bag_set_crl1521410
-Ref: gnutls_pkcs12_bag_set_crt1521843
-Ref: gnutls_pkcs12_bag_set_data1522289
-Ref: gnutls_pkcs12_bag_set_friendly_name1522760
-Ref: gnutls_pkcs12_bag_set_key_id1523444
-Ref: gnutls_pkcs12_bag_set_privkey1524118
-Ref: gnutls_pkcs12_deinit1524774
-Ref: gnutls_pkcs12_export1524976
-Ref: gnutls_pkcs12_export21525883
-Ref: gnutls_pkcs12_generate_mac1526559
-Ref: gnutls_pkcs12_generate_mac21526950
-Ref: gnutls_pkcs12_get_bag1527394
-Ref: gnutls_pkcs12_import1527980
-Ref: gnutls_pkcs12_init1528701
-Ref: gnutls_pkcs12_mac_info1529134
-Ref: gnutls_pkcs12_set_bag1530443
-Ref: gnutls_pkcs12_simple_parse1530849
-Ref: gnutls_pkcs12_verify_mac1533530
-Node: PKCS 11 API1533886
-Ref: gnutls_pkcs11_add_provider1534215
-Ref: gnutls_pkcs11_copy_attached_extension1534960
-Ref: gnutls_pkcs11_copy_pubkey1535819
-Ref: gnutls_pkcs11_copy_secret_key1536852
-Ref: gnutls_pkcs11_copy_x509_crt1537577
-Ref: gnutls_pkcs11_copy_x509_crt21538225
-Ref: gnutls_pkcs11_copy_x509_privkey1539193
-Ref: gnutls_pkcs11_copy_x509_privkey21540010
-Ref: gnutls_pkcs11_crt_is_known1540955
-Ref: gnutls_pkcs11_deinit1542091
-Ref: gnutls_pkcs11_delete_url1542408
-Ref: gnutls_pkcs11_get_pin_function1542924
-Ref: gnutls_pkcs11_get_raw_issuer1543307
-Ref: gnutls_pkcs11_get_raw_issuer_by_dn1544217
-Ref: gnutls_pkcs11_get_raw_issuer_by_subject_key_id1545256
-Ref: gnutls_pkcs11_init1546367
-Ref: gnutls_pkcs11_obj_deinit1547409
-Ref: gnutls_pkcs11_obj_export1547655
-Ref: gnutls_pkcs11_obj_export21548500
-Ref: gnutls_pkcs11_obj_export31549097
-Ref: gnutls_pkcs11_obj_export_url1549770
-Ref: gnutls_pkcs11_obj_flags_get_str1550297
-Ref: gnutls_pkcs11_obj_get_exts1550776
-Ref: gnutls_pkcs11_obj_get_flags1551712
-Ref: gnutls_pkcs11_obj_get_info1552249
-Ref: gnutls_pkcs11_obj_get_ptr1553513
-Ref: gnutls_pkcs11_obj_get_type1554422
-Ref: gnutls_pkcs11_obj_import_url1554772
-Ref: gnutls_pkcs11_obj_init1555692
-Ref: gnutls_pkcs11_obj_list_import_url31556077
-Ref: gnutls_pkcs11_obj_list_import_url41558018
-Ref: gnutls_pkcs11_obj_set_info1559694
-Ref: gnutls_pkcs11_obj_set_pin_function1560473
-Ref: gnutls_pkcs11_privkey_cpy1560984
-Ref: gnutls_pkcs11_privkey_deinit1561485
-Ref: gnutls_pkcs11_privkey_export_pubkey1561748
-Ref: gnutls_pkcs11_privkey_export_url1562552
-Ref: gnutls_pkcs11_privkey_generate1563062
-Ref: gnutls_pkcs11_privkey_generate21563734
-Ref: gnutls_pkcs11_privkey_generate31564964
-Ref: gnutls_pkcs11_privkey_get_info1566474
-Ref: gnutls_pkcs11_privkey_get_pk_algorithm1567356
-Ref: gnutls_pkcs11_privkey_import_url1567887
-Ref: gnutls_pkcs11_privkey_init1568588
-Ref: gnutls_pkcs11_privkey_set_pin_function1569303
-Ref: gnutls_pkcs11_privkey_status1569823
-Ref: gnutls_pkcs11_reinit1570199
-Ref: gnutls_pkcs11_set_pin_function1570759
-Ref: gnutls_pkcs11_set_token_function1571249
-Ref: gnutls_pkcs11_token_check_mechanism1571667
-Ref: gnutls_pkcs11_token_get_flags1572424
-Ref: gnutls_pkcs11_token_get_info1572966
-Ref: gnutls_pkcs11_token_get_mechanism1573989
-Ref: gnutls_pkcs11_token_get_ptr1574602
-Ref: gnutls_pkcs11_token_get_random1575301
-Ref: gnutls_pkcs11_token_get_url1575932
-Ref: gnutls_pkcs11_token_init1576600
-Ref: gnutls_pkcs11_token_set_pin1577238
-Ref: gnutls_pkcs11_type_get_name1578078
-Ref: gnutls_x509_crt_import_pkcs111578567
-Ref: gnutls_x509_crt_list_import_pkcs111579089
-Node: TPM API1579698
-Ref: gnutls_tpm_get_registered1579977
-Ref: gnutls_tpm_key_list_deinit1580370
-Ref: gnutls_tpm_key_list_get_url1580638
-Ref: gnutls_tpm_privkey_delete1581291
-Ref: gnutls_tpm_privkey_generate1581729
-Node: Abstract key API1583079
-Ref: gnutls_certificate_set_key1583400
-Ref: gnutls_certificate_set_retrieve_function21585536
-Ref: gnutls_certificate_set_retrieve_function31587786
-Ref: gnutls_pcert_deinit1590646
-Ref: gnutls_pcert_export_openpgp1590891
-Ref: gnutls_pcert_export_x5091591240
-Ref: gnutls_pcert_import_openpgp1591890
-Ref: gnutls_pcert_import_openpgp_raw1592289
-Ref: gnutls_pcert_import_rawpk1592858
-Ref: gnutls_pcert_import_rawpk_raw1593711
-Ref: gnutls_pcert_import_x5091594960
-Ref: gnutls_pcert_import_x509_list1595557
-Ref: gnutls_pcert_import_x509_raw1596747
-Ref: gnutls_pcert_list_import_x509_file1597453
-Ref: gnutls_pcert_list_import_x509_raw1598885
-Ref: gnutls_privkey_decrypt_data1600219
-Ref: gnutls_privkey_decrypt_data21600867
-Ref: gnutls_privkey_deinit1601692
-Ref: gnutls_privkey_export_dsa_raw1601941
-Ref: gnutls_privkey_export_dsa_raw21602671
-Ref: gnutls_privkey_export_ecc_raw1603477
-Ref: gnutls_privkey_export_ecc_raw21604339
-Ref: gnutls_privkey_export_gost_raw21605281
-Ref: gnutls_privkey_export_openpgp1606415
-Ref: gnutls_privkey_export_pkcs111606767
-Ref: gnutls_privkey_export_rsa_raw1607379
-Ref: gnutls_privkey_export_rsa_raw21608410
-Ref: gnutls_privkey_export_x5091609456
-Ref: gnutls_privkey_generate1610104
-Ref: gnutls_privkey_generate21611595
-Ref: gnutls_privkey_get_pk_algorithm1613723
-Ref: gnutls_privkey_get_seed1614337
-Ref: gnutls_privkey_get_spki1615136
-Ref: gnutls_privkey_get_type1615716
-Ref: gnutls_privkey_import_dsa_raw1616205
-Ref: gnutls_privkey_import_ecc_raw1616917
-Ref: gnutls_privkey_import_ext1617730
-Ref: gnutls_privkey_import_ext21618880
-Ref: gnutls_privkey_import_ext31620237
-Ref: gnutls_privkey_import_ext41621851
-Ref: gnutls_privkey_import_gost_raw1624611
-Ref: gnutls_privkey_import_openpgp1625819
-Ref: gnutls_privkey_import_openpgp_raw1626228
-Ref: gnutls_privkey_import_pkcs111626817
-Ref: gnutls_privkey_import_pkcs11_url1627575
-Ref: gnutls_privkey_import_rsa_raw1628024
-Ref: gnutls_privkey_import_tpm_raw1629020
-Ref: gnutls_privkey_import_tpm_url1629887
-Ref: gnutls_privkey_import_url1630990
-Ref: gnutls_privkey_import_x5091631537
-Ref: gnutls_privkey_import_x509_raw1632285
-Ref: gnutls_privkey_init1633064
-Ref: gnutls_privkey_set_flags1633982
-Ref: gnutls_privkey_set_pin_function1634507
-Ref: gnutls_privkey_set_spki1635077
-Ref: gnutls_privkey_sign_data1635650
-Ref: gnutls_privkey_sign_data21636670
-Ref: gnutls_privkey_sign_hash1637568
-Ref: gnutls_privkey_sign_hash21639005
-Ref: gnutls_privkey_status1640271
-Ref: gnutls_privkey_verify_params1640815
-Ref: gnutls_privkey_verify_seed1641177
-Ref: gnutls_pubkey_deinit1641889
-Ref: gnutls_pubkey_encrypt_data1642129
-Ref: gnutls_pubkey_export1642771
-Ref: gnutls_pubkey_export21643785
-Ref: gnutls_pubkey_export_dsa_raw1644558
-Ref: gnutls_pubkey_export_dsa_raw21645370
-Ref: gnutls_pubkey_export_ecc_raw1646254
-Ref: gnutls_pubkey_export_ecc_raw21647153
-Ref: gnutls_pubkey_export_ecc_x9621648132
-Ref: gnutls_pubkey_export_gost_raw21648791
-Ref: gnutls_pubkey_export_rsa_raw1649935
-Ref: gnutls_pubkey_export_rsa_raw21650632
-Ref: gnutls_pubkey_get_key_id1651393
-Ref: gnutls_pubkey_get_key_usage1652418
-Ref: gnutls_pubkey_get_openpgp_key_id1652915
-Ref: gnutls_pubkey_get_pk_algorithm1653554
-Ref: gnutls_pubkey_get_preferred_hash_algorithm1654202
-Ref: gnutls_pubkey_get_spki1655143
-Ref: gnutls_pubkey_import1655711
-Ref: gnutls_pubkey_import_dsa_raw1656395
-Ref: gnutls_pubkey_import_ecc_raw1657056
-Ref: gnutls_pubkey_import_ecc_x9621657824
-Ref: gnutls_pubkey_import_gost_raw1658460
-Ref: gnutls_pubkey_import_openpgp1659607
-Ref: gnutls_pubkey_import_openpgp_raw1659999
-Ref: gnutls_pubkey_import_pkcs111660568
-Ref: gnutls_pubkey_import_privkey1661110
-Ref: gnutls_pubkey_import_rsa_raw1661812
-Ref: gnutls_pubkey_import_tpm_raw1662336
-Ref: gnutls_pubkey_import_tpm_url1663113
-Ref: gnutls_pubkey_import_url1664005
-Ref: gnutls_pubkey_import_x5091664478
-Ref: gnutls_pubkey_import_x509_crq1664978
-Ref: gnutls_pubkey_import_x509_raw1665481
-Ref: gnutls_pubkey_init1666058
-Ref: gnutls_pubkey_print1666387
-Ref: gnutls_pubkey_set_key_usage1667121
-Ref: gnutls_pubkey_set_pin_function1667690
-Ref: gnutls_pubkey_set_spki1668255
-Ref: gnutls_pubkey_verify_data21668826
-Ref: gnutls_pubkey_verify_hash21669734
-Ref: gnutls_pubkey_verify_params1670858
-Ref: gnutls_register_custom_url1671216
-Ref: gnutls_system_key_add_x5091672154
-Ref: gnutls_system_key_delete1672899
-Ref: gnutls_system_key_iter_deinit1673323
-Ref: gnutls_system_key_iter_get_info1673591
-Ref: gnutls_x509_crl_privkey_sign1674865
-Ref: gnutls_x509_crq_privkey_sign1676134
-Ref: gnutls_x509_crq_set_pubkey1677496
-Ref: gnutls_x509_crt_privkey_sign1678004
-Ref: gnutls_x509_crt_set_pubkey1679247
-Node: Socket specific API1679700
-Ref: gnutls_transport_set_fastopen1679993
-Node: DANE API1681539
-Ref: dane_cert_type_name1681913
-Ref: dane_cert_usage_name1682203
-Ref: dane_match_type_name1682515
-Ref: dane_query_data1682798
-Ref: dane_query_deinit1683477
-Ref: dane_query_entries1683682
-Ref: dane_query_status1683924
-Ref: dane_query_tlsa1684218
-Ref: dane_query_to_raw_tlsa1684809
-Ref: dane_raw_tlsa1686151
-Ref: dane_state_deinit1687228
-Ref: dane_state_init1687420
-Ref: dane_state_set_dlv_file1687934
-Ref: dane_strerror1688235
-Ref: dane_verification_status_print1688734
-Ref: dane_verify_crt1689328
-Ref: dane_verify_crt_raw1691515
-Ref: dane_verify_session_crt1692748
-Node: Cryptographic API1694150
-Ref: gnutls_aead_cipher_decrypt1694651
-Ref: gnutls_aead_cipher_decryptv21696030
-Ref: gnutls_aead_cipher_deinit1696955
-Ref: gnutls_aead_cipher_encrypt1697283
-Ref: gnutls_aead_cipher_encryptv1698392
-Ref: gnutls_aead_cipher_encryptv21699540
-Ref: gnutls_aead_cipher_init1700468
-Ref: gnutls_cipher_add_auth1701134
-Ref: gnutls_cipher_decrypt1701714
-Ref: gnutls_cipher_decrypt21702338
-Ref: gnutls_cipher_deinit1703264
-Ref: gnutls_cipher_encrypt1703543
-Ref: gnutls_cipher_encrypt21704003
-Ref: gnutls_cipher_get_block_size1704780
-Ref: gnutls_cipher_get_iv_size1705060
-Ref: gnutls_cipher_get_tag_size1705542
-Ref: gnutls_cipher_init1705948
-Ref: gnutls_cipher_set_iv1706678
-Ref: gnutls_cipher_tag1707023
-Ref: gnutls_crypto_register_aead_cipher1707525
-Ref: gnutls_crypto_register_cipher1709129
-Ref: gnutls_crypto_register_digest1710910
-Ref: gnutls_crypto_register_mac1712134
-Ref: gnutls_decode_ber_digest_info1713562
-Ref: gnutls_decode_gost_rs_value1714361
-Ref: gnutls_decode_rs_value1715161
-Ref: gnutls_encode_ber_digest_info1715946
-Ref: gnutls_encode_gost_rs_value1716590
-Ref: gnutls_encode_rs_value1717336
-Ref: gnutls_hash1717956
-Ref: gnutls_hash_copy1718387
-Ref: gnutls_hash_deinit1718904
-Ref: gnutls_hash_fast1719232
-Ref: gnutls_hash_get_len1719749
-Ref: gnutls_hash_init1720082
-Ref: gnutls_hash_output1720618
-Ref: gnutls_hkdf_expand1720950
-Ref: gnutls_hkdf_extract1721653
-Ref: gnutls_hmac1722196
-Ref: gnutls_hmac_copy1722627
-Ref: gnutls_hmac_deinit1723108
-Ref: gnutls_hmac_fast1723435
-Ref: gnutls_hmac_get_key_size1724159
-Ref: gnutls_hmac_get_len1724620
-Ref: gnutls_hmac_init1724950
-Ref: gnutls_hmac_output1725733
-Ref: gnutls_hmac_set_nonce1726068
-Ref: gnutls_mac_get_nonce_size1726435
-Ref: gnutls_pbkdf21726751
-Ref: gnutls_rnd1727384
-Ref: gnutls_rnd_refresh1728022
-Node: Compatibility API1728308
-Ref: gnutls_compression_get1728650
-Ref: gnutls_compression_get_id1729002
-Ref: gnutls_compression_get_name1729366
-Ref: gnutls_compression_list1729748
-Ref: gnutls_global_set_mem_functions1730080
-Ref: gnutls_openpgp_privkey_sign_hash1731455
-Ref: gnutls_priority_compression_list1731884
-Ref: gnutls_x509_crt_get_preferred_hash_algorithm1732336
-Ref: gnutls_x509_privkey_sign_hash1733217
-Node: Copying Information1734087
-Node: Bibliography1759264
-Ref: CBCATT1759403
-Ref: GPGH1759581
-Ref: GUTPKI1759704
-Ref: PRNGATTACKS1759879
-Ref: KEYPIN1760079
-Ref: NISTSP800571760254
-Ref: RFC74131760502
-Ref: RFC79181760669
-Ref: RFC61251760846
-Ref: RFC76851761187
-Ref: RFC76131761362
-Ref: RFC22461761610
-Ref: RFC60831761771
-Ref: RFC44181762008
-Ref: RFC46801762175
-Ref: RFC76331762333
-Ref: RFC79191762505
-Ref: RFC45141762709
-Ref: RFC43461762913
-Ref: RFC43471763063
-Ref: RFC52461763230
-Ref: RFC24401763381
-Ref: RFC48801763563
-Ref: RFC42111763757
-Ref: RFC28171763951
-Ref: RFC28181764104
-Ref: RFC29451764218
-Ref: RFC73011764368
-Ref: RFC29861764588
-Ref: PKIX1764777
-Ref: RFC37491765040
-Ref: RFC38201765206
-Ref: RFC65201765449
-Ref: RFC57461765688
-Ref: RFC52801765897
-Ref: TLSTKT1766164
-Ref: PKCS121766396
-Ref: PKCS111766537
-Ref: RESCORLA1766683
-Ref: SELKEY1766779
-Ref: SSL31766938
-Ref: STEVENS1767129
-Ref: TLSEXT1767237
-Ref: TLSPGP1767454
-Ref: TLSSRP1767619
-Ref: TLSPSK1767816
-Ref: TOMSRP1767985
-Ref: WEGER1768098
-Ref: ECRYPT1768290
-Ref: RFC50561768495
-Ref: RFC57641768648
-Ref: RFC59291768936
-Ref: PKCS11URI1769079
-Ref: TPMURI1769215
-Ref: ANDERSON1769409
-Ref: RFC48211769555
-Ref: RFC25601769708
-Ref: RIVESTCRL1769902
-Node: Function and Data Index1770263
-Node: Concept Index1896190
+Ref: p11tool id313760
+Ref: p11tool mark-wrap314017
+Ref: p11tool mark-trusted314264
+Ref: p11tool mark-distrusted314628
+Ref: p11tool mark-decrypt315082
+Ref: p11tool mark-sign315359
+Ref: p11tool mark-ca315636
+Ref: p11tool mark-private315909
+Ref: p11tool ca316207
+Ref: p11tool private316341
+Ref: p11tool secret-key316496
+Ref: p11tool other-options316659
+Ref: p11tool debug316761
+Ref: p11tool so-login316902
+Ref: p11tool admin-login317146
+Ref: p11tool test-sign317287
+Ref: p11tool sign-params317581
+Ref: p11tool hash317921
+Ref: p11tool generate-random318217
+Ref: p11tool inder318391
+Ref: p11tool inraw318616
+Ref: p11tool outder318742
+Ref: p11tool outraw318994
+Ref: p11tool provider319127
+Ref: p11tool provider-opts319336
+Ref: p11tool batch319609
+Ref: p11tool exit status319762
+Ref: p11tool See Also319992
+Ref: p11tool Examples320040
+Node: Trusted Platform Module322461
+Ref: Trusted Platform Module-Footnote-1324254
+Ref: Trusted Platform Module-Footnote-2324302
+Node: Keys in TPM324359
+Node: Key generation325843
+Node: Using keys328111
+Node: tpmtool Invocation331756
+Ref: tpmtool usage332182
+Ref: tpmtool debug335494
+Ref: tpmtool generate-rsa335635
+Ref: tpmtool user335906
+Ref: tpmtool system336265
+Ref: tpmtool test-sign336619
+Ref: tpmtool sec-param336902
+Ref: tpmtool inder337228
+Ref: tpmtool outder337529
+Ref: tpmtool srk-well-known337748
+Ref: tpmtool exit status337904
+Ref: tpmtool See Also338134
+Ref: tpmtool Examples338195
+Node: How to use GnuTLS in applications338812
+Node: Introduction to the library339381
+Node: General idea339980
+Ref: fig-gnutls-design340829
+Ref: General idea-Footnote-1342134
+Node: Error handling342179
+Node: Common types344406
+Node: Debugging and auditing345740
+Ref: tab:environment346611
+Node: Thread safety349478
+Ref: Thread safety-Footnote-1351624
+Node: Running in a sandbox351836
+Node: Sessions and fork353230
+Node: Callback functions353782
+Node: Preparation354750
+Node: Headers355169
+Node: Initialization355458
+Ref: Initialization-Footnote-1356452
+Node: Version check356745
+Node: Building the source357620
+Node: Session initialization359731
+Ref: gnutls_init_flags_t361208
+Node: Associating the credentials368221
+Ref: tab:key-exchange-cred368997
+Node: Certificate credentials370128
+Node: Raw public-key credentials385713
+Node: SRP credentials387013
+Node: PSK credentials391911
+Node: Anonymous credentials395846
+Node: Setting up the transport layer396692
+Node: Asynchronous operation406245
+Node: Reducing round-trips410546
+Node: Zero-roundtrip mode413986
+Node: Anti-replay protection416191
+Node: DTLS sessions419836
+Ref: DTLS sessions-Footnote-1422140
+Node: DTLS and SCTP422217
+Node: TLS handshake423237
+Node: Data transfer and termination427155
+Node: Buffered data transfer436297
+Node: Handling alerts438098
+Node: Priority Strings441480
+Ref: tab:prio-keywords444080
+Ref: tab:prio-algorithms451158
+Ref: tab:prio-special1456588
+Ref: tab:prio-special2460435
+Ref: Priority Strings-Footnote-1467056
+Node: Selecting cryptographic key sizes467278
+Ref: tab:key-sizes467927
+Node: Advanced topics472676
+Node: Virtual hosts and credentials473174
+Node: Session resumption476499
+Node: Certificate verification484406
+Ref: dane_verify_status_t494127
+Node: TLS 1.2 re-authentication494532
+Node: TLS 1.3 re-authentication and re-key499389
+Node: Parameter generation501048
+Node: Deriving keys for other applications/protocols503695
+Node: Channel Bindings506925
+Node: Interoperability508464
+Node: Compatibility with the OpenSSL library509782
+Node: GnuTLS application examples510509
+Ref: examples510728
+Node: Client examples511021
+Node: Client example with X.509 certificate support511548
+Ref: ex-verify511786
+Node: Datagram TLS client example516830
+Node: Client using a smart card with TLS521235
+Ref: ex-pkcs11-client521472
+Node: Client with Resume capability example526767
+Ref: ex-resume-client527051
+Node: Client example with SSH-style certificate verification532238
+Node: Server examples536445
+Node: Echo server with X.509 authentication536799
+Node: DTLS echo server with X.509 authentication544523
+Node: More advanced client and servers558934
+Node: Client example with anonymous authentication559791
+Node: Using a callback to select the certificate to use563715
+Node: Obtaining session information570098
+Node: Advanced certificate verification example574311
+Ref: ex-verify2574587
+Node: Client example with PSK authentication580017
+Node: Client example with SRP authentication584383
+Node: Legacy client example with X.509 certificate support588667
+Ref: ex-verify-legacy588984
+Node: Client example in C++594937
+Node: Echo server with PSK authentication597509
+Node: Echo server with SRP authentication606240
+Node: Echo server with anonymous authentication613158
+Node: Helper functions for TCP connections618486
+Node: Helper functions for UDP connections620078
+Node: OCSP example621983
+Ref: Generate OCSP request622166
+Node: Miscellaneous examples631773
+Node: Checking for an alert632099
+Node: X.509 certificate parsing example633548
+Ref: ex-x509-info633805
+Node: Listing the ciphersuites in a priority string637834
+Node: PKCS12 structure generation example640151
+Node: System-wide configuration of the library644356
+Node: Application-specific priority strings646183
+Node: Disabling algorithms and protocols647631
+Node: Querying for disabled algorithms and protocols653128
+Node: Overriding the parameter verification profile654250
+Node: Overriding the default priority string655252
+Node: Using GnuTLS as a cryptographic library655869
+Ref: Using GnuTLS as a cryptographic library-Footnote-1656725
+Node: Symmetric algorithms656782
+Ref: gnutls_cipher_algorithm_t657542
+Ref: Symmetric algorithms-Footnote-1665972
+Node: Public key algorithms666057
+Node: Cryptographic Message Syntax / PKCS7670779
+Ref: gnutls_pkcs7_sign_flags674218
+Node: Hash and MAC functions675686
+Ref: gnutls_mac_algorithm_t676298
+Ref: gnutls_digest_algorithm_t679670
+Node: Random number generation680721
+Ref: gnutls_rnd_level_t681083
+Node: Overriding algorithms682190
+Node: Other included programs688508
+Node: gnutls-cli Invocation689079
+Ref: gnutls-cli usage689641
+Ref: gnutls-cli debug697391
+Ref: gnutls-cli tofu697532
+Ref: gnutls-cli strict-tofu697995
+Ref: gnutls-cli dane698397
+Ref: gnutls-cli local-dns698740
+Ref: gnutls-cli ca-verification699055
+Ref: gnutls-cli ocsp699410
+Ref: gnutls-cli resume699652
+Ref: gnutls-cli rehandshake699798
+Ref: gnutls-cli sni-hostname699965
+Ref: gnutls-cli verify-hostname700491
+Ref: gnutls-cli starttls700724
+Ref: gnutls-cli app-proto700908
+Ref: gnutls-cli starttls-proto701070
+Ref: gnutls-cli save-ocsp-multi701581
+Ref: gnutls-cli dh-bits702038
+Ref: gnutls-cli priority702389
+Ref: gnutls-cli rawpkkeyfile702767
+Ref: gnutls-cli rawpkfile703224
+Ref: gnutls-cli ranges703765
+Ref: gnutls-cli benchmark-ciphers704015
+Ref: gnutls-cli benchmark-tls-ciphers704333
+Ref: gnutls-cli list704652
+Ref: gnutls-cli priority-list705019
+Ref: gnutls-cli noticket705265
+Ref: gnutls-cli alpn705426
+Ref: gnutls-cli disable-extensions705735
+Ref: gnutls-cli single-key-share705967
+Ref: gnutls-cli post-handshake-auth706183
+Ref: gnutls-cli inline-commands706380
+Ref: gnutls-cli inline-commands-prefix706700
+Ref: gnutls-cli provider707103
+Ref: gnutls-cli logfile707300
+Ref: gnutls-cli waitresumption707657
+Ref: gnutls-cli ca-auto-retrieve707914
+Ref: gnutls-cli exit status708318
+Ref: gnutls-cli See Also708554
+Ref: gnutls-cli Examples708631
+Node: gnutls-serv Invocation712838
+Ref: gnutls-serv usage713315
+Ref: gnutls-serv debug718835
+Ref: gnutls-serv sni-hostname718976
+Ref: gnutls-serv alpn719308
+Ref: gnutls-serv require-client-cert719595
+Ref: gnutls-serv verify-client-cert719839
+Ref: gnutls-serv heartbeat720068
+Ref: gnutls-serv priority720219
+Ref: gnutls-serv x509keyfile720588
+Ref: gnutls-serv x509certfile721105
+Ref: gnutls-serv x509dsakeyfile721622
+Ref: gnutls-serv x509dsacertfile721786
+Ref: gnutls-serv x509ecckeyfile721953
+Ref: gnutls-serv x509ecccertfile722115
+Ref: gnutls-serv rawpkkeyfile722282
+Ref: gnutls-serv rawpkfile723101
+Ref: gnutls-serv ocsp-response723956
+Ref: gnutls-serv ignore-ocsp-response-errors724273
+Ref: gnutls-serv list724520
+Ref: gnutls-serv provider724758
+Ref: gnutls-serv exit status724955
+Ref: gnutls-serv See Also725193
+Ref: gnutls-serv Examples725271
+Node: gnutls-cli-debug Invocation730579
+Ref: gnutls-cli-debug usage731401
+Ref: gnutls-cli-debug debug733656
+Ref: gnutls-cli-debug app-proto733797
+Ref: gnutls-cli-debug starttls-proto733965
+Ref: gnutls-cli-debug exit status734344
+Ref: gnutls-cli-debug See Also734592
+Ref: gnutls-cli-debug Examples734675
+Node: Internal architecture of GnuTLS738172
+Node: The TLS Protocol738778
+Ref: fig-client-server739254
+Node: TLS Handshake Protocol739344
+Ref: fig-gnutls-handshake739786
+Ref: fig-gnutls-handshake-sequence740295
+Node: TLS Authentication Methods740393
+Ref: TLS Authentication Methods-Footnote-1742697
+Node: TLS Hello Extension Handling742763
+Node: Cryptographic Backend755865
+Ref: fig-crypto-layers756548
+Ref: Cryptographic Backend-Footnote-1759830
+Ref: Cryptographic Backend-Footnote-2759915
+Node: Random Number Generators-internals760023
+Node: FIPS140-2 mode767387
+Ref: gnutls_fips_mode_t770023
+Node: Upgrading from previous versions772170
+Node: Support786164
+Node: Getting help786412
+Node: Commercial Support787000
+Node: Bug Reports787271
+Node: Contributing788635
+Node: Certification790661
+Node: Error codes791125
+Node: Supported ciphersuites815758
+Ref: ciphersuites815931
+Node: API reference830975
+Node: Core TLS API831385
+Ref: gnutls_alert_get831612
+Ref: gnutls_alert_get_name832231
+Ref: gnutls_alert_get_strname832616
+Ref: gnutls_alert_send832951
+Ref: gnutls_alert_send_appropriate833829
+Ref: gnutls_alert_set_read_function834796
+Ref: gnutls_alpn_get_selected_protocol835180
+Ref: gnutls_alpn_set_protocols835844
+Ref: gnutls_anon_allocate_client_credentials836681
+Ref: gnutls_anon_allocate_server_credentials837066
+Ref: gnutls_anon_free_client_credentials837443
+Ref: gnutls_anon_free_server_credentials837732
+Ref: gnutls_anon_set_params_function838013
+Ref: gnutls_anon_set_server_dh_params838689
+Ref: gnutls_anon_set_server_known_dh_params839349
+Ref: gnutls_anon_set_server_params_function840258
+Ref: gnutls_anti_replay_deinit840921
+Ref: gnutls_anti_replay_enable841235
+Ref: gnutls_anti_replay_init841583
+Ref: gnutls_anti_replay_set_add_function842111
+Ref: gnutls_anti_replay_set_ptr843129
+Ref: gnutls_anti_replay_set_window843464
+Ref: gnutls_auth_client_get_type844232
+Ref: gnutls_auth_get_type844859
+Ref: gnutls_auth_server_get_type845671
+Ref: gnutls_base64_decode2846300
+Ref: gnutls_base64_encode2846856
+Ref: gnutls_buffer_append_data847476
+Ref: gnutls_bye847874
+Ref: gnutls_certificate_activation_time_peers849475
+Ref: gnutls_certificate_allocate_credentials849893
+Ref: gnutls_certificate_client_get_request_status850290
+Ref: gnutls_certificate_expiration_time_peers850698
+Ref: gnutls_certificate_free_ca_names851102
+Ref: gnutls_certificate_free_cas851771
+Ref: gnutls_certificate_free_credentials852174
+Ref: gnutls_certificate_free_crls852608
+Ref: gnutls_certificate_free_keys852908
+Ref: gnutls_certificate_get_crt_raw853342
+Ref: gnutls_certificate_get_issuer854413
+Ref: gnutls_certificate_get_ocsp_expiration855496
+Ref: gnutls_certificate_get_ours856667
+Ref: gnutls_certificate_get_peers857497
+Ref: gnutls_certificate_get_peers_subkey_id858620
+Ref: gnutls_certificate_get_verify_flags858976
+Ref: gnutls_certificate_get_x509_crt859389
+Ref: gnutls_certificate_get_x509_key861033
+Ref: gnutls_certificate_send_x509_rdn_sequence862348
+Ref: gnutls_certificate_server_set_request863055
+Ref: gnutls_certificate_set_dh_params863845
+Ref: gnutls_certificate_set_flags864664
+Ref: gnutls_certificate_set_known_dh_params865189
+Ref: gnutls_certificate_set_ocsp_status_request_file866117
+Ref: gnutls_certificate_set_ocsp_status_request_file2868023
+Ref: gnutls_certificate_set_ocsp_status_request_function869541
+Ref: gnutls_certificate_set_ocsp_status_request_function2871029
+Ref: gnutls_certificate_set_ocsp_status_request_mem872995
+Ref: gnutls_certificate_set_params_function874770
+Ref: gnutls_certificate_set_pin_function875467
+Ref: gnutls_certificate_set_rawpk_key_file876120
+Ref: gnutls_certificate_set_rawpk_key_mem879424
+Ref: gnutls_certificate_set_retrieve_function882571
+Ref: gnutls_certificate_set_verify_flags884701
+Ref: gnutls_certificate_set_verify_function885194
+Ref: gnutls_certificate_set_verify_limits886258
+Ref: gnutls_certificate_set_x509_crl886939
+Ref: gnutls_certificate_set_x509_crl_file887767
+Ref: gnutls_certificate_set_x509_crl_mem888548
+Ref: gnutls_certificate_set_x509_key889325
+Ref: gnutls_certificate_set_x509_key_file890993
+Ref: gnutls_certificate_set_x509_key_file2893229
+Ref: gnutls_certificate_set_x509_key_mem895763
+Ref: gnutls_certificate_set_x509_key_mem2897411
+Ref: gnutls_certificate_set_x509_simple_pkcs12_file899224
+Ref: gnutls_certificate_set_x509_simple_pkcs12_mem901354
+Ref: gnutls_certificate_set_x509_system_trust903454
+Ref: gnutls_certificate_set_x509_trust904024
+Ref: gnutls_certificate_set_x509_trust_dir905004
+Ref: gnutls_certificate_set_x509_trust_file905742
+Ref: gnutls_certificate_set_x509_trust_mem906918
+Ref: gnutls_certificate_type_get907861
+Ref: gnutls_certificate_type_get2908708
+Ref: gnutls_certificate_type_get_id910093
+Ref: gnutls_certificate_type_get_name910490
+Ref: gnutls_certificate_type_list910873
+Ref: gnutls_certificate_verification_status_print911227
+Ref: gnutls_certificate_verify_peers911985
+Ref: gnutls_certificate_verify_peers2914781
+Ref: gnutls_certificate_verify_peers3916696
+Ref: gnutls_check_version919006
+Ref: gnutls_cipher_get919748
+Ref: gnutls_cipher_get_id920053
+Ref: gnutls_cipher_get_key_size920435
+Ref: gnutls_cipher_get_name920799
+Ref: gnutls_cipher_list921146
+Ref: gnutls_cipher_suite_get_name921706
+Ref: gnutls_cipher_suite_info922574
+Ref: gnutls_credentials_clear923757
+Ref: gnutls_credentials_get923985
+Ref: gnutls_credentials_set924940
+Ref: gnutls_db_check_entry926304
+Ref: gnutls_db_check_entry_expire_time926761
+Ref: gnutls_db_check_entry_time927167
+Ref: gnutls_db_get_default_cache_expiration927558
+Ref: gnutls_db_get_ptr927753
+Ref: gnutls_db_remove_session928065
+Ref: gnutls_db_set_cache_expiration928602
+Ref: gnutls_db_set_ptr929023
+Ref: gnutls_db_set_remove_function929358
+Ref: gnutls_db_set_retrieve_function929861
+Ref: gnutls_db_set_store_function930547
+Ref: gnutls_deinit931014
+Ref: gnutls_dh_get_group931353
+Ref: gnutls_dh_get_peers_public_bits932205
+Ref: gnutls_dh_get_prime_bits932649
+Ref: gnutls_dh_get_pubkey933289
+Ref: gnutls_dh_get_secret_bits933987
+Ref: gnutls_dh_params_cpy934419
+Ref: gnutls_dh_params_deinit934927
+Ref: gnutls_dh_params_export2_pkcs3935168
+Ref: gnutls_dh_params_export_pkcs3935989
+Ref: gnutls_dh_params_export_raw937008
+Ref: gnutls_dh_params_generate2937761
+Ref: gnutls_dh_params_import_dsa939015
+Ref: gnutls_dh_params_import_pkcs3939492
+Ref: gnutls_dh_params_import_raw940231
+Ref: gnutls_dh_params_import_raw2940861
+Ref: gnutls_dh_params_import_raw3941575
+Ref: gnutls_dh_params_init942275
+Ref: gnutls_dh_set_prime_bits942606
+Ref: gnutls_digest_get_id943709
+Ref: gnutls_digest_get_name944135
+Ref: gnutls_digest_get_oid944481
+Ref: gnutls_digest_list944872
+Ref: gnutls_digest_mark_insecure945251
+Ref: gnutls_digest_mark_secure945570
+Ref: gnutls_early_cipher_get945923
+Ref: gnutls_early_prf_hash_get946296
+Ref: gnutls_ecc_curve_get946714
+Ref: gnutls_ecc_curve_get_id947115
+Ref: gnutls_ecc_curve_get_name947496
+Ref: gnutls_ecc_curve_get_oid947830
+Ref: gnutls_ecc_curve_get_pk948175
+Ref: gnutls_ecc_curve_get_size948479
+Ref: gnutls_ecc_curve_list948708
+Ref: gnutls_ecc_curve_mark_disabled949049
+Ref: gnutls_ecc_curve_mark_enabled949506
+Ref: gnutls_error_is_fatal949986
+Ref: gnutls_error_to_alert950788
+Ref: gnutls_est_record_overhead_size951520
+Ref: gnutls_ext_get_current_msg952428
+Ref: gnutls_ext_get_data953119
+Ref: gnutls_ext_get_name953634
+Ref: gnutls_ext_get_name2953952
+Ref: gnutls_ext_raw_parse954462
+Ref: gnutls_ext_register955612
+Ref: gnutls_ext_set_data957247
+Ref: gnutls_fingerprint957758
+Ref: gnutls_fips140_mode_enabled958764
+Ref: gnutls_fips140_set_mode959318
+Ref: gnutls_get_system_config_file960371
+Ref: gnutls_global_deinit960747
+Ref: gnutls_global_init961197
+Ref: gnutls_global_set_audit_log_function962472
+Ref: gnutls_global_set_log_function963179
+Ref: gnutls_global_set_log_level963687
+Ref: gnutls_global_set_mutex964175
+Ref: gnutls_global_set_time_function965277
+Ref: gnutls_gost_paramset_get_name965714
+Ref: gnutls_gost_paramset_get_oid966090
+Ref: gnutls_group_get966467
+Ref: gnutls_group_get_id966837
+Ref: gnutls_group_get_name967184
+Ref: gnutls_group_list967504
+Ref: gnutls_handshake967826
+Ref: gnutls_handshake_description_get_name969931
+Ref: gnutls_handshake_get_last_in970319
+Ref: gnutls_handshake_get_last_out970944
+Ref: gnutls_handshake_set_hook_function971576
+Ref: gnutls_handshake_set_max_packet_length972968
+Ref: gnutls_handshake_set_post_client_hello_function973753
+Ref: gnutls_handshake_set_private_extensions975079
+Ref: gnutls_handshake_set_random975758
+Ref: gnutls_handshake_set_read_function976478
+Ref: gnutls_handshake_set_secret_function976879
+Ref: gnutls_handshake_set_timeout977258
+Ref: gnutls_handshake_write977948
+Ref: gnutls_heartbeat_allowed978649
+Ref: gnutls_heartbeat_enable979123
+Ref: gnutls_heartbeat_get_timeout979961
+Ref: gnutls_heartbeat_ping980500
+Ref: gnutls_heartbeat_pong981632
+Ref: gnutls_heartbeat_set_timeouts982039
+Ref: gnutls_hex2bin982810
+Ref: gnutls_hex_decode983529
+Ref: gnutls_hex_decode2984255
+Ref: gnutls_hex_encode984684
+Ref: gnutls_hex_encode2985281
+Ref: gnutls_idna_map985796
+Ref: gnutls_idna_reverse_map986926
+Ref: gnutls_init987691
+Ref: gnutls_key_generate988519
+Ref: gnutls_kx_get988936
+Ref: gnutls_kx_get_id989522
+Ref: gnutls_kx_get_name989866
+Ref: gnutls_kx_list990211
+Ref: gnutls_load_file990539
+Ref: gnutls_mac_get991311
+Ref: gnutls_mac_get_id991616
+Ref: gnutls_mac_get_key_size992029
+Ref: gnutls_mac_get_name992366
+Ref: gnutls_mac_list992685
+Ref: gnutls_memcmp993073
+Ref: gnutls_memset993633
+Ref: gnutls_ocsp_status_request_enable_client994027
+Ref: gnutls_ocsp_status_request_get995038
+Ref: gnutls_ocsp_status_request_get2995700
+Ref: gnutls_ocsp_status_request_is_checked996695
+Ref: gnutls_oid_to_digest998083
+Ref: gnutls_oid_to_ecc_curve998492
+Ref: gnutls_oid_to_gost_paramset998818
+Ref: gnutls_oid_to_mac999229
+Ref: gnutls_oid_to_pk999642
+Ref: gnutls_oid_to_sign1000014
+Ref: gnutls_openpgp_send_cert1000418
+Ref: gnutls_packet_deinit1000720
+Ref: gnutls_packet_get1000994
+Ref: gnutls_pem_base64_decode1001499
+Ref: gnutls_pem_base64_decode21002354
+Ref: gnutls_pem_base64_encode1003349
+Ref: gnutls_pem_base64_encode21004178
+Ref: gnutls_perror1005114
+Ref: gnutls_pk_algorithm_get_name1005410
+Ref: gnutls_pk_bits_to_sec_param1005766
+Ref: gnutls_pk_get_id1006240
+Ref: gnutls_pk_get_name1006758
+Ref: gnutls_pk_get_oid1007126
+Ref: gnutls_pk_list1007525
+Ref: gnutls_pk_to_sign1007858
+Ref: gnutls_prf1008269
+Ref: gnutls_prf_early1010264
+Ref: gnutls_prf_hash_get1011919
+Ref: gnutls_prf_raw1012451
+Ref: gnutls_prf_rfc57051014335
+Ref: gnutls_priority_certificate_type_list1016012
+Ref: gnutls_priority_certificate_type_list21016708
+Ref: gnutls_priority_cipher_list1017324
+Ref: gnutls_priority_deinit1017711
+Ref: gnutls_priority_ecc_curve_list1017954
+Ref: gnutls_priority_get_cipher_suite_index1018486
+Ref: gnutls_priority_group_list1019402
+Ref: gnutls_priority_init1019783
+Ref: gnutls_priority_init21020863
+Ref: gnutls_priority_kx_list1025237
+Ref: gnutls_priority_mac_list1025642
+Ref: gnutls_priority_protocol_list1026047
+Ref: gnutls_priority_set1026449
+Ref: gnutls_priority_set_direct1027104
+Ref: gnutls_priority_sign_list1028037
+Ref: gnutls_priority_string_list1028453
+Ref: gnutls_protocol_get_id1029085
+Ref: gnutls_protocol_get_name1029401
+Ref: gnutls_protocol_get_version1029760
+Ref: gnutls_protocol_list1030058
+Ref: gnutls_protocol_mark_disabled1030410
+Ref: gnutls_protocol_mark_enabled1030727
+Ref: gnutls_psk_allocate_client_credentials1031103
+Ref: gnutls_psk_allocate_server_credentials1031523
+Ref: gnutls_psk_client_get_hint1031919
+Ref: gnutls_psk_free_client_credentials1032546
+Ref: gnutls_psk_free_server_credentials1032829
+Ref: gnutls_psk_server_get_username1033104
+Ref: gnutls_psk_server_get_username21033811
+Ref: gnutls_psk_set_client_credentials1034505
+Ref: gnutls_psk_set_client_credentials21035528
+Ref: gnutls_psk_set_client_credentials_function1036308
+Ref: gnutls_psk_set_client_credentials_function21037311
+Ref: gnutls_psk_set_params_function1038468
+Ref: gnutls_psk_set_server_credentials_file1039148
+Ref: gnutls_psk_set_server_credentials_function1040009
+Ref: gnutls_psk_set_server_credentials_function21040963
+Ref: gnutls_psk_set_server_credentials_hint1042086
+Ref: gnutls_psk_set_server_dh_params1042710
+Ref: gnutls_psk_set_server_known_dh_params1043395
+Ref: gnutls_psk_set_server_params_function1044292
+Ref: gnutls_random_art1044933
+Ref: gnutls_range_split1045795
+Ref: gnutls_reauth1046877
+Ref: gnutls_record_can_use_length_hiding1048979
+Ref: gnutls_record_check_corked1049730
+Ref: gnutls_record_check_pending1050113
+Ref: gnutls_record_cork1050524
+Ref: gnutls_record_disable_padding1050938
+Ref: gnutls_record_discard_queued1051546
+Ref: gnutls_record_get_direction1052163
+Ref: gnutls_record_get_max_early_data_size1053144
+Ref: gnutls_record_get_max_size1053696
+Ref: gnutls_record_get_state1054063
+Ref: gnutls_record_overhead_size1055085
+Ref: gnutls_record_recv1055472
+Ref: gnutls_record_recv_early_data1056922
+Ref: gnutls_record_recv_packet1057984
+Ref: gnutls_record_recv_seq1058863
+Ref: gnutls_record_send1059849
+Ref: gnutls_record_send21061907
+Ref: gnutls_record_send_early_data1063059
+Ref: gnutls_record_send_range1064115
+Ref: gnutls_record_set_max_early_data_size1065294
+Ref: gnutls_record_set_max_recv_size1065940
+Ref: gnutls_record_set_max_size1066644
+Ref: gnutls_record_set_state1067823
+Ref: gnutls_record_set_timeout1068481
+Ref: gnutls_record_uncork1069082
+Ref: gnutls_rehandshake1070022
+Ref: gnutls_safe_renegotiation_status1071804
+Ref: gnutls_sec_param_get_name1072219
+Ref: gnutls_sec_param_to_pk_bits1072593
+Ref: gnutls_sec_param_to_symmetric_bits1073263
+Ref: gnutls_server_name_get1073647
+Ref: gnutls_server_name_set1075119
+Ref: gnutls_session_channel_binding1076277
+Ref: gnutls_session_enable_compatibility_mode1076995
+Ref: gnutls_session_etm_status1077702
+Ref: gnutls_session_ext_master_secret_status1078105
+Ref: gnutls_session_ext_register1078596
+Ref: gnutls_session_force_valid1080858
+Ref: gnutls_session_get_data1081279
+Ref: gnutls_session_get_data21081939
+Ref: gnutls_session_get_desc1084212
+Ref: gnutls_session_get_flags1084734
+Ref: gnutls_session_get_id1085272
+Ref: gnutls_session_get_id21086795
+Ref: gnutls_session_get_keylog_function1088265
+Ref: gnutls_session_get_master_secret1088672
+Ref: gnutls_session_get_ptr1089156
+Ref: gnutls_session_get_random1089551
+Ref: gnutls_session_get_verify_cert_status1090172
+Ref: gnutls_session_is_resumed1090845
+Ref: gnutls_session_key_update1091215
+Ref: gnutls_session_resumption_requested1092163
+Ref: gnutls_session_set_data1092545
+Ref: gnutls_session_set_id1093386
+Ref: gnutls_session_set_keylog_function1094061
+Ref: gnutls_session_set_premaster1094460
+Ref: gnutls_session_set_ptr1095555
+Ref: gnutls_session_set_verify_cert1095955
+Ref: gnutls_session_set_verify_cert21097299
+Ref: gnutls_session_set_verify_function1098483
+Ref: gnutls_session_supplemental_register1099595
+Ref: gnutls_session_ticket_enable_client1100853
+Ref: gnutls_session_ticket_enable_server1101346
+Ref: gnutls_session_ticket_key_generate1102140
+Ref: gnutls_session_ticket_send1102568
+Ref: gnutls_set_default_priority1103152
+Ref: gnutls_set_default_priority_append1104237
+Ref: gnutls_sign_algorithm_get1105579
+Ref: gnutls_sign_algorithm_get_client1106022
+Ref: gnutls_sign_algorithm_get_requested1106489
+Ref: gnutls_sign_get_hash_algorithm1107516
+Ref: gnutls_sign_get_id1107928
+Ref: gnutls_sign_get_name1108291
+Ref: gnutls_sign_get_oid1108623
+Ref: gnutls_sign_get_pk_algorithm1109009
+Ref: gnutls_sign_is_secure1109616
+Ref: gnutls_sign_is_secure21109886
+Ref: gnutls_sign_list1110222
+Ref: gnutls_sign_mark_insecure1110566
+Ref: gnutls_sign_mark_secure1111163
+Ref: gnutls_sign_supports_pk_algorithm1111948
+Ref: gnutls_srp_allocate_client_credentials1112532
+Ref: gnutls_srp_allocate_server_credentials1112933
+Ref: gnutls_srp_base64_decode1113306
+Ref: gnutls_srp_base64_decode21114011
+Ref: gnutls_srp_base64_encode1114679
+Ref: gnutls_srp_base64_encode21115480
+Ref: gnutls_srp_free_client_credentials1116211
+Ref: gnutls_srp_free_server_credentials1116494
+Ref: gnutls_srp_server_get_username1116769
+Ref: gnutls_srp_set_client_credentials1117223
+Ref: gnutls_srp_set_client_credentials_function1118113
+Ref: gnutls_srp_set_prime_bits1119360
+Ref: gnutls_srp_set_server_credentials_file1120045
+Ref: gnutls_srp_set_server_credentials_function1120771
+Ref: gnutls_srp_set_server_fake_salt_seed1122486
+Ref: gnutls_srp_verifier1123989
+Ref: gnutls_srtp_get_keys1124917
+Ref: gnutls_srtp_get_mki1126311
+Ref: gnutls_srtp_get_profile_id1126880
+Ref: gnutls_srtp_get_profile_name1127338
+Ref: gnutls_srtp_get_selected_profile1127759
+Ref: gnutls_srtp_set_mki1128203
+Ref: gnutls_srtp_set_profile1128652
+Ref: gnutls_srtp_set_profile_direct1129184
+Ref: gnutls_store_commitment1129907
+Ref: gnutls_store_pubkey1131206
+Ref: gnutls_strerror1132993
+Ref: gnutls_strerror_name1133478
+Ref: gnutls_supplemental_get_name1133947
+Ref: gnutls_supplemental_recv1134369
+Ref: gnutls_supplemental_register1134839
+Ref: gnutls_supplemental_send1135951
+Ref: gnutls_system_recv_timeout1136396
+Ref: gnutls_tdb_deinit1137138
+Ref: gnutls_tdb_init1137353
+Ref: gnutls_tdb_set_store_commitment_func1137712
+Ref: gnutls_tdb_set_store_func1138393
+Ref: gnutls_tdb_set_verify_func1138982
+Ref: gnutls_transport_get_int1139726
+Ref: gnutls_transport_get_int21140134
+Ref: gnutls_transport_get_ptr1140637
+Ref: gnutls_transport_get_ptr21141053
+Ref: gnutls_transport_set_errno1141587
+Ref: gnutls_transport_set_errno_function1142574
+Ref: gnutls_transport_set_int1143111
+Ref: gnutls_transport_set_int21143665
+Ref: gnutls_transport_set_ptr1144394
+Ref: gnutls_transport_set_ptr21144807
+Ref: gnutls_transport_set_pull_function1145451
+Ref: gnutls_transport_set_pull_timeout_function1146231
+Ref: gnutls_transport_set_push_function1147934
+Ref: gnutls_transport_set_vec_push_function1148779
+Ref: gnutls_url_is_supported1149475
+Ref: gnutls_utf8_password_normalize1149895
+Ref: gnutls_verify_stored_pubkey1150684
+Node: Datagram TLS API1153831
+Ref: gnutls_dtls_cookie_send1154107
+Ref: gnutls_dtls_cookie_verify1155362
+Ref: gnutls_dtls_get_data_mtu1156306
+Ref: gnutls_dtls_get_mtu1156749
+Ref: gnutls_dtls_get_timeout1157192
+Ref: gnutls_dtls_prestate_set1157735
+Ref: gnutls_dtls_set_data_mtu1158319
+Ref: gnutls_dtls_set_mtu1159293
+Ref: gnutls_dtls_set_timeouts1159900
+Ref: gnutls_record_get_discarded1160904
+Node: X509 certificate API1161178
+Ref: gnutls_certificate_get_trust_list1161527
+Ref: gnutls_certificate_set_trust_list1162175
+Ref: gnutls_certificate_verification_profile_get_id1162950
+Ref: gnutls_certificate_verification_profile_get_name1163497
+Ref: gnutls_pkcs8_info1163880
+Ref: gnutls_pkcs_schema_get_name1165398
+Ref: gnutls_pkcs_schema_get_oid1165803
+Ref: gnutls_session_set_verify_output_function1166230
+Ref: gnutls_subject_alt_names_deinit1167387
+Ref: gnutls_subject_alt_names_get1167666
+Ref: gnutls_subject_alt_names_init1168676
+Ref: gnutls_subject_alt_names_set1169056
+Ref: gnutls_x509_aia_deinit1169875
+Ref: gnutls_x509_aia_get1170109
+Ref: gnutls_x509_aia_init1171268
+Ref: gnutls_x509_aia_set1171603
+Ref: gnutls_x509_aki_deinit1172398
+Ref: gnutls_x509_aki_get_cert_issuer1172662
+Ref: gnutls_x509_aki_get_id1173728
+Ref: gnutls_x509_aki_init1174267
+Ref: gnutls_x509_aki_set_cert_issuer1174616
+Ref: gnutls_x509_aki_set_id1175731
+Ref: gnutls_x509_cidr_to_rfc52801176160
+Ref: gnutls_x509_crl_check_issuer1177058
+Ref: gnutls_x509_crl_deinit1177506
+Ref: gnutls_x509_crl_dist_points_deinit1177738
+Ref: gnutls_x509_crl_dist_points_get1178033
+Ref: gnutls_x509_crl_dist_points_init1179007
+Ref: gnutls_x509_crl_dist_points_set1179403
+Ref: gnutls_x509_crl_export1180106
+Ref: gnutls_x509_crl_export21180989
+Ref: gnutls_x509_crl_get_authority_key_gn_serial1181709
+Ref: gnutls_x509_crl_get_authority_key_id1183023
+Ref: gnutls_x509_crl_get_crt_count1184086
+Ref: gnutls_x509_crl_get_crt_serial1184444
+Ref: gnutls_x509_crl_get_dn_oid1185348
+Ref: gnutls_x509_crl_get_extension_data1186154
+Ref: gnutls_x509_crl_get_extension_data21187271
+Ref: gnutls_x509_crl_get_extension_info1188150
+Ref: gnutls_x509_crl_get_extension_oid1189414
+Ref: gnutls_x509_crl_get_issuer_dn1190266
+Ref: gnutls_x509_crl_get_issuer_dn21191267
+Ref: gnutls_x509_crl_get_issuer_dn31192101
+Ref: gnutls_x509_crl_get_issuer_dn_by_oid1193079
+Ref: gnutls_x509_crl_get_next_update1194590
+Ref: gnutls_x509_crl_get_number1195024
+Ref: gnutls_x509_crl_get_raw_issuer_dn1195749
+Ref: gnutls_x509_crl_get_signature1196203
+Ref: gnutls_x509_crl_get_signature_algorithm1196750
+Ref: gnutls_x509_crl_get_signature_oid1197312
+Ref: gnutls_x509_crl_get_this_update1197973
+Ref: gnutls_x509_crl_get_version1198298
+Ref: gnutls_x509_crl_import1198606
+Ref: gnutls_x509_crl_init1199230
+Ref: gnutls_x509_crl_iter_crt_serial1199819
+Ref: gnutls_x509_crl_iter_deinit1200965
+Ref: gnutls_x509_crl_list_import1201210
+Ref: gnutls_x509_crl_list_import21202212
+Ref: gnutls_x509_crl_print1203078
+Ref: gnutls_x509_crl_set_authority_key_id1203727
+Ref: gnutls_x509_crl_set_crt1204380
+Ref: gnutls_x509_crl_set_crt_serial1204953
+Ref: gnutls_x509_crl_set_next_update1205585
+Ref: gnutls_x509_crl_set_number1206202
+Ref: gnutls_x509_crl_set_this_update1206779
+Ref: gnutls_x509_crl_set_version1207183
+Ref: gnutls_x509_crl_sign1207726
+Ref: gnutls_x509_crl_sign21208419
+Ref: gnutls_x509_crl_verify1209655
+Ref: gnutls_x509_crq_deinit1210899
+Ref: gnutls_x509_crq_export1211137
+Ref: gnutls_x509_crq_export21212134
+Ref: gnutls_x509_crq_get_attribute_by_oid1212908
+Ref: gnutls_x509_crq_get_attribute_data1213933
+Ref: gnutls_x509_crq_get_attribute_info1215045
+Ref: gnutls_x509_crq_get_basic_constraints1216242
+Ref: gnutls_x509_crq_get_challenge_password1217495
+Ref: gnutls_x509_crq_get_dn1218107
+Ref: gnutls_x509_crq_get_dn21219056
+Ref: gnutls_x509_crq_get_dn31219913
+Ref: gnutls_x509_crq_get_dn_by_oid1220921
+Ref: gnutls_x509_crq_get_dn_oid1222382
+Ref: gnutls_x509_crq_get_extension_by_oid1223169
+Ref: gnutls_x509_crq_get_extension_by_oid21224326
+Ref: gnutls_x509_crq_get_extension_data1225408
+Ref: gnutls_x509_crq_get_extension_data21226538
+Ref: gnutls_x509_crq_get_extension_info1227417
+Ref: gnutls_x509_crq_get_key_id1228678
+Ref: gnutls_x509_crq_get_key_purpose_oid1229745
+Ref: gnutls_x509_crq_get_key_rsa_raw1230760
+Ref: gnutls_x509_crq_get_key_usage1231384
+Ref: gnutls_x509_crq_get_pk_algorithm1232470
+Ref: gnutls_x509_crq_get_pk_oid1233191
+Ref: gnutls_x509_crq_get_private_key_usage_period1233848
+Ref: gnutls_x509_crq_get_signature_algorithm1234563
+Ref: gnutls_x509_crq_get_signature_oid1235202
+Ref: gnutls_x509_crq_get_spki1235863
+Ref: gnutls_x509_crq_get_subject_alt_name1236423
+Ref: gnutls_x509_crq_get_subject_alt_othername_oid1237981
+Ref: gnutls_x509_crq_get_tlsfeatures1239461
+Ref: gnutls_x509_crq_get_version1240590
+Ref: gnutls_x509_crq_import1240936
+Ref: gnutls_x509_crq_init1241618
+Ref: gnutls_x509_crq_print1241966
+Ref: gnutls_x509_crq_set_attribute_by_oid1242622
+Ref: gnutls_x509_crq_set_basic_constraints1243487
+Ref: gnutls_x509_crq_set_challenge_password1244231
+Ref: gnutls_x509_crq_set_dn1244682
+Ref: gnutls_x509_crq_set_dn_by_oid1245300
+Ref: gnutls_x509_crq_set_extension_by_oid1246430
+Ref: gnutls_x509_crq_set_key1247209
+Ref: gnutls_x509_crq_set_key_purpose_oid1247672
+Ref: gnutls_x509_crq_set_key_rsa_raw1248452
+Ref: gnutls_x509_crq_set_key_usage1249028
+Ref: gnutls_x509_crq_set_private_key_usage_period1249532
+Ref: gnutls_x509_crq_set_spki1250037
+Ref: gnutls_x509_crq_set_subject_alt_name1250908
+Ref: gnutls_x509_crq_set_subject_alt_othername1251734
+Ref: gnutls_x509_crq_set_tlsfeatures1252572
+Ref: gnutls_x509_crq_set_version1253122
+Ref: gnutls_x509_crq_sign1253607
+Ref: gnutls_x509_crq_sign21254378
+Ref: gnutls_x509_crq_verify1255710
+Ref: gnutls_x509_crt_check_email1256303
+Ref: gnutls_x509_crt_check_hostname1256831
+Ref: gnutls_x509_crt_check_hostname21257543
+Ref: gnutls_x509_crt_check_ip1259294
+Ref: gnutls_x509_crt_check_issuer1259908
+Ref: gnutls_x509_crt_check_key_purpose1260646
+Ref: gnutls_x509_crt_check_revocation1261340
+Ref: gnutls_x509_crt_cpy_crl_dist_points1261989
+Ref: gnutls_x509_crt_deinit1262578
+Ref: gnutls_x509_crt_equals1262796
+Ref: gnutls_x509_crt_equals21263178
+Ref: gnutls_x509_crt_export1263602
+Ref: gnutls_x509_crt_export21264513
+Ref: gnutls_x509_crt_get_activation_time1265211
+Ref: gnutls_x509_crt_get_authority_info_access1265589
+Ref: gnutls_x509_crt_get_authority_key_gn_serial1269063
+Ref: gnutls_x509_crt_get_authority_key_id1270504
+Ref: gnutls_x509_crt_get_basic_constraints1271635
+Ref: gnutls_x509_crt_get_ca_status1272849
+Ref: gnutls_x509_crt_get_crl_dist_points1273848
+Ref: gnutls_x509_crt_get_dn1275173
+Ref: gnutls_x509_crt_get_dn21276368
+Ref: gnutls_x509_crt_get_dn31277177
+Ref: gnutls_x509_crt_get_dn_by_oid1278137
+Ref: gnutls_x509_crt_get_dn_oid1279906
+Ref: gnutls_x509_crt_get_expiration_time1280934
+Ref: gnutls_x509_crt_get_extension_by_oid1281300
+Ref: gnutls_x509_crt_get_extension_by_oid21282427
+Ref: gnutls_x509_crt_get_extension_data1283500
+Ref: gnutls_x509_crt_get_extension_data21284589
+Ref: gnutls_x509_crt_get_extension_info1285454
+Ref: gnutls_x509_crt_get_extension_oid1286866
+Ref: gnutls_x509_crt_get_fingerprint1287829
+Ref: gnutls_x509_crt_get_inhibit_anypolicy1288717
+Ref: gnutls_x509_crt_get_issuer1289686
+Ref: gnutls_x509_crt_get_issuer_alt_name1290324
+Ref: gnutls_x509_crt_get_issuer_alt_name21292124
+Ref: gnutls_x509_crt_get_issuer_alt_othername_oid1293706
+Ref: gnutls_x509_crt_get_issuer_dn1295355
+Ref: gnutls_x509_crt_get_issuer_dn21296476
+Ref: gnutls_x509_crt_get_issuer_dn31297323
+Ref: gnutls_x509_crt_get_issuer_dn_by_oid1298314
+Ref: gnutls_x509_crt_get_issuer_dn_oid1300101
+Ref: gnutls_x509_crt_get_issuer_unique_id1301137
+Ref: gnutls_x509_crt_get_key_id1302232
+Ref: gnutls_x509_crt_get_key_purpose_oid1303255
+Ref: gnutls_x509_crt_get_key_usage1304416
+Ref: gnutls_x509_crt_get_name_constraints1305476
+Ref: gnutls_x509_crt_get_pk_algorithm1306884
+Ref: gnutls_x509_crt_get_pk_dsa_raw1307673
+Ref: gnutls_x509_crt_get_pk_ecc_raw1308341
+Ref: gnutls_x509_crt_get_pk_gost_raw1309154
+Ref: gnutls_x509_crt_get_pk_oid1309998
+Ref: gnutls_x509_crt_get_pk_rsa_raw1310624
+Ref: gnutls_x509_crt_get_policy1311202
+Ref: gnutls_x509_crt_get_private_key_usage_period1312148
+Ref: gnutls_x509_crt_get_proxy1312900
+Ref: gnutls_x509_crt_get_raw_dn1313921
+Ref: gnutls_x509_crt_get_raw_issuer_dn1314514
+Ref: gnutls_x509_crt_get_serial1315093
+Ref: gnutls_x509_crt_get_signature1315833
+Ref: gnutls_x509_crt_get_signature_algorithm1316388
+Ref: gnutls_x509_crt_get_signature_oid1317001
+Ref: gnutls_x509_crt_get_spki1317659
+Ref: gnutls_x509_crt_get_subject1318145
+Ref: gnutls_x509_crt_get_subject_alt_name1318788
+Ref: gnutls_x509_crt_get_subject_alt_name21320547
+Ref: gnutls_x509_crt_get_subject_alt_othername_oid1322112
+Ref: gnutls_x509_crt_get_subject_key_id1323752
+Ref: gnutls_x509_crt_get_subject_unique_id1324584
+Ref: gnutls_x509_crt_get_tlsfeatures1325669
+Ref: gnutls_x509_crt_get_version1326781
+Ref: gnutls_x509_crt_import1327108
+Ref: gnutls_x509_crt_import_url1327809
+Ref: gnutls_x509_crt_init1328530
+Ref: gnutls_x509_crt_list_import1328877
+Ref: gnutls_x509_crt_list_import21330244
+Ref: gnutls_x509_crt_list_import_url1331316
+Ref: gnutls_x509_crt_list_verify1332540
+Ref: gnutls_x509_crt_print1334120
+Ref: gnutls_x509_crt_set_activation_time1335012
+Ref: gnutls_x509_crt_set_authority_info_access1335479
+Ref: gnutls_x509_crt_set_authority_key_id1336374
+Ref: gnutls_x509_crt_set_basic_constraints1336956
+Ref: gnutls_x509_crt_set_ca_status1337655
+Ref: gnutls_x509_crt_set_crl_dist_points1338253
+Ref: gnutls_x509_crt_set_crl_dist_points21338905
+Ref: gnutls_x509_crt_set_crq1339604
+Ref: gnutls_x509_crt_set_crq_extension_by_oid1340321
+Ref: gnutls_x509_crt_set_crq_extensions1340957
+Ref: gnutls_x509_crt_set_dn1341423
+Ref: gnutls_x509_crt_set_dn_by_oid1342306
+Ref: gnutls_x509_crt_set_expiration_time1343423
+Ref: gnutls_x509_crt_set_extension_by_oid1343968
+Ref: gnutls_x509_crt_set_flags1344743
+Ref: gnutls_x509_crt_set_inhibit_anypolicy1345251
+Ref: gnutls_x509_crt_set_issuer_alt_name1345761
+Ref: gnutls_x509_crt_set_issuer_alt_othername1346783
+Ref: gnutls_x509_crt_set_issuer_dn1347759
+Ref: gnutls_x509_crt_set_issuer_dn_by_oid1348398
+Ref: gnutls_x509_crt_set_issuer_unique_id1349677
+Ref: gnutls_x509_crt_set_key1350182
+Ref: gnutls_x509_crt_set_key_purpose_oid1350762
+Ref: gnutls_x509_crt_set_key_usage1351530
+Ref: gnutls_x509_crt_set_name_constraints1351989
+Ref: gnutls_x509_crt_set_pin_function1352611
+Ref: gnutls_x509_crt_set_policy1353279
+Ref: gnutls_x509_crt_set_private_key_usage_period1354132
+Ref: gnutls_x509_crt_set_proxy1354639
+Ref: gnutls_x509_crt_set_proxy_dn1355453
+Ref: gnutls_x509_crt_set_serial1356472
+Ref: gnutls_x509_crt_set_spki1357532
+Ref: gnutls_x509_crt_set_subject_alt_name1358387
+Ref: gnutls_x509_crt_set_subject_alt_othername1359627
+Ref: gnutls_x509_crt_set_subject_alternative_name1360635
+Ref: gnutls_x509_crt_set_subject_key_id1361533
+Ref: gnutls_x509_crt_set_subject_unique_id1362053
+Ref: gnutls_x509_crt_set_tlsfeatures1362576
+Ref: gnutls_x509_crt_set_version1363100
+Ref: gnutls_x509_crt_sign1363923
+Ref: gnutls_x509_crt_sign21364618
+Ref: gnutls_x509_crt_verify1365851
+Ref: gnutls_x509_crt_verify_data21366900
+Ref: gnutls_x509_dn_deinit1367904
+Ref: gnutls_x509_dn_export1368166
+Ref: gnutls_x509_dn_export21369060
+Ref: gnutls_x509_dn_get_rdn_ava1369721
+Ref: gnutls_x509_dn_get_str1370753
+Ref: gnutls_x509_dn_get_str21371349
+Ref: gnutls_x509_dn_import1372211
+Ref: gnutls_x509_dn_init1372827
+Ref: gnutls_x509_dn_oid_known1373248
+Ref: gnutls_x509_dn_oid_name1373917
+Ref: gnutls_x509_dn_set_str1374446
+Ref: gnutls_x509_ext_deinit1375045
+Ref: gnutls_x509_ext_export_aia1375289
+Ref: gnutls_x509_ext_export_authority_key_id1375883
+Ref: gnutls_x509_ext_export_basic_constraints1376539
+Ref: gnutls_x509_ext_export_crl_dist_points1377236
+Ref: gnutls_x509_ext_export_inhibit_anypolicy1377904
+Ref: gnutls_x509_ext_export_key_purposes1378572
+Ref: gnutls_x509_ext_export_key_usage1379191
+Ref: gnutls_x509_ext_export_name_constraints1379807
+Ref: gnutls_x509_ext_export_policies1380448
+Ref: gnutls_x509_ext_export_private_key_usage_period1381111
+Ref: gnutls_x509_ext_export_proxy1381776
+Ref: gnutls_x509_ext_export_subject_alt_names1382762
+Ref: gnutls_x509_ext_export_subject_key_id1383411
+Ref: gnutls_x509_ext_export_tlsfeatures1384033
+Ref: gnutls_x509_ext_import_aia1384651
+Ref: gnutls_x509_ext_import_authority_key_id1385356
+Ref: gnutls_x509_ext_import_basic_constraints1386024
+Ref: gnutls_x509_ext_import_crl_dist_points1386650
+Ref: gnutls_x509_ext_import_inhibit_anypolicy1387278
+Ref: gnutls_x509_ext_import_key_purposes1388193
+Ref: gnutls_x509_ext_import_key_usage1388827
+Ref: gnutls_x509_ext_import_name_constraints1389843
+Ref: gnutls_x509_ext_import_policies1391181
+Ref: gnutls_x509_ext_import_private_key_usage_period1391788
+Ref: gnutls_x509_ext_import_proxy1392403
+Ref: gnutls_x509_ext_import_subject_alt_names1393489
+Ref: gnutls_x509_ext_import_subject_key_id1394247
+Ref: gnutls_x509_ext_import_tlsfeatures1394882
+Ref: gnutls_x509_ext_print1395774
+Ref: gnutls_x509_key_purpose_deinit1396485
+Ref: gnutls_x509_key_purpose_get1396739
+Ref: gnutls_x509_key_purpose_init1397467
+Ref: gnutls_x509_key_purpose_set1397828
+Ref: gnutls_x509_name_constraints_add_excluded1398283
+Ref: gnutls_x509_name_constraints_add_permitted1399224
+Ref: gnutls_x509_name_constraints_check1400099
+Ref: gnutls_x509_name_constraints_check_crt1400936
+Ref: gnutls_x509_name_constraints_deinit1401806
+Ref: gnutls_x509_name_constraints_get_excluded1402106
+Ref: gnutls_x509_name_constraints_get_permitted1403177
+Ref: gnutls_x509_name_constraints_init1404231
+Ref: gnutls_x509_othername_to_virtual1404614
+Ref: gnutls_x509_policies_deinit1405233
+Ref: gnutls_x509_policies_get1405513
+Ref: gnutls_x509_policies_init1406299
+Ref: gnutls_x509_policies_set1406664
+Ref: gnutls_x509_policy_release1407131
+Ref: gnutls_x509_privkey_cpy1407495
+Ref: gnutls_x509_privkey_deinit1407965
+Ref: gnutls_x509_privkey_export1408206
+Ref: gnutls_x509_privkey_export21409241
+Ref: gnutls_x509_privkey_export2_pkcs81410119
+Ref: gnutls_x509_privkey_export_dsa_raw1411395
+Ref: gnutls_x509_privkey_export_ecc_raw1412135
+Ref: gnutls_x509_privkey_export_gost_raw1413018
+Ref: gnutls_x509_privkey_export_pkcs81414103
+Ref: gnutls_x509_privkey_export_rsa_raw1415608
+Ref: gnutls_x509_privkey_export_rsa_raw21416469
+Ref: gnutls_x509_privkey_fix1417455
+Ref: gnutls_x509_privkey_generate1417840
+Ref: gnutls_x509_privkey_generate21419365
+Ref: gnutls_x509_privkey_get_key_id1421524
+Ref: gnutls_x509_privkey_get_pk_algorithm1422543
+Ref: gnutls_x509_privkey_get_pk_algorithm21422971
+Ref: gnutls_x509_privkey_get_seed1423462
+Ref: gnutls_x509_privkey_get_spki1424286
+Ref: gnutls_x509_privkey_import1424821
+Ref: gnutls_x509_privkey_import21425616
+Ref: gnutls_x509_privkey_import_dsa_raw1426689
+Ref: gnutls_x509_privkey_import_ecc_raw1427421
+Ref: gnutls_x509_privkey_import_gost_raw1428237
+Ref: gnutls_x509_privkey_import_openssl1429513
+Ref: gnutls_x509_privkey_import_pkcs81430387
+Ref: gnutls_x509_privkey_import_rsa_raw1431834
+Ref: gnutls_x509_privkey_import_rsa_raw21432688
+Ref: gnutls_x509_privkey_init1433684
+Ref: gnutls_x509_privkey_sec_param1434029
+Ref: gnutls_x509_privkey_set_flags1434448
+Ref: gnutls_x509_privkey_set_pin_function1434998
+Ref: gnutls_x509_privkey_set_spki1435616
+Ref: gnutls_x509_privkey_sign_data1436163
+Ref: gnutls_x509_privkey_verify_params1437384
+Ref: gnutls_x509_privkey_verify_seed1437720
+Ref: gnutls_x509_rdn_get1438549
+Ref: gnutls_x509_rdn_get21439367
+Ref: gnutls_x509_rdn_get_by_oid1440275
+Ref: gnutls_x509_rdn_get_oid1441257
+Ref: gnutls_x509_spki_deinit1442002
+Ref: gnutls_x509_spki_get_rsa_pss_params1442284
+Ref: gnutls_x509_spki_init1442845
+Ref: gnutls_x509_spki_set_rsa_pss_params1443361
+Ref: gnutls_x509_tlsfeatures_add1443874
+Ref: gnutls_x509_tlsfeatures_check_crt1444330
+Ref: gnutls_x509_tlsfeatures_deinit1444930
+Ref: gnutls_x509_tlsfeatures_get1445208
+Ref: gnutls_x509_tlsfeatures_init1445768
+Ref: gnutls_x509_trust_list_add_cas1446153
+Ref: gnutls_x509_trust_list_add_crls1447338
+Ref: gnutls_x509_trust_list_add_named_crt1448716
+Ref: gnutls_x509_trust_list_add_system_trust1449931
+Ref: gnutls_x509_trust_list_add_trust_dir1450693
+Ref: gnutls_x509_trust_list_add_trust_file1451556
+Ref: gnutls_x509_trust_list_add_trust_mem1452703
+Ref: gnutls_x509_trust_list_deinit1453622
+Ref: gnutls_x509_trust_list_get_issuer1454248
+Ref: gnutls_x509_trust_list_get_issuer_by_dn1455298
+Ref: gnutls_x509_trust_list_get_issuer_by_subject_key_id1456027
+Ref: gnutls_x509_trust_list_get_ptr1456835
+Ref: gnutls_x509_trust_list_init1457348
+Ref: gnutls_x509_trust_list_iter_deinit1457853
+Ref: gnutls_x509_trust_list_iter_get_ca1458162
+Ref: gnutls_x509_trust_list_remove_cas1459342
+Ref: gnutls_x509_trust_list_remove_trust_file1460197
+Ref: gnutls_x509_trust_list_remove_trust_mem1460898
+Ref: gnutls_x509_trust_list_set_getissuer_function1461556
+Ref: gnutls_x509_trust_list_set_ptr1463189
+Ref: gnutls_x509_trust_list_verify_crt1463727
+Ref: gnutls_x509_trust_list_verify_crt21464890
+Ref: gnutls_x509_trust_list_verify_named_crt1467824
+Node: PKCS 7 API1470552
+Ref: gnutls_pkcs7_add_attr1470848
+Ref: gnutls_pkcs7_attrs_deinit1471654
+Ref: gnutls_pkcs7_deinit1471889
+Ref: gnutls_pkcs7_delete_crl1472094
+Ref: gnutls_pkcs7_delete_crt1472523
+Ref: gnutls_pkcs7_export1472969
+Ref: gnutls_pkcs7_export21473869
+Ref: gnutls_pkcs7_get_attr1474530
+Ref: gnutls_pkcs7_get_crl_count1475417
+Ref: gnutls_pkcs7_get_crl_raw1475765
+Ref: gnutls_pkcs7_get_crl_raw21476540
+Ref: gnutls_pkcs7_get_crt_count1477171
+Ref: gnutls_pkcs7_get_crt_raw1477546
+Ref: gnutls_pkcs7_get_crt_raw21478446
+Ref: gnutls_pkcs7_get_embedded_data1479300
+Ref: gnutls_pkcs7_get_embedded_data_oid1480300
+Ref: gnutls_pkcs7_get_signature_count1480860
+Ref: gnutls_pkcs7_get_signature_info1481267
+Ref: gnutls_pkcs7_import1481940
+Ref: gnutls_pkcs7_init1482561
+Ref: gnutls_pkcs7_print1482985
+Ref: gnutls_pkcs7_print_signature_info1483730
+Ref: gnutls_pkcs7_set_crl1484535
+Ref: gnutls_pkcs7_set_crl_raw1484936
+Ref: gnutls_pkcs7_set_crt1485326
+Ref: gnutls_pkcs7_set_crt_raw1485810
+Ref: gnutls_pkcs7_sign1486223
+Ref: gnutls_pkcs7_signature_info_deinit1487662
+Ref: gnutls_pkcs7_verify1488015
+Ref: gnutls_pkcs7_verify_direct1489180
+Node: OCSP API1490640
+Ref: gnutls_ocsp_req_add_cert1490924
+Ref: gnutls_ocsp_req_add_cert_id1491884
+Ref: gnutls_ocsp_req_deinit1493204
+Ref: gnutls_ocsp_req_export1493421
+Ref: gnutls_ocsp_req_get_cert_id1493846
+Ref: gnutls_ocsp_req_get_extension1495438
+Ref: gnutls_ocsp_req_get_nonce1496854
+Ref: gnutls_ocsp_req_get_version1497508
+Ref: gnutls_ocsp_req_import1497895
+Ref: gnutls_ocsp_req_init1498391
+Ref: gnutls_ocsp_req_print1498719
+Ref: gnutls_ocsp_req_randomize_nonce1499455
+Ref: gnutls_ocsp_req_set_extension1499888
+Ref: gnutls_ocsp_req_set_nonce1500572
+Ref: gnutls_ocsp_resp_check_crt1501159
+Ref: gnutls_ocsp_resp_deinit1501743
+Ref: gnutls_ocsp_resp_export1501967
+Ref: gnutls_ocsp_resp_export21502393
+Ref: gnutls_ocsp_resp_get_certs1502913
+Ref: gnutls_ocsp_resp_get_extension1504038
+Ref: gnutls_ocsp_resp_get_nonce1505462
+Ref: gnutls_ocsp_resp_get_produced1506128
+Ref: gnutls_ocsp_resp_get_responder1506475
+Ref: gnutls_ocsp_resp_get_responder21507580
+Ref: gnutls_ocsp_resp_get_responder_raw_id1508843
+Ref: gnutls_ocsp_resp_get_response1509674
+Ref: gnutls_ocsp_resp_get_signature1510900
+Ref: gnutls_ocsp_resp_get_signature_algorithm1511389
+Ref: gnutls_ocsp_resp_get_single1511867
+Ref: gnutls_ocsp_resp_get_status1513809
+Ref: gnutls_ocsp_resp_get_version1514238
+Ref: gnutls_ocsp_resp_import1514646
+Ref: gnutls_ocsp_resp_import21515214
+Ref: gnutls_ocsp_resp_init1515842
+Ref: gnutls_ocsp_resp_list_import21516191
+Ref: gnutls_ocsp_resp_print1517382
+Ref: gnutls_ocsp_resp_verify1518108
+Ref: gnutls_ocsp_resp_verify_direct1519725
+Node: PKCS 12 API1522158
+Ref: gnutls_pkcs12_bag_decrypt1522448
+Ref: gnutls_pkcs12_bag_deinit1522880
+Ref: gnutls_pkcs12_bag_enc_info1523118
+Ref: gnutls_pkcs12_bag_encrypt1524491
+Ref: gnutls_pkcs12_bag_get_count1524996
+Ref: gnutls_pkcs12_bag_get_data1525307
+Ref: gnutls_pkcs12_bag_get_friendly_name1525913
+Ref: gnutls_pkcs12_bag_get_key_id1526550
+Ref: gnutls_pkcs12_bag_get_type1527169
+Ref: gnutls_pkcs12_bag_init1527539
+Ref: gnutls_pkcs12_bag_set_crl1527997
+Ref: gnutls_pkcs12_bag_set_crt1528430
+Ref: gnutls_pkcs12_bag_set_data1528876
+Ref: gnutls_pkcs12_bag_set_friendly_name1529347
+Ref: gnutls_pkcs12_bag_set_key_id1530031
+Ref: gnutls_pkcs12_bag_set_privkey1530705
+Ref: gnutls_pkcs12_deinit1531361
+Ref: gnutls_pkcs12_export1531563
+Ref: gnutls_pkcs12_export21532470
+Ref: gnutls_pkcs12_generate_mac1533146
+Ref: gnutls_pkcs12_generate_mac21533537
+Ref: gnutls_pkcs12_get_bag1533981
+Ref: gnutls_pkcs12_import1534567
+Ref: gnutls_pkcs12_init1535288
+Ref: gnutls_pkcs12_mac_info1535721
+Ref: gnutls_pkcs12_set_bag1537030
+Ref: gnutls_pkcs12_simple_parse1537436
+Ref: gnutls_pkcs12_verify_mac1540117
+Node: PKCS 11 API1540473
+Ref: gnutls_pkcs11_add_provider1540802
+Ref: gnutls_pkcs11_copy_attached_extension1541547
+Ref: gnutls_pkcs11_copy_pubkey1542406
+Ref: gnutls_pkcs11_copy_secret_key1543439
+Ref: gnutls_pkcs11_copy_x509_crt1544164
+Ref: gnutls_pkcs11_copy_x509_crt21544812
+Ref: gnutls_pkcs11_copy_x509_privkey1545780
+Ref: gnutls_pkcs11_copy_x509_privkey21546597
+Ref: gnutls_pkcs11_crt_is_known1547542
+Ref: gnutls_pkcs11_deinit1548678
+Ref: gnutls_pkcs11_delete_url1548995
+Ref: gnutls_pkcs11_get_pin_function1549511
+Ref: gnutls_pkcs11_get_raw_issuer1549894
+Ref: gnutls_pkcs11_get_raw_issuer_by_dn1550804
+Ref: gnutls_pkcs11_get_raw_issuer_by_subject_key_id1551843
+Ref: gnutls_pkcs11_init1552954
+Ref: gnutls_pkcs11_obj_deinit1553996
+Ref: gnutls_pkcs11_obj_export1554242
+Ref: gnutls_pkcs11_obj_export21555087
+Ref: gnutls_pkcs11_obj_export31555684
+Ref: gnutls_pkcs11_obj_export_url1556357
+Ref: gnutls_pkcs11_obj_flags_get_str1556884
+Ref: gnutls_pkcs11_obj_get_exts1557363
+Ref: gnutls_pkcs11_obj_get_flags1558299
+Ref: gnutls_pkcs11_obj_get_info1558836
+Ref: gnutls_pkcs11_obj_get_ptr1560100
+Ref: gnutls_pkcs11_obj_get_type1561009
+Ref: gnutls_pkcs11_obj_import_url1561359
+Ref: gnutls_pkcs11_obj_init1562279
+Ref: gnutls_pkcs11_obj_list_import_url31562664
+Ref: gnutls_pkcs11_obj_list_import_url41564605
+Ref: gnutls_pkcs11_obj_set_info1566281
+Ref: gnutls_pkcs11_obj_set_pin_function1567060
+Ref: gnutls_pkcs11_privkey_cpy1567571
+Ref: gnutls_pkcs11_privkey_deinit1568072
+Ref: gnutls_pkcs11_privkey_export_pubkey1568335
+Ref: gnutls_pkcs11_privkey_export_url1569139
+Ref: gnutls_pkcs11_privkey_generate1569649
+Ref: gnutls_pkcs11_privkey_generate21570321
+Ref: gnutls_pkcs11_privkey_generate31571551
+Ref: gnutls_pkcs11_privkey_get_info1573061
+Ref: gnutls_pkcs11_privkey_get_pk_algorithm1573943
+Ref: gnutls_pkcs11_privkey_import_url1574474
+Ref: gnutls_pkcs11_privkey_init1575175
+Ref: gnutls_pkcs11_privkey_set_pin_function1575890
+Ref: gnutls_pkcs11_privkey_status1576410
+Ref: gnutls_pkcs11_reinit1576786
+Ref: gnutls_pkcs11_set_pin_function1577346
+Ref: gnutls_pkcs11_set_token_function1577836
+Ref: gnutls_pkcs11_token_check_mechanism1578254
+Ref: gnutls_pkcs11_token_get_flags1579011
+Ref: gnutls_pkcs11_token_get_info1579553
+Ref: gnutls_pkcs11_token_get_mechanism1580576
+Ref: gnutls_pkcs11_token_get_ptr1581189
+Ref: gnutls_pkcs11_token_get_random1581888
+Ref: gnutls_pkcs11_token_get_url1582519
+Ref: gnutls_pkcs11_token_init1583187
+Ref: gnutls_pkcs11_token_set_pin1583825
+Ref: gnutls_pkcs11_type_get_name1584665
+Ref: gnutls_x509_crt_import_pkcs111585154
+Ref: gnutls_x509_crt_list_import_pkcs111585676
+Node: TPM API1586285
+Ref: gnutls_tpm_get_registered1586564
+Ref: gnutls_tpm_key_list_deinit1586957
+Ref: gnutls_tpm_key_list_get_url1587225
+Ref: gnutls_tpm_privkey_delete1587878
+Ref: gnutls_tpm_privkey_generate1588316
+Node: Abstract key API1589666
+Ref: gnutls_certificate_set_key1589987
+Ref: gnutls_certificate_set_retrieve_function21592123
+Ref: gnutls_certificate_set_retrieve_function31594373
+Ref: gnutls_pcert_deinit1597233
+Ref: gnutls_pcert_export_openpgp1597478
+Ref: gnutls_pcert_export_x5091597827
+Ref: gnutls_pcert_import_openpgp1598477
+Ref: gnutls_pcert_import_openpgp_raw1598876
+Ref: gnutls_pcert_import_rawpk1599445
+Ref: gnutls_pcert_import_rawpk_raw1600298
+Ref: gnutls_pcert_import_x5091601547
+Ref: gnutls_pcert_import_x509_list1602144
+Ref: gnutls_pcert_import_x509_raw1603334
+Ref: gnutls_pcert_list_import_x509_file1604040
+Ref: gnutls_pcert_list_import_x509_raw1605472
+Ref: gnutls_privkey_decrypt_data1606806
+Ref: gnutls_privkey_decrypt_data21607454
+Ref: gnutls_privkey_deinit1608279
+Ref: gnutls_privkey_export_dsa_raw1608528
+Ref: gnutls_privkey_export_dsa_raw21609258
+Ref: gnutls_privkey_export_ecc_raw1610064
+Ref: gnutls_privkey_export_ecc_raw21610926
+Ref: gnutls_privkey_export_gost_raw21611868
+Ref: gnutls_privkey_export_openpgp1613002
+Ref: gnutls_privkey_export_pkcs111613354
+Ref: gnutls_privkey_export_rsa_raw1613966
+Ref: gnutls_privkey_export_rsa_raw21614997
+Ref: gnutls_privkey_export_x5091616043
+Ref: gnutls_privkey_generate1616691
+Ref: gnutls_privkey_generate21618182
+Ref: gnutls_privkey_get_pk_algorithm1620310
+Ref: gnutls_privkey_get_seed1620924
+Ref: gnutls_privkey_get_spki1621723
+Ref: gnutls_privkey_get_type1622303
+Ref: gnutls_privkey_import_dsa_raw1622792
+Ref: gnutls_privkey_import_ecc_raw1623504
+Ref: gnutls_privkey_import_ext1624317
+Ref: gnutls_privkey_import_ext21625467
+Ref: gnutls_privkey_import_ext31626824
+Ref: gnutls_privkey_import_ext41628438
+Ref: gnutls_privkey_import_gost_raw1631198
+Ref: gnutls_privkey_import_openpgp1632406
+Ref: gnutls_privkey_import_openpgp_raw1632815
+Ref: gnutls_privkey_import_pkcs111633404
+Ref: gnutls_privkey_import_pkcs11_url1634162
+Ref: gnutls_privkey_import_rsa_raw1634611
+Ref: gnutls_privkey_import_tpm_raw1635607
+Ref: gnutls_privkey_import_tpm_url1636474
+Ref: gnutls_privkey_import_url1637577
+Ref: gnutls_privkey_import_x5091638124
+Ref: gnutls_privkey_import_x509_raw1638872
+Ref: gnutls_privkey_init1639651
+Ref: gnutls_privkey_set_flags1640569
+Ref: gnutls_privkey_set_pin_function1641094
+Ref: gnutls_privkey_set_spki1641664
+Ref: gnutls_privkey_sign_data1642237
+Ref: gnutls_privkey_sign_data21643257
+Ref: gnutls_privkey_sign_hash1644155
+Ref: gnutls_privkey_sign_hash21645592
+Ref: gnutls_privkey_status1646858
+Ref: gnutls_privkey_verify_params1647402
+Ref: gnutls_privkey_verify_seed1647764
+Ref: gnutls_pubkey_deinit1648476
+Ref: gnutls_pubkey_encrypt_data1648716
+Ref: gnutls_pubkey_export1649358
+Ref: gnutls_pubkey_export21650372
+Ref: gnutls_pubkey_export_dsa_raw1651145
+Ref: gnutls_pubkey_export_dsa_raw21651957
+Ref: gnutls_pubkey_export_ecc_raw1652841
+Ref: gnutls_pubkey_export_ecc_raw21653740
+Ref: gnutls_pubkey_export_ecc_x9621654719
+Ref: gnutls_pubkey_export_gost_raw21655378
+Ref: gnutls_pubkey_export_rsa_raw1656522
+Ref: gnutls_pubkey_export_rsa_raw21657219
+Ref: gnutls_pubkey_get_key_id1657980
+Ref: gnutls_pubkey_get_key_usage1659005
+Ref: gnutls_pubkey_get_openpgp_key_id1659502
+Ref: gnutls_pubkey_get_pk_algorithm1660141
+Ref: gnutls_pubkey_get_preferred_hash_algorithm1660789
+Ref: gnutls_pubkey_get_spki1661730
+Ref: gnutls_pubkey_import1662298
+Ref: gnutls_pubkey_import_dsa_raw1662982
+Ref: gnutls_pubkey_import_ecc_raw1663643
+Ref: gnutls_pubkey_import_ecc_x9621664411
+Ref: gnutls_pubkey_import_gost_raw1665047
+Ref: gnutls_pubkey_import_openpgp1666194
+Ref: gnutls_pubkey_import_openpgp_raw1666586
+Ref: gnutls_pubkey_import_pkcs111667155
+Ref: gnutls_pubkey_import_privkey1667697
+Ref: gnutls_pubkey_import_rsa_raw1668399
+Ref: gnutls_pubkey_import_tpm_raw1668923
+Ref: gnutls_pubkey_import_tpm_url1669700
+Ref: gnutls_pubkey_import_url1670592
+Ref: gnutls_pubkey_import_x5091671065
+Ref: gnutls_pubkey_import_x509_crq1671565
+Ref: gnutls_pubkey_import_x509_raw1672068
+Ref: gnutls_pubkey_init1672645
+Ref: gnutls_pubkey_print1672974
+Ref: gnutls_pubkey_set_key_usage1673708
+Ref: gnutls_pubkey_set_pin_function1674277
+Ref: gnutls_pubkey_set_spki1674842
+Ref: gnutls_pubkey_verify_data21675413
+Ref: gnutls_pubkey_verify_hash21676321
+Ref: gnutls_pubkey_verify_params1677445
+Ref: gnutls_register_custom_url1677803
+Ref: gnutls_system_key_add_x5091678741
+Ref: gnutls_system_key_delete1679486
+Ref: gnutls_system_key_iter_deinit1679910
+Ref: gnutls_system_key_iter_get_info1680178
+Ref: gnutls_x509_crl_privkey_sign1681452
+Ref: gnutls_x509_crq_privkey_sign1682721
+Ref: gnutls_x509_crq_set_pubkey1684083
+Ref: gnutls_x509_crt_privkey_sign1684591
+Ref: gnutls_x509_crt_set_pubkey1685834
+Node: Socket specific API1686287
+Ref: gnutls_transport_set_fastopen1686580
+Node: DANE API1688126
+Ref: dane_cert_type_name1688500
+Ref: dane_cert_usage_name1688790
+Ref: dane_match_type_name1689102
+Ref: dane_query_data1689385
+Ref: dane_query_deinit1690064
+Ref: dane_query_entries1690269
+Ref: dane_query_status1690511
+Ref: dane_query_tlsa1690805
+Ref: dane_query_to_raw_tlsa1691396
+Ref: dane_raw_tlsa1692738
+Ref: dane_state_deinit1693815
+Ref: dane_state_init1694007
+Ref: dane_state_set_dlv_file1694521
+Ref: dane_strerror1694822
+Ref: dane_verification_status_print1695321
+Ref: dane_verify_crt1695915
+Ref: dane_verify_crt_raw1698102
+Ref: dane_verify_session_crt1699335
+Node: Cryptographic API1700737
+Ref: gnutls_aead_cipher_decrypt1701238
+Ref: gnutls_aead_cipher_decryptv21702617
+Ref: gnutls_aead_cipher_deinit1703542
+Ref: gnutls_aead_cipher_encrypt1703870
+Ref: gnutls_aead_cipher_encryptv1704979
+Ref: gnutls_aead_cipher_encryptv21706127
+Ref: gnutls_aead_cipher_init1707055
+Ref: gnutls_cipher_add_auth1707721
+Ref: gnutls_cipher_decrypt1708301
+Ref: gnutls_cipher_decrypt21708925
+Ref: gnutls_cipher_deinit1709851
+Ref: gnutls_cipher_encrypt1710130
+Ref: gnutls_cipher_encrypt21710590
+Ref: gnutls_cipher_get_block_size1711367
+Ref: gnutls_cipher_get_iv_size1711647
+Ref: gnutls_cipher_get_tag_size1712129
+Ref: gnutls_cipher_init1712535
+Ref: gnutls_cipher_set_iv1713265
+Ref: gnutls_cipher_tag1713610
+Ref: gnutls_crypto_register_aead_cipher1714112
+Ref: gnutls_crypto_register_cipher1715716
+Ref: gnutls_crypto_register_digest1717497
+Ref: gnutls_crypto_register_mac1718721
+Ref: gnutls_decode_ber_digest_info1720149
+Ref: gnutls_decode_gost_rs_value1720948
+Ref: gnutls_decode_rs_value1721748
+Ref: gnutls_encode_ber_digest_info1722533
+Ref: gnutls_encode_gost_rs_value1723177
+Ref: gnutls_encode_rs_value1723923
+Ref: gnutls_hash1724543
+Ref: gnutls_hash_copy1724974
+Ref: gnutls_hash_deinit1725491
+Ref: gnutls_hash_fast1725819
+Ref: gnutls_hash_get_len1726336
+Ref: gnutls_hash_init1726669
+Ref: gnutls_hash_output1727205
+Ref: gnutls_hkdf_expand1727537
+Ref: gnutls_hkdf_extract1728240
+Ref: gnutls_hmac1728783
+Ref: gnutls_hmac_copy1729214
+Ref: gnutls_hmac_deinit1729695
+Ref: gnutls_hmac_fast1730022
+Ref: gnutls_hmac_get_key_size1730746
+Ref: gnutls_hmac_get_len1731207
+Ref: gnutls_hmac_init1731537
+Ref: gnutls_hmac_output1732320
+Ref: gnutls_hmac_set_nonce1732655
+Ref: gnutls_mac_get_nonce_size1733022
+Ref: gnutls_pbkdf21733338
+Ref: gnutls_rnd1733971
+Ref: gnutls_rnd_refresh1734609
+Node: Compatibility API1734895
+Ref: gnutls_compression_get1735237
+Ref: gnutls_compression_get_id1735589
+Ref: gnutls_compression_get_name1735953
+Ref: gnutls_compression_list1736335
+Ref: gnutls_global_set_mem_functions1736667
+Ref: gnutls_openpgp_privkey_sign_hash1738042
+Ref: gnutls_priority_compression_list1738471
+Ref: gnutls_x509_crt_get_preferred_hash_algorithm1738923
+Ref: gnutls_x509_privkey_sign_hash1739804
+Node: Copying Information1740674
+Node: Bibliography1765851
+Ref: CBCATT1765990
+Ref: GPGH1766168
+Ref: GUTPKI1766291
+Ref: PRNGATTACKS1766466
+Ref: KEYPIN1766666
+Ref: NISTSP800571766841
+Ref: RFC74131767089
+Ref: RFC79181767256
+Ref: RFC61251767433
+Ref: RFC76851767774
+Ref: RFC76131767949
+Ref: RFC22461768197
+Ref: RFC60831768358
+Ref: RFC44181768595
+Ref: RFC46801768762
+Ref: RFC76331768920
+Ref: RFC79191769092
+Ref: RFC45141769296
+Ref: RFC43461769500
+Ref: RFC43471769650
+Ref: RFC52461769817
+Ref: RFC24401769968
+Ref: RFC48801770150
+Ref: RFC42111770344
+Ref: RFC28171770538
+Ref: RFC28181770691
+Ref: RFC29451770805
+Ref: RFC73011770955
+Ref: RFC29861771175
+Ref: PKIX1771364
+Ref: RFC37491771627
+Ref: RFC38201771793
+Ref: RFC65201772036
+Ref: RFC57461772275
+Ref: RFC52801772484
+Ref: TLSTKT1772751
+Ref: PKCS121772983
+Ref: PKCS111773124
+Ref: RESCORLA1773270
+Ref: SELKEY1773366
+Ref: SSL31773525
+Ref: STEVENS1773716
+Ref: TLSEXT1773824
+Ref: TLSPGP1774041
+Ref: TLSSRP1774206
+Ref: TLSPSK1774403
+Ref: TOMSRP1774572
+Ref: WEGER1774685
+Ref: ECRYPT1774877
+Ref: RFC50561775082
+Ref: RFC57641775235
+Ref: RFC59291775523
+Ref: PKCS11URI1775666
+Ref: TPMURI1775802
+Ref: ANDERSON1775996
+Ref: RFC48211776142
+Ref: RFC25601776295
+Ref: RIVESTCRL1776489
+Node: Function and Data Index1776850
+Node: Concept Index1903361

End Tag Table
diff -ruN gnutls-3.7.2/doc/gnutls.info-1 gnutls-3.7.2-bootstrapped/doc/gnutls.info-1
--- gnutls-3.7.2/doc/gnutls.info-1 2021-05-29 10:19:34.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/gnutls.info-1 2021-06-28 09:39:56.000000000 +0200
@@ -7426,6 +7426,12 @@
to a token. Must be combined with one of -load-privkey, -load-pubkey,
-load-certificate option.
+When writing a certificate object, its CKA_ID is set to the same CKA_ID
+of the corresponding public key, if it exists on the token; otherwise it
+will be derived from the X.509 Subject Key Identifier of the
+certificate. If this behavior is undesired, write the public key to the
+token beforehand.
+
id option.
..........
diff -ruN gnutls-3.7.2/doc/gnutls.info-3 gnutls-3.7.2-bootstrapped/doc/gnutls.info-3
--- gnutls-3.7.2/doc/gnutls.info-3 2021-05-29 10:19:36.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/gnutls.info-3 2021-06-28 09:39:58.000000000 +0200
@@ -1350,6 +1350,7 @@
* 'insecure-hash': to mark the hash algorithm as insecure for digital
signature use (provides a more generic way to disable digital
signatures for broken hash algorithms).
+ * 'disabled-curve': to disable the specified elliptic curve.
* 'disabled-version': to disable the specified TLS versions.
* 'tls-disabled-cipher': to disable the specified ciphers for use in
the TLS or DTLS protocols.
@@ -1362,12 +1363,54 @@
earlier).
Each of the options can be repeated multiple times when multiple values
-need to be disabled.
+need to be disabled or enabled.
The valid values for the options above can be found in the 'Protocols',
'Digests' 'PK-signatures', 'Protocols', 'Ciphrers', and 'MACs' fields of
the output of 'gnutls-cli --list'.
+Sometimes the system administrator wants to enable only specific
+algorithms, despite the library defaults. GnuTLS provides an
+alternative mode of overriding: allowlisting.
+
+In the allowlisting mode, all the algorithms are initially marked as
+insecure or disabled, and shall be explicitly turned on by the options
+in the '[overrides]' section. Those options are mutually exclusive to
+the above ones for the blocklisting mode (the default)
+ * 'secure-sig-for-cert': to mark the signature algorithm as secure
+ when used in certificates.
+ * 'secure-sig': to mark the signature algorithm as secure for any
+ use.
+ * 'secure-hash': to mark the hash algorithm as secure for digital
+ signature use (provides a more generic way to enable digital
+ signatures for broken hash algorithms).
+ * 'enabled-curve': to enable the specified elliptic curve.
+ * 'enabled-version': to enable the specified TLS versions.
+ * 'tls-enabled-cipher': to enable the specified ciphers for use in
+ the TLS or DTLS protocols.
+ * 'tls-enabled-mac': to enable the specified MAC algorithms for use
+ in the TLS or DTLS protocols.
+ * 'tls-enabled-group': to enable the specified group for use in the
+ TLS or DTLS protocols.
+ * 'tls-enabled-kx': to enable the specified key exchange algorithms
+ for use in the TLS or DTLS protocols (applies to TLS1.2 or
+ earlier).
+
+The allowlisting mode can be enabled by adding 'override-mode =
+allowlist' in the '[global]' section.
+
+When the allowlisting mode is in effect, it is also possible for the
+applications to modify the setting through the API.
+
+'INT *note gnutls_ecc_curve_mark_enabled:: (gnutls_ecc_curve_t CURVE)'
+'INT *note gnutls_sign_mark_secure:: (gnutls_sign_algorithm_t SIGN, unsigned FLAGS)'
+'INT *note gnutls_digest_mark_secure:: (gnutls_digest_algorithm_t DIG)'
+'INT *note gnutls_protocol_mark_enabled:: (gnutls_protocol_t VERSION)'
+'INT *note gnutls_ecc_curve_mark_disabled:: (gnutls_ecc_curve_t CURVE)'
+'INT *note gnutls_sign_mark_insecure:: (gnutls_sign_algorithm_t SIGN, unsigned FLAGS)'
+'INT *note gnutls_digest_mark_insecure:: (gnutls_digest_algorithm_t DIG)'
+'INT *note gnutls_protocol_mark_disabled:: (gnutls_protocol_t VERSION)'
+
8.2.1 Examples
--------------
@@ -1396,6 +1439,17 @@
tls-disabled-mac = sha1
tls-disabled-group = group-ffdhe8192
+The following example demonstrates the use of the allowlisting mode. It
+disables all the signature algorithms but 'RSA-SHA256'. Note that the
+hash algorithm 'SHA256' also needs to be explicitly enabled.
+
+ [global]
+ override-mode = allowlist
+
+ [overrides]
+ secure-hash = sha256
+ secure-sig = rsa-sha256
+

File: gnutls.info, Node: Querying for disabled algorithms and protocols, Next: Overriding the parameter verification profile, Prev: Disabling algorithms and protocols, Up: System-wide configuration of the library
@@ -8538,6 +8592,31 @@
'gnutls_digest_algorithm_t' integers indicating the available
digests.
+gnutls_digest_mark_insecure
+---------------------------
+
+ -- Function: int gnutls_digest_mark_insecure (gnutls_digest_algorithm_t
+ DIG)
+ DIG: is a digest algorithm
+
+ Mark 'dig' as insecure system wide. This only works if the
+ allowlisting mode is used in the configuration file.
+
+ *Since:* 3.7.3
+
+gnutls_digest_mark_secure
+-------------------------
+
+ -- Function: int gnutls_digest_mark_secure (gnutls_digest_algorithm_t
+ DIG)
+ DIG: is a digest algorithm
+
+ Invalidate previous system wide setting that marked 'dig' as
+ insecure. This only works if the allowlisting mode is used in the
+ configuration file.
+
+ *Since:* 3.7.3
+
gnutls_early_cipher_get
-----------------------
@@ -8657,6 +8736,37 @@
*Returns:* Return a (0)-terminated list of 'gnutls_ecc_curve_t'
integers indicating the available curves.
+gnutls_ecc_curve_mark_disabled
+------------------------------
+
+ -- Function: int gnutls_ecc_curve_mark_disabled (gnutls_ecc_curve_t
+ CURVE)
+ CURVE: is an ECC curve
+
+ Mark 'curve' as disabled system wide. This setting can be reverted
+ with 'gnutls_ecc_curve_mark_enabled()' . This only works if the
+ configuration file uses the allowlisting mode.
+
+ *Returns:* 0 on success or negative error code otherwise.
+
+ *Since:* 3.7.3
+
+gnutls_ecc_curve_mark_enabled
+-----------------------------
+
+ -- Function: int gnutls_ecc_curve_mark_enabled (gnutls_ecc_curve_t
+ CURVE)
+ CURVE: is an ECC curve
+
+ Invalidate previous system wide setting that marked 'curve' as
+ disabled. This only works if the curve is disabled with
+ 'gnutls_ecc_curve_mark_disabled()' or through the allowlisting mode
+ in the configuration file.
+
+ *Returns:* 0 on success or negative error code otherwise.
+
+ *Since:* 3.7.3
+
gnutls_error_is_fatal
---------------------
@@ -11047,6 +11157,27 @@
*Returns:* a (0)-terminated list of 'gnutls_protocol_t' integers
indicating the available protocols.
+gnutls_protocol_mark_disabled
+-----------------------------
+
+ -- Function: int gnutls_protocol_mark_disabled (gnutls_protocol_t
+ VERSION)
+ VERSION: is a (gnutls) version number
+
+ Mark 'version' as disabled system wide. This only works if the
+ allowlisting mode is used in the configuration file.
+
+gnutls_protocol_mark_enabled
+----------------------------
+
+ -- Function: int gnutls_protocol_mark_enabled (gnutls_protocol_t
+ VERSION)
+ VERSION: is a (gnutls) version number
+
+ Invalidate previous system wide setting that marked 'version' as
+ disabled. This only works if the allowlisting mode is used in the
+ configuration file.
+
gnutls_psk_allocate_client_credentials
--------------------------------------
@@ -13235,6 +13366,45 @@
*Returns:* a (0)-terminated list of 'gnutls_sign_algorithm_t'
integers indicating the available ciphers.
+gnutls_sign_mark_insecure
+-------------------------
+
+ -- Function: int gnutls_sign_mark_insecure (gnutls_sign_algorithm_t
+ SIGN, unsigned FLAGS)
+ SIGN: the sign algorithm
+
+ FLAGS: 'GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS' or 0
+
+ Mark 'sign' as insecure system wide. This only works if the
+ allowlisting mode is used in the configuration file.
+
+ If 'flags' has 'GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS' bit set, and the
+ algorithm was previously considered secure for all purposes, it
+ only marks the algorithm as insecure for the use with certificates.
+
+ *Since:* 3.7.3
+
+gnutls_sign_mark_secure
+-----------------------
+
+ -- Function: int gnutls_sign_mark_secure (gnutls_sign_algorithm_t SIGN,
+ unsigned FLAGS)
+ SIGN: the sign algorithm
+
+ FLAGS: 'GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS' or 0
+
+ Invalidate previous system wide setting that marked 'sign' as
+ insecure. This only works if the algorithm is marked as insecure
+ with 'gnutls_sign_mark_insecure()' or through the allowlisting mode
+ in the configuration file.
+
+ If 'flags' has 'GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS' bit set, it
+ marks it the algorithm as secure for all purposes. If the absence
+ of this flag, it will mark it as "secure, but not for certificates"
+ at most, but it won't restrict anything either.
+
+ *Since:* 3.7.3
+
gnutls_sign_supports_pk_algorithm
---------------------------------
diff -ruN gnutls-3.7.2/doc/gnutls.info-6 gnutls-3.7.2-bootstrapped/doc/gnutls.info-6
--- gnutls-3.7.2/doc/gnutls.info-6 2021-05-29 10:19:38.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/gnutls.info-6 2021-06-28 09:40:00.000000000 +0200
@@ -7847,6 +7847,8 @@
* gnutls_digest_get_name: Core TLS API. (line 3005)
* gnutls_digest_get_oid: Core TLS API. (line 3017)
* gnutls_digest_list: Core TLS API. (line 3032)
+* gnutls_digest_mark_insecure: Core TLS API. (line 3046)
+* gnutls_digest_mark_secure: Core TLS API. (line 3058)
* gnutls_dtls_cookie_send: Datagram TLS API. (line 11)
* gnutls_dtls_cookie_verify: Datagram TLS API. (line 45)
* gnutls_dtls_get_data_mtu: Datagram TLS API. (line 74)
@@ -7858,71 +7860,73 @@
* gnutls_dtls_set_data_mtu: Datagram TLS API. (line 139)
* gnutls_dtls_set_mtu: Datagram TLS API. (line 165)
* gnutls_dtls_set_timeouts: Datagram TLS API. (line 182)
-* gnutls_early_cipher_get: Core TLS API. (line 3046)
-* gnutls_early_prf_hash_get: Core TLS API. (line 3060)
-* gnutls_ecc_curve_get: Core TLS API. (line 3075)
-* gnutls_ecc_curve_get_id: Core TLS API. (line 3089)
-* gnutls_ecc_curve_get_name: Core TLS API. (line 3103)
-* gnutls_ecc_curve_get_oid: Core TLS API. (line 3117)
-* gnutls_ecc_curve_get_pk: Core TLS API. (line 3131)
-* gnutls_ecc_curve_get_size: Core TLS API. (line 3143)
-* gnutls_ecc_curve_list: Core TLS API. (line 3153)
+* gnutls_early_cipher_get: Core TLS API. (line 3071)
+* gnutls_early_prf_hash_get: Core TLS API. (line 3085)
+* gnutls_ecc_curve_get: Core TLS API. (line 3100)
+* gnutls_ecc_curve_get_id: Core TLS API. (line 3114)
+* gnutls_ecc_curve_get_name: Core TLS API. (line 3128)
+* gnutls_ecc_curve_get_oid: Core TLS API. (line 3142)
+* gnutls_ecc_curve_get_pk: Core TLS API. (line 3156)
+* gnutls_ecc_curve_get_size: Core TLS API. (line 3168)
+* gnutls_ecc_curve_list: Core TLS API. (line 3178)
+* gnutls_ecc_curve_mark_disabled: Core TLS API. (line 3190)
+* gnutls_ecc_curve_mark_enabled: Core TLS API. (line 3205)
* gnutls_encode_ber_digest_info: Cryptographic API. (line 689)
* gnutls_encode_gost_rs_value: Cryptographic API. (line 709)
* gnutls_encode_rs_value: Cryptographic API. (line 732)
* gnutls_error_is_fatal: Data transfer and termination.
(line 82)
-* gnutls_error_is_fatal <1>: Core TLS API. (line 3165)
+* gnutls_error_is_fatal <1>: Core TLS API. (line 3221)
* gnutls_error_to_alert: Handling alerts. (line 66)
-* gnutls_error_to_alert <1>: Core TLS API. (line 3185)
-* gnutls_est_record_overhead_size: Core TLS API. (line 3204)
-* gnutls_ext_get_current_msg: Core TLS API. (line 3231)
-* gnutls_ext_get_data: Core TLS API. (line 3249)
-* gnutls_ext_get_name: Core TLS API. (line 3268)
-* gnutls_ext_get_name2: Core TLS API. (line 3279)
-* gnutls_ext_raw_parse: Core TLS API. (line 3296)
-* gnutls_ext_register: Core TLS API. (line 3327)
-* gnutls_ext_set_data: Core TLS API. (line 3374)
-* gnutls_fingerprint: Core TLS API. (line 3391)
-* gnutls_fips140_mode_enabled: Core TLS API. (line 3418)
-* gnutls_fips140_set_mode: Core TLS API. (line 3436)
+* gnutls_error_to_alert <1>: Core TLS API. (line 3241)
+* gnutls_est_record_overhead_size: Core TLS API. (line 3260)
+* gnutls_ext_get_current_msg: Core TLS API. (line 3287)
+* gnutls_ext_get_data: Core TLS API. (line 3305)
+* gnutls_ext_get_name: Core TLS API. (line 3324)
+* gnutls_ext_get_name2: Core TLS API. (line 3335)
+* gnutls_ext_raw_parse: Core TLS API. (line 3352)
+* gnutls_ext_register: Core TLS API. (line 3383)
+* gnutls_ext_set_data: Core TLS API. (line 3430)
+* gnutls_fingerprint: Core TLS API. (line 3447)
+* gnutls_fips140_mode_enabled: Core TLS API. (line 3474)
+* gnutls_fips140_set_mode: Core TLS API. (line 3492)
* gnutls_get_system_config_file: System-wide configuration of the library.
(line 24)
-* gnutls_get_system_config_file <1>: Core TLS API. (line 3462)
-* gnutls_global_deinit: Core TLS API. (line 3476)
-* gnutls_global_init: Core TLS API. (line 3489)
+* gnutls_get_system_config_file <1>: Core TLS API. (line 3518)
+* gnutls_global_deinit: Core TLS API. (line 3532)
+* gnutls_global_init: Core TLS API. (line 3545)
* gnutls_global_set_audit_log_function: Debugging and auditing.
(line 64)
-* gnutls_global_set_audit_log_function <1>: Core TLS API. (line 3518)
-* gnutls_global_set_log_function: Core TLS API. (line 3537)
-* gnutls_global_set_log_level: Core TLS API. (line 3552)
+* gnutls_global_set_audit_log_function <1>: Core TLS API. (line 3574)
+* gnutls_global_set_log_function: Core TLS API. (line 3593)
+* gnutls_global_set_log_level: Core TLS API. (line 3608)
* gnutls_global_set_mem_functions: Compatibility API. (line 60)
-* gnutls_global_set_mutex: Core TLS API. (line 3565)
-* gnutls_global_set_time_function: Core TLS API. (line 3594)
-* gnutls_gost_paramset_get_name: Core TLS API. (line 3608)
-* gnutls_gost_paramset_get_oid: Core TLS API. (line 3622)
-* gnutls_group_get: Core TLS API. (line 3636)
-* gnutls_group_get_id: Core TLS API. (line 3649)
-* gnutls_group_get_name: Core TLS API. (line 3662)
-* gnutls_group_list: Core TLS API. (line 3675)
+* gnutls_global_set_mutex: Core TLS API. (line 3621)
+* gnutls_global_set_time_function: Core TLS API. (line 3650)
+* gnutls_gost_paramset_get_name: Core TLS API. (line 3664)
+* gnutls_gost_paramset_get_oid: Core TLS API. (line 3678)
+* gnutls_group_get: Core TLS API. (line 3692)
+* gnutls_group_get_id: Core TLS API. (line 3705)
+* gnutls_group_get_name: Core TLS API. (line 3718)
+* gnutls_group_list: Core TLS API. (line 3731)
* gnutls_handshake: TLS handshake. (line 10)
-* gnutls_handshake <1>: Core TLS API. (line 3689)
-* gnutls_handshake_description_get_name: Core TLS API. (line 3732)
-* gnutls_handshake_get_last_in: Core TLS API. (line 3744)
-* gnutls_handshake_get_last_out: Core TLS API. (line 3761)
+* gnutls_handshake <1>: Core TLS API. (line 3745)
+* gnutls_handshake_description_get_name: Core TLS API. (line 3788)
+* gnutls_handshake_get_last_in: Core TLS API. (line 3800)
+* gnutls_handshake_get_last_out: Core TLS API. (line 3817)
* gnutls_handshake_set_hook_function: Virtual hosts and credentials.
(line 56)
-* gnutls_handshake_set_hook_function <1>: Core TLS API. (line 3778)
-* gnutls_handshake_set_max_packet_length: Core TLS API. (line 3815)
+* gnutls_handshake_set_hook_function <1>: Core TLS API. (line 3834)
+* gnutls_handshake_set_max_packet_length: Core TLS API. (line 3871)
* gnutls_handshake_set_post_client_hello_function: Core TLS API.
- (line 3836)
-* gnutls_handshake_set_private_extensions: Core TLS API. (line 3867)
-* gnutls_handshake_set_random: Core TLS API. (line 3886)
-* gnutls_handshake_set_read_function: Core TLS API. (line 3908)
-* gnutls_handshake_set_secret_function: Core TLS API. (line 3922)
+ (line 3892)
+* gnutls_handshake_set_private_extensions: Core TLS API. (line 3923)
+* gnutls_handshake_set_random: Core TLS API. (line 3942)
+* gnutls_handshake_set_read_function: Core TLS API. (line 3964)
+* gnutls_handshake_set_secret_function: Core TLS API. (line 3978)
* gnutls_handshake_set_timeout: TLS handshake. (line 50)
-* gnutls_handshake_set_timeout <1>: Core TLS API. (line 3936)
-* gnutls_handshake_write: Core TLS API. (line 3956)
+* gnutls_handshake_set_timeout <1>: Core TLS API. (line 3992)
+* gnutls_handshake_write: Core TLS API. (line 4012)
* gnutls_hash: Cryptographic API. (line 753)
* gnutls_hash_copy: Cryptographic API. (line 771)
* gnutls_hash_deinit: Cryptographic API. (line 787)
@@ -7930,17 +7934,17 @@
* gnutls_hash_get_len: Cryptographic API. (line 821)
* gnutls_hash_init: Cryptographic API. (line 835)
* gnutls_hash_output: Cryptographic API. (line 853)
-* gnutls_heartbeat_allowed: Core TLS API. (line 3977)
-* gnutls_heartbeat_enable: Core TLS API. (line 3994)
-* gnutls_heartbeat_get_timeout: Core TLS API. (line 4018)
-* gnutls_heartbeat_ping: Core TLS API. (line 4034)
-* gnutls_heartbeat_pong: Core TLS API. (line 4066)
-* gnutls_heartbeat_set_timeouts: Core TLS API. (line 4082)
-* gnutls_hex2bin: Core TLS API. (line 4104)
-* gnutls_hex_decode: Core TLS API. (line 4127)
-* gnutls_hex_decode2: Core TLS API. (line 4149)
-* gnutls_hex_encode: Core TLS API. (line 4164)
-* gnutls_hex_encode2: Core TLS API. (line 4183)
+* gnutls_heartbeat_allowed: Core TLS API. (line 4033)
+* gnutls_heartbeat_enable: Core TLS API. (line 4050)
+* gnutls_heartbeat_get_timeout: Core TLS API. (line 4074)
+* gnutls_heartbeat_ping: Core TLS API. (line 4090)
+* gnutls_heartbeat_pong: Core TLS API. (line 4122)
+* gnutls_heartbeat_set_timeouts: Core TLS API. (line 4138)
+* gnutls_hex2bin: Core TLS API. (line 4160)
+* gnutls_hex_decode: Core TLS API. (line 4183)
+* gnutls_hex_decode2: Core TLS API. (line 4205)
+* gnutls_hex_encode: Core TLS API. (line 4220)
+* gnutls_hex_encode2: Core TLS API. (line 4239)
* gnutls_hkdf_expand: Cryptographic API. (line 867)
* gnutls_hkdf_extract: Cryptographic API. (line 891)
* gnutls_hmac: Cryptographic API. (line 912)
@@ -7952,25 +7956,25 @@
* gnutls_hmac_init: Cryptographic API. (line 1015)
* gnutls_hmac_output: Cryptographic API. (line 1041)
* gnutls_hmac_set_nonce: Cryptographic API. (line 1055)
-* gnutls_idna_map: Core TLS API. (line 4201)
-* gnutls_idna_reverse_map: Core TLS API. (line 4232)
+* gnutls_idna_map: Core TLS API. (line 4257)
+* gnutls_idna_reverse_map: Core TLS API. (line 4288)
* gnutls_init: Session initialization.
(line 14)
-* gnutls_init <1>: Core TLS API. (line 4258)
-* gnutls_key_generate: Core TLS API. (line 4281)
-* gnutls_kx_get: Core TLS API. (line 4298)
-* gnutls_kx_get_id: Core TLS API. (line 4315)
-* gnutls_kx_get_name: Core TLS API. (line 4327)
-* gnutls_kx_list: Core TLS API. (line 4339)
-* gnutls_load_file: Core TLS API. (line 4351)
-* gnutls_mac_get: Core TLS API. (line 4374)
-* gnutls_mac_get_id: Core TLS API. (line 4386)
-* gnutls_mac_get_key_size: Core TLS API. (line 4399)
-* gnutls_mac_get_name: Core TLS API. (line 4411)
+* gnutls_init <1>: Core TLS API. (line 4314)
+* gnutls_key_generate: Core TLS API. (line 4337)
+* gnutls_kx_get: Core TLS API. (line 4354)
+* gnutls_kx_get_id: Core TLS API. (line 4371)
+* gnutls_kx_get_name: Core TLS API. (line 4383)
+* gnutls_kx_list: Core TLS API. (line 4395)
+* gnutls_load_file: Core TLS API. (line 4407)
+* gnutls_mac_get: Core TLS API. (line 4430)
+* gnutls_mac_get_id: Core TLS API. (line 4442)
+* gnutls_mac_get_key_size: Core TLS API. (line 4455)
+* gnutls_mac_get_name: Core TLS API. (line 4467)
* gnutls_mac_get_nonce_size: Cryptographic API. (line 1070)
-* gnutls_mac_list: Core TLS API. (line 4423)
-* gnutls_memcmp: Core TLS API. (line 4435)
-* gnutls_memset: Core TLS API. (line 4456)
+* gnutls_mac_list: Core TLS API. (line 4479)
+* gnutls_memcmp: Core TLS API. (line 4491)
+* gnutls_memset: Core TLS API. (line 4512)
* gnutls_ocsp_req_add_cert: OCSP API. (line 12)
* gnutls_ocsp_req_add_cert_id: OCSP API. (line 36)
* gnutls_ocsp_req_deinit: OCSP API. (line 69)
@@ -8011,20 +8015,20 @@
* gnutls_ocsp_resp_print: OCSP API. (line 757)
* gnutls_ocsp_resp_verify: OCSP API. (line 780)
* gnutls_ocsp_resp_verify_direct: OCSP API. (line 818)
-* gnutls_ocsp_status_request_enable_client: Core TLS API. (line 4471)
-* gnutls_ocsp_status_request_get: Core TLS API. (line 4499)
-* gnutls_ocsp_status_request_get2: Core TLS API. (line 4518)
-* gnutls_ocsp_status_request_is_checked: Core TLS API. (line 4544)
-* gnutls_oid_to_digest: Core TLS API. (line 4578)
-* gnutls_oid_to_ecc_curve: Core TLS API. (line 4593)
-* gnutls_oid_to_gost_paramset: Core TLS API. (line 4605)
-* gnutls_oid_to_mac: Core TLS API. (line 4620)
-* gnutls_oid_to_pk: Core TLS API. (line 4635)
-* gnutls_oid_to_sign: Core TLS API. (line 4649)
+* gnutls_ocsp_status_request_enable_client: Core TLS API. (line 4527)
+* gnutls_ocsp_status_request_get: Core TLS API. (line 4555)
+* gnutls_ocsp_status_request_get2: Core TLS API. (line 4574)
+* gnutls_ocsp_status_request_is_checked: Core TLS API. (line 4600)
+* gnutls_oid_to_digest: Core TLS API. (line 4634)
+* gnutls_oid_to_ecc_curve: Core TLS API. (line 4649)
+* gnutls_oid_to_gost_paramset: Core TLS API. (line 4661)
+* gnutls_oid_to_mac: Core TLS API. (line 4676)
+* gnutls_oid_to_pk: Core TLS API. (line 4691)
+* gnutls_oid_to_sign: Core TLS API. (line 4705)
* gnutls_openpgp_privkey_sign_hash: Compatibility API. (line 95)
-* gnutls_openpgp_send_cert: Core TLS API. (line 4664)
-* gnutls_packet_deinit: Core TLS API. (line 4677)
-* gnutls_packet_get: Core TLS API. (line 4688)
+* gnutls_openpgp_send_cert: Core TLS API. (line 4720)
+* gnutls_packet_deinit: Core TLS API. (line 4733)
+* gnutls_packet_get: Core TLS API. (line 4744)
* gnutls_pbkdf2: Cryptographic API. (line 1083)
* gnutls_pcert_deinit: Abstract key API. (line 176)
* gnutls_pcert_export_openpgp: Abstract key API. (line 186)
@@ -8038,11 +8042,11 @@
* gnutls_pcert_import_x509_raw: Abstract key API. (line 370)
* gnutls_pcert_list_import_x509_file: Abstract key API. (line 393)
* gnutls_pcert_list_import_x509_raw: Abstract key API. (line 430)
-* gnutls_pem_base64_decode: Core TLS API. (line 4706)
-* gnutls_pem_base64_decode2: Core TLS API. (line 4730)
-* gnutls_pem_base64_encode: Core TLS API. (line 4758)
-* gnutls_pem_base64_encode2: Core TLS API. (line 4781)
-* gnutls_perror: Core TLS API. (line 4809)
+* gnutls_pem_base64_decode: Core TLS API. (line 4762)
+* gnutls_pem_base64_decode2: Core TLS API. (line 4786)
+* gnutls_pem_base64_encode: Core TLS API. (line 4814)
+* gnutls_pem_base64_encode2: Core TLS API. (line 4837)
+* gnutls_perror: Core TLS API. (line 4865)
* gnutls_pkcs11_add_provider: PKCS11 Manual Initialization.
(line 13)
* gnutls_pkcs11_add_provider <1>: PKCS 11 API. (line 12)
@@ -8183,39 +8187,39 @@
(line 122)
* gnutls_pkcs_schema_get_oid: X509 certificate API.
(line 137)
-* gnutls_pk_algorithm_get_name: Core TLS API. (line 4818)
+* gnutls_pk_algorithm_get_name: Core TLS API. (line 4874)
* gnutls_pk_bits_to_sec_param: Selecting cryptographic key sizes.
(line 91)
-* gnutls_pk_bits_to_sec_param <1>: Core TLS API. (line 4830)
-* gnutls_pk_get_id: Core TLS API. (line 4847)
-* gnutls_pk_get_name: Core TLS API. (line 4862)
-* gnutls_pk_get_oid: Core TLS API. (line 4876)
-* gnutls_pk_list: Core TLS API. (line 4891)
-* gnutls_pk_to_sign: Core TLS API. (line 4905)
-* gnutls_prf: Core TLS API. (line 4920)
-* gnutls_prf_early: Core TLS API. (line 4970)
-* gnutls_prf_hash_get: Core TLS API. (line 5015)
-* gnutls_prf_raw: Core TLS API. (line 5032)
+* gnutls_pk_bits_to_sec_param <1>: Core TLS API. (line 4886)
+* gnutls_pk_get_id: Core TLS API. (line 4903)
+* gnutls_pk_get_name: Core TLS API. (line 4918)
+* gnutls_pk_get_oid: Core TLS API. (line 4932)
+* gnutls_pk_list: Core TLS API. (line 4947)
+* gnutls_pk_to_sign: Core TLS API. (line 4961)
+* gnutls_prf: Core TLS API. (line 4976)
+* gnutls_prf_early: Core TLS API. (line 5026)
+* gnutls_prf_hash_get: Core TLS API. (line 5071)
+* gnutls_prf_raw: Core TLS API. (line 5088)
* gnutls_prf_rfc5705: Deriving keys for other applications/protocols.
(line 16)
-* gnutls_prf_rfc5705 <1>: Core TLS API. (line 5077)
-* gnutls_priority_certificate_type_list: Core TLS API. (line 5124)
-* gnutls_priority_certificate_type_list2: Core TLS API. (line 5145)
-* gnutls_priority_cipher_list: Core TLS API. (line 5165)
+* gnutls_prf_rfc5705 <1>: Core TLS API. (line 5133)
+* gnutls_priority_certificate_type_list: Core TLS API. (line 5180)
+* gnutls_priority_certificate_type_list2: Core TLS API. (line 5201)
+* gnutls_priority_cipher_list: Core TLS API. (line 5221)
* gnutls_priority_compression_list: Compatibility API. (line 111)
-* gnutls_priority_deinit: Core TLS API. (line 5180)
-* gnutls_priority_ecc_curve_list: Core TLS API. (line 5189)
-* gnutls_priority_get_cipher_suite_index: Core TLS API. (line 5207)
-* gnutls_priority_group_list: Core TLS API. (line 5232)
-* gnutls_priority_init: Core TLS API. (line 5247)
-* gnutls_priority_init2: Core TLS API. (line 5275)
-* gnutls_priority_kx_list: Core TLS API. (line 5383)
-* gnutls_priority_mac_list: Core TLS API. (line 5399)
-* gnutls_priority_protocol_list: Core TLS API. (line 5414)
-* gnutls_priority_set: Core TLS API. (line 5430)
-* gnutls_priority_set_direct: Core TLS API. (line 5448)
-* gnutls_priority_sign_list: Core TLS API. (line 5472)
-* gnutls_priority_string_list: Core TLS API. (line 5488)
+* gnutls_priority_deinit: Core TLS API. (line 5236)
+* gnutls_priority_ecc_curve_list: Core TLS API. (line 5245)
+* gnutls_priority_get_cipher_suite_index: Core TLS API. (line 5263)
+* gnutls_priority_group_list: Core TLS API. (line 5288)
+* gnutls_priority_init: Core TLS API. (line 5303)
+* gnutls_priority_init2: Core TLS API. (line 5331)
+* gnutls_priority_kx_list: Core TLS API. (line 5439)
+* gnutls_priority_mac_list: Core TLS API. (line 5455)
+* gnutls_priority_protocol_list: Core TLS API. (line 5470)
+* gnutls_priority_set: Core TLS API. (line 5486)
+* gnutls_priority_set_direct: Core TLS API. (line 5504)
+* gnutls_priority_sign_list: Core TLS API. (line 5528)
+* gnutls_priority_string_list: Core TLS API. (line 5544)
* gnutls_privkey_decrypt_data: Operations. (line 144)
* gnutls_privkey_decrypt_data <1>: Abstract key API. (line 465)
* gnutls_privkey_decrypt_data2: Abstract key API. (line 488)
@@ -8275,33 +8279,35 @@
* gnutls_privkey_status: Abstract key API. (line 1705)
* gnutls_privkey_verify_params: Abstract key API. (line 1721)
* gnutls_privkey_verify_seed: Abstract key API. (line 1734)
-* gnutls_protocol_get_id: Core TLS API. (line 5508)
-* gnutls_protocol_get_name: Core TLS API. (line 5520)
-* gnutls_protocol_get_version: Core TLS API. (line 5532)
-* gnutls_protocol_list: Core TLS API. (line 5543)
-* gnutls_psk_allocate_client_credentials: Core TLS API. (line 5555)
-* gnutls_psk_allocate_server_credentials: Core TLS API. (line 5567)
-* gnutls_psk_client_get_hint: Core TLS API. (line 5579)
-* gnutls_psk_free_client_credentials: Core TLS API. (line 5598)
-* gnutls_psk_free_server_credentials: Core TLS API. (line 5607)
-* gnutls_psk_server_get_username: Core TLS API. (line 5616)
-* gnutls_psk_server_get_username2: Core TLS API. (line 5636)
-* gnutls_psk_set_client_credentials: Core TLS API. (line 5657)
-* gnutls_psk_set_client_credentials2: Core TLS API. (line 5683)
+* gnutls_protocol_get_id: Core TLS API. (line 5564)
+* gnutls_protocol_get_name: Core TLS API. (line 5576)
+* gnutls_protocol_get_version: Core TLS API. (line 5588)
+* gnutls_protocol_list: Core TLS API. (line 5599)
+* gnutls_protocol_mark_disabled: Core TLS API. (line 5611)
+* gnutls_protocol_mark_enabled: Core TLS API. (line 5621)
+* gnutls_psk_allocate_client_credentials: Core TLS API. (line 5632)
+* gnutls_psk_allocate_server_credentials: Core TLS API. (line 5644)
+* gnutls_psk_client_get_hint: Core TLS API. (line 5656)
+* gnutls_psk_free_client_credentials: Core TLS API. (line 5675)
+* gnutls_psk_free_server_credentials: Core TLS API. (line 5684)
+* gnutls_psk_server_get_username: Core TLS API. (line 5693)
+* gnutls_psk_server_get_username2: Core TLS API. (line 5713)
+* gnutls_psk_set_client_credentials: Core TLS API. (line 5734)
+* gnutls_psk_set_client_credentials2: Core TLS API. (line 5760)
* gnutls_psk_set_client_credentials_function: PSK credentials.
(line 22)
* gnutls_psk_set_client_credentials_function <1>: Core TLS API.
- (line 5706)
-* gnutls_psk_set_client_credentials_function2: Core TLS API. (line 5731)
-* gnutls_psk_set_params_function: Core TLS API. (line 5760)
+ (line 5783)
+* gnutls_psk_set_client_credentials_function2: Core TLS API. (line 5808)
+* gnutls_psk_set_params_function: Core TLS API. (line 5837)
* gnutls_psk_set_server_credentials_file: PSK credentials. (line 59)
-* gnutls_psk_set_server_credentials_file <1>: Core TLS API. (line 5778)
-* gnutls_psk_set_server_credentials_function: Core TLS API. (line 5800)
-* gnutls_psk_set_server_credentials_function2: Core TLS API. (line 5825)
-* gnutls_psk_set_server_credentials_hint: Core TLS API. (line 5854)
-* gnutls_psk_set_server_dh_params: Core TLS API. (line 5873)
-* gnutls_psk_set_server_known_dh_params: Core TLS API. (line 5891)
-* gnutls_psk_set_server_params_function: Core TLS API. (line 5915)
+* gnutls_psk_set_server_credentials_file <1>: Core TLS API. (line 5855)
+* gnutls_psk_set_server_credentials_function: Core TLS API. (line 5877)
+* gnutls_psk_set_server_credentials_function2: Core TLS API. (line 5902)
+* gnutls_psk_set_server_credentials_hint: Core TLS API. (line 5931)
+* gnutls_psk_set_server_dh_params: Core TLS API. (line 5950)
+* gnutls_psk_set_server_known_dh_params: Core TLS API. (line 5968)
+* gnutls_psk_set_server_params_function: Core TLS API. (line 5992)
* gnutls_pubkey_deinit: Abstract key API. (line 1758)
* gnutls_pubkey_encrypt_data: Operations. (line 60)
* gnutls_pubkey_encrypt_data <1>: Abstract key API. (line 1768)
@@ -8351,169 +8357,171 @@
* gnutls_pubkey_verify_hash2: Operations. (line 33)
* gnutls_pubkey_verify_hash2 <1>: Abstract key API. (line 2681)
* gnutls_pubkey_verify_params: Abstract key API. (line 2711)
-* gnutls_random_art: Core TLS API. (line 5933)
-* gnutls_range_split: Core TLS API. (line 5960)
-* gnutls_reauth: Core TLS API. (line 5986)
-* gnutls_record_can_use_length_hiding: Core TLS API. (line 6032)
-* gnutls_record_check_corked: Core TLS API. (line 6050)
+* gnutls_random_art: Core TLS API. (line 6010)
+* gnutls_range_split: Core TLS API. (line 6037)
+* gnutls_reauth: Core TLS API. (line 6063)
+* gnutls_record_can_use_length_hiding: Core TLS API. (line 6109)
+* gnutls_record_check_corked: Core TLS API. (line 6127)
* gnutls_record_check_pending: Data transfer and termination.
(line 138)
-* gnutls_record_check_pending <1>: Core TLS API. (line 6064)
+* gnutls_record_check_pending <1>: Core TLS API. (line 6141)
* gnutls_record_cork: Buffered data transfer.
(line 12)
-* gnutls_record_cork <1>: Core TLS API. (line 6077)
-* gnutls_record_disable_padding: Core TLS API. (line 6091)
-* gnutls_record_discard_queued: Core TLS API. (line 6106)
+* gnutls_record_cork <1>: Core TLS API. (line 6154)
+* gnutls_record_disable_padding: Core TLS API. (line 6168)
+* gnutls_record_discard_queued: Core TLS API. (line 6183)
* gnutls_record_get_direction: Asynchronous operation.
(line 65)
-* gnutls_record_get_direction <1>: Core TLS API. (line 6125)
+* gnutls_record_get_direction <1>: Core TLS API. (line 6202)
* gnutls_record_get_discarded: Datagram TLS API. (line 209)
-* gnutls_record_get_max_early_data_size: Core TLS API. (line 6148)
-* gnutls_record_get_max_size: Core TLS API. (line 6164)
-* gnutls_record_get_state: Core TLS API. (line 6176)
-* gnutls_record_overhead_size: Core TLS API. (line 6207)
+* gnutls_record_get_max_early_data_size: Core TLS API. (line 6225)
+* gnutls_record_get_max_size: Core TLS API. (line 6241)
+* gnutls_record_get_state: Core TLS API. (line 6253)
+* gnutls_record_overhead_size: Core TLS API. (line 6284)
* gnutls_record_recv: Data transfer and termination.
(line 53)
-* gnutls_record_recv <1>: Core TLS API. (line 6220)
-* gnutls_record_recv_early_data: Core TLS API. (line 6252)
-* gnutls_record_recv_packet: Core TLS API. (line 6280)
+* gnutls_record_recv <1>: Core TLS API. (line 6297)
+* gnutls_record_recv_early_data: Core TLS API. (line 6329)
+* gnutls_record_recv_packet: Core TLS API. (line 6357)
* gnutls_record_recv_seq: Data transfer and termination.
(line 108)
-* gnutls_record_recv_seq <1>: Core TLS API. (line 6304)
+* gnutls_record_recv_seq <1>: Core TLS API. (line 6381)
* gnutls_record_send: Data transfer and termination.
(line 12)
-* gnutls_record_send <1>: Core TLS API. (line 6331)
+* gnutls_record_send <1>: Core TLS API. (line 6408)
* gnutls_record_send2: On Record Padding. (line 23)
-* gnutls_record_send2 <1>: Core TLS API. (line 6375)
-* gnutls_record_send_early_data: Core TLS API. (line 6408)
-* gnutls_record_send_range: Core TLS API. (line 6436)
-* gnutls_record_set_max_early_data_size: Core TLS API. (line 6465)
-* gnutls_record_set_max_recv_size: Core TLS API. (line 6484)
-* gnutls_record_set_max_size: Core TLS API. (line 6506)
-* gnutls_record_set_state: Core TLS API. (line 6535)
-* gnutls_record_set_timeout: Core TLS API. (line 6556)
+* gnutls_record_send2 <1>: Core TLS API. (line 6452)
+* gnutls_record_send_early_data: Core TLS API. (line 6485)
+* gnutls_record_send_range: Core TLS API. (line 6513)
+* gnutls_record_set_max_early_data_size: Core TLS API. (line 6542)
+* gnutls_record_set_max_recv_size: Core TLS API. (line 6561)
+* gnutls_record_set_max_size: Core TLS API. (line 6583)
+* gnutls_record_set_state: Core TLS API. (line 6612)
+* gnutls_record_set_timeout: Core TLS API. (line 6633)
* gnutls_record_uncork: Buffered data transfer.
(line 23)
-* gnutls_record_uncork <1>: Core TLS API. (line 6575)
+* gnutls_record_uncork <1>: Core TLS API. (line 6652)
* gnutls_register_custom_url: Application-specific keys.
(line 69)
* gnutls_register_custom_url <1>: Abstract key API. (line 2724)
* gnutls_rehandshake: TLS 1.2 re-authentication.
(line 70)
-* gnutls_rehandshake <1>: Core TLS API. (line 6600)
+* gnutls_rehandshake <1>: Core TLS API. (line 6677)
* gnutls_rnd: Random number generation.
(line 21)
* gnutls_rnd <1>: Cryptographic API. (line 1108)
* gnutls_rnd_refresh: Cryptographic API. (line 1130)
* gnutls_safe_renegotiation_status: TLS 1.2 re-authentication.
(line 44)
-* gnutls_safe_renegotiation_status <1>: Core TLS API. (line 6640)
-* gnutls_sec_param_get_name: Core TLS API. (line 6655)
+* gnutls_safe_renegotiation_status <1>: Core TLS API. (line 6717)
+* gnutls_sec_param_get_name: Core TLS API. (line 6732)
* gnutls_sec_param_to_pk_bits: Selecting cryptographic key sizes.
(line 75)
-* gnutls_sec_param_to_pk_bits <1>: Core TLS API. (line 6669)
-* gnutls_sec_param_to_symmetric_bits: Core TLS API. (line 6688)
-* gnutls_server_name_get: Core TLS API. (line 6702)
-* gnutls_server_name_set: Core TLS API. (line 6741)
-* gnutls_session_channel_binding: Core TLS API. (line 6772)
-* gnutls_session_enable_compatibility_mode: Core TLS API. (line 6793)
-* gnutls_session_etm_status: Core TLS API. (line 6813)
-* gnutls_session_ext_master_secret_status: Core TLS API. (line 6826)
-* gnutls_session_ext_register: Core TLS API. (line 6840)
-* gnutls_session_force_valid: Core TLS API. (line 6896)
-* gnutls_session_get_data: Core TLS API. (line 6907)
-* gnutls_session_get_data2: Core TLS API. (line 6927)
-* gnutls_session_get_desc: Core TLS API. (line 6975)
-* gnutls_session_get_flags: Core TLS API. (line 6992)
-* gnutls_session_get_id: Core TLS API. (line 7011)
+* gnutls_sec_param_to_pk_bits <1>: Core TLS API. (line 6746)
+* gnutls_sec_param_to_symmetric_bits: Core TLS API. (line 6765)
+* gnutls_server_name_get: Core TLS API. (line 6779)
+* gnutls_server_name_set: Core TLS API. (line 6818)
+* gnutls_session_channel_binding: Core TLS API. (line 6849)
+* gnutls_session_enable_compatibility_mode: Core TLS API. (line 6870)
+* gnutls_session_etm_status: Core TLS API. (line 6890)
+* gnutls_session_ext_master_secret_status: Core TLS API. (line 6903)
+* gnutls_session_ext_register: Core TLS API. (line 6917)
+* gnutls_session_force_valid: Core TLS API. (line 6973)
+* gnutls_session_get_data: Core TLS API. (line 6984)
+* gnutls_session_get_data2: Core TLS API. (line 7004)
+* gnutls_session_get_desc: Core TLS API. (line 7052)
+* gnutls_session_get_flags: Core TLS API. (line 7069)
+* gnutls_session_get_id: Core TLS API. (line 7088)
* gnutls_session_get_id2: Session resumption. (line 49)
-* gnutls_session_get_id2 <1>: Core TLS API. (line 7045)
-* gnutls_session_get_keylog_function: Core TLS API. (line 7078)
-* gnutls_session_get_master_secret: Core TLS API. (line 7092)
-* gnutls_session_get_ptr: Core TLS API. (line 7108)
-* gnutls_session_get_random: Core TLS API. (line 7120)
-* gnutls_session_get_verify_cert_status: Core TLS API. (line 7140)
+* gnutls_session_get_id2 <1>: Core TLS API. (line 7122)
+* gnutls_session_get_keylog_function: Core TLS API. (line 7155)
+* gnutls_session_get_master_secret: Core TLS API. (line 7169)
+* gnutls_session_get_ptr: Core TLS API. (line 7185)
+* gnutls_session_get_random: Core TLS API. (line 7197)
+* gnutls_session_get_verify_cert_status: Core TLS API. (line 7217)
* gnutls_session_is_resumed: Session resumption. (line 40)
-* gnutls_session_is_resumed <1>: Core TLS API. (line 7160)
-* gnutls_session_key_update: Core TLS API. (line 7172)
+* gnutls_session_is_resumed <1>: Core TLS API. (line 7237)
+* gnutls_session_key_update: Core TLS API. (line 7249)
* gnutls_session_resumption_requested: Session resumption. (line 150)
-* gnutls_session_resumption_requested <1>: Core TLS API. (line 7199)
-* gnutls_session_set_data: Core TLS API. (line 7212)
-* gnutls_session_set_id: Core TLS API. (line 7235)
-* gnutls_session_set_keylog_function: Core TLS API. (line 7256)
-* gnutls_session_set_premaster: Core TLS API. (line 7270)
-* gnutls_session_set_ptr: Core TLS API. (line 7305)
+* gnutls_session_resumption_requested <1>: Core TLS API. (line 7276)
+* gnutls_session_set_data: Core TLS API. (line 7289)
+* gnutls_session_set_id: Core TLS API. (line 7312)
+* gnutls_session_set_keylog_function: Core TLS API. (line 7333)
+* gnutls_session_set_premaster: Core TLS API. (line 7347)
+* gnutls_session_set_ptr: Core TLS API. (line 7382)
* gnutls_session_set_verify_cert: Certificate credentials.
(line 267)
-* gnutls_session_set_verify_cert <1>: Core TLS API. (line 7318)
-* gnutls_session_set_verify_cert2: Core TLS API. (line 7351)
-* gnutls_session_set_verify_function: Core TLS API. (line 7383)
+* gnutls_session_set_verify_cert <1>: Core TLS API. (line 7395)
+* gnutls_session_set_verify_cert2: Core TLS API. (line 7428)
+* gnutls_session_set_verify_function: Core TLS API. (line 7460)
* gnutls_session_set_verify_output_function: X509 certificate API.
(line 152)
-* gnutls_session_supplemental_register: Core TLS API. (line 7412)
-* gnutls_session_ticket_enable_client: Core TLS API. (line 7448)
+* gnutls_session_supplemental_register: Core TLS API. (line 7489)
+* gnutls_session_ticket_enable_client: Core TLS API. (line 7525)
* gnutls_session_ticket_enable_server: Session resumption. (line 117)
-* gnutls_session_ticket_enable_server <1>: Core TLS API. (line 7464)
+* gnutls_session_ticket_enable_server <1>: Core TLS API. (line 7541)
* gnutls_session_ticket_key_generate: Session resumption. (line 137)
-* gnutls_session_ticket_key_generate <1>: Core TLS API. (line 7487)
+* gnutls_session_ticket_key_generate <1>: Core TLS API. (line 7564)
* gnutls_session_ticket_send: Session resumption. (line 170)
-* gnutls_session_ticket_send <1>: Core TLS API. (line 7503)
-* gnutls_set_default_priority: Core TLS API. (line 7521)
-* gnutls_set_default_priority_append: Core TLS API. (line 7547)
-* gnutls_sign_algorithm_get: Core TLS API. (line 7583)
-* gnutls_sign_algorithm_get_client: Core TLS API. (line 7597)
-* gnutls_sign_algorithm_get_requested: Core TLS API. (line 7612)
-* gnutls_sign_get_hash_algorithm: Core TLS API. (line 7639)
-* gnutls_sign_get_id: Core TLS API. (line 7654)
-* gnutls_sign_get_name: Core TLS API. (line 7666)
-* gnutls_sign_get_oid: Core TLS API. (line 7678)
-* gnutls_sign_get_pk_algorithm: Core TLS API. (line 7692)
-* gnutls_sign_is_secure: Core TLS API. (line 7710)
-* gnutls_sign_is_secure2: Core TLS API. (line 7720)
-* gnutls_sign_list: Core TLS API. (line 7732)
-* gnutls_sign_supports_pk_algorithm: Core TLS API. (line 7743)
-* gnutls_srp_allocate_client_credentials: Core TLS API. (line 7761)
-* gnutls_srp_allocate_server_credentials: Core TLS API. (line 7773)
-* gnutls_srp_base64_decode: Core TLS API. (line 7785)
-* gnutls_srp_base64_decode2: Core TLS API. (line 7807)
-* gnutls_srp_base64_encode: Core TLS API. (line 7827)
-* gnutls_srp_base64_encode2: Core TLS API. (line 7849)
-* gnutls_srp_free_client_credentials: Core TLS API. (line 7870)
-* gnutls_srp_free_server_credentials: Core TLS API. (line 7879)
-* gnutls_srp_server_get_username: Core TLS API. (line 7888)
-* gnutls_srp_set_client_credentials: Core TLS API. (line 7901)
+* gnutls_session_ticket_send <1>: Core TLS API. (line 7580)
+* gnutls_set_default_priority: Core TLS API. (line 7598)
+* gnutls_set_default_priority_append: Core TLS API. (line 7624)
+* gnutls_sign_algorithm_get: Core TLS API. (line 7660)
+* gnutls_sign_algorithm_get_client: Core TLS API. (line 7674)
+* gnutls_sign_algorithm_get_requested: Core TLS API. (line 7689)
+* gnutls_sign_get_hash_algorithm: Core TLS API. (line 7716)
+* gnutls_sign_get_id: Core TLS API. (line 7731)
+* gnutls_sign_get_name: Core TLS API. (line 7743)
+* gnutls_sign_get_oid: Core TLS API. (line 7755)
+* gnutls_sign_get_pk_algorithm: Core TLS API. (line 7769)
+* gnutls_sign_is_secure: Core TLS API. (line 7787)
+* gnutls_sign_is_secure2: Core TLS API. (line 7797)
+* gnutls_sign_list: Core TLS API. (line 7809)
+* gnutls_sign_mark_insecure: Core TLS API. (line 7820)
+* gnutls_sign_mark_secure: Core TLS API. (line 7838)
+* gnutls_sign_supports_pk_algorithm: Core TLS API. (line 7859)
+* gnutls_srp_allocate_client_credentials: Core TLS API. (line 7877)
+* gnutls_srp_allocate_server_credentials: Core TLS API. (line 7889)
+* gnutls_srp_base64_decode: Core TLS API. (line 7901)
+* gnutls_srp_base64_decode2: Core TLS API. (line 7923)
+* gnutls_srp_base64_encode: Core TLS API. (line 7943)
+* gnutls_srp_base64_encode2: Core TLS API. (line 7965)
+* gnutls_srp_free_client_credentials: Core TLS API. (line 7986)
+* gnutls_srp_free_server_credentials: Core TLS API. (line 7995)
+* gnutls_srp_server_get_username: Core TLS API. (line 8004)
+* gnutls_srp_set_client_credentials: Core TLS API. (line 8017)
* gnutls_srp_set_client_credentials_function: SRP credentials.
(line 19)
* gnutls_srp_set_client_credentials_function <1>: Core TLS API.
- (line 7924)
-* gnutls_srp_set_prime_bits: Core TLS API. (line 7957)
+ (line 8040)
+* gnutls_srp_set_prime_bits: Core TLS API. (line 8073)
* gnutls_srp_set_server_credentials_file: SRP credentials. (line 56)
-* gnutls_srp_set_server_credentials_file <1>: Core TLS API. (line 7978)
+* gnutls_srp_set_server_credentials_file <1>: Core TLS API. (line 8094)
* gnutls_srp_set_server_credentials_function: SRP credentials.
(line 72)
* gnutls_srp_set_server_credentials_function <1>: Core TLS API.
- (line 7997)
-* gnutls_srp_set_server_fake_salt_seed: Core TLS API. (line 8035)
+ (line 8113)
+* gnutls_srp_set_server_fake_salt_seed: Core TLS API. (line 8151)
* gnutls_srp_verifier: Authentication using SRP.
(line 45)
-* gnutls_srp_verifier <1>: Core TLS API. (line 8072)
+* gnutls_srp_verifier <1>: Core TLS API. (line 8188)
* gnutls_srtp_get_keys: SRTP. (line 31)
-* gnutls_srtp_get_keys <1>: Core TLS API. (line 8101)
-* gnutls_srtp_get_mki: Core TLS API. (line 8139)
-* gnutls_srtp_get_profile_id: Core TLS API. (line 8157)
-* gnutls_srtp_get_profile_name: Core TLS API. (line 8173)
-* gnutls_srtp_get_selected_profile: Core TLS API. (line 8188)
-* gnutls_srtp_set_mki: Core TLS API. (line 8204)
-* gnutls_srtp_set_profile: Core TLS API. (line 8221)
-* gnutls_srtp_set_profile_direct: Core TLS API. (line 8238)
+* gnutls_srtp_get_keys <1>: Core TLS API. (line 8217)
+* gnutls_srtp_get_mki: Core TLS API. (line 8255)
+* gnutls_srtp_get_profile_id: Core TLS API. (line 8273)
+* gnutls_srtp_get_profile_name: Core TLS API. (line 8289)
+* gnutls_srtp_get_selected_profile: Core TLS API. (line 8304)
+* gnutls_srtp_set_mki: Core TLS API. (line 8320)
+* gnutls_srtp_set_profile: Core TLS API. (line 8337)
+* gnutls_srtp_set_profile_direct: Core TLS API. (line 8354)
* gnutls_store_commitment: Certificate verification.
(line 115)
-* gnutls_store_commitment <1>: Core TLS API. (line 8259)
+* gnutls_store_commitment <1>: Core TLS API. (line 8375)
* gnutls_store_pubkey: Certificate verification.
(line 64)
-* gnutls_store_pubkey <1>: Core TLS API. (line 8299)
-* gnutls_strerror: Core TLS API. (line 8348)
-* gnutls_strerror_name: Core TLS API. (line 8362)
+* gnutls_store_pubkey <1>: Core TLS API. (line 8415)
+* gnutls_strerror: Core TLS API. (line 8464)
+* gnutls_strerror_name: Core TLS API. (line 8478)
* gnutls_subject_alt_names_deinit: X509 certificate API.
(line 181)
* gnutls_subject_alt_names_get: X509 certificate API.
@@ -8522,22 +8530,22 @@
(line 221)
* gnutls_subject_alt_names_set: X509 certificate API.
(line 235)
-* gnutls_supplemental_get_name: Core TLS API. (line 8377)
-* gnutls_supplemental_recv: Core TLS API. (line 8390)
-* gnutls_supplemental_register: Core TLS API. (line 8405)
-* gnutls_supplemental_send: Core TLS API. (line 8436)
+* gnutls_supplemental_get_name: Core TLS API. (line 8493)
+* gnutls_supplemental_recv: Core TLS API. (line 8506)
+* gnutls_supplemental_register: Core TLS API. (line 8521)
+* gnutls_supplemental_send: Core TLS API. (line 8552)
* gnutls_system_key_add_x509: Abstract key API. (line 2750)
* gnutls_system_key_delete: Abstract key API. (line 2776)
* gnutls_system_key_iter_deinit: Abstract key API. (line 2792)
* gnutls_system_key_iter_get_info: Application-specific keys.
(line 20)
* gnutls_system_key_iter_get_info <1>: Abstract key API. (line 2803)
-* gnutls_system_recv_timeout: Core TLS API. (line 8450)
-* gnutls_tdb_deinit: Core TLS API. (line 8473)
-* gnutls_tdb_init: Core TLS API. (line 8482)
-* gnutls_tdb_set_store_commitment_func: Core TLS API. (line 8493)
-* gnutls_tdb_set_store_func: Core TLS API. (line 8513)
-* gnutls_tdb_set_verify_func: Core TLS API. (line 8532)
+* gnutls_system_recv_timeout: Core TLS API. (line 8566)
+* gnutls_tdb_deinit: Core TLS API. (line 8589)
+* gnutls_tdb_init: Core TLS API. (line 8598)
+* gnutls_tdb_set_store_commitment_func: Core TLS API. (line 8609)
+* gnutls_tdb_set_store_func: Core TLS API. (line 8629)
+* gnutls_tdb_set_verify_func: Core TLS API. (line 8648)
* gnutls_tpm_get_registered: TPM API. (line 12)
* gnutls_tpm_key_list_deinit: TPM API. (line 27)
* gnutls_tpm_key_list_get_url: TPM API. (line 38)
@@ -8546,44 +8554,44 @@
* gnutls_tpm_privkey_delete <2>: TPM API. (line 60)
* gnutls_tpm_privkey_generate: Key generation. (line 9)
* gnutls_tpm_privkey_generate <1>: TPM API. (line 76)
-* gnutls_transport_get_int: Core TLS API. (line 8554)
-* gnutls_transport_get_int2: Core TLS API. (line 8568)
-* gnutls_transport_get_ptr: Core TLS API. (line 8585)
-* gnutls_transport_get_ptr2: Core TLS API. (line 8598)
+* gnutls_transport_get_int: Core TLS API. (line 8670)
+* gnutls_transport_get_int2: Core TLS API. (line 8684)
+* gnutls_transport_get_ptr: Core TLS API. (line 8701)
+* gnutls_transport_get_ptr2: Core TLS API. (line 8714)
* gnutls_transport_set_errno: Setting up the transport layer.
(line 116)
-* gnutls_transport_set_errno <1>: Core TLS API. (line 8614)
-* gnutls_transport_set_errno_function: Core TLS API. (line 8637)
+* gnutls_transport_set_errno <1>: Core TLS API. (line 8730)
+* gnutls_transport_set_errno_function: Core TLS API. (line 8753)
* gnutls_transport_set_fastopen: Reducing round-trips.
(line 22)
* gnutls_transport_set_fastopen <1>: Socket specific API.
(line 11)
-* gnutls_transport_set_int: Core TLS API. (line 8655)
-* gnutls_transport_set_int2: Core TLS API. (line 8673)
-* gnutls_transport_set_ptr: Core TLS API. (line 8695)
-* gnutls_transport_set_ptr2: Core TLS API. (line 8708)
+* gnutls_transport_set_int: Core TLS API. (line 8771)
+* gnutls_transport_set_int2: Core TLS API. (line 8789)
+* gnutls_transport_set_ptr: Core TLS API. (line 8811)
+* gnutls_transport_set_ptr2: Core TLS API. (line 8824)
* gnutls_transport_set_pull_function: Setting up the transport layer.
(line 56)
-* gnutls_transport_set_pull_function <1>: Core TLS API. (line 8725)
+* gnutls_transport_set_pull_function <1>: Core TLS API. (line 8841)
* gnutls_transport_set_pull_timeout_function: Setting up the transport layer.
(line 71)
* gnutls_transport_set_pull_timeout_function <1>: Setting up the transport layer.
(line 156)
* gnutls_transport_set_pull_timeout_function <2>: Core TLS API.
- (line 8743)
+ (line 8859)
* gnutls_transport_set_push_function: Setting up the transport layer.
(line 23)
-* gnutls_transport_set_push_function <1>: Core TLS API. (line 8783)
+* gnutls_transport_set_push_function <1>: Core TLS API. (line 8899)
* gnutls_transport_set_vec_push_function: Setting up the transport layer.
(line 40)
-* gnutls_transport_set_vec_push_function <1>: Core TLS API. (line 8803)
+* gnutls_transport_set_vec_push_function <1>: Core TLS API. (line 8919)
* gnutls_url_is_supported: Abstract public keys.
(line 57)
-* gnutls_url_is_supported <1>: Core TLS API. (line 8822)
-* gnutls_utf8_password_normalize: Core TLS API. (line 8836)
+* gnutls_url_is_supported <1>: Core TLS API. (line 8938)
+* gnutls_utf8_password_normalize: Core TLS API. (line 8952)
* gnutls_verify_stored_pubkey: Certificate verification.
(line 18)
-* gnutls_verify_stored_pubkey <1>: Core TLS API. (line 8861)
+* gnutls_verify_stored_pubkey <1>: Core TLS API. (line 8977)
* gnutls_x509_aia_deinit: X509 certificate API.
(line 262)
* gnutls_x509_aia_get: X509 certificate API.
diff -ruN gnutls-3.7.2/doc/invoke-p11tool.texi gnutls-3.7.2-bootstrapped/doc/invoke-p11tool.texi
--- gnutls-3.7.2/doc/invoke-p11tool.texi 2021-05-29 10:19:05.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/invoke-p11tool.texi 2021-06-28 09:39:25.000000000 +0200
@@ -403,8 +403,9 @@
@anchor{p11tool write}
This is the ``writes the loaded objects to a pkcs #11 token'' option.
-It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with
- one of --load-privkey, --load-pubkey, --load-certificate option.
+It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with one of --load-privkey, --load-pubkey, --load-certificate option.
+
+When writing a certificate object, its CKA_ID is set to the same CKA_ID of the corresponding public key, if it exists on the token; otherwise it will be derived from the X.509 Subject Key Identifier of the certificate. If this behavior is undesired, write the public key to the token beforehand.
@subsubheading id option.
@anchor{p11tool id}
diff -ruN gnutls-3.7.2/doc/Makefile.am gnutls-3.7.2-bootstrapped/doc/Makefile.am
--- gnutls-3.7.2/doc/Makefile.am 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/Makefile.am 2021-06-28 09:09:14.000000000 +0200
@@ -974,6 +974,10 @@
FUNCS += functions/gnutls_digest_get_oid.short
FUNCS += functions/gnutls_digest_list
FUNCS += functions/gnutls_digest_list.short
+FUNCS += functions/gnutls_digest_mark_insecure
+FUNCS += functions/gnutls_digest_mark_insecure.short
+FUNCS += functions/gnutls_digest_mark_secure
+FUNCS += functions/gnutls_digest_mark_secure.short
FUNCS += functions/gnutls_dtls_cookie_send
FUNCS += functions/gnutls_dtls_cookie_send.short
FUNCS += functions/gnutls_dtls_cookie_verify
@@ -1010,6 +1014,10 @@
FUNCS += functions/gnutls_ecc_curve_get_size.short
FUNCS += functions/gnutls_ecc_curve_list
FUNCS += functions/gnutls_ecc_curve_list.short
+FUNCS += functions/gnutls_ecc_curve_mark_disabled
+FUNCS += functions/gnutls_ecc_curve_mark_disabled.short
+FUNCS += functions/gnutls_ecc_curve_mark_enabled
+FUNCS += functions/gnutls_ecc_curve_mark_enabled.short
FUNCS += functions/gnutls_encode_ber_digest_info
FUNCS += functions/gnutls_encode_ber_digest_info.short
FUNCS += functions/gnutls_encode_gost_rs_value
@@ -1730,6 +1738,10 @@
FUNCS += functions/gnutls_protocol_get_version.short
FUNCS += functions/gnutls_protocol_list
FUNCS += functions/gnutls_protocol_list.short
+FUNCS += functions/gnutls_protocol_mark_disabled
+FUNCS += functions/gnutls_protocol_mark_disabled.short
+FUNCS += functions/gnutls_protocol_mark_enabled
+FUNCS += functions/gnutls_protocol_mark_enabled.short
FUNCS += functions/gnutls_psk_allocate_client_credentials
FUNCS += functions/gnutls_psk_allocate_client_credentials.short
FUNCS += functions/gnutls_psk_allocate_server_credentials
@@ -2024,6 +2036,10 @@
FUNCS += functions/gnutls_sign_is_secure2.short
FUNCS += functions/gnutls_sign_list
FUNCS += functions/gnutls_sign_list.short
+FUNCS += functions/gnutls_sign_mark_insecure
+FUNCS += functions/gnutls_sign_mark_insecure.short
+FUNCS += functions/gnutls_sign_mark_secure
+FUNCS += functions/gnutls_sign_mark_secure.short
FUNCS += functions/gnutls_sign_supports_pk_algorithm
FUNCS += functions/gnutls_sign_supports_pk_algorithm.short
FUNCS += functions/gnutls_srp_allocate_client_credentials
diff -ruN gnutls-3.7.2/doc/Makefile.in gnutls-3.7.2-bootstrapped/doc/Makefile.in
--- gnutls-3.7.2/doc/Makefile.in 2021-05-29 10:11:20.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/Makefile.in 2021-06-28 09:11:37.000000000 +0200
@@ -2697,6 +2697,10 @@
functions/gnutls_digest_get_oid.short \
functions/gnutls_digest_list \
functions/gnutls_digest_list.short \
+ functions/gnutls_digest_mark_insecure \
+ functions/gnutls_digest_mark_insecure.short \
+ functions/gnutls_digest_mark_secure \
+ functions/gnutls_digest_mark_secure.short \
functions/gnutls_dtls_cookie_send \
functions/gnutls_dtls_cookie_send.short \
functions/gnutls_dtls_cookie_verify \
@@ -2733,6 +2737,10 @@
functions/gnutls_ecc_curve_get_size.short \
functions/gnutls_ecc_curve_list \
functions/gnutls_ecc_curve_list.short \
+ functions/gnutls_ecc_curve_mark_disabled \
+ functions/gnutls_ecc_curve_mark_disabled.short \
+ functions/gnutls_ecc_curve_mark_enabled \
+ functions/gnutls_ecc_curve_mark_enabled.short \
functions/gnutls_encode_ber_digest_info \
functions/gnutls_encode_ber_digest_info.short \
functions/gnutls_encode_gost_rs_value \
@@ -3403,6 +3411,10 @@
functions/gnutls_protocol_get_version.short \
functions/gnutls_protocol_list \
functions/gnutls_protocol_list.short \
+ functions/gnutls_protocol_mark_disabled \
+ functions/gnutls_protocol_mark_disabled.short \
+ functions/gnutls_protocol_mark_enabled \
+ functions/gnutls_protocol_mark_enabled.short \
functions/gnutls_psk_allocate_client_credentials \
functions/gnutls_psk_allocate_client_credentials.short \
functions/gnutls_psk_allocate_server_credentials \
@@ -3692,6 +3704,10 @@
functions/gnutls_sign_is_secure2 \
functions/gnutls_sign_is_secure2.short \
functions/gnutls_sign_list functions/gnutls_sign_list.short \
+ functions/gnutls_sign_mark_insecure \
+ functions/gnutls_sign_mark_insecure.short \
+ functions/gnutls_sign_mark_secure \
+ functions/gnutls_sign_mark_secure.short \
functions/gnutls_sign_supports_pk_algorithm \
functions/gnutls_sign_supports_pk_algorithm.short \
functions/gnutls_srp_allocate_client_credentials \
diff -ruN gnutls-3.7.2/doc/manpages/certtool.1 gnutls-3.7.2-bootstrapped/doc/manpages/certtool.1
--- gnutls-3.7.2/doc/manpages/certtool.1 2021-05-29 10:15:21.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/certtool.1 2021-06-28 09:35:22.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH certtool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH certtool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/danetool.1 gnutls-3.7.2-bootstrapped/doc/manpages/danetool.1
--- gnutls-3.7.2/doc/manpages/danetool.1 2021-05-29 10:15:24.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/danetool.1 2021-06-28 09:35:24.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH danetool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH danetool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/gnutls-cli.1 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls-cli.1
--- gnutls-3.7.2/doc/manpages/gnutls-cli.1 2021-05-29 10:15:21.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls-cli.1 2021-06-28 09:35:22.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH gnutls-cli 1 "29 May 2021" "3.7.2" "User Commands"
+.TH gnutls-cli 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/gnutls-cli-debug.1 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls-cli-debug.1
--- gnutls-3.7.2/doc/manpages/gnutls-cli-debug.1 2021-05-29 10:15:21.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls-cli-debug.1 2021-06-28 09:35:22.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH gnutls-cli-debug 1 "29 May 2021" "3.7.2" "User Commands"
+.TH gnutls-cli-debug 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_digest_mark_insecure.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_digest_mark_insecure.3
--- gnutls-3.7.2/doc/manpages/gnutls_digest_mark_insecure.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_digest_mark_insecure.3 2021-06-28 09:35:39.000000000 +0200
@@ -0,0 +1,36 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_digest_mark_insecure" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_digest_mark_insecure \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_digest_mark_insecure(gnutls_digest_algorithm_t " dig ");"
+.SH ARGUMENTS
+.IP "gnutls_digest_algorithm_t dig" 12
+is a digest algorithm
+.SH "DESCRIPTION"
+Mark \fIdig\fP as insecure system wide. This only works if the allowlisting mode
+is used in the configuration file.
+.SH "SINCE"
+3.7.3
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_digest_mark_secure.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_digest_mark_secure.3
--- gnutls-3.7.2/doc/manpages/gnutls_digest_mark_secure.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_digest_mark_secure.3 2021-06-28 09:35:39.000000000 +0200
@@ -0,0 +1,36 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_digest_mark_secure" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_digest_mark_secure \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_digest_mark_secure(gnutls_digest_algorithm_t " dig ");"
+.SH ARGUMENTS
+.IP "gnutls_digest_algorithm_t dig" 12
+is a digest algorithm
+.SH "DESCRIPTION"
+Invalidate previous system wide setting that marked \fIdig\fP as insecure. This
+only works if the allowlisting mode is used in the configuration file.
+.SH "SINCE"
+3.7.3
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_ecc_curve_mark_disabled.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_ecc_curve_mark_disabled.3
--- gnutls-3.7.2/doc/manpages/gnutls_ecc_curve_mark_disabled.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_ecc_curve_mark_disabled.3 2021-06-28 09:35:38.000000000 +0200
@@ -0,0 +1,39 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_ecc_curve_mark_disabled" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_ecc_curve_mark_disabled \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_ecc_curve_mark_disabled(gnutls_ecc_curve_t " curve ");"
+.SH ARGUMENTS
+.IP "gnutls_ecc_curve_t curve" 12
+is an ECC curve
+.SH "DESCRIPTION"
+Mark \fIcurve\fP as disabled system wide. This setting can be reverted with
+\fBgnutls_ecc_curve_mark_enabled()\fP. This only works if the configuration file
+uses the allowlisting mode.
+.SH "RETURNS"
+0 on success or negative error code otherwise.
+.SH "SINCE"
+3.7.3
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_ecc_curve_mark_enabled.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_ecc_curve_mark_enabled.3
--- gnutls-3.7.2/doc/manpages/gnutls_ecc_curve_mark_enabled.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_ecc_curve_mark_enabled.3 2021-06-28 09:35:39.000000000 +0200
@@ -0,0 +1,39 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_ecc_curve_mark_enabled" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_ecc_curve_mark_enabled \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_ecc_curve_mark_enabled(gnutls_ecc_curve_t " curve ");"
+.SH ARGUMENTS
+.IP "gnutls_ecc_curve_t curve" 12
+is an ECC curve
+.SH "DESCRIPTION"
+Invalidate previous system wide setting that marked \fIcurve\fP as disabled. This
+only works if the curve is disabled with \fBgnutls_ecc_curve_mark_disabled()\fP or
+through the allowlisting mode in the configuration file.
+.SH "RETURNS"
+0 on success or negative error code otherwise.
+.SH "SINCE"
+3.7.3
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_protocol_mark_disabled.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_protocol_mark_disabled.3
--- gnutls-3.7.2/doc/manpages/gnutls_protocol_mark_disabled.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_protocol_mark_disabled.3 2021-06-28 09:35:39.000000000 +0200
@@ -0,0 +1,34 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_protocol_mark_disabled" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_protocol_mark_disabled \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_protocol_mark_disabled(gnutls_protocol_t " version ");"
+.SH ARGUMENTS
+.IP "gnutls_protocol_t version" 12
+is a (gnutls) version number
+.SH "DESCRIPTION"
+Mark \fIversion\fP as disabled system wide. This only works if the allowlisting
+mode is used in the configuration file.
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_protocol_mark_enabled.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_protocol_mark_enabled.3
--- gnutls-3.7.2/doc/manpages/gnutls_protocol_mark_enabled.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_protocol_mark_enabled.3 2021-06-28 09:35:40.000000000 +0200
@@ -0,0 +1,35 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_protocol_mark_enabled" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_protocol_mark_enabled \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_protocol_mark_enabled(gnutls_protocol_t " version ");"
+.SH ARGUMENTS
+.IP "gnutls_protocol_t version" 12
+is a (gnutls) version number
+.SH "DESCRIPTION"
+Invalidate previous system wide setting that marked \fIversion\fP as
+disabled. This only works if the allowlisting mode is used in the
+configuration file.
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls-serv.1 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls-serv.1
--- gnutls-3.7.2/doc/manpages/gnutls-serv.1 2021-05-29 10:15:21.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls-serv.1 2021-06-28 09:35:22.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH gnutls-serv 1 "29 May 2021" "3.7.2" "User Commands"
+.TH gnutls-serv 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_sign_mark_insecure.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_sign_mark_insecure.3
--- gnutls-3.7.2/doc/manpages/gnutls_sign_mark_insecure.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_sign_mark_insecure.3 2021-06-28 09:35:39.000000000 +0200
@@ -0,0 +1,42 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_sign_mark_insecure" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_sign_mark_insecure \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_sign_mark_insecure(gnutls_sign_algorithm_t " sign ", unsigned " flags ");"
+.SH ARGUMENTS
+.IP "gnutls_sign_algorithm_t sign" 12
+the sign algorithm
+.IP "unsigned flags" 12
+\fBGNUTLS_SIGN_FLAG_SECURE_FOR_CERTS\fP or 0
+.SH "DESCRIPTION"
+Mark \fIsign\fP as insecure system wide. This only works if the
+allowlisting mode is used in the configuration file.
+
+If \fIflags\fP has \fBGNUTLS_SIGN_FLAG_SECURE_FOR_CERTS\fP bit set,
+and the algorithm was previously considered secure for all purposes,
+it only marks the algorithm as insecure for the use with certificates.
+.SH "SINCE"
+3.7.3
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/gnutls_sign_mark_secure.3 gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_sign_mark_secure.3
--- gnutls-3.7.2/doc/manpages/gnutls_sign_mark_secure.3 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/doc/manpages/gnutls_sign_mark_secure.3 2021-06-28 09:35:39.000000000 +0200
@@ -0,0 +1,46 @@
+.\" DO NOT MODIFY THIS FILE! It was generated by gdoc.
+.TH "gnutls_sign_mark_secure" 3 "3.7.2" "gnutls" "gnutls"
+.SH NAME
+gnutls_sign_mark_secure \- API function
+.SH SYNOPSIS
+.B #include <gnutls/gnutls.h>
+.sp
+.BI "int gnutls_sign_mark_secure(gnutls_sign_algorithm_t " sign ", unsigned " flags ");"
+.SH ARGUMENTS
+.IP "gnutls_sign_algorithm_t sign" 12
+the sign algorithm
+.IP "unsigned flags" 12
+\fBGNUTLS_SIGN_FLAG_SECURE_FOR_CERTS\fP or 0
+.SH "DESCRIPTION"
+Invalidate previous system wide setting that marked \fIsign\fP as
+insecure. This only works if the algorithm is marked as insecure
+with \fBgnutls_sign_mark_insecure()\fP or through the allowlisting mode
+in the configuration file.
+
+If \fIflags\fP has \fBGNUTLS_SIGN_FLAG_SECURE_FOR_CERTS\fP bit set,
+it marks it the algorithm as secure for all purposes.
+If the absence of this flag, it will mark it as
+"secure, but not for certificates" at most,
+but it won't restrict anything either.
+.SH "SINCE"
+3.7.3
+.SH "REPORTING BUGS"
+Report bugs to <bugs@gnutls.org>.
+.br
+Home page: https://www.gnutls.org
+
+.SH COPYRIGHT
+Copyright \(co 2001- Free Software Foundation, Inc., and others.
+.br
+Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.
+.SH "SEE ALSO"
+The full documentation for
+.B gnutls
+is maintained as a Texinfo manual.
+If the /usr/share/doc/gnutls/
+directory does not contain the HTML form visit
+.B
+.IP https://www.gnutls.org/manual/
+.PP
diff -ruN gnutls-3.7.2/doc/manpages/Makefile.am gnutls-3.7.2-bootstrapped/doc/manpages/Makefile.am
--- gnutls-3.7.2/doc/manpages/Makefile.am 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/Makefile.am 2021-06-28 09:09:14.000000000 +0200
@@ -289,6 +289,8 @@
APIMANS += gnutls_digest_get_name.3
APIMANS += gnutls_digest_get_oid.3
APIMANS += gnutls_digest_list.3
+APIMANS += gnutls_digest_mark_insecure.3
+APIMANS += gnutls_digest_mark_secure.3
APIMANS += gnutls_dtls_cookie_send.3
APIMANS += gnutls_dtls_cookie_verify.3
APIMANS += gnutls_dtls_get_data_mtu.3
@@ -307,6 +309,8 @@
APIMANS += gnutls_ecc_curve_get_pk.3
APIMANS += gnutls_ecc_curve_get_size.3
APIMANS += gnutls_ecc_curve_list.3
+APIMANS += gnutls_ecc_curve_mark_disabled.3
+APIMANS += gnutls_ecc_curve_mark_enabled.3
APIMANS += gnutls_encode_ber_digest_info.3
APIMANS += gnutls_encode_gost_rs_value.3
APIMANS += gnutls_encode_rs_value.3
@@ -667,6 +671,8 @@
APIMANS += gnutls_protocol_get_name.3
APIMANS += gnutls_protocol_get_version.3
APIMANS += gnutls_protocol_list.3
+APIMANS += gnutls_protocol_mark_disabled.3
+APIMANS += gnutls_protocol_mark_enabled.3
APIMANS += gnutls_psk_allocate_client_credentials.3
APIMANS += gnutls_psk_allocate_server_credentials.3
APIMANS += gnutls_psk_client_get_hint.3
@@ -814,6 +820,8 @@
APIMANS += gnutls_sign_is_secure.3
APIMANS += gnutls_sign_is_secure2.3
APIMANS += gnutls_sign_list.3
+APIMANS += gnutls_sign_mark_insecure.3
+APIMANS += gnutls_sign_mark_secure.3
APIMANS += gnutls_sign_supports_pk_algorithm.3
APIMANS += gnutls_srp_allocate_client_credentials.3
APIMANS += gnutls_srp_allocate_server_credentials.3
diff -ruN gnutls-3.7.2/doc/manpages/Makefile.in gnutls-3.7.2-bootstrapped/doc/manpages/Makefile.in
--- gnutls-3.7.2/doc/manpages/Makefile.in 2021-05-29 10:11:21.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/Makefile.in 2021-06-28 09:11:38.000000000 +0200
@@ -2185,6 +2185,7 @@
gnutls_dh_params_init.3 gnutls_dh_set_prime_bits.3 \
gnutls_digest_get_id.3 gnutls_digest_get_name.3 \
gnutls_digest_get_oid.3 gnutls_digest_list.3 \
+ gnutls_digest_mark_insecure.3 gnutls_digest_mark_secure.3 \
gnutls_dtls_cookie_send.3 gnutls_dtls_cookie_verify.3 \
gnutls_dtls_get_data_mtu.3 gnutls_dtls_get_mtu.3 \
gnutls_dtls_get_timeout.3 gnutls_dtls_prestate_set.3 \
@@ -2194,6 +2195,8 @@
gnutls_ecc_curve_get_id.3 gnutls_ecc_curve_get_name.3 \
gnutls_ecc_curve_get_oid.3 gnutls_ecc_curve_get_pk.3 \
gnutls_ecc_curve_get_size.3 gnutls_ecc_curve_list.3 \
+ gnutls_ecc_curve_mark_disabled.3 \
+ gnutls_ecc_curve_mark_enabled.3 \
gnutls_encode_ber_digest_info.3 gnutls_encode_gost_rs_value.3 \
gnutls_encode_rs_value.3 gnutls_error_is_fatal.3 \
gnutls_error_to_alert.3 gnutls_est_record_overhead_size.3 \
@@ -2399,7 +2402,8 @@
gnutls_privkey_status.3 gnutls_privkey_verify_params.3 \
gnutls_privkey_verify_seed.3 gnutls_protocol_get_id.3 \
gnutls_protocol_get_name.3 gnutls_protocol_get_version.3 \
- gnutls_protocol_list.3 \
+ gnutls_protocol_list.3 gnutls_protocol_mark_disabled.3 \
+ gnutls_protocol_mark_enabled.3 \
gnutls_psk_allocate_client_credentials.3 \
gnutls_psk_allocate_server_credentials.3 \
gnutls_psk_client_get_hint.3 \
@@ -2498,6 +2502,7 @@
gnutls_sign_get_name.3 gnutls_sign_get_oid.3 \
gnutls_sign_get_pk_algorithm.3 gnutls_sign_is_secure.3 \
gnutls_sign_is_secure2.3 gnutls_sign_list.3 \
+ gnutls_sign_mark_insecure.3 gnutls_sign_mark_secure.3 \
gnutls_sign_supports_pk_algorithm.3 \
gnutls_srp_allocate_client_credentials.3 \
gnutls_srp_allocate_server_credentials.3 \
diff -ruN gnutls-3.7.2/doc/manpages/ocsptool.1 gnutls-3.7.2-bootstrapped/doc/manpages/ocsptool.1
--- gnutls-3.7.2/doc/manpages/ocsptool.1 2021-05-29 10:15:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/ocsptool.1 2021-06-28 09:35:23.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH ocsptool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH ocsptool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/p11tool.1 gnutls-3.7.2-bootstrapped/doc/manpages/p11tool.1
--- gnutls-3.7.2/doc/manpages/p11tool.1 2021-05-29 10:15:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/p11tool.1 2021-06-28 09:35:23.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH p11tool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH p11tool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
@@ -230,8 +230,9 @@
.NOP \f\*[B-Font]\-\-write\f[]
Writes the loaded objects to a PKCS #11 token.
.sp
-It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with
- one of \--load-privkey, \--load-pubkey, \--load-certificate option.
+It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with one of \--load-privkey, \--load-pubkey, \--load-certificate option.
+.sp
+When writing a certificate object, its CKA_ID is set to the same CKA_ID of the corresponding public key, if it exists on the token; otherwise it will be derived from the X.509 Subject Key Identifier of the certificate. If this behavior is undesired, write the public key to the token beforehand.
.TP
.NOP \f\*[B-Font]\-\-delete\f[]
Deletes the objects matching the given PKCS #11 URL.
diff -ruN gnutls-3.7.2/doc/manpages/psktool.1 gnutls-3.7.2-bootstrapped/doc/manpages/psktool.1
--- gnutls-3.7.2/doc/manpages/psktool.1 2021-05-29 10:15:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/psktool.1 2021-06-28 09:35:23.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH psktool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH psktool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/srptool.1 gnutls-3.7.2-bootstrapped/doc/manpages/srptool.1
--- gnutls-3.7.2/doc/manpages/srptool.1 2021-05-29 10:15:24.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/srptool.1 2021-06-28 09:35:24.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH srptool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH srptool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/manpages/tpmtool.1 gnutls-3.7.2-bootstrapped/doc/manpages/tpmtool.1
--- gnutls-3.7.2/doc/manpages/tpmtool.1 2021-05-29 10:15:23.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/tpmtool.1 2021-06-28 09:35:23.000000000 +0200
@@ -10,7 +10,7 @@
.ds B-Font B
.ds I-Font I
.ds R-Font R
-.TH tpmtool 1 "29 May 2021" "3.7.2" "User Commands"
+.TH tpmtool 1 "28 Jun 2021" "3.7.2" "User Commands"
.\"
.\" DO NOT EDIT THIS FILE (in-mem file)
.\"
diff -ruN gnutls-3.7.2/doc/reference/gnutls-sections.txt gnutls-3.7.2-bootstrapped/doc/reference/gnutls-sections.txt
--- gnutls-3.7.2/doc/reference/gnutls-sections.txt 2021-05-29 10:23:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/reference/gnutls-sections.txt 2021-06-28 09:56:37.000000000 +0200
@@ -267,6 +267,8 @@
encipher_type
GNUTLS_SIGN_FLAG_TLS13_OK
GNUTLS_SIGN_FLAG_CRT_VRFY_REVERSE
+GNUTLS_SIGN_FLAG_INSECURE_REVERTIBLE
+GNUTLS_SIGN_FLAG_ALLOW_INSECURE_REVERTIBLE
gnutls_sign_entry_st
gnutls_ecc_curve_entry_st
MAX_ECC_CURVE_SIZE
@@ -1486,6 +1488,14 @@
gnutls_sign_algorithm_get_requested
gnutls_cipher_get_name
gnutls_oid_to_digest
+gnutls_ecc_curve_mark_disabled
+gnutls_ecc_curve_mark_enabled
+gnutls_sign_mark_insecure
+gnutls_sign_mark_secure
+gnutls_digest_mark_insecure
+gnutls_digest_mark_secure
+gnutls_protocol_mark_disabled
+gnutls_protocol_mark_enabled
gnutls_error_is_fatal
gnutls_perror
gnutls_strerror
@@ -2268,6 +2278,8 @@
gnutls_group_entry_st
GNUTLS_MAC_FLAG_PREIMAGE_INSECURE
GNUTLS_MAC_FLAG_CONTINUOUS_MAC
+GNUTLS_MAC_FLAG_PREIMAGE_INSECURE_REVERTIBLE
+GNUTLS_MAC_FLAG_ALLOW_INSECURE_REVERTIBLE
mac_entry_st
version_entry_st
sign_algorithm_st
diff -ruN gnutls-3.7.2/lib/algorithms/ecc.c gnutls-3.7.2-bootstrapped/lib/algorithms/ecc.c
--- gnutls-3.7.2/lib/algorithms/ecc.c 2021-05-10 16:34:47.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/algorithms/ecc.c 2021-06-28 09:09:14.000000000 +0200
@@ -351,13 +351,83 @@
return ret;
}
-int _gnutls_ecc_curve_mark_disabled(const char *name)
+/* This is only called by cfg_apply in priority.c, in blocklisting mode. */
+int _gnutls_ecc_curve_mark_disabled(gnutls_ecc_curve_t curve)
{
gnutls_ecc_curve_entry_st *p;
for(p = ecc_curves; p->name != NULL; p++) {
- if (c_strcasecmp(p->name, name) == 0) {
- p->supported = 0;
+ if (p->id == curve) {
+ p->supported = false;
+ return 0;
+ }
+ }
+
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+}
+
+/* This is only called by cfg_apply in priority.c, in allowlisting mode. */
+void _gnutls_ecc_curve_mark_disabled_all(void)
+{
+ gnutls_ecc_curve_entry_st *p;
+
+ for(p = ecc_curves; p->name != NULL; p++) {
+ p->supported = false;
+ p->supported_revertible = true;
+ }
+}
+
+/**
+ * gnutls_ecc_curve_mark_enabled:
+ * @curve: is an ECC curve
+ *
+ * Mark @curve as disabled system wide. This setting can be reverted with
+ * gnutls_ecc_curve_mark_enabled(). This only works if the configuration file
+ * uses the allowlisting mode.
+ *
+ * Returns: 0 on success or negative error code otherwise.
+ *
+ * Since: 3.7.3
+ */
+int gnutls_ecc_curve_mark_disabled(gnutls_ecc_curve_t curve)
+{
+ gnutls_ecc_curve_entry_st *p;
+
+ for(p = ecc_curves; p->name != NULL; p++) {
+ if (p->id == curve) {
+ if (!p->supported_revertible) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ p->supported = false;
+ return 0;
+ }
+ }
+
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+}
+
+/**
+ * gnutls_ecc_curve_mark_enabled:
+ * @curve: is an ECC curve
+ *
+ * Invalidate previous system wide setting that marked @curve as disabled. This
+ * only works if the curve is disabled with gnutls_ecc_curve_mark_disabled() or
+ * through the allowlisting mode in the configuration file.
+ *
+ * Returns: 0 on success or negative error code otherwise.
+ *
+ * Since: 3.7.3
+ */
+int gnutls_ecc_curve_mark_enabled(gnutls_ecc_curve_t curve)
+{
+ gnutls_ecc_curve_entry_st *p;
+
+ for(p = ecc_curves; p->name != NULL; p++) {
+ if (p->id == curve) {
+ if (!p->supported_revertible) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ p->supported = true;
return 0;
}
}
diff -ruN gnutls-3.7.2/lib/algorithms/groups.c gnutls-3.7.2-bootstrapped/lib/algorithms/groups.c
--- gnutls-3.7.2/lib/algorithms/groups.c 2021-04-19 09:28:28.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/algorithms/groups.c 2021-06-28 09:09:14.000000000 +0200
@@ -276,6 +276,24 @@
return ret;
}
+
+/* Similar to gnutls_group_get_id, except that it does not check if
+ * the curve is supported.
+ */
+gnutls_group_t _gnutls_group_get_id(const char *name)
+{
+ gnutls_group_t ret = GNUTLS_GROUP_INVALID;
+
+ GNUTLS_GROUP_LOOP(
+ if (c_strcasecmp(p->name, name) == 0) {
+ ret = p->id;
+ break;
+ }
+ );
+
+ return ret;
+}
+
/**
* gnutls_group_get_name:
* @group: is an element from %gnutls_group_t
diff -ruN gnutls-3.7.2/lib/algorithms/mac.c gnutls-3.7.2-bootstrapped/lib/algorithms/mac.c
--- gnutls-3.7.2/lib/algorithms/mac.c 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/algorithms/mac.c 2021-06-28 09:09:14.000000000 +0200
@@ -291,13 +291,56 @@
return ret;
}
-int _gnutls_digest_mark_insecure(const char *name)
+/* This is only called by cfg_apply in priority.c, in blocklisting mode. */
+int _gnutls_digest_mark_insecure(gnutls_digest_algorithm_t dig)
{
#ifndef DISABLE_SYSTEM_CONFIG
mac_entry_st *p;
for(p = hash_algorithms; p->name != NULL; p++) {
- if (p->oid != NULL && c_strcasecmp(p->name, name) == 0) {
+ if (p->oid != NULL && p->id == (gnutls_mac_algorithm_t)dig) {
+ p->flags |= GNUTLS_MAC_FLAG_PREIMAGE_INSECURE;
+ return 0;
+ }
+ }
+
+#endif
+ return GNUTLS_E_INVALID_REQUEST;
+}
+
+/* This is only called by cfg_apply in priority.c, in allowlisting mode. */
+void _gnutls_digest_mark_insecure_all(void)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ mac_entry_st *p;
+
+ for(p = hash_algorithms; p->name != NULL; p++) {
+ p->flags |= GNUTLS_MAC_FLAG_PREIMAGE_INSECURE_REVERTIBLE |
+ GNUTLS_MAC_FLAG_PREIMAGE_INSECURE;
+ }
+
+#endif
+}
+
+/**
+ * gnutls_digest_mark_insecure:
+ * @dig: is a digest algorithm
+ *
+ * Mark @dig as insecure system wide. This only works if the allowlisting mode
+ * is used in the configuration file.
+ *
+ * Since: 3.7.3
+ */
+int gnutls_digest_mark_insecure(gnutls_digest_algorithm_t dig)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ mac_entry_st *p;
+
+ for(p = hash_algorithms; p->name != NULL; p++) {
+ if (p->oid != NULL && p->id == (gnutls_mac_algorithm_t)dig) {
+ if (!(p->flags & GNUTLS_MAC_FLAG_PREIMAGE_INSECURE_REVERTIBLE)) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
p->flags |= GNUTLS_MAC_FLAG_PREIMAGE_INSECURE;
return 0;
}
@@ -307,6 +350,34 @@
return GNUTLS_E_INVALID_REQUEST;
}
+/**
+ * gnutls_digest_mark_secure:
+ * @dig: is a digest algorithm
+ *
+ * Invalidate previous system wide setting that marked @dig as insecure. This
+ * only works if the allowlisting mode is used in the configuration file.
+ *
+ * Since: 3.7.3
+ */
+int gnutls_digest_mark_secure(gnutls_digest_algorithm_t dig)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ mac_entry_st *p;
+
+ for(p = hash_algorithms; p->name != NULL; p++) {
+ if (p->oid != NULL && p->id == (gnutls_mac_algorithm_t)dig) {
+ if (!(p->flags & GNUTLS_MAC_FLAG_PREIMAGE_INSECURE_REVERTIBLE)) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ p->flags &= ~GNUTLS_MAC_FLAG_PREIMAGE_INSECURE;
+ return 0;
+ }
+ }
+
+#endif
+ return GNUTLS_E_INVALID_REQUEST;
+}
+
unsigned _gnutls_digest_is_insecure(gnutls_digest_algorithm_t dig)
{
const mac_entry_st *p;
@@ -320,6 +391,21 @@
return 1;
}
+bool _gnutls_digest_is_insecure2(gnutls_digest_algorithm_t dig, unsigned flags)
+{
+ const mac_entry_st *p;
+
+ for(p = hash_algorithms; p->name != NULL; p++) {
+ if (p->oid != NULL && p->id == (gnutls_mac_algorithm_t)dig) {
+ return (p->flags & GNUTLS_MAC_FLAG_PREIMAGE_INSECURE &&
+ !(flags & GNUTLS_MAC_FLAG_ALLOW_INSECURE_REVERTIBLE &&
+ p->flags & GNUTLS_MAC_FLAG_PREIMAGE_INSECURE_REVERTIBLE));
+ }
+ }
+
+ return true;
+}
+
/**
* gnutls_mac_get_id:
* @name: is a MAC algorithm name
diff -ruN gnutls-3.7.2/lib/algorithms/protocols.c gnutls-3.7.2-bootstrapped/lib/algorithms/protocols.c
--- gnutls-3.7.2/lib/algorithms/protocols.c 2021-05-10 16:34:47.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/algorithms/protocols.c 2021-06-28 09:09:14.000000000 +0200
@@ -198,14 +198,82 @@
return 0;
}
-int _gnutls_version_mark_disabled(const char *name)
+/* This is only called by cfg_apply in priority.c, in blocklisting mode. */
+int _gnutls_version_mark_disabled(gnutls_protocol_t version)
{
#ifndef DISABLE_SYSTEM_CONFIG
version_entry_st *p;
for (p = sup_versions; p->name != NULL; p++)
- if (c_strcasecmp(p->name, name) == 0) {
- p->supported = 0;
+ if (p->id == version) {
+ p->supported = false;
+ return 0;
+ }
+
+#endif
+ return GNUTLS_E_INVALID_REQUEST;
+}
+
+/* This is only called by cfg_apply in priority.c, in allowlisting mode. */
+void _gnutls_version_mark_disabled_all(void)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ version_entry_st *p;
+
+ for (p = sup_versions; p->name != NULL; p++) {
+ p->supported = false;
+ p->supported_revertible = true;
+ }
+
+#endif
+}
+
+/**
+ * gnutls_protocol_mark_disabled:
+ * @version: is a (gnutls) version number
+ *
+ * Mark @version as disabled system wide. This only works if the allowlisting
+ * mode is used in the configuration file.
+ *
+ */
+int gnutls_protocol_mark_disabled(gnutls_protocol_t version)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ version_entry_st *p;
+
+ for (p = sup_versions; p->name != NULL; p++)
+ if (p->id == version) {
+ if (!p->supported_revertible) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ p->supported = false;
+ return 0;
+ }
+
+#endif
+ return GNUTLS_E_INVALID_REQUEST;
+}
+
+/**
+ * gnutls_protocol_mark_enabled:
+ * @version: is a (gnutls) version number
+ *
+ * Invalidate previous system wide setting that marked @version as
+ * disabled. This only works if the allowlisting mode is used in the
+ * configuration file.
+ *
+ */
+int gnutls_protocol_mark_enabled(gnutls_protocol_t version)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ version_entry_st *p;
+
+ for (p = sup_versions; p->name != NULL; p++)
+ if (p->id == version) {
+ if (!p->supported_revertible) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ p->supported = true;
return 0;
}
@@ -469,6 +537,25 @@
return supported_protocols;
}
+/* Return all versions, including non-supported ones.
+ */
+const gnutls_protocol_t *_gnutls_protocol_list(void)
+{
+ const version_entry_st *p;
+ static gnutls_protocol_t protocols[MAX_ALGOS] = { 0 };
+
+ if (protocols[0] == 0) {
+ int i = 0;
+
+ for (p = sup_versions; p->name != NULL; p++) {
+ protocols[i++] = p->id;
+ }
+ protocols[i++] = 0;
+ }
+
+ return protocols;
+}
+
/* Returns a version number given the major and minor numbers.
*/
gnutls_protocol_t _gnutls_version_get(uint8_t major, uint8_t minor)
diff -ruN gnutls-3.7.2/lib/algorithms/sign.c gnutls-3.7.2-bootstrapped/lib/algorithms/sign.c
--- gnutls-3.7.2/lib/algorithms/sign.c 2021-05-10 16:34:47.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/algorithms/sign.c 2021-06-28 09:09:14.000000000 +0200
@@ -453,16 +453,23 @@
bool _gnutls_sign_is_secure2(const gnutls_sign_entry_st *se, unsigned int flags)
{
- if (se->hash != GNUTLS_DIG_UNKNOWN && _gnutls_digest_is_insecure(se->hash))
- return gnutls_assert_val(0);
+ if (se->hash != GNUTLS_DIG_UNKNOWN &&
+ _gnutls_digest_is_insecure2(se->hash,
+ flags & GNUTLS_SIGN_FLAG_ALLOW_INSECURE_REVERTIBLE ?
+ GNUTLS_MAC_FLAG_ALLOW_INSECURE_REVERTIBLE :
+ 0)) {
+ return gnutls_assert_val(false);
+ }
- if (flags & GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS)
- return (se->slevel==_SECURE)?1:0;
- else
- return (se->slevel==_SECURE || se->slevel == _INSECURE_FOR_CERTS)?1:0;
+ return (flags & GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS ?
+ se->slevel == _SECURE :
+ (se->slevel == _SECURE || se->slevel == _INSECURE_FOR_CERTS)) ||
+ (flags & GNUTLS_SIGN_FLAG_ALLOW_INSECURE_REVERTIBLE &&
+ se->flags & GNUTLS_SIGN_FLAG_INSECURE_REVERTIBLE);
}
-int _gnutls_sign_mark_insecure(const char *name, hash_security_level_t level)
+/* This is only called by cfg_apply in priority.c, in blocklisting mode. */
+int _gnutls_sign_mark_insecure(gnutls_sign_algorithm_t sign, hash_security_level_t level)
{
#ifndef DISABLE_SYSTEM_CONFIG
gnutls_sign_entry_st *p;
@@ -471,11 +478,106 @@
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
for(p = sign_algorithms; p->name != NULL; p++) {
- if (c_strcasecmp(p->name, name) == 0) {
+ if (p->id && p->id == sign) {
+ if (p->slevel < level)
p->slevel = level;
return 0;
}
}
+#endif
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+}
+
+/* This is only called by cfg_apply in priority.c, in allowlisting mode. */
+void _gnutls_sign_mark_insecure_all(hash_security_level_t level)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ gnutls_sign_entry_st *p;
+
+ for(p = sign_algorithms; p->name != NULL; p++) {
+ if (p->slevel < level)
+ p->slevel = level;
+ p->flags |= GNUTLS_SIGN_FLAG_INSECURE_REVERTIBLE;
+ }
+#endif
+}
+
+/**
+ * gnutls_sign_mark_insecure:
+ * @sign: the sign algorithm
+ * @flags: %GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS or 0
+ *
+ * Mark @sign as insecure system wide. This only works if the
+ * allowlisting mode is used in the configuration file.
+ *
+ * If @flags has %GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS bit set,
+ * and the algorithm was previously considered secure for all purposes,
+ * it only marks the algorithm as insecure for the use with certificates.
+ *
+ * Since: 3.7.3
+ */
+int gnutls_sign_mark_insecure(gnutls_sign_algorithm_t sign, unsigned flags)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ gnutls_sign_entry_st *p;
+
+ for(p = sign_algorithms; p->name != NULL; p++) {
+ if (p->id && p->id == sign) {
+ if (!(p->flags & GNUTLS_SIGN_FLAG_INSECURE_REVERTIBLE)) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ if (flags & GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS) {
+ if (p->slevel < _INSECURE_FOR_CERTS)
+ p->slevel = _INSECURE_FOR_CERTS;
+ } else {
+ p->slevel = _INSECURE;
+ }
+ return 0;
+ }
+ }
+#endif
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+}
+// TODO: really not sure about the intuitiveness of the interface of this one,
+// the flag naming isn't ideal here
+
+/**
+ * gnutls_sign_mark_secure:
+ * @sign: the sign algorithm
+ * @flags: %GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS or 0
+ *
+ * Invalidate previous system wide setting that marked @sign as
+ * insecure. This only works if the algorithm is marked as insecure
+ * with gnutls_sign_mark_insecure() or through the allowlisting mode
+ * in the configuration file.
+ *
+ * If @flags has %GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS bit set,
+ * it marks it the algorithm as secure for all purposes.
+ * If the absence of this flag, it will mark it as
+ * "secure, but not for certificates" at most,
+ * but it won't restrict anything either.
+ *
+ * Since: 3.7.3
+ */
+int gnutls_sign_mark_secure(gnutls_sign_algorithm_t sign, unsigned flags)
+{
+#ifndef DISABLE_SYSTEM_CONFIG
+ gnutls_sign_entry_st *p;
+
+ for(p = sign_algorithms; p->name != NULL; p++) {
+ if (p->id && p->id == sign) {
+ if (!(p->flags & GNUTLS_SIGN_FLAG_INSECURE_REVERTIBLE)) {
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ }
+ if (flags & GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS) {
+ p->slevel = _SECURE;
+ } else {
+ if (p->slevel > _INSECURE_FOR_CERTS)
+ p->slevel = _INSECURE_FOR_CERTS;
+ }
+ return 0;
+ }
+ }
#endif
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
}
diff -ruN gnutls-3.7.2/lib/algorithms.h gnutls-3.7.2-bootstrapped/lib/algorithms.h
--- gnutls-3.7.2/lib/algorithms.h 2021-05-10 16:34:47.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/algorithms.h 2021-06-28 09:09:14.000000000 +0200
@@ -345,15 +345,27 @@
_INSECURE
} hash_security_level_t;
-int _gnutls_ecc_curve_mark_disabled(const char *name);
-int _gnutls_sign_mark_insecure(const char *name, hash_security_level_t);
-int _gnutls_digest_mark_insecure(const char *name);
+int _gnutls_ecc_curve_mark_disabled(gnutls_ecc_curve_t curve);
+int _gnutls_sign_mark_insecure(gnutls_sign_algorithm_t, hash_security_level_t);
+int _gnutls_digest_mark_insecure(gnutls_digest_algorithm_t dig);
unsigned _gnutls_digest_is_insecure(gnutls_digest_algorithm_t dig);
-int _gnutls_version_mark_disabled(const char *name);
+bool _gnutls_digest_is_insecure2(gnutls_digest_algorithm_t dig, unsigned flags);
+const gnutls_protocol_t *_gnutls_protocol_list(void);
+int _gnutls_version_mark_disabled(gnutls_protocol_t version);
gnutls_protocol_t _gnutls_protocol_get_id_if_supported(const char *name);
+/* these functions are for revertible settings, meaning that algorithms marked
+ * as disabled/insecure with mark_*_all functions can be re-enabled with
+ * mark_{enabled,secure} functions */
+void _gnutls_ecc_curve_mark_disabled_all(void);
+void _gnutls_sign_mark_insecure_all(hash_security_level_t level);
+void _gnutls_digest_mark_insecure_all(void);
+void _gnutls_version_mark_disabled_all(void);
+
#define GNUTLS_SIGN_FLAG_TLS13_OK 1 /* if it is ok to use under TLS1.3 */
#define GNUTLS_SIGN_FLAG_CRT_VRFY_REVERSE (1 << 1) /* reverse order of bytes in CrtVrfy signature */
+#define GNUTLS_SIGN_FLAG_INSECURE_REVERTIBLE (1 << 2)
+#define GNUTLS_SIGN_FLAG_ALLOW_INSECURE_REVERTIBLE (1 << 3)
struct gnutls_sign_entry_st {
const char *name;
const char *oid;
@@ -448,6 +460,7 @@
unsigned sig_size; /* the size of curve signatures in bytes (EdDSA) */
unsigned gost_curve;
bool supported;
+ bool supported_revertible;
gnutls_group_t group;
} gnutls_ecc_curve_entry_st;
@@ -459,6 +472,7 @@
gnutls_group_t _gnutls_ecc_curve_get_group(gnutls_ecc_curve_t);
const gnutls_group_entry_st *_gnutls_tls_id_to_group(unsigned num);
const gnutls_group_entry_st * _gnutls_id_to_group(unsigned id);
+gnutls_group_t _gnutls_group_get_id(const char *name);
gnutls_ecc_curve_t _gnutls_ecc_bits_to_curve(gnutls_pk_algorithm_t pk, int bits);
#define MAX_ECC_CURVE_SIZE 66
diff -ruN gnutls-3.7.2/lib/gnutls_int.h gnutls-3.7.2-bootstrapped/lib/gnutls_int.h
--- gnutls-3.7.2/lib/gnutls_int.h 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/gnutls_int.h 2021-06-28 09:09:14.000000000 +0200
@@ -662,6 +662,8 @@
#define GNUTLS_MAC_FLAG_PREIMAGE_INSECURE 1 /* if this algorithm should not be trusted for pre-image attacks */
#define GNUTLS_MAC_FLAG_CONTINUOUS_MAC (1 << 1) /* if this MAC should be used in a 'continuous' way in TLS */
+#define GNUTLS_MAC_FLAG_PREIMAGE_INSECURE_REVERTIBLE (1 << 2) /* if this algorithm should not be trusted for pre-image attacks, but can be enabled through API */
+#define GNUTLS_MAC_FLAG_ALLOW_INSECURE_REVERTIBLE (1 << 3) /* when checking with _gnutls_digest_is_insecure2, don't treat revertible setting as fatal */
/* This structure is used both for MACs and digests
*/
typedef struct mac_entry_st {
@@ -685,6 +687,7 @@
uint8_t minor; /* defined by the protocol */
transport_t transport; /* Type of transport, stream or datagram */
bool supported; /* 0 not supported, > 0 is supported */
+ bool supported_revertible;
bool explicit_iv;
bool extensions; /* whether it supports extensions */
bool selectable_sighash; /* whether signatures can be selected */
diff -ruN gnutls-3.7.2/lib/includes/gnutls/gnutls.h.in gnutls-3.7.2-bootstrapped/lib/includes/gnutls/gnutls.h.in
--- gnutls-3.7.2/lib/includes/gnutls/gnutls.h.in 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/includes/gnutls/gnutls.h.in 2021-06-28 09:09:14.000000000 +0200
@@ -1438,6 +1438,16 @@
gnutls_mac_algorithm_t * mac,
gnutls_protocol_t * min_version);
+ /* functions for run-time enablement of algorithms */
+int gnutls_ecc_curve_mark_disabled(gnutls_ecc_curve_t curve);
+int gnutls_ecc_curve_mark_enabled(gnutls_ecc_curve_t curve);
+int gnutls_sign_mark_insecure(gnutls_sign_algorithm_t sign, unsigned flags);
+int gnutls_sign_mark_secure(gnutls_sign_algorithm_t sign, unsigned flags);
+int gnutls_digest_mark_insecure(gnutls_digest_algorithm_t dig);
+int gnutls_digest_mark_secure(gnutls_digest_algorithm_t dig);
+int gnutls_protocol_mark_disabled(gnutls_protocol_t version);
+int gnutls_protocol_mark_enabled(gnutls_protocol_t version);
+
/* error functions */
int gnutls_error_is_fatal(int error) __GNUTLS_CONST__;
int gnutls_error_to_alert(int err, int *level);
diff -ruN gnutls-3.7.2/lib/libgnutls.map gnutls-3.7.2-bootstrapped/lib/libgnutls.map
--- gnutls-3.7.2/lib/libgnutls.map 2021-05-29 07:16:27.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/libgnutls.map 2021-06-28 09:09:14.000000000 +0200
@@ -1355,6 +1355,21 @@
*;
} GNUTLS_3_7_0;
+GNUTLS_3_7_3
+{
+ global:
+ gnutls_ecc_curve_mark_disabled;
+ gnutls_ecc_curve_mark_enabled;
+ gnutls_sign_mark_insecure;
+ gnutls_sign_mark_secure;
+ gnutls_digest_mark_insecure;
+ gnutls_digest_mark_secure;
+ gnutls_protocol_mark_disabled;
+ gnutls_protocol_mark_enabled;
+ local:
+ *;
+} GNUTLS_3_7_2;
+
GNUTLS_FIPS140_3_4 {
global:
gnutls_cipher_self_test;
diff -ruN gnutls-3.7.2/lib/priority.c gnutls-3.7.2-bootstrapped/lib/priority.c
--- gnutls-3.7.2/lib/priority.c 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/lib/priority.c 2021-06-28 09:09:14.000000000 +0200
@@ -700,6 +700,7 @@
#define LEVEL_SUITEB128 "SUITEB128"
#define LEVEL_SUITEB192 "SUITEB192"
#define LEVEL_LEGACY "LEGACY"
+#define LEVEL_SYSTEM "SYSTEM"
struct priority_groups_st {
const char *name;
@@ -1001,17 +1002,22 @@
static gnutls_certificate_verification_profiles_t system_wide_verification_profile = GNUTLS_PROFILE_UNKNOWN;
static name_val_array_t system_wide_priority_strings = NULL;
+static char *system_wide_priority_string = NULL;
static unsigned system_wide_priority_strings_init = 0;
static unsigned system_wide_default_priority_string = 0;
static unsigned fail_on_invalid_config = 0;
-static unsigned system_wide_disabled_ciphers[MAX_ALGOS+1] = {0};
-static unsigned system_wide_disabled_macs[MAX_ALGOS+1] = {0};
-static unsigned system_wide_disabled_groups[MAX_ALGOS+1] = {0};
-static unsigned system_wide_disabled_kxs[MAX_ALGOS+1] = {0};
+static bool system_wide_allowlisting;
+static unsigned system_wide_tls_ciphers[MAX_ALGOS+1] = {0};
+static unsigned system_wide_tls_macs[MAX_ALGOS+1] = {0};
+static unsigned system_wide_tls_groups[MAX_ALGOS+1] = {0};
+static unsigned system_wide_tls_kxs[MAX_ALGOS+1] = {0};
+static unsigned system_wide_tls_sigs[MAX_ALGOS+1] = {0};
+static unsigned system_wide_tls_vers[MAX_ALGOS+1] = {0};
static const char *system_priority_file = SYSTEM_PRIORITY_FILE;
static time_t system_priority_last_mod = 0;
+#define GLOBAL_SECTION "global"
#define CUSTOM_PRIORITY_SECTION "priorities"
#define OVERRIDES_SECTION "overrides"
#define MAX_ALGO_NAME 2048
@@ -1051,108 +1057,479 @@
return out;
}
-/* This function parses a gnutls configuration file and updates internal
- * settings accordingly.
+struct cfg {
+ bool allowlisting;
+
+ name_val_array_t priority_strings;
+ bool priority_strings_init;
+ char *default_priority_string;
+ gnutls_certificate_verification_profiles_t verification_profile;
+
+ gnutls_cipher_algorithm_t ciphers[MAX_ALGOS+1];
+ gnutls_mac_algorithm_t macs[MAX_ALGOS+1];
+ gnutls_group_t groups[MAX_ALGOS+1];
+ gnutls_kx_algorithm_t kxs[MAX_ALGOS+1];
+
+ gnutls_digest_algorithm_t *hashes;
+ size_t hashes_size;
+ gnutls_sign_algorithm_t *sigs;
+ size_t sigs_size;
+ gnutls_sign_algorithm_t *sigs_for_cert;
+ size_t sigs_for_cert_size;
+ gnutls_protocol_t *versions;
+ size_t versions_size;
+ gnutls_ecc_curve_t *curves;
+ size_t curves_size;
+};
+
+static inline void
+cfg_deinit(struct cfg *cfg)
+{
+ if (cfg->priority_strings) {
+ _name_val_array_clear(&cfg->priority_strings);
+ }
+ cfg->priority_strings_init = false;
+ gnutls_free(cfg->default_priority_string);
+ gnutls_free(cfg->hashes);
+ gnutls_free(cfg->sigs);
+ gnutls_free(cfg->sigs_for_cert);
+ gnutls_free(cfg->versions);
+ gnutls_free(cfg->curves);
+}
+
+static inline int
+cfg_apply(struct cfg *cfg)
+{
+ size_t i;
+
+ system_wide_verification_profile = cfg->verification_profile;
+
+ if (cfg->priority_strings_init) {
+ system_wide_priority_strings = cfg->priority_strings;
+ cfg->priority_strings = NULL;
+ cfg->priority_strings_init = false;
+ system_wide_priority_strings_init = 1;
+ }
+
+ if (cfg->default_priority_string) {
+ _clear_default_system_priority();
+ _gnutls_default_priority_string = cfg->default_priority_string;
+ cfg->default_priority_string = NULL;
+ system_wide_default_priority_string = 1;
+ }
+
+ system_wide_allowlisting = cfg->allowlisting;
+ memcpy(system_wide_tls_ciphers, cfg->ciphers, sizeof(cfg->ciphers));
+ memcpy(system_wide_tls_macs, cfg->macs, sizeof(cfg->macs));
+ memcpy(system_wide_tls_groups, cfg->groups, sizeof(cfg->groups));
+ memcpy(system_wide_tls_kxs, cfg->kxs, sizeof(cfg->kxs));
+
+ if (cfg->allowlisting) {
+ unsigned tls_sig_sem = 0;
+ size_t j;
+
+ _gnutls_digest_mark_insecure_all();
+ for (i = 0; i < cfg->hashes_size; i++) {
+ int ret = gnutls_digest_mark_secure(cfg->hashes[i]);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ _gnutls_sign_mark_insecure_all(_INSECURE);
+ for (i = 0; i < cfg->sigs_size; i++) {
+ int ret = gnutls_sign_mark_secure(cfg->sigs[i], 0);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ for (i = 0; i < cfg->sigs_for_cert_size; i++) {
+ int ret = gnutls_sign_mark_secure(cfg->sigs_for_cert[i],
+ GNUTLS_SIGN_FLAG_SECURE_FOR_CERTS);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ _gnutls_version_mark_disabled_all();
+ for (i = 0, j = 0; i < cfg->versions_size; i++) {
+ const version_entry_st *vers;
+ int ret = gnutls_protocol_mark_enabled(cfg->versions[i]);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ vers = version_to_entry(cfg->versions[i]);
+ if (vers && vers->supported) {
+ tls_sig_sem |= vers->tls_sig_sem;
+ system_wide_tls_vers[j++] = vers->id;
+ }
+ }
+ _gnutls_ecc_curve_mark_disabled_all();
+ for (i = 0; i < cfg->curves_size; i++) {
+ int ret = gnutls_ecc_curve_mark_enabled(cfg->curves[i]);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ for (i = 0, j = 0; i < cfg->sigs_size; i++) {
+ const gnutls_sign_entry_st *se;
+
+ se = _gnutls_sign_to_entry(cfg->sigs[i]);
+ if (se != NULL && se->aid.tls_sem & tls_sig_sem &&
+ _gnutls_sign_is_secure2(se, 0)) {
+ system_wide_tls_sigs[j++] = se->id;
+ }
+ }
+ } else {
+ for (i = 0; i < cfg->hashes_size; i++) {
+ int ret = _gnutls_digest_mark_insecure(cfg->hashes[i]);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ for (i = 0; i < cfg->sigs_size; i++) {
+ int ret = _gnutls_sign_mark_insecure(cfg->sigs[i], _INSECURE);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ for (i = 0; i < cfg->sigs_for_cert_size; i++) {
+ int ret = _gnutls_sign_mark_insecure(cfg->sigs_for_cert[i], _INSECURE_FOR_CERTS);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ for (i = 0; i < cfg->versions_size; i++) {
+ int ret = _gnutls_version_mark_disabled(cfg->versions[i]);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ for (i = 0; i < cfg->curves_size; i++) {
+ int ret = _gnutls_ecc_curve_mark_disabled(cfg->curves[i]);
+ if (unlikely(ret < 0)) {
+ return ret;
+ }
+ }
+ }
+
+ return 0;
+}
+
+/* This function parse the global section of the configuration file.
+ */
+static int global_ini_handler(void *ctx, const char *section, const char *name, const char *value)
+{
+ char *p;
+ char str[MAX_ALGO_NAME];
+ struct cfg *cfg = ctx;
+
+ if (section != NULL && c_strcasecmp(section, GLOBAL_SECTION) == 0) {
+ if (c_strcasecmp(name, "override-mode") == 0) {
+ p = clear_spaces(value, str);
+ if (c_strcasecmp(value, "allowlist") == 0) {
+ cfg->allowlisting = true;
+ } else if (c_strcasecmp(value, "blocklist") == 0) {
+ cfg->allowlisting = false;
+ } else {
+ _gnutls_debug_log("cfg: unknown override mode %s\n",
+ p);
+ if (fail_on_invalid_config)
+ return 0;
+ }
+ } else {
+ _gnutls_debug_log("unknown parameter %s\n", name);
+ if (fail_on_invalid_config)
+ return 0;
+ }
+ }
+
+ return 1;
+}
+
+static bool
+override_allowed(struct cfg *cfg, const char *name)
+{
+ static const struct {
+ const char *allowlist_name;
+ const char *blocklist_name;
+ } names[] = {
+ { "secure-hash", "insecure-hash" },
+ { "secure-sig", "insecure-sig" },
+ { "secure-sig-for-cert", "insecure-sig-for-cert" },
+ { "enabled-version", "disabled-version" },
+ { "enabled-curve", "disabled-curve" },
+ { "tls-enabled-cipher", "tls-disabled-cipher" },
+ { "tls-enabled-group", "tls-disabled-group" },
+ { "tls-enabled-kx", "tls-disabled-kx" },
+ { "tls-enabled-mac", "tls-disabled-mac" }
+ };
+ size_t i;
+
+ for (i = 0; i < sizeof(names) / sizeof(names[0]); i++) {
+ if (c_strcasecmp(name,
+ cfg->allowlisting ?
+ names[i].blocklist_name :
+ names[i].allowlist_name) == 0)
+ return false;
+ }
+
+ return true;
+}
+
+/* This function parses a gnutls configuration file. Updating internal settings
+ * according to the parsed configuration is done by cfg_apply.
*/
-static int cfg_ini_handler(void *_ctx, const char *section, const char *name, const char *value)
+static int cfg_ini_handler(void *ctx, const char *section, const char *name, const char *value)
{
char *p;
- int ret, type;
+ int ret;
unsigned i;
char str[MAX_ALGO_NAME];
+ struct cfg *cfg = ctx;
/* Note that we intentionally overwrite the value above; inih does
* not use that value after we handle it. */
/* Parse sections */
if (section == NULL || section[0] == 0 || c_strcasecmp(section, CUSTOM_PRIORITY_SECTION)==0) {
- if (system_wide_priority_strings_init == 0) {
- _name_val_array_init(&system_wide_priority_strings);
- system_wide_priority_strings_init = 1;
+ if (!cfg->priority_strings_init) {
+ _name_val_array_init(&cfg->priority_strings);
+ cfg->priority_strings_init = true;
}
_gnutls_debug_log("cfg: adding priority: %s -> %s\n", name, value);
- ret = _name_val_array_append(&system_wide_priority_strings, name, value);
+ ret = _name_val_array_append(&cfg->priority_strings, name, value);
if (ret < 0)
return 0;
} else if (c_strcasecmp(section, OVERRIDES_SECTION)==0) {
- if (c_strcasecmp(name, "default-priority-string")==0) {
- _clear_default_system_priority();
+ if (!override_allowed(cfg, name)) {
+ _gnutls_debug_log("cfg: %s is not allowed in this mode\n",
+ name);
+ if (fail_on_invalid_config)
+ return 0;
+ } else if (c_strcasecmp(name, "default-priority-string")==0) {
+ if (cfg->default_priority_string) {
+ gnutls_free(cfg->default_priority_string);
+ cfg->default_priority_string = NULL;
+ }
p = clear_spaces(value, str);
_gnutls_debug_log("cfg: setting default-priority-string to %s\n", p);
if (strlen(p) > 0) {
- _gnutls_default_priority_string = gnutls_strdup(p);
- if (!_gnutls_default_priority_string) {
- _gnutls_default_priority_string = DEFAULT_PRIORITY_STRING;
+ cfg->default_priority_string = gnutls_strdup(p);
+ if (!cfg->default_priority_string) {
_gnutls_debug_log("cfg: failed setting default-priority-string\n");
return 0;
}
- system_wide_default_priority_string = 1;
} else {
_gnutls_debug_log("cfg: empty default-priority-string, using default\n");
if (fail_on_invalid_config)
return 0;
}
- } else if (c_strcasecmp(name, "insecure-hash")==0) {
+ } else if (c_strcasecmp(name, "insecure-hash") == 0 ||
+ c_strcasecmp(name, "secure-hash") == 0) {
+ gnutls_digest_algorithm_t dig, *tmp;
+
p = clear_spaces(value, str);
- _gnutls_debug_log("cfg: marking hash %s as insecure\n",
- p);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: marking hash %s as secure\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: marking hash %s as insecure\n",
+ p);
+ }
- ret = _gnutls_digest_mark_insecure(p);
- if (ret < 0) {
+ dig = gnutls_digest_get_id(p);
+ if (dig == GNUTLS_DIG_UNKNOWN) {
_gnutls_debug_log("cfg: found unknown hash %s in %s\n",
p, name);
if (fail_on_invalid_config)
return 0;
+ goto exit;
+ }
+ tmp = _gnutls_reallocarray(cfg->hashes,
+ cfg->hashes_size + 1,
+ sizeof(gnutls_digest_algorithm_t));
+ if (!tmp) {
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: failed marking hash %s as secure\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: failed marking hash %s as insecure\n",
+ p);
+ }
+ if (fail_on_invalid_config)
+ return 0;
+ goto exit;
}
- } else if (c_strcasecmp(name, "insecure-sig")==0 || c_strcasecmp(name, "insecure-sig-for-cert")==0) {
+
+ cfg->hashes = tmp;
+ cfg->hashes[cfg->hashes_size] = dig;
+ cfg->hashes_size++;
+ } else if (c_strcasecmp(name, "insecure-sig") == 0 ||
+ c_strcasecmp(name, "secure-sig") == 0) {
+ gnutls_sign_algorithm_t sig, *tmp;
+
p = clear_spaces(value, str);
- if (c_strcasecmp(name, "insecure-sig")==0) {
- type = _INSECURE;
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: marking signature %s as secure\n",
+ p);
+ } else {
_gnutls_debug_log("cfg: marking signature %s as insecure\n",
p);
+ }
+
+ sig = gnutls_sign_get_id(p);
+ if (sig == GNUTLS_SIGN_UNKNOWN) {
+ _gnutls_debug_log("cfg: found unknown signature algorithm %s in %s\n",
+ p, name);
+ if (fail_on_invalid_config)
+ return 0;
+ goto exit;
+ }
+ tmp = _gnutls_reallocarray(cfg->sigs,
+ cfg->sigs_size + 1,
+ sizeof(gnutls_sign_algorithm_t));
+ if (!tmp) {
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: failed marking signature %s as secure\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: failed marking signature %s as insecure\n",
+ p);
+ }
+ if (fail_on_invalid_config)
+ return 0;
+ goto exit;
+ }
+
+ cfg->sigs = tmp;
+ cfg->sigs[cfg->sigs_size] = sig;
+ cfg->sigs_size++;
+ } else if (c_strcasecmp(name, "insecure-sig-for-cert") == 0 ||
+ c_strcasecmp(name, "secure-sig-for-cert") == 0) {
+ gnutls_sign_algorithm_t sig, *tmp;
+
+ p = clear_spaces(value, str);
+
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: marking signature %s as secure for certs\n",
+ p);
} else {
_gnutls_debug_log("cfg: marking signature %s as insecure for certs\n",
p);
- type = _INSECURE_FOR_CERTS;
}
- ret = _gnutls_sign_mark_insecure(p, type);
- if (ret < 0) {
+ sig = gnutls_sign_get_id(p);
+ if (sig == GNUTLS_SIGN_UNKNOWN) {
_gnutls_debug_log("cfg: found unknown signature algorithm %s in %s\n",
p, name);
if (fail_on_invalid_config)
return 0;
+ goto exit;
+ }
+ tmp = _gnutls_reallocarray(cfg->sigs_for_cert,
+ cfg->sigs_for_cert_size + 1,
+ sizeof(gnutls_sign_algorithm_t));
+ if (!tmp) {
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: failed marking signature %s as secure for certs\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: failed marking signature %s as insecure for certs\n",
+ p);
+ }
+ if (fail_on_invalid_config)
+ return 0;
+ goto exit;
}
- } else if (c_strcasecmp(name, "disabled-version")==0) {
+
+ cfg->sigs_for_cert = tmp;
+ cfg->sigs_for_cert[cfg->sigs_for_cert_size] = sig;
+ cfg->sigs_for_cert_size++;
+ } else if (c_strcasecmp(name, "disabled-version") == 0 ||
+ c_strcasecmp(name, "enabled-version") == 0) {
+ gnutls_protocol_t prot, *tmp;
+
p = clear_spaces(value, str);
- _gnutls_debug_log("cfg: disabling version %s\n",
- p);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: enabling version %s\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: disabling version %s\n",
+ p);
+ }
- ret = _gnutls_version_mark_disabled(p);
- if (ret < 0) {
+ prot = gnutls_protocol_get_id(p);
+ if (prot == GNUTLS_VERSION_UNKNOWN) {
_gnutls_debug_log("cfg: found unknown version %s in %s\n",
p, name);
if (fail_on_invalid_config)
return 0;
+ goto exit;
}
- } else if (c_strcasecmp(name, "disabled-curve")==0) {
+ tmp = _gnutls_reallocarray(cfg->versions,
+ cfg->versions_size + 1,
+ sizeof(gnutls_protocol_t));
+ if (!tmp) {
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: failed enabling version %s\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: failed disabling version %s\n",
+ p);
+ }
+ if (fail_on_invalid_config)
+ return 0;
+ goto exit;
+ }
+
+ cfg->versions = tmp;
+ cfg->versions[cfg->versions_size] = prot;
+ cfg->versions_size++;
+ } else if (c_strcasecmp(name, "disabled-curve") == 0 ||
+ c_strcasecmp(name, "enabled-curve") == 0) {
+ gnutls_ecc_curve_t curve, *tmp;
+
p = clear_spaces(value, str);
- _gnutls_debug_log("cfg: disabling curve %s\n",
- p);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: enabling curve %s\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: disabling curve %s\n",
+ p);
+ }
- ret = _gnutls_ecc_curve_mark_disabled(p);
- if (ret < 0) {
+ curve = gnutls_ecc_curve_get_id(p);
+ if (curve == GNUTLS_ECC_CURVE_INVALID) {
_gnutls_debug_log("cfg: found unknown curve %s in %s\n",
p, name);
if (fail_on_invalid_config)
return 0;
+ goto exit;
+ }
+ tmp = _gnutls_reallocarray(cfg->curves,
+ cfg->curves_size + 1,
+ sizeof(gnutls_ecc_curve_t));
+ if (!tmp) {
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: failed enabling curve %s\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: failed disabling curve %s\n",
+ p);
+ }
+ if (fail_on_invalid_config)
+ return 0;
+ goto exit;
}
+
+ cfg->curves = tmp;
+ cfg->curves[cfg->curves_size] = curve;
+ cfg->curves_size++;
} else if (c_strcasecmp(name, "min-verification-profile")==0) {
gnutls_certificate_verification_profiles_t profile;
profile = gnutls_certificate_verification_profile_get_id(value);
@@ -1162,47 +1539,65 @@
value, name);
if (fail_on_invalid_config)
return 0;
+ goto exit;
}
- system_wide_verification_profile = profile;
- } else if (c_strcasecmp(name, "tls-disabled-cipher")==0) {
- unsigned algo;
+ cfg->verification_profile = profile;
+ } else if (c_strcasecmp(name, "tls-disabled-cipher") == 0 ||
+ c_strcasecmp(name, "tls-enabled-cipher") == 0) {
+ gnutls_cipher_algorithm_t algo;
p = clear_spaces(value, str);
- _gnutls_debug_log("cfg: disabling cipher %s for TLS\n",
- p);
-
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: enabling cipher %s for TLS\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: disabling cipher %s for TLS\n",
+ p);
+ }
algo = gnutls_cipher_get_id(p);
- if (algo == 0) {
+ if (algo == GNUTLS_CIPHER_UNKNOWN) {
_gnutls_debug_log("cfg: unknown algorithm %s listed at %s\n",
p, name);
if (fail_on_invalid_config)
return 0;
+ goto exit;
}
i = 0;
- while (system_wide_disabled_ciphers[i] != 0)
+ while (cfg->ciphers[i] != 0)
i++;
if (i > MAX_ALGOS-1) {
- _gnutls_debug_log("cfg: too many (%d) disabled ciphers from %s\n",
- i, name);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: too many (%d) enabled ciphers from %s\n",
+ i, name);
+ } else {
+ _gnutls_debug_log("cfg: too many (%d) disabled ciphers from %s\n",
+ i, name);
+ }
if (fail_on_invalid_config)
return 0;
goto exit;
}
- system_wide_disabled_ciphers[i] = algo;
- system_wide_disabled_ciphers[i+1] = 0;
+ cfg->ciphers[i] = algo;
+ cfg->ciphers[i+1] = 0;
- } else if (c_strcasecmp(name, "tls-disabled-mac")==0) {
- unsigned algo;
+ } else if (c_strcasecmp(name, "tls-disabled-mac") == 0 ||
+ c_strcasecmp(name, "tls-enabled-mac") == 0) {
+ gnutls_mac_algorithm_t algo;
p = clear_spaces(value, str);
- _gnutls_debug_log("cfg: disabling MAC %s for TLS\n",
- p);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: enabling MAC %s for TLS\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: disabling MAC %s for TLS\n",
+ p);
+ }
algo = gnutls_mac_get_id(p);
if (algo == 0) {
@@ -1214,30 +1609,41 @@
}
i = 0;
- while (system_wide_disabled_macs[i] != 0)
+ while (cfg->macs[i] != 0)
i++;
if (i > MAX_ALGOS-1) {
- _gnutls_debug_log("cfg: too many (%d) disabled MACs from %s\n",
- i, name);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: too many (%d) enabled MACs from %s\n",
+ i, name);
+ } else {
+ _gnutls_debug_log("cfg: too many (%d) disabled MACs from %s\n",
+ i, name);
+ }
if (fail_on_invalid_config)
return 0;
goto exit;
}
- system_wide_disabled_macs[i] = algo;
- system_wide_disabled_macs[i+1] = 0;
- } else if (c_strcasecmp(name, "tls-disabled-group")==0) {
- unsigned algo;
+ cfg->macs[i] = algo;
+ cfg->macs[i+1] = 0;
+ } else if (c_strcasecmp(name, "tls-disabled-group") == 0 ||
+ c_strcasecmp(name, "tls-enabled-group") == 0) {
+ gnutls_group_t algo;
p = clear_spaces(value, str);
- if (strlen(p) > 6)
- p += 6; // skip GROUP-
+ if (c_strncasecmp(p, "GROUP-", 6) == 0)
+ p += 6;
- _gnutls_debug_log("cfg: disabling group %s for TLS\n",
- p);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: enabling group %s for TLS\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: disabling group %s for TLS\n",
+ p);
+ }
- algo = gnutls_group_get_id(p);
+ algo = _gnutls_group_get_id(p);
if (algo == 0) {
_gnutls_debug_log("cfg: unknown group %s listed at %s\n",
p, name);
@@ -1247,25 +1653,36 @@
}
i = 0;
- while (system_wide_disabled_groups[i] != 0)
+ while (cfg->groups[i] != 0)
i++;
if (i > MAX_ALGOS-1) {
- _gnutls_debug_log("cfg: too many (%d) disabled groups from %s\n",
- i, name);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: too many (%d) enabled groups from %s\n",
+ i, name);
+ } else {
+ _gnutls_debug_log("cfg: too many (%d) disabled groups from %s\n",
+ i, name);
+ }
if (fail_on_invalid_config)
return 0;
goto exit;
}
- system_wide_disabled_groups[i] = algo;
- system_wide_disabled_groups[i+1] = 0;
- } else if (c_strcasecmp(name, "tls-disabled-kx")==0) {
+ cfg->groups[i] = algo;
+ cfg->groups[i+1] = 0;
+ } else if (c_strcasecmp(name, "tls-disabled-kx") == 0 ||
+ c_strcasecmp(name, "tls-enabled-kx") == 0) {
unsigned algo;
p = clear_spaces(value, str);
- _gnutls_debug_log("cfg: disabling key exchange %s for TLS\n",
- p);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: enabling key exchange %s for TLS\n",
+ p);
+ } else {
+ _gnutls_debug_log("cfg: disabling key exchange %s for TLS\n",
+ p);
+ }
algo = gnutls_kx_get_id(p);
if (algo == 0) {
@@ -1277,24 +1694,29 @@
}
i = 0;
- while (system_wide_disabled_kxs[i] != 0)
+ while (cfg->kxs[i] != 0)
i++;
if (i > MAX_ALGOS-1) {
- _gnutls_debug_log("cfg: too many (%d) disabled key exchanges from %s\n",
- i, name);
+ if (cfg->allowlisting) {
+ _gnutls_debug_log("cfg: too many (%d) enabled key exchanges from %s\n",
+ i, name);
+ } else {
+ _gnutls_debug_log("cfg: too many (%d) disabled key exchanges from %s\n",
+ i, name);
+ }
if (fail_on_invalid_config)
return 0;
goto exit;
}
- system_wide_disabled_kxs[i] = algo;
- system_wide_disabled_kxs[i+1] = 0;
+ cfg->kxs[i] = algo;
+ cfg->kxs[i+1] = 0;
} else {
_gnutls_debug_log("unknown parameter %s\n", name);
if (fail_on_invalid_config)
return 0;
}
- } else {
+ } else if (c_strcasecmp(section, GLOBAL_SECTION) != 0) {
_gnutls_debug_log("cfg: unknown section %s\n",
section);
if (fail_on_invalid_config)
@@ -1310,6 +1732,7 @@
int ret;
struct stat sb;
FILE *fp;
+ struct cfg cfg;
if (stat(system_priority_file, &sb) < 0) {
_gnutls_debug_log("cfg: unable to access: %s: %d\n",
@@ -1327,21 +1750,41 @@
if (system_wide_priority_strings_init != 0)
_name_val_array_clear(&system_wide_priority_strings);
+ gnutls_free(system_wide_priority_string);
+ system_wide_priority_string = NULL;
+
fp = fopen(system_priority_file, "re");
if (fp == NULL) {
_gnutls_debug_log("cfg: unable to open: %s: %d\n",
system_priority_file, errno);
return;
}
- ret = ini_parse_file(fp, cfg_ini_handler, NULL);
+ /* Parsing the configuration file needs to be done in 2 phases: first
+ * parsing the [global] section and then the other sections, because the
+ * [global] section modifies the parsing behavior.
+ */
+ memset(&cfg, 0, sizeof(cfg));
+ ret = ini_parse_file(fp, global_ini_handler, &cfg);
+ if (ret == 0) {
+ if (fseek(fp, 0L, SEEK_SET) < 0) {
+ _gnutls_debug_log("cfg: unable to rewind: %s: %d\n",
+ system_priority_file, ret);
+ if (fail_on_invalid_config)
+ exit(1);
+ }
+ ret = ini_parse_file(fp, cfg_ini_handler, &cfg);
+ }
fclose(fp);
if (ret != 0) {
+ cfg_deinit(&cfg);
_gnutls_debug_log("cfg: unable to parse: %s: %d\n",
system_priority_file, ret);
if (fail_on_invalid_config)
exit(1);
return;
}
+ cfg_apply(&cfg);
+ cfg_deinit(&cfg);
_gnutls_debug_log("cfg: loaded system priority %s mtime %lld\n",
system_priority_file,
@@ -1368,6 +1811,7 @@
void _gnutls_unload_system_priorities(void)
{
_name_val_array_clear(&system_wide_priority_strings);
+ gnutls_free(system_wide_priority_string);
_clear_default_system_priority();
system_priority_last_mod = 0;
}
@@ -1391,6 +1835,124 @@
return NULL;
}
+static const char *
+resolve_priorities_from_system_wide_allowlisting(void)
+{
+ gnutls_buffer_st buf;
+ int ret;
+ size_t i;
+
+ if (system_wide_priority_string) {
+ return system_wide_priority_string;
+ }
+
+ assert(system_wide_allowlisting);
+
+ _gnutls_buffer_init(&buf);
+
+ ret = _gnutls_buffer_append_str(&buf, "NONE");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ for (i = 0; system_wide_tls_kxs[i] != 0; i++) {
+ ret = _gnutls_buffer_append_str(&buf, ":+");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ ret = _gnutls_buffer_append_str(&buf,
+ gnutls_kx_get_name(system_wide_tls_kxs[i]));
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+ }
+
+ for (i = 0; system_wide_tls_groups[i] != 0; i++) {
+ ret = _gnutls_buffer_append_str(&buf, ":+GROUP-");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ ret = _gnutls_buffer_append_str(&buf,
+ gnutls_group_get_name(system_wide_tls_groups[i]));
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+ }
+
+ for (i = 0; system_wide_tls_ciphers[i] != 0; i++) {
+ ret = _gnutls_buffer_append_str(&buf, ":+");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ ret = _gnutls_buffer_append_str(&buf,
+ gnutls_cipher_get_name(system_wide_tls_ciphers[i]));
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+ }
+
+ for (i = 0; system_wide_tls_macs[i] != 0; i++) {
+ ret = _gnutls_buffer_append_str(&buf, ":+");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ ret = _gnutls_buffer_append_str(&buf,
+ gnutls_mac_get_name(system_wide_tls_macs[i]));
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+ }
+
+ for (i = 0; system_wide_tls_sigs[i] != 0; i++) {
+ ret = _gnutls_buffer_append_str(&buf, ":+SIGN-");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ ret = _gnutls_buffer_append_str(&buf,
+ gnutls_sign_get_name(system_wide_tls_sigs[i]));
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+ }
+
+ for (i = 0; system_wide_tls_vers[i] != 0; i++) {
+ ret = _gnutls_buffer_append_str(&buf, ":+VERS-");
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+
+ ret = _gnutls_buffer_append_str(&buf,
+ gnutls_protocol_get_name(system_wide_tls_vers[i]));
+ if (ret < 0) {
+ _gnutls_buffer_clear(&buf);
+ return NULL;
+ }
+ }
+
+ gnutls_free(system_wide_priority_string);
+ system_wide_priority_string = gnutls_strdup((char *)buf.data);
+ _gnutls_buffer_clear(&buf);
+
+ return system_wide_priority_string;
+}
+
#define S(str) ((str!=NULL)?str:"")
/* Returns the new priorities if a priority string prefixed
@@ -1445,7 +2007,13 @@
*/
_gnutls_update_system_priorities();
- p = _name_val_array_value(system_wide_priority_strings, ss, ss_len);
+ if (system_wide_allowlisting &&
+ ss_len == sizeof(LEVEL_SYSTEM) - 1 &&
+ strncmp(LEVEL_SYSTEM, ss, ss_len) == 0) {
+ p = resolve_priorities_from_system_wide_allowlisting();
+ } else {
+ p = _name_val_array_value(system_wide_priority_strings, ss, ss_len);
+ }
_gnutls_debug_log("resolved '%.*s' to '%s', next '%.*s'\n",
ss_len, ss, S(p), ss_next_len, S(ss_next));
@@ -1548,48 +2116,52 @@
priority_cache->groups.size = 0;
priority_cache->groups.have_ffdhe = 0;
- /* disable key exchanges which are globally disabled */
- z = 0;
- while (system_wide_disabled_kxs[z] != 0) {
- for (i = j = 0; i < priority_cache->_kx.num_priorities; i++) {
- if (priority_cache->_kx.priorities[i] != system_wide_disabled_kxs[z])
- priority_cache->_kx.priorities[j++] = priority_cache->_kx.priorities[i];
- }
- priority_cache->_kx.num_priorities = j;
- z++;
- }
-
- /* disable groups which are globally disabled */
- z = 0;
- while (system_wide_disabled_groups[z] != 0) {
- for (i = j = 0; i < priority_cache->_supported_ecc.num_priorities; i++) {
- if (priority_cache->_supported_ecc.priorities[i] != system_wide_disabled_groups[z])
- priority_cache->_supported_ecc.priorities[j++] = priority_cache->_supported_ecc.priorities[i];
- }
- priority_cache->_supported_ecc.num_priorities = j;
- z++;
- }
-
- /* disable ciphers which are globally disabled */
- z = 0;
- while (system_wide_disabled_ciphers[z] != 0) {
- for (i = j = 0; i < priority_cache->_cipher.num_priorities; i++) {
- if (priority_cache->_cipher.priorities[i] != system_wide_disabled_ciphers[z])
- priority_cache->_cipher.priorities[j++] = priority_cache->_cipher.priorities[i];
- }
- priority_cache->_cipher.num_priorities = j;
- z++;
- }
-
- /* disable MACs which are globally disabled */
- z = 0;
- while (system_wide_disabled_macs[z] != 0) {
- for (i = j = 0; i < priority_cache->_mac.num_priorities; i++) {
- if (priority_cache->_mac.priorities[i] != system_wide_disabled_macs[z])
- priority_cache->_mac.priorities[j++] = priority_cache->_mac.priorities[i];
+ /* in blocklisting mode, apply system wide disablement of key exchanges,
+ * groups, MACs, and ciphers. */
+ if (!system_wide_allowlisting) {
+ /* disable key exchanges which are globally disabled */
+ z = 0;
+ while (system_wide_tls_kxs[z] != 0) {
+ for (i = j = 0; i < priority_cache->_kx.num_priorities; i++) {
+ if (priority_cache->_kx.priorities[i] != system_wide_tls_kxs[z])
+ priority_cache->_kx.priorities[j++] = priority_cache->_kx.priorities[i];
+ }
+ priority_cache->_kx.num_priorities = j;
+ z++;
+ }
+
+ /* disable groups which are globally disabled */
+ z = 0;
+ while (system_wide_tls_groups[z] != 0) {
+ for (i = j = 0; i < priority_cache->_supported_ecc.num_priorities; i++) {
+ if (priority_cache->_supported_ecc.priorities[i] != system_wide_tls_groups[z])
+ priority_cache->_supported_ecc.priorities[j++] = priority_cache->_supported_ecc.priorities[i];
+ }
+ priority_cache->_supported_ecc.num_priorities = j;
+ z++;
+ }
+
+ /* disable ciphers which are globally disabled */
+ z = 0;
+ while (system_wide_tls_ciphers[z] != 0) {
+ for (i = j = 0; i < priority_cache->_cipher.num_priorities; i++) {
+ if (priority_cache->_cipher.priorities[i] != system_wide_tls_ciphers[z])
+ priority_cache->_cipher.priorities[j++] = priority_cache->_cipher.priorities[i];
+ }
+ priority_cache->_cipher.num_priorities = j;
+ z++;
+ }
+
+ /* disable MACs which are globally disabled */
+ z = 0;
+ while (system_wide_tls_macs[z] != 0) {
+ for (i = j = 0; i < priority_cache->_mac.num_priorities; i++) {
+ if (priority_cache->_mac.priorities[i] != system_wide_tls_macs[z])
+ priority_cache->_mac.priorities[j++] = priority_cache->_mac.priorities[i];
+ }
+ priority_cache->_mac.num_priorities = j;
+ z++;
}
- priority_cache->_mac.num_priorities = j;
- z++;
}
for (j=0;j<priority_cache->_cipher.num_priorities;j++) {
@@ -1737,10 +2309,15 @@
for (i = 0; i < priority_cache->_sign_algo.num_priorities; i++) {
se = _gnutls_sign_to_entry(priority_cache->_sign_algo.priorities[i]);
if (se != NULL && priority_cache->sigalg.size < sizeof(priority_cache->sigalg.entry)/sizeof(priority_cache->sigalg.entry[0])) {
- /* if the signature algorithm semantics are not compatible with
- * the protocol's, then skip. */
- if ((se->aid.tls_sem & tls_sig_sem) == 0)
+ /* if the signature algorithm semantics is not
+ * compatible with the protocol's, or the algorithm is
+ * marked as insecure, then skip. */
+ if ((se->aid.tls_sem & tls_sig_sem) == 0 ||
+ !_gnutls_sign_is_secure2(se, system_wide_allowlisting ?
+ GNUTLS_SIGN_FLAG_ALLOW_INSECURE_REVERTIBLE :
+ 0)) {
continue;
+ }
priority_cache->sigalg.entry[priority_cache->sigalg.size++] = se;
}
}
@@ -2017,6 +2594,9 @@
(*priority_cache)->min_record_version = 1;
gnutls_atomic_init(&(*priority_cache)->usage_cnt);
+ if (system_wide_allowlisting && !priorities) {
+ priorities = "@" LEVEL_SYSTEM;
+ }
if (priorities == NULL) {
priorities = _gnutls_default_priority_string;
resolved_match = 0;
@@ -2150,7 +2730,7 @@
_supported_groups_gost);
} else {
if ((algo =
- gnutls_group_get_id
+ _gnutls_group_get_id
(&broken_list[i][7])) !=
GNUTLS_GROUP_INVALID)
fn(&(*priority_cache)->
diff -ruN gnutls-3.7.2/Makefile.in gnutls-3.7.2-bootstrapped/Makefile.in
--- gnutls-3.7.2/Makefile.in 2021-05-29 10:11:20.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/Makefile.in 2021-06-28 09:11:37.000000000 +0200
@@ -35,7 +35,7 @@
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
# aminclude_static.am generated automatically by Autoconf
-# from AX_AM_MACROS_STATIC on Sat May 29 10:11:18 CEST 2021
+# from AX_AM_MACROS_STATIC on Mon Jun 28 09:11:35 CEST 2021
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
diff -ruN gnutls-3.7.2/NEWS gnutls-3.7.2-bootstrapped/NEWS
--- gnutls-3.7.2/NEWS 2021-05-29 10:08:56.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/NEWS 2021-06-28 09:09:14.000000000 +0200
@@ -5,6 +5,23 @@
Copyright (C) 2013-2019 Nikos Mavrogiannopoulos
See the end for copying conditions.
+* Version 3.7.3 (unreleased)
+
+** libgnutls: The allowlisting configuration mode has been added to the system-wide
+ settings. In this mode, all the algorithms are initially marked as insecure
+ or disabled, while the applications can re-enable them either through the
+ [overrides] section of the configuration file or the new API (#1172).
+
+** API and ABI modifications:
+gnutls_ecc_curve_mark_disabled: Added.
+gnutls_ecc_curve_mark_enabled: Added.
+gnutls_sign_mark_insecure: Added.
+gnutls_sign_mark_secure: Added.
+gnutls_digest_mark_insecure: Added.
+gnutls_digest_mark_secure: Added.
+gnutls_protocol_mark_disabled: Added.
+gnutls_protocol_mark_enabled: Added.
+
* Version 3.7.2 (released 2021-05-29)
** libgnutls: The priority string option %DISABLE_TLS13_COMPAT_MODE was added
diff -ruN gnutls-3.7.2/po/cs.po gnutls-3.7.2-bootstrapped/po/cs.po
--- gnutls-3.7.2/po/cs.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/cs.po 2021-06-28 09:35:00.000000000 +0200
@@ -9,7 +9,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-06-18 07:01+02:00\n"
"Last-Translator: Petr Pisar <petr.pisar@atlas.cz>\n"
"Language-Team: Czech <translation-team-cs@lists.sourceforge.net>\n"
diff -ruN gnutls-3.7.2/po/de.po gnutls-3.7.2-bootstrapped/po/de.po
--- gnutls-3.7.2/po/de.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/de.po 2021-06-28 09:35:00.000000000 +0200
@@ -10,7 +10,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.2.3\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-05-16 20:42+0200\n"
"Last-Translator: Roland Illig <roland.illig@gmx.de>\n"
"Language-Team: German <translation-team-de@lists.sourceforge.net>\n"
diff -ruN gnutls-3.7.2/po/eo.po gnutls-3.7.2-bootstrapped/po/eo.po
--- gnutls-3.7.2/po/eo.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/eo.po 2021-06-28 09:35:00.000000000 +0200
@@ -7,7 +7,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-07-15 13:25-0300\n"
"Last-Translator: Felipe Castro <fefcas@gmail.com>\n"
"Language-Team: Esperanto <translation-team-eo@lists.sourceforge.net>\n"
diff -ruN gnutls-3.7.2/po/es.po gnutls-3.7.2-bootstrapped/po/es.po
--- gnutls-3.7.2/po/es.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/es.po 2021-06-28 09:35:00.000000000 +0200
@@ -7,7 +7,7 @@
msgstr ""
"Project-Id-Version: libgnutls 3.2.3\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2018-05-02 19:11+0200\n"
"Last-Translator: Francisco Javier Serrador <fserrador@gmail.com>\n"
"Language-Team: Spanish <es@tp.org.es>\n"
diff -ruN gnutls-3.7.2/po/fi.po gnutls-3.7.2-bootstrapped/po/fi.po
--- gnutls-3.7.2/po/fi.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/fi.po 2021-06-28 09:35:00.000000000 +0200
@@ -7,7 +7,7 @@
msgstr ""
"Project-Id-Version: libgnutls 3.2.1\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2013-06-19 17:09+0300\n"
"Last-Translator: Jorma Karvonen <karvonen.jorma@gmail.com>\n"
"Language-Team: Finnish <translation-team-fi@lists.sourceforge.net>\n"
diff -ruN gnutls-3.7.2/po/fr.po gnutls-3.7.2-bootstrapped/po/fr.po
--- gnutls-3.7.2/po/fr.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/fr.po 2021-06-28 09:35:00.000000000 +0200
@@ -12,7 +12,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-08-12 01:03+0200\n"
"Last-Translator: Stéphane Aulery <lkppo@free.fr>\n"
"Language-Team: French <traduc@traduc.org>\n"
diff -ruN gnutls-3.7.2/po/gnutls.pot gnutls-3.7.2-bootstrapped/po/gnutls.pot
--- gnutls-3.7.2/po/gnutls.pot 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/gnutls.pot 2021-06-28 09:35:00.000000000 +0200
@@ -8,7 +8,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.7.2\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
diff -ruN gnutls-3.7.2/po/it.po gnutls-3.7.2-bootstrapped/po/it.po
--- gnutls-3.7.2/po/it.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/it.po 2021-06-28 09:35:00.000000000 +0200
@@ -8,7 +8,7 @@
msgstr ""
"Project-Id-Version: gnutls-3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-08-02 11:43+0200\n"
"Last-Translator: Milo Casagrande <milo@milo.name>\n"
"Language-Team: Italian <tp@lists.linux.it>\n"
Binary files gnutls-3.7.2/po/ms.gmo and gnutls-3.7.2-bootstrapped/po/ms.gmo differ
diff -ruN gnutls-3.7.2/po/ms.po gnutls-3.7.2-bootstrapped/po/ms.po
--- gnutls-3.7.2/po/ms.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/ms.po 2021-06-28 09:35:00.000000000 +0200
@@ -7,8 +7,8 @@
msgstr ""
"Project-Id-Version: gnutls 3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
-"PO-Revision-Date: 2021-04-20 16:03+0800\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
+"PO-Revision-Date: 2021-06-14 00:17+0800\n"
"Last-Translator: Sharuzzaman Ahmat Raslan <sharuzzaman@gmail.com>\n"
"Language-Team: Malay <translation-team-ms@lists.sourceforge.net>\n"
"Language: ms\n"
@@ -16,7 +16,7 @@
"Content-Type: text/plain; charset=utf-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Bugs: Report translation errors to the Language-Team address.\n"
-"X-Generator: Poedit 2.4.2\n"
+"X-Generator: Poedit 3.0\n"
#: lib/alert.c:39
msgid "Close notify"
@@ -139,7 +139,7 @@
#: lib/alert.c:83
#, fuzzy
msgid "An extension was expected but was not seen"
-msgstr "')' dijangka\n"
+msgstr "Sambungan tidak disokong telah dihantar"
#: lib/alert.c:86
msgid "No supported application protocol could be negotiated"
@@ -1224,20 +1224,19 @@
msgstr "%s\t\t\tnamaLain OID: %.*s\n"
#: lib/x509/output.c:152
-#, fuzzy, c-format
-#| msgid "\t\t\tXMPP Address: %.*s\n"
+#, c-format
msgid "%sXMPP Address: %.*s\n"
-msgstr "\t\t\tAlamat XMPP: %.*s\n"
+msgstr "%sAlamat XMPP: %.*s\n"
#: lib/x509/output.c:156
-#, fuzzy, c-format
+#, c-format
msgid "%sKRB5Principal: %.*s\n"
-msgstr "%s: %s.\n"
+msgstr "%sKRB5Principal: %.*s\n"
#: lib/x509/output.c:160
-#, fuzzy, c-format
+#, c-format
msgid "%sUnknown name: "
-msgstr "Nama"
+msgstr "%sNama tidak diketahui: "
#: lib/x509/output.c:302
#, c-format
@@ -1266,14 +1265,14 @@
"\t\t\tLambakan Hex: "
#: lib/x509/output.c:347
-#, fuzzy, c-format
+#, c-format
msgid "%s\t\t\tPermitted:\n"
-msgstr "TDB: Tulis tidak dibenarkan"
+msgstr "%s\t\t\tDibenarkan:\n"
#: lib/x509/output.c:359
-#, fuzzy, c-format
+#, c-format
msgid "%s\t\t\tExcluded:\n"
-msgstr "%s%s: %.*s (%s)\n"
+msgstr "%s\t\t\tDikecualikan:\n"
#: lib/x509/output.c:399 lib/x509/output.c:401 lib/x509/output.c:403
#, c-format
diff -ruN gnutls-3.7.2/po/nl.po gnutls-3.7.2-bootstrapped/po/nl.po
--- gnutls-3.7.2/po/nl.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/nl.po 2021-06-28 09:35:00.000000000 +0200
@@ -10,7 +10,7 @@
msgstr ""
"Project-Id-Version: libgnutls-3.2.1\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2013-06-13 19:56+0200\n"
"Last-Translator: Benno Schulenberg <benno@vertaalt.nl>\n"
"Language-Team: Dutch <vertaling@vrijschrift.org>\n"
diff -ruN gnutls-3.7.2/po/pl.po gnutls-3.7.2-bootstrapped/po/pl.po
--- gnutls-3.7.2/po/pl.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/pl.po 2021-06-28 09:35:00.000000000 +0200
@@ -7,7 +7,7 @@
msgstr ""
"Project-Id-Version: gnutls-3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-06-01 08:22+0200\n"
"Last-Translator: Jakub Bogusz <qboosh@pld-linux.org>\n"
"Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n"
diff -ruN gnutls-3.7.2/po/pt_BR.po gnutls-3.7.2-bootstrapped/po/pt_BR.po
--- gnutls-3.7.2/po/pt_BR.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/pt_BR.po 2021-06-28 09:35:00.000000000 +0200
@@ -7,7 +7,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-06-11 03:55-0200\n"
"Last-Translator: Rafael Fontenelle <rafaelff@gnome.org>\n"
"Language-Team: Brazilian Portuguese <ldpbr-translation@lists.sourceforge."
diff -ruN gnutls-3.7.2/po/sr.po gnutls-3.7.2-bootstrapped/po/sr.po
--- gnutls-3.7.2/po/sr.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/sr.po 2021-06-28 09:35:00.000000000 +0200
@@ -6,7 +6,7 @@
msgstr ""
"Project-Id-Version: gnutls-3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2020-08-04 15:21+0200\n"
"Last-Translator: Мирослав Николић <miroslavnikolic@rocketmail.com>\n"
"Language-Team: Serbian <(nothing)>\n"
diff -ruN gnutls-3.7.2/po/sv.po gnutls-3.7.2-bootstrapped/po/sv.po
--- gnutls-3.7.2/po/sv.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/sv.po 2021-06-28 09:35:00.000000000 +0200
@@ -8,7 +8,7 @@
msgstr ""
"Project-Id-Version: libgnutls 3.2.3\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2017-06-22 13:44+0200\n"
"Last-Translator: Anders Jonsson <anders.jonsson@norsjovallen.se>\n"
"Language-Team: Swedish <tp-sv@listor.tp-sv.se>\n"
diff -ruN gnutls-3.7.2/po/uk.po gnutls-3.7.2-bootstrapped/po/uk.po
--- gnutls-3.7.2/po/uk.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/uk.po 2021-06-28 09:35:00.000000000 +0200
@@ -8,7 +8,7 @@
msgstr ""
"Project-Id-Version: gnutls 3.6.8\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2019-06-06 21:38+0300\n"
"Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
"Language-Team: Ukrainian <trans-uk@lists.fedoraproject.org>\n"
diff -ruN gnutls-3.7.2/po/vi.po gnutls-3.7.2-bootstrapped/po/vi.po
--- gnutls-3.7.2/po/vi.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/vi.po 2021-06-28 09:35:00.000000000 +0200
@@ -8,7 +8,7 @@
msgstr ""
"Project-Id-Version: libgnutls-3.2.3\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2013-08-06 07:13+0700\n"
"Last-Translator: Trần Ngọc Quân <vnwildman@gmail.com>\n"
"Language-Team: Vietnamese <translation-team-vi@lists.sourceforge.net>\n"
diff -ruN gnutls-3.7.2/po/zh_CN.po gnutls-3.7.2-bootstrapped/po/zh_CN.po
--- gnutls-3.7.2/po/zh_CN.po 2021-05-29 10:15:00.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/po/zh_CN.po 2021-06-28 09:35:00.000000000 +0200
@@ -10,7 +10,7 @@
msgstr ""
"Project-Id-Version: libgnutls 3.2.3\n"
"Report-Msgid-Bugs-To: bug-gnutls@gnu.org\n"
-"POT-Creation-Date: 2021-05-29 10:15+0200\n"
+"POT-Creation-Date: 2021-06-28 09:35+0200\n"
"PO-Revision-Date: 2015-11-10 09:47-0500\n"
"Last-Translator: Mingye Wang (Arthur2e5) <arthur200126@gmail.com>\n"
"Language-Team: Chinese (simplified) <i18n-zh@googlegroups.com>\n"
diff -ruN gnutls-3.7.2/src/p11tool-args.def gnutls-3.7.2-bootstrapped/src/p11tool-args.def
--- gnutls-3.7.2/src/p11tool-args.def 2021-04-19 09:28:28.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/src/p11tool-args.def 2021-06-25 17:46:01.000000000 +0200
@@ -268,8 +268,9 @@
flag = {
name = write;
descrip = "Writes the loaded objects to a PKCS #11 token";
- doc = "It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with
- one of --load-privkey, --load-pubkey, --load-certificate option.";
+ doc = "It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with one of --load-privkey, --load-pubkey, --load-certificate option.
+
+When writing a certificate object, its CKA_ID is set to the same CKA_ID of the corresponding public key, if it exists on the token; otherwise it will be derived from the X.509 Subject Key Identifier of the certificate. If this behavior is undesired, write the public key to the token beforehand.";
};
flag = {
diff -ruN gnutls-3.7.2/tests/Makefile.am gnutls-3.7.2-bootstrapped/tests/Makefile.am
--- gnutls-3.7.2/tests/Makefile.am 2021-05-27 08:10:21.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/tests/Makefile.am 2021-06-28 09:09:42.000000000 +0200
@@ -108,7 +108,7 @@
libutils_la_SOURCES = utils.h utils.c seccomp.c utils-adv.c
libutils_la_LIBADD = ../lib/libgnutls.la
-indirect_tests = system-override-hash system-override-sig
+indirect_tests = system-override-hash system-override-sig system-override-sig-tls
ctests = tls13/supported_versions tls13/tls12-no-tls13-exts \
tls13/post-handshake-with-cert tls13/post-handshake-without-cert \
@@ -509,7 +509,13 @@
dist_check_SCRIPTS += system-override-sig.sh system-override-hash.sh \
system-override-versions.sh system-override-invalid.sh \
system-override-curves.sh system-override-profiles.sh system-override-tls.sh \
- system-override-kx.sh system-override-default-priority-string.sh
+ system-override-kx.sh system-override-default-priority-string.sh \
+ system-override-sig-tls.sh
+
+dist_check_SCRIPTS += system-override-sig-allowlist.sh \
+ system-override-hash-allowlist.sh \
+ system-override-versions-allowlist.sh \
+ system-override-curves-allowlist.sh
endif
dist_check_SCRIPTS += gnutls-cli-self-signed.sh gnutls-cli-invalid-crl.sh gnutls-cli-rawpk.sh
@@ -605,6 +611,7 @@
endif
TEST_EXTENSIONS = .sh
+SH_LOG_COMPILER = $(SHELL)
LOG_COMPILER = $(VALGRIND)
distclean-local:
diff -ruN gnutls-3.7.2/tests/Makefile.in gnutls-3.7.2-bootstrapped/tests/Makefile.in
--- gnutls-3.7.2/tests/Makefile.in 2021-05-29 10:11:25.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/tests/Makefile.in 2021-06-28 09:11:42.000000000 +0200
@@ -191,11 +191,20 @@
@WINDOWS_FALSE@ gnutls-cli-resume.sh profile-tests.sh \
@WINDOWS_FALSE@ server-weak-keys.sh
@WINDOWS_FALSE@am__append_17 = dtls-stress
-@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@am__append_18 = system-override-sig.sh system-override-hash.sh \
-@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-versions.sh system-override-invalid.sh \
-@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-curves.sh system-override-profiles.sh system-override-tls.sh \
-@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-kx.sh system-override-default-priority-string.sh
-
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@am__append_18 = system-override-sig.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-hash.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-versions.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-invalid.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-curves.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-profiles.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-tls.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-kx.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-default-priority-string.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-sig-tls.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-sig-allowlist.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-hash-allowlist.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-versions-allowlist.sh \
+@DISABLE_SYSTEM_CONFIG_FALSE@@WINDOWS_FALSE@ system-override-curves-allowlist.sh
@WINDOWS_FALSE@am__append_19 = gnutls-cli-self-signed.sh \
@WINDOWS_FALSE@ gnutls-cli-invalid-crl.sh gnutls-cli-rawpk.sh \
@WINDOWS_FALSE@ dh-fips-approved.sh
@@ -662,8 +671,8 @@
@ENABLE_PKCS11_TRUE@@HAVE_PKCS11_TRUST_STORE_TRUE@@P11KIT_0_23_11_API_TRUE@@WINDOWS_FALSE@ pkcs11/list-objects$(EXEEXT)
@WINDOWS_FALSE@am__EXEEXT_18 = datefudge-check$(EXEEXT)
am__EXEEXT_19 = system-override-hash$(EXEEXT) \
- system-override-sig$(EXEEXT) $(am__EXEEXT_16) $(am__EXEEXT_17) \
- $(am__EXEEXT_18)
+ system-override-sig$(EXEEXT) system-override-sig-tls$(EXEEXT) \
+ $(am__EXEEXT_16) $(am__EXEEXT_17) $(am__EXEEXT_18)
PROGRAMS = $(noinst_PROGRAMS)
LTLIBRARIES = $(noinst_LTLIBRARIES)
@ENABLE_PKCS11_TRUE@@WINDOWS_FALSE@libpkcs11mock1_la_DEPENDENCIES = \
@@ -2366,6 +2375,11 @@
system_override_sig_LDADD = $(LDADD)
system_override_sig_DEPENDENCIES = $(COMMON_GNUTLS_LDADD) libutils.la \
$(am__DEPENDENCIES_2)
+system_override_sig_tls_SOURCES = system-override-sig-tls.c
+system_override_sig_tls_OBJECTS = system-override-sig-tls.$(OBJEXT)
+system_override_sig_tls_LDADD = $(LDADD)
+system_override_sig_tls_DEPENDENCIES = $(COMMON_GNUTLS_LDADD) \
+ libutils.la $(am__DEPENDENCIES_2)
system_prio_file_SOURCES = system-prio-file.c
system_prio_file_OBJECTS = system-prio-file.$(OBJEXT)
system_prio_file_LDADD = $(LDADD)
@@ -2997,10 +3011,13 @@
system-override-profiles.sh system-override-tls.sh \
system-override-kx.sh \
system-override-default-priority-string.sh \
- gnutls-cli-self-signed.sh gnutls-cli-invalid-crl.sh \
- gnutls-cli-rawpk.sh dh-fips-approved.sh p11-kit-trust.sh \
- testpkcs11.sh certtool-pkcs11.sh p11-kit-load.sh danetool.sh \
- tpmtool_test.sh
+ system-override-sig-tls.sh system-override-sig-allowlist.sh \
+ system-override-hash-allowlist.sh \
+ system-override-versions-allowlist.sh \
+ system-override-curves-allowlist.sh gnutls-cli-self-signed.sh \
+ gnutls-cli-invalid-crl.sh gnutls-cli-rawpk.sh \
+ dh-fips-approved.sh p11-kit-trust.sh testpkcs11.sh \
+ certtool-pkcs11.sh p11-kit-load.sh danetool.sh tpmtool_test.sh
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
@@ -3216,6 +3233,7 @@
./$(DEPDIR)/status-request.Po ./$(DEPDIR)/str-idna.Po \
./$(DEPDIR)/str-unicode.Po ./$(DEPDIR)/strict-der.Po \
./$(DEPDIR)/system-override-hash.Po \
+ ./$(DEPDIR)/system-override-sig-tls.Po \
./$(DEPDIR)/system-override-sig.Po \
./$(DEPDIR)/system-prio-file.Po ./$(DEPDIR)/time.Po \
./$(DEPDIR)/tls-channel-binding.Po \
@@ -3522,16 +3540,16 @@
ssl30-server-kx-neg.c status-request.c status-request-ext.c \
status-request-ok.c status-request-revoked.c str-idna.c \
str-unicode.c strict-der.c system-override-hash.c \
- system-override-sig.c system-prio-file.c time.c \
- tls-channel-binding.c tls-client-with-seccomp.c \
- tls-crt_type-neg.c tls-etm.c tls-ext-not-in-dtls.c \
- tls-ext-register.c tls-force-etm.c tls-neg-ext-key.c \
- tls-neg-ext4-key.c tls-pthread.c tls-record-size-limit.c \
- tls-record-size-limit-asym.c tls-session-ext-override.c \
- tls-session-ext-register.c tls-session-supplemental.c \
- tls-supplemental.c tls-with-seccomp.c \
- $(tls10_cert_key_exchange_SOURCES) tls10-cipher-neg.c \
- tls10-prf.c tls10-server-kx-neg.c \
+ system-override-sig.c system-override-sig-tls.c \
+ system-prio-file.c time.c tls-channel-binding.c \
+ tls-client-with-seccomp.c tls-crt_type-neg.c tls-etm.c \
+ tls-ext-not-in-dtls.c tls-ext-register.c tls-force-etm.c \
+ tls-neg-ext-key.c tls-neg-ext4-key.c tls-pthread.c \
+ tls-record-size-limit.c tls-record-size-limit-asym.c \
+ tls-session-ext-override.c tls-session-ext-register.c \
+ tls-session-supplemental.c tls-supplemental.c \
+ tls-with-seccomp.c $(tls10_cert_key_exchange_SOURCES) \
+ tls10-cipher-neg.c tls10-prf.c tls10-server-kx-neg.c \
$(tls11_cert_key_exchange_SOURCES) \
$(tls11_check_rollback_val_SOURCES) tls11-cipher-neg.c \
$(tls11_rollback_detection_SOURCES) tls11-server-kx-neg.c \
@@ -3707,16 +3725,16 @@
ssl30-server-kx-neg.c status-request.c status-request-ext.c \
status-request-ok.c status-request-revoked.c str-idna.c \
str-unicode.c strict-der.c system-override-hash.c \
- system-override-sig.c system-prio-file.c time.c \
- tls-channel-binding.c tls-client-with-seccomp.c \
- tls-crt_type-neg.c tls-etm.c tls-ext-not-in-dtls.c \
- tls-ext-register.c tls-force-etm.c tls-neg-ext-key.c \
- tls-neg-ext4-key.c tls-pthread.c tls-record-size-limit.c \
- tls-record-size-limit-asym.c tls-session-ext-override.c \
- tls-session-ext-register.c tls-session-supplemental.c \
- tls-supplemental.c tls-with-seccomp.c \
- $(tls10_cert_key_exchange_SOURCES) tls10-cipher-neg.c \
- tls10-prf.c tls10-server-kx-neg.c \
+ system-override-sig.c system-override-sig-tls.c \
+ system-prio-file.c time.c tls-channel-binding.c \
+ tls-client-with-seccomp.c tls-crt_type-neg.c tls-etm.c \
+ tls-ext-not-in-dtls.c tls-ext-register.c tls-force-etm.c \
+ tls-neg-ext-key.c tls-neg-ext4-key.c tls-pthread.c \
+ tls-record-size-limit.c tls-record-size-limit-asym.c \
+ tls-session-ext-override.c tls-session-ext-register.c \
+ tls-session-supplemental.c tls-supplemental.c \
+ tls-with-seccomp.c $(tls10_cert_key_exchange_SOURCES) \
+ tls10-cipher-neg.c tls10-prf.c tls10-server-kx-neg.c \
$(tls11_cert_key_exchange_SOURCES) \
$(tls11_check_rollback_val_SOURCES) tls11-cipher-neg.c \
$(tls11_rollback_detection_SOURCES) tls11-server-kx-neg.c \
@@ -5822,7 +5840,8 @@
libutils_la_SOURCES = utils.h utils.c seccomp.c utils-adv.c
libutils_la_LIBADD = ../lib/libgnutls.la
indirect_tests = system-override-hash system-override-sig \
- $(am__append_17) $(am__append_22) $(am__append_28)
+ system-override-sig-tls $(am__append_17) $(am__append_22) \
+ $(am__append_28)
ctests = tls13/supported_versions tls13/tls12-no-tls13-exts \
tls13/post-handshake-with-cert \
tls13/post-handshake-without-cert tls13/cookie tls13/key_share \
@@ -6115,6 +6134,7 @@
@ENABLE_CXX_TRUE@@HAVE_CMOCKA_TRUE@ -I$(top_builddir)/gl
TEST_EXTENSIONS = .sh
+SH_LOG_COMPILER = $(SHELL)
LOG_COMPILER = $(VALGRIND)
all: all-recursive
@@ -7590,6 +7610,10 @@
@rm -f system-override-sig$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(system_override_sig_OBJECTS) $(system_override_sig_LDADD) $(LIBS)
+system-override-sig-tls$(EXEEXT): $(system_override_sig_tls_OBJECTS) $(system_override_sig_tls_DEPENDENCIES) $(EXTRA_system_override_sig_tls_DEPENDENCIES)
+ @rm -f system-override-sig-tls$(EXEEXT)
+ $(AM_V_CCLD)$(LINK) $(system_override_sig_tls_OBJECTS) $(system_override_sig_tls_LDADD) $(LIBS)
+
system-prio-file$(EXEEXT): $(system_prio_file_OBJECTS) $(system_prio_file_DEPENDENCIES) $(EXTRA_system_prio_file_DEPENDENCIES)
@rm -f system-prio-file$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(system_prio_file_OBJECTS) $(system_prio_file_LDADD) $(LIBS)
@@ -8396,6 +8420,7 @@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/str-unicode.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/strict-der.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/system-override-hash.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/system-override-sig-tls.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/system-override-sig.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/system-prio-file.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/time.Po@am__quote@ # am--include-marker
@@ -12588,6 +12613,7 @@
-rm -f ./$(DEPDIR)/str-unicode.Po
-rm -f ./$(DEPDIR)/strict-der.Po
-rm -f ./$(DEPDIR)/system-override-hash.Po
+ -rm -f ./$(DEPDIR)/system-override-sig-tls.Po
-rm -f ./$(DEPDIR)/system-override-sig.Po
-rm -f ./$(DEPDIR)/system-prio-file.Po
-rm -f ./$(DEPDIR)/time.Po
@@ -13075,6 +13101,7 @@
-rm -f ./$(DEPDIR)/str-unicode.Po
-rm -f ./$(DEPDIR)/strict-der.Po
-rm -f ./$(DEPDIR)/system-override-hash.Po
+ -rm -f ./$(DEPDIR)/system-override-sig-tls.Po
-rm -f ./$(DEPDIR)/system-override-sig.Po
-rm -f ./$(DEPDIR)/system-prio-file.Po
-rm -f ./$(DEPDIR)/time.Po
diff -ruN gnutls-3.7.2/tests/suite/Makefile.am gnutls-3.7.2-bootstrapped/tests/suite/Makefile.am
--- gnutls-3.7.2/tests/suite/Makefile.am 2021-05-27 08:08:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/tests/suite/Makefile.am 2021-06-28 09:09:42.000000000 +0200
@@ -115,4 +115,5 @@
prime_check_CPPFLAGS = $(AM_CPPFLAGS) $(NETTLE_CFLAGS)
TEST_EXTENSIONS = .sh
+SH_LOG_COMPILER = $(SHELL)
LOG_COMPILER = $(VALGRIND)
diff -ruN gnutls-3.7.2/tests/suite/Makefile.in gnutls-3.7.2-bootstrapped/tests/suite/Makefile.in
--- gnutls-3.7.2/tests/suite/Makefile.in 2021-05-29 10:11:26.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/tests/suite/Makefile.in 2021-06-28 09:11:43.000000000 +0200
@@ -2351,6 +2351,7 @@
nodist_check_SCRIPTS = $(scripts_to_test)
prime_check_CPPFLAGS = $(AM_CPPFLAGS) $(NETTLE_CFLAGS)
TEST_EXTENSIONS = .sh
+SH_LOG_COMPILER = $(SHELL)
LOG_COMPILER = $(VALGRIND)
all: all-am
diff -ruN gnutls-3.7.2/tests/system-override-curves-allowlist.sh gnutls-3.7.2-bootstrapped/tests/system-override-curves-allowlist.sh
--- gnutls-3.7.2/tests/system-override-curves-allowlist.sh 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/tests/system-override-curves-allowlist.sh 2021-06-28 09:09:14.000000000 +0200
@@ -0,0 +1,113 @@
+#!/bin/sh
+
+# Copyright (C) 2019 Red Hat, Inc.
+#
+# Author: Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>
+
+: ${srcdir=.}
+: ${SERV=../src/gnutls-serv${EXEEXT}}
+: ${CLI=../src/gnutls-cli${EXEEXT}}
+TMPFILE=config.$$.tmp
+TMPFILE2=log.$$.tmp
+export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+
+if ! test -x "${SERV}"; then
+ exit 77
+fi
+
+if ! test -x "${CLI}"; then
+ exit 77
+fi
+
+if test "${WINDIR}" != ""; then
+ exit 77
+fi
+
+. "${srcdir}/scripts/common.sh"
+
+# This test doesn't work in FIPS mode
+if test -n "${GNUTLS_FORCE_FIPS_MODE}" && test "${GNUTLS_FORCE_FIPS_MODE}" != 0; then
+ exit 77
+fi
+
+# We intentionally add stray spaces and tabs to check our parser
+cat <<_EOF_ > ${TMPFILE}
+[global]
+override-mode = allowlist
+
+[overrides]
+enabled-curve = secp384r1
+_EOF_
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+export GNUTLS_DEBUG_LEVEL=3
+
+"${CLI}" --list|grep ^Groups >${TMPFILE2}
+cat ${TMPFILE2}
+if grep -i "SECP256R1" ${TMPFILE2} || grep -i "SECP521R1" ${TMPFILE2};then
+ echo "Found disabled curve with --list"
+ exit 1
+fi
+
+if ! grep -i "SECP384R1" ${TMPFILE2};then
+ echo "Could not found secp384r1"
+ exit 1
+fi
+
+# Try whether a client connection with a disabled curve will succeed.
+
+KEY1=${srcdir}/../doc/credentials/x509/key-rsa.pem
+CERT1=${srcdir}/../doc/credentials/x509/cert-rsa.pem
+
+unset GNUTLS_SYSTEM_PRIORITY_FILE
+
+eval "${GETPORT}"
+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" --x509keyfile ${KEY1} --x509certfile ${CERT1}
+PID=$!
+wait_server ${PID}
+
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CURVE-ALL:+CURVE-SECP256R1:+CURVE-SECP521R1 --insecure --logfile ${TMPFILE2} </dev/null >/dev/null ||
+ fail "expected connection to succeed (1)"
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CURVE-ALL:+CURVE-SECP256R1:+CURVE-SECP521R1 --insecure --logfile ${TMPFILE2} </dev/null >/dev/null &&
+ fail "expected connection to fail (2)"
+
+kill ${PID}
+wait
+
+# Try whether a server connection with a disabled curve will succeed.
+
+KEY1=${srcdir}/../doc/credentials/x509/key-rsa.pem
+CERT1=${srcdir}/../doc/credentials/x509/cert-rsa.pem
+
+eval "${GETPORT}"
+launch_server --echo --priority "NORMAL" --x509keyfile ${KEY1} --x509certfile ${CERT1}
+PID=$!
+wait_server ${PID}
+
+unset GNUTLS_SYSTEM_PRIORITY_FILE
+
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-CURVE-ALL:+CURVE-SECP256R1:+CURVE-SECP521R1" --insecure --logfile ${TMPFILE2} </dev/null >/dev/null &&
+ fail "expected connection to fail (2)"
+
+kill ${PID}
+wait
+
+exit 0
diff -ruN gnutls-3.7.2/tests/system-override-hash-allowlist.sh gnutls-3.7.2-bootstrapped/tests/system-override-hash-allowlist.sh
--- gnutls-3.7.2/tests/system-override-hash-allowlist.sh 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/tests/system-override-hash-allowlist.sh 2021-06-28 09:09:14.000000000 +0200
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+# Copyright (C) 2019 Nikos Mavrogiannopoulos
+#
+# Author: Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+: ${builddir=.}
+TMPFILE=c.$$.tmp
+export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+
+cat <<_EOF_ > ${TMPFILE}
+[global]
+override-mode = allowlist
+
+[overrides]
+secure-hash = sha384
+secure-sig = rsa-pss-sha384
+_EOF_
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+
+"${builddir}/system-override-hash"
+rc=$?
+rm ${TMPFILE}
+exit $rc
diff -ruN gnutls-3.7.2/tests/system-override-sig-allowlist.sh gnutls-3.7.2-bootstrapped/tests/system-override-sig-allowlist.sh
--- gnutls-3.7.2/tests/system-override-sig-allowlist.sh 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/tests/system-override-sig-allowlist.sh 2021-06-28 09:09:14.000000000 +0200
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2019 Nikos Mavrogiannopoulos
+#
+# Author: Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+: ${builddir=.}
+TMPFILE=c.$$.tmp
+export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+
+cat <<_EOF_ > ${TMPFILE}
+[global]
+override-mode = allowlist
+
+[overrides]
+secure-hash = sha256
+secure-sig = rsa-sha256
+secure-hash = sha384
+secure-sig = rsa-pss-sha384
+_EOF_
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+
+"${builddir}/system-override-sig"
+rc=$?
+rm ${TMPFILE}
+exit $rc
diff -ruN gnutls-3.7.2/tests/system-override-sig-tls.c gnutls-3.7.2-bootstrapped/tests/system-override-sig-tls.c
--- gnutls-3.7.2/tests/system-override-sig-tls.c 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/tests/system-override-sig-tls.c 2021-06-25 17:46:13.000000000 +0200
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2015-2021 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos, Daiki Ueno
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <assert.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+#include "utils.h"
+
+#define SKIP16(pos, total) { \
+ uint16_t _s; \
+ if (pos+2 > total) fail("error\n"); \
+ _s = (msg->data[pos] << 8) | msg->data[pos+1]; \
+ if ((size_t)(pos+2+_s) > total) fail("error\n"); \
+ pos += 2+_s; \
+ }
+
+#define SKIP8(pos, total) { \
+ uint8_t _s; \
+ if (pos+1 > total) fail("error\n"); \
+ _s = msg->data[pos]; \
+ if ((size_t)(pos+1+_s) > total) fail("error\n"); \
+ pos += 1+_s; \
+ }
+
+#define HANDSHAKE_SESSION_ID_POS 34
+
+#include "eagain-common.h"
+#include "cert-common.h"
+
+/* This tests whether the client omits signature algorithms marked as insecure,
+ * from the signature_algorithms extension.
+ */
+
+const char *side;
+
+static void tls_log_func(int level, const char *str)
+{
+ fprintf(stderr, "%s|<%d>| %s", side, level, str);
+}
+
+#define PRIO "NORMAL:-VERS-ALL:+VERS-TLS1.3:-SIGN-ALL:" \
+ "+SIGN-RSA-PSS-RSAE-SHA256:+SIGN-RSA-PSS-RSAE-SHA384"
+/* rsa_pss_rsae_sha384 */
+#define SIGALGS_EXP "\x00\x02\x08\x05"
+
+static int
+ext_callback(void *ctx, unsigned tls_id,
+ const unsigned char *data, unsigned size)
+{
+ if (tls_id == 13) { /* signature algorithms */
+ if (size != sizeof(SIGALGS_EXP) - 1) {
+ fail("invalid signature_algorithms length: %u != 4\n",
+ size);
+ }
+ if (memcmp(data, SIGALGS_EXP, sizeof(SIGALGS_EXP) - 1) != 0) {
+ fail("invalid signature_algorithms\n");
+ }
+ }
+ return 0;
+}
+
+static int
+handshake_callback(gnutls_session_t session, unsigned int htype,
+ unsigned post, unsigned int incoming,
+ const gnutls_datum_t *msg)
+{
+ assert(post);
+
+ if (!incoming && htype == GNUTLS_HANDSHAKE_CLIENT_HELLO) {
+ int ret;
+ unsigned pos;
+ gnutls_datum_t mmsg;
+
+ assert(msg->size >= HANDSHAKE_SESSION_ID_POS);
+ pos = HANDSHAKE_SESSION_ID_POS;
+ SKIP8(pos, msg->size);
+ SKIP16(pos, msg->size);
+ SKIP8(pos, msg->size);
+
+ mmsg.data = &msg->data[pos];
+ mmsg.size = msg->size - pos;
+ ret = gnutls_ext_raw_parse(NULL, ext_callback, &mmsg, 0);
+ assert(ret >= 0);
+ }
+ return 0;
+}
+
+void doit(void)
+{
+ int ret;
+ /* Server stuff. */
+ gnutls_certificate_credentials_t serverx509cred;
+ gnutls_session_t server;
+ int sret = GNUTLS_E_AGAIN;
+ /* Client stuff. */
+ gnutls_certificate_credentials_t clientx509cred;
+ gnutls_session_t client;
+ int cret = GNUTLS_E_AGAIN;
+
+ global_init();
+
+ /* General init. */
+ gnutls_global_set_log_function(tls_log_func);
+ if (debug)
+ gnutls_global_set_log_level(6);
+
+ /* Init server */
+ gnutls_certificate_allocate_credentials(&serverx509cred);
+ gnutls_certificate_set_x509_key_mem(serverx509cred,
+ &server2_cert, &server2_key,
+ GNUTLS_X509_FMT_PEM);
+
+ gnutls_init(&server, GNUTLS_SERVER);
+ gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE,
+ serverx509cred);
+
+ gnutls_priority_set_direct(server, PRIO, NULL);
+
+ gnutls_transport_set_push_function(server, server_push);
+ gnutls_transport_set_pull_function(server, server_pull);
+ gnutls_transport_set_pull_timeout_function(server,
+ server_pull_timeout_func);
+ gnutls_transport_set_ptr(server, server);
+
+ /* Init client */
+ ret = gnutls_certificate_allocate_credentials(&clientx509cred);
+ if (ret < 0)
+ exit(1);
+
+ ret = gnutls_certificate_set_x509_trust_mem(clientx509cred, &ca2_cert, GNUTLS_X509_FMT_PEM);
+ if (ret < 0)
+ exit(1);
+
+ ret = gnutls_init(&client, GNUTLS_CLIENT);
+ if (ret < 0)
+ exit(1);
+
+ ret = gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE,
+ clientx509cred);
+ if (ret < 0)
+ exit(1);
+
+ ret = gnutls_priority_set_direct(client, PRIO, NULL);
+ if (ret < 0)
+ exit(1);
+
+ gnutls_transport_set_push_function(client, client_push);
+ gnutls_transport_set_pull_function(client, client_pull);
+ gnutls_transport_set_pull_timeout_function(client,
+ client_pull_timeout_func);
+ gnutls_transport_set_ptr(client, client);
+
+ gnutls_handshake_set_hook_function(client,
+ GNUTLS_HANDSHAKE_ANY,
+ GNUTLS_HOOK_POST,
+ handshake_callback);
+
+ HANDSHAKE(client, server);
+
+ gnutls_bye(client, GNUTLS_SHUT_RDWR);
+ gnutls_bye(server, GNUTLS_SHUT_RDWR);
+
+ gnutls_deinit(client);
+ gnutls_deinit(server);
+
+ gnutls_certificate_free_credentials(serverx509cred);
+ gnutls_certificate_free_credentials(clientx509cred);
+
+ gnutls_global_deinit();
+
+ reset_buffers();
+}
diff -ruN gnutls-3.7.2/tests/system-override-sig-tls.sh gnutls-3.7.2-bootstrapped/tests/system-override-sig-tls.sh
--- gnutls-3.7.2/tests/system-override-sig-tls.sh 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/tests/system-override-sig-tls.sh 2021-06-25 17:46:13.000000000 +0200
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# Copyright (C) 2019 Nikos Mavrogiannopoulos
+# Copyright (C) 2021 Red Hat, Inc.
+#
+# Author: Nikos Mavrogiannopoulos, Daiki Ueno
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+: ${builddir=.}
+TMPFILE=c.$$.tmp
+export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+
+cat <<_EOF_ > ${TMPFILE}
+[overrides]
+
+insecure-sig = rsa-pss-rsae-sha256
+_EOF_
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+
+"${builddir}/system-override-sig-tls"
+rc=$?
+rm ${TMPFILE}
+exit $rc
diff -ruN gnutls-3.7.2/tests/system-override-versions-allowlist.sh gnutls-3.7.2-bootstrapped/tests/system-override-versions-allowlist.sh
--- gnutls-3.7.2/tests/system-override-versions-allowlist.sh 1970-01-01 01:00:00.000000000 +0100
+++ gnutls-3.7.2-bootstrapped/tests/system-override-versions-allowlist.sh 2021-06-28 09:09:14.000000000 +0200
@@ -0,0 +1,109 @@
+#!/bin/sh
+
+# Copyright (C) 2019 Red Hat, Inc.
+#
+# Author: Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+: ${srcdir=.}
+: ${SERV=../src/gnutls-serv${EXEEXT}}
+: ${CLI=../src/gnutls-cli${EXEEXT}}
+TMPFILE=config.$$.tmp
+TMPFILE2=log.$$.tmp
+export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+
+if ! test -x "${SERV}"; then
+ exit 77
+fi
+
+if ! test -x "${CLI}"; then
+ exit 77
+fi
+
+if test "${WINDIR}" != ""; then
+ exit 77
+fi
+
+. "${srcdir}/scripts/common.sh"
+
+cat <<_EOF_ > ${TMPFILE}
+[global]
+override-mode = allowlist
+
+[overrides]
+enabled-version = tls1.1
+_EOF_
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+export GNUTLS_DEBUG_LEVEL=3
+
+"${CLI}" --list|grep Protocols >${TMPFILE2}
+cat ${TMPFILE2}
+if grep "VERS-TLS1.2" ${TMPFILE2} || grep "VERS-TLS1.3" ${TMPFILE2};then
+ echo "Found disabled protocol with --list"
+ exit 1
+fi
+
+PRIO=@SYSTEM:+CIPHER-ALL:+MAC-ALL:+GROUP-ALL
+
+"${CLI}" --priority "$PRIO" --list|grep Protocols >${TMPFILE2}
+cat ${TMPFILE2}
+if grep "VERS-TLS1.2" ${TMPFILE2} || grep "VERS-TLS1.3" ${TMPFILE2};then
+ echo "Found disabled protocol with --list --priority $PRIO"
+ exit 1
+fi
+
+# Try whether a client connection with these protocols will succeed.
+
+KEY1=${srcdir}/../doc/credentials/x509/key-rsa.pem
+CERT1=${srcdir}/../doc/credentials/x509/cert-rsa.pem
+
+unset GNUTLS_SYSTEM_PRIORITY_FILE
+
+eval "${GETPORT}"
+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" --x509keyfile ${KEY1} --x509certfile ${CERT1}
+PID=$!
+wait_server ${PID}
+
+export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
+
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "$PRIO" --insecure --logfile ${TMPFILE2} </dev/null >/dev/null &&
+ fail "expected connection to fail (1)"
+
+kill ${PID}
+wait
+
+# Try whether a server connection with these protocols will succeed.
+
+KEY1=${srcdir}/../doc/credentials/x509/key-rsa.pem
+CERT1=${srcdir}/../doc/credentials/x509/cert-rsa.pem
+
+eval "${GETPORT}"
+launch_server --echo --priority "$PRIO" --x509keyfile ${KEY1} --x509certfile ${CERT1}
+PID=$!
+wait_server ${PID}
+
+unset GNUTLS_SYSTEM_PRIORITY_FILE
+
+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" --insecure --logfile ${TMPFILE2} </dev/null >/dev/null &&
+ fail "expected connection to fail (2)"
+
+kill ${PID}
+wait
+
+exit 0