Module Name:	pkgsrc
Committed By:	wiz
Date:		Sat Dec 31 00:02:58 UTC 2005

Modified Files:
	pkgsrc/security/gnutls: Makefile PLIST distinfo

Log Message:
Update to 1.3.2:

* Version 1.3.2 (released 2005-12-15)

** GnuTLS now support TLS Inner application (TLS/IA).
This is per draft-funk-tls-inner-application-extension-01.  This
functionality is added to libgnutls-extra, so it is licensed under the
GNU General Public License.

** New APIs to access the TLS Pseudo-Random-Function (PRF).
The PRF is used by some protocols building on TLS, such as EAP-PEAP
and EAP-TTLS.  One function to access the raw PRF and one to access
the PRF seeded with the client/server random fields are provided.
Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.

** New APIs to acceess the client and server random fields in a session.
These fields can be useful by protocols using TLS.  Note that these
fields are typically used as input to the TLS PRF, and if this is your
intended use, you should use the TLS PRF API that use the
client/server random field directly.  Suggested by Jouni Malinen
<jkmaline@cc.hut.fi>.

** Internal type cleanups.
The uint8, uint16, uint32 types have been replaced by uint8_t,
uint16_t, uint32_t.  Gnulib is used to guarantee the presence of
correct types on platforms that lack them.  The uint type have been
replaced by unsigned.

** API and ABI modifications:
New functions to invoke the TLS Pseudo-Random-Function (PRF):
  gnutls_prf
  gnutls_prf_raw

New functions to retrieve the session's client and server random values:
  gnutls_session_get_server_random
  gnutls_session_get_client_random

New function, to perform TLS/IA handshake:
  gnutls_ia_handshake

New function to decide whether to do a TLS/IA handshake:
  gnutls_ia_handshake_p

New functions to allocate a TLS/IA credential:
  gnutls_ia_allocate_client_credentials
  gnutls_ia_free_client_credentials
  gnutls_ia_allocate_server_credentials
  gnutls_ia_free_server_credentials

New functions to handle the AVP callback:
  gnutls_ia_set_client_avp_function
  gnutls_ia_set_client_avp_ptr
  gnutls_ia_get_client_avp_ptr
  gnutls_ia_set_server_avp_function
  gnutls_ia_set_server_avp_ptr
  gnutls_ia_get_server_avp_ptr

New functions, to toggle TLS/IA application phases:
  gnutls_ia_require_inner_phase

New function to mix session keys with inner secret:
  gnutls_ia_permute_inner_secret

Low-level API (used internally by gnutls_ia_handshake):
  gnutls_ia_endphase_send
  gnutls_ia_send
  gnutls_ia_recv

New functions that can be used after successful TLS/IA negotiation:
  gnutls_ia_generate_challenge
  gnutls_ia_extract_inner_secret

Enum type with TLS/IA modes:
  gnutls_ia_mode_t

Enum type with TLS/IA packet types:
  gnutls_ia_apptype_t

Enum values for TLS/IA alerts:
  GNUTLS_A_INNER_APPLICATION_FAILURE
  GNUTLS_A_INNER_APPLICATION_VERIFICATION

New error codes, to signal when an application phase has finished:
  GNUTLS_E_WARNING_IA_IPHF_RECEIVED
  GNUTLS_E_WARNING_IA_FPHF_RECEIVED

New error code to signal TLS/IA verify failure:
  GNUTLS_E_IA_VERIFY_FAILED

* Version 1.3.1 (released 2005-12-08)

** Support for DHE-PSK cipher suites has been added.
This method offers perfect forward secrecy.

** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.

** Corrected a bug in certtool for 64 bit machines. Reported
by Max Kellermann <max@duempel.org>.

** New function to set a X.509 private key and certificate pairs, and/or
CRLs, from an PKCS#12 file, suggested by Emile van Bergen
<emile@e-advies.nl>.

The integrity of the PKCS#12 file is protected through a password
based MAC; public-key based signatures for integrity protection are
not supported.  PKCS#12 bags may be encrypted using password derived
symmetric keys, public-key based encryption is not supported.  The
PKCS#8 keys may be encrypted using passwords.  The API use the same
password for all operations.  We believe that any more flexibility
create too much complexity that would hurt overall security, but may
add more PKCS#12 related APIs if real-world experience indicate
otherwise.

** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys,
reported by Emile van Bergen <emile@e-advies.nl>.
This will enable "certtool -k -8" to parse those keys.

** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords.
Use "certtool -p -8" and press press enter at the prompt.  Earlier,
certtool would have encrypted the key using an empty password.

** Certtool now accept --password for --key-info and encrypted PKCS#8 keys.
Earlier it would have prompted the user for it, even if --password was
supplied.

** Added self test of PKCS#8 parsing.
Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and
pbeWithSHAAnd40BitRC2-CBC) formats are tested.  The test is in
tests/pkcs8.

** API and ABI modifications:
New function to set X.509 credentials from a PKCS#12 file:
  gnutls_certificate_set_x509_simple_pkcs12_file

New gnutls_kx_algorithm_t enum type:
  GNUTLS_KX_DHE_PSK

New API to return session data (better data types than
gnutls_session_get_data):
  gnutls_session_get_data2

New API to set PSK Diffie-Hellman parameters:
  gnutls_psk_set_server_dh_params

* Version 1.3.0 (2005-11-15)

** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added.
This add several new APIs, see below.  Read the updated manual for
more information.  A new self test "pskself" has been added, that will
test this functionality.

** The session resumption data are now system independent.

** The code has been re-indented to conform to the GNU coding style.

** Removed the RIPEMD ciphersuites.

** Added a discussion of the internals of gnutls in manual.

** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin.

** Remove trailing comma in enums, for IBM C v6, from Albert Chin.

** Make sure config.h is included first in a few files, from Albert Chin.

** Don't use C++ comments ("//") as they are invalid, from Albert Chin.

** Don't install SRP programs and man pages if --disable-srp-authentication,
from Albert Chin.

** API and ABI modifications:
New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK

New gnutls_credentials_type_t credential type:
  GNUTLS_CRD_PSK

New credential types:
  gnutls_psk_server_credentials_t
  gnutls_psk_client_credentials_t

New functions to allocate PSK credentials:
  gnutls_psk_allocate_client_credentials
  gnutls_psk_free_client_credentials
  gnutls_psk_free_server_credentials
  gnutls_psk_allocate_server_credentials

New enum type for PSK key flags:
  gnutls_psk_key_flags

New function prototypes for credential callback:
  gnutls_psk_client_credentials_function
  gnutls_psk_server_credentials_function

New function to set PSK username and key:
  gnutls_psk_set_client_credentials

New function to set PSK passwd file:
  gnutls_psk_set_server_credentials_file

New function to extract PSK user in server:
  gnutls_psk_server_get_username

New functions to set PSK callback:
  gnutls_psk_set_server_credentials_function
  gnutls_psk_set_client_credentials_function

Use size_t instead of int for output size parameter:
  gnutls_srp_base64_encode
  gnutls_srp_base64_decode


To generate a diff of this commit:
cvs rdiff -r1.37 -r1.38 pkgsrc/security/gnutls/Makefile
cvs rdiff -r1.15 -r1.16 pkgsrc/security/gnutls/PLIST
cvs rdiff -r1.22 -r1.23 pkgsrc/security/gnutls/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.