http://permalink.gmane.org/gmane.network.gnutls.general hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.network.gnutls.general/3177 <pre>Hello again, For what it's worth, I could finally complete the build after making the following change: index 790cdb1..c1b9867 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am &lt; at &gt;&lt; at &gt; -141,6 +141,7 &lt; at &gt;&lt; at &gt; endif if ENABLE_NETTLE libgnutls_la_LIBADD += nettle/libcrypto.la +thirdparty_libadd += $(NETTLE_LIBS) $(HOGWEED_LIBS) $(GMP_LIBS) endif if HAVE_LD_OUTPUT_DEF Best regards, Sébastien. _______________________________________________ Gnutls-help mailing list Gnutls-help&lt; at &gt;lists.gnutls.org http://lists.gnupg.org/mailman/listinfo/gnutls-help</pre> Sebastien Decugis 2013-06-19T04:14:33 http://permalink.gmane.org/gmane.network.gnutls.general/3176 <pre>Hello, I am trying to build latest gnutls from source, and I encounter an issue. My system is Ubuntu Precise. I have installed all dependencies as described in README-alpha. In addition, I have built from source and installed under my home folder the latest automake and nettle. [Side comment, when I ran "make bootstrap" I encountered an issue already reported here about missing src/libopts/Makefile.in, and I had to run "autoreconf -fvi" to fix it. Is it normal? It could be worth writing this in the README-alpha file...] I am now encountering an error when I try to make GNUTLS: make[4]: Entering directory `/home/thedoc/sources/gnutls-latest/src/crywrap' CC crywrap.o crywrap.c: In function '_crywrap_do_one': crywrap.c:867:9: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] crywrap.c:868:9: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] crywrap.c: In function '_crywrap_setup_pidfile': crywrap.c:819:10: warning: ignoring return value of</pre> Sebastien Decugis 2013-06-18T11:21:08 http://permalink.gmane.org/gmane.network.gnutls.general/3175 <pre> Hello, The examples on the web work only on the applicable version, which it typically the latest released. It is better to stick in the documentation shipped by your system libraries, if you'd like to use them, or just install the latest gnutls version. regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-17T09:44:40 http://permalink.gmane.org/gmane.network.gnutls.general/3174 <pre>Hi I want to embed gnutls into my application, currently i am playing with exmples included with gnutls. Examples work fine. The problem is when i standalone compile the simple X.509 example at http://www.gnutls.org/manual/gnutls.html#Echo-server-with-X_002e509-authentication, i am getting compile errors. Here is my Makefile CC=gcc CFLAGS= -g \ -I./gnutls CFILES = server_x509.c LIBS = -lgnutls all: server server: $(CC) $(CFILES) $(CFLAGS) $(LIBS) -o server_x509 clean: rm -f server_x509 Compile error i am getting $ make -f Makefile gcc server_x509.c -g -I./gnutls -lgnutls -o server_x509 /tmp/cc6UmJrw.o: In function `main': /home/ma1/OS/1GNUTLS/examples/server_x509.c:126: undefined reference to `gnutls_transport_set_int2' collect2: error: ld returned 1 exit status make: *** [server] Error 1 How to fix this error? So, can anyone tell me how to embed gnutls to an application or is there any guide available for this? Regards _______________________________________________ Gnutls-help mailing list </pre> mammar 2013-06-17T07:11:17 http://permalink.gmane.org/gmane.network.gnutls.general/3173 <pre> That's pretty interesting issue. I would expect that the presence of those files would improve any issues in linking rather than cause new ones. May I ask you to report your issue to the libtool [0] people (and keep me CC if possible)? [0]. http://www.gnu.org/software/libtool/ regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-13T14:12:10 http://permalink.gmane.org/gmane.network.gnutls.general/3172 <pre> Indeed, this appears to be the problem. If I (temporarily) remove *all* the .la files from /usr/lib64 then build Gnutls: everything works and, after installation: $ ldd /usr/local/lib/libgnutls.so linux-vdso.so.1 (0x00007fff437ff000) libz.so.1 =&gt; /usr/lib64/libz.so.1 (0x00007fc9247c2000) libp11-kit.so.0 =&gt; /usr/lib64/libp11-kit.so.0 (0x00007fc9245b0000) libtasn1.so.6 =&gt; /usr/local/lib/libtasn1.so.6 (0x00007fc92439d000) libnettle.so.4 =&gt; /usr/local/lib/libnettle.so.4 (0x00007fc92416c000) libhogweed.so.2 =&gt; /usr/local/lib/libhogweed.so.2 (0x00007fc923f3d000) libc.so.6 =&gt; /lib64/libc.so.6 (0x00007fc923b4f000) libdl.so.2 =&gt; /lib64/libdl.so.2 (0x00007fc92394b000) libpthread.so.0 =&gt; /lib64/libpthread.so.0 (0x00007fc92372e000) libgmp.so.10 =&gt; /usr/local/lib/libgmp.so.10 (0x00007fc9234b6000) /lib64/ld-linux-x86-64.so.2 (0x00007fc924ce5000) Fine. But I am unable to find *which* .la files cause problems; if I remove only: libgmp.la libgmpxx.la libgnu</pre> Marco Maggi 2013-06-12T19:06:54 http://permalink.gmane.org/gmane.network.gnutls.general/3171 <pre>On Mon, Jun 10, 2013 at 4:43 AM, Sebastien Decugis &lt;sdecugis&lt; at &gt;freediameter.net&gt; wrote: Check gnutls_prf(). That allows access to the key material exporter. Currently hooks are allowed after client hello (post_client_hello) and when a certificate is received. Most probably a hook to intercept the handshake before or after any arbitrary handshake message would be useful here. I'll try to add such functionality to 3.2 releases (in addition with an API to disable the replay protection). The window size is 64 after gnutls 3.1.0 (may be 32 on 3.0.x). That would be nice. regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-10T08:04:33 http://permalink.gmane.org/gmane.network.gnutls.general/3170 <pre>Hi Nikos, This is a very good question :) I have done some more research and it appears that yes, when using DTLS over SCTP, the SCTP-AUTH extension must be used and this extension provides the anti-replay detection at the SCTP layer. When the extension is not used, there is a "light" protection in SCTP that is probably not sufficient to protect against malicious attacks. However, I realize that in order to use this SCTP-AUTH extension, more interaction between GNU TLS and the SCTP stack is required, in particular: - support for DTLS Keying Material Exporters as described in RFC5705 ( I did not find in the documentation if this is supported in GNU TLS), - ability to be notified *during* handshake so that the new derived key can be set for SCTP-AUTH before the "Finished" message is sent. Would you have any advice about these additional requirements? I am going to start implementing DTLS over SCTP without using the SCTP-AUTH mechanism and without disabling the replay protection in a first step. Can you </pre> Sebastien Decugis 2013-06-10T02:43:19 http://permalink.gmane.org/gmane.network.gnutls.general/3169 <pre> My Debian doesn't ship those files, so could it be them that prohibit the correct linkage? </pre> Nikos Mavrogiannopoulos 2013-06-08T18:21:14 http://permalink.gmane.org/gmane.network.gnutls.general/3168 <pre> Your understanding looks correct, having a method to disable the replay protection may seem reasonable then. How would malicious replays be detected in that case? Does the SCTP/DTLS protocol include it? http://gnutls.org/manual/gnutls.html#index-gnutls_005fheartbeat_005fset_005ftimeouts Thanks. I've now corrected it. regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-08T18:18:36 http://permalink.gmane.org/gmane.network.gnutls.general/3167 <pre>Thank you for your answers Nikos, more comments inline. I plan to use several streams over SCTP, and send my application messages (Diameter messages) over each streams in turn. Let's imagine I have a large message (1^14 bytes) followed by a series of very short messages (few bytes). On the sending side, I am sending a first record with sequence number #1 over stream #1, length is 1^14 (I am simplifying). Then short record #2 over stream #2, record #3 over stream #3, etc... Because the payload sizes are different, on the receiving side the messages for streams #2, #3, ... get delivered first and successfully parsed by the DTLS layer. If I undertand correctly, the anti-replay protection might cause the record with sequence #1 to be discarded if it is delivered "too late" with respect to the sequence number. Is it correct? This would be an issue for the upper layer, hence the requirement in RFC 6083 to disable it. I apologize if my understanding is incorrect, I am new to DTLS... Ok, thank you f</pre> Sebastien Decugis 2013-06-08T02:19:49 http://permalink.gmane.org/gmane.network.gnutls.general/3166 <pre> Yes, the Slackware packages include the .la files of the original distributions; I think the relevant ones are: /usr/lib64/libp11-kit.la /usr/lib64/libgmp.la /usr/lib64/libgnutls.la the latest Slackware comes with Gnutls 3.0.23. </pre> Marco Maggi 2013-06-07T20:05:20 http://permalink.gmane.org/gmane.network.gnutls.general/3165 <pre>hi, this message might not fit the topic but might be related to these problems regarding nettle. i installed nettle using a custom --prefix=/home/... gnutls 3.2.1 configure script is invoked with a PKG_CONFIG_PATH=/home/... pointing to right pkgconfig location underneath the prefix. unfortunately gnutls doesn't use the values supplied by pkgconfig. the makefile „x509/Makefile“ contains the right include path NETTLE_CFLAGS but the values isn't passed to the compiler later on. gcc can't find „&lt;nettle/memxor.h&gt;“ regards joke On Friday 07 June 2013 08:41:23 Nikos Mavrogiannopoulos wrote: _______________________________________________ Gnutls-help mailing list Gnutls-help&lt; at &gt;lists.gnutls.org http://lists.gnupg.org/mailman/listinfo/gnutls-help</pre> Joke de Buhr 2013-06-07T15:30:41 http://permalink.gmane.org/gmane.network.gnutls.general/3164 <pre>On Fri, Jun 7, 2013 at 12:09 PM, Sebastien Decugis &lt;sdecugis&lt; at &gt;freediameter.net&gt; wrote: Hello, Currently there is no way to disable anti-replay protection. Would it really matter though? If you say there are no replays over SCTP what would this disabling buy? No. gnutls_heartbeat_set_timeouts() is relevant to heartbeat message retransmission, not the DTLS handshake. There is (again) no direct way to disable those timeouts, but you can always set a retransmission timeout that is larger than the total handshake timeout, which is equivalent to having no retransmissions. You can set that using gnutls_dtls_set_timeouts(). regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-07T12:37:35 http://permalink.gmane.org/gmane.network.gnutls.general/3163 <pre>Hello, I am looking at implementing DTLS over SCTP (as per RFC 6083) in my application, and I noticed that one of the requirements is to disable the anti-replay protection, as the higher layer expects reliable delivery above SCTP link. Could you tell me if this can be done with GNUTLS ? I was not able to find any information in gnutls manual about this feature. I also noticed that the retransmissions must be disabled for the handshake protocol, I think this can be done with gnutls_heartbeat_set_timeouts by setting a retrains_timeout greater than the total_timeout; can you confirm? Thank you in advance! Best regards, Sebastien. </pre> Sebastien Decugis 2013-06-07T10:09:30 http://permalink.gmane.org/gmane.network.gnutls.general/3162 <pre> Hello, I have exactly the same situation in my system but never experienced what you describe. [...] Do you have in /usr/lib64, any .la files? regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-07T06:41:23 http://permalink.gmane.org/gmane.network.gnutls.general/3161 <pre> Sorry for the very late reply and for this very long message. Unfortunately Gnutls 3.2.1 still does not work. To recapitulate: * I have the libraries: $ ls -1 \ /usr/lib64/libgmp.so \ /usr/lib64/libnettle.so \ /usr/lib64/libhogweed.so \ /usr/lib64/libtasn1.so /usr/lib64/libgmp.so /usr/lib64/libhogweed.so /usr/lib64/libnettle.so /usr/lib64/libtasn1.so $ ls -1 \ /usr/local/lib/libgmp.so \ /usr/local/lib/libnettle.so \ /usr/local/lib/libhogweed.so \ /usr/local/lib/libtasn1.so /usr/local/lib/libgmp.so /usr/local/lib/libhogweed.so /usr/local/lib/libnettle.so /usr/local/lib/libtasn1.so * I have the ld config file $ cat /etc/ld.so.conf /usr/local/lib /usr/local/lib64 ... and see the libraries: $ /sbin/ldconfig -p | grep '\(gmp\|tasn1\|nettle\|hogweed\)' libtasn1.so.6 (libc6,x86-64) =&gt; /usr/local/lib/libtasn1.so.6 libtasn1.so.3 (libc6,x86-64) =&gt; /usr/lib64/libtasn</pre> Marco Maggi 2013-06-06T19:19:50 http://permalink.gmane.org/gmane.network.gnutls.general/3160 <pre>Hello, I would like to know if anyone has implemented DTLS over SCTP with GnuTLS, or at least had a look at RFC6083 ? Would you have any advice about the amount of work that will be required to support this mechanism ? Thank you in advance for any information! Best regards, Sébastien _______________________________________________ Gnutls-help mailing list Gnutls-help&lt; at &gt;lists.gnutls.org http://lists.gnupg.org/mailman/listinfo/gnutls-help</pre> Sebastien Decugis 2013-06-04T10:10:47 http://permalink.gmane.org/gmane.network.gnutls.general/3159 <pre> Thanks. It seems that this was reported few days ago. A fix is already in the repository but the bug is on the testsuite so you can ignore it. regards, Nikos </pre> Nikos Mavrogiannopoulos 2013-06-03T19:23:40 http://permalink.gmane.org/gmane.network.gnutls.general/3158 <pre> One note: for 3.2.1, a test fails on i686: pem-decoding http://hydra.nixos.org/build/5222124/nixlog/1/tail-reload It looks like related to a date limit on 32-bit timestamps. On x86_64 it works fine. 3.1.12 works fine. Thank you, Lluís. </pre> Lluís Batlle i Rossell 2013-06-03T13:01:55 http://permalink.gmane.org/gmane.network.gnutls.general/3157 <pre> Right, now wget works perfect, thank you! </pre> Lluís Batlle i Rossell 2013-06-03T10:18:32 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.network.gnutls.general