glib2 2.1.0-x86-mingw32 → 2.2.0-x86-mingw32

data/vendor/local/share/info/gnutls.info-1

@@ -1,7 +1,6 @@
-This is gnutls.info, produced by makeinfo version 5.1 from gnutls.texi.
+This is gnutls.info, produced by makeinfo version 5.2 from gnutls.texi.
 
-This manual is last updated 10 November 2013 for version 3.2.7 of
-GnuTLS.
+This manual is last updated 1 January 2014 for version 3.2.12 of GnuTLS.
 
 Copyright (C) 2001-2013 Free Software Foundation, Inc.\\ Copyright (C)
 2001-2013 Nikos Mavrogiannopoulos
@@ -33,8 +32,7 @@ File: gnutls.info,  Node: Top,  Next: Preface,  Up: (dir)
 GnuTLS
 ******
 
-This manual is last updated 10 November 2013 for version 3.2.7 of
-GnuTLS.
+This manual is last updated 1 January 2014 for version 3.2.12 of GnuTLS.
 
 Copyright (C) 2001-2013 Free Software Foundation, Inc.\\ Copyright (C)
 2001-2013 Nikos Mavrogiannopoulos
@@ -94,8 +92,7 @@ most of it.  A good introduction to networking can be found in
 engineering in [_ANDERSON_].
 
 Updated versions of the GnuTLS software and this document will be
-available from <http://www.gnutls.org/> and
-<http://www.gnu.org/software/gnutls/>.
+available from <http://www.gnutls.org/>.
 
 
 File: gnutls.info,  Node: Introduction to GnuTLS,  Next: Introduction to TLS,  Prev: Preface,  Up: Top
@@ -183,22 +180,24 @@ may get libz from <http://www.zlib.net/>, p11-kit from
 A few 'configure' options may be relevant, summarized below.  They
 disable or enable particular features, to create a smaller library with
 only the required features.  Note however, that although a smaller
-library is generated, the included programs are not guarranteed to
+library is generated, the included programs are not guaranteed to
 compile if some of these options are given.
 
 --disable-srp-authentication
 --disable-psk-authentication
 --disable-anon-authentication
+--disable-openpgp-authentication
 --disable-dhe
 --disable-ecdhe
---disable-rsa-export
---disable-extra-pki
---disable-openpgp-authentication
 --disable-openssl-compatibility
+--disable-dtls-srtp-support
+--disable-alpn-support
+--disable-heartbeat-support
 --disable-libdane
 --without-p11-kit
---with-tpm
---disable-dtls-srtp-support
+--without-tpm
+--without-zlib
+
 
 For the complete list, refer to the output from 'configure --help'.
 
@@ -502,7 +501,7 @@ GnuTLS server side.
 If compatibility with such devices is a concern, not sending
 length-hidden messages solves the problem by using minimal padding.
 
-If you implement an application that have a configuration file, we
+If you implement an application that has a configuration file, we
 recommend that you make it possible for users or administrators to
 specify a GnuTLS protocol priority string, which is used by your
 application via *note gnutls_priority_set::.  To allow the best
@@ -744,8 +743,8 @@ File: gnutls.info,  Node: Session tickets,  Next: HeartBeat,  Prev: Server name
 3.6.3 Session tickets
 ---------------------
 
-To resume a TLS session the server normally store session parameters.
-This complicates deployment, and could be avoiding by delegating the
+To resume a TLS session, the server normally stores session parameters.
+This complicates deployment, and can be avoided by delegating the
 storage to the client.  Because session parameters are sensitive they
 are encrypted and authenticated with a key only known to the server and
 then sent to the client.  The Session Tickets extension is described in
@@ -798,9 +797,10 @@ traffic to an other server who will see this traffic as an initial
 negotiation attempt.
 
 This might be seen as a valid design decision, but it seems it was not
-widely known or understood, thus today some application protocols the
-TLS renegotiation feature in a manner that enables a malicious server to
-insert content of his choice in the beginning of a TLS session.
+widely known or understood, thus today some application protocols use
+the TLS renegotiation feature in a manner that enables a malicious
+server to insert content of his choice in the beginning of a TLS
+session.
 
 The most prominent vulnerability was with HTTPS. There servers request a
 renegotiation to enforce an anonymous user to use a certificate in order
@@ -1845,7 +1845,7 @@ gnutls_certificate_verify_flags.
 
 'GNUTLS_VERIFY_DISABLE_CA_SIGN'
      If set a signer does not have to be a certificate authority.  This
-     flag should normaly be disabled, unless you know what this means.
+     flag should normally be disabled, unless you know what this means.
 'GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT'
      Allow trusted CA certificates with version 1.  This is safer than
      'GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT' , and should be used
@@ -3115,7 +3115,6 @@ to 'more'.  Both will exit with a status code of 0.
                                      - prohibits the option 'infile'
         -e, --verify-chain         Verify a PEM encoded certificate chain
             --verify               Verify a PEM encoded certificate chain using a trusted list
-                                     - requires the option 'load-ca-certificate'
             --verify-crl           Verify a CRL using a trusted list
                                      - requires the option 'load-ca-certificate'
             --generate-dh-params   Generate PKCS #3 encoded Diffie-Hellman parameters
@@ -3130,7 +3129,7 @@ to 'more'.  Both will exit with a status code of 0.
             --load-ca-certificate=str Loads the certificate authority's certificate file
             --password=str         Password to use
             --hex-numbers          Print big number in an easier format to parse
-            --cprint               In certain operations it prints the information is C-friendly format
+            --cprint               In certain operations it prints the information in C-friendly format
             --null-password        Enforce a NULL password
         -i, --certificate-info     Print information on the given certificate
             --certificate-pubkey   Print certificate's public key
@@ -3150,23 +3149,24 @@ to 'more'.  Both will exit with a status code of 0.
                                      - requires the option 'load-certificate'
             --to-p8                Generate a PKCS #8 structure
         -8, --pkcs8                Use PKCS #8 format for private keys
-            --rsa                  Generate RSA key
-            --dsa                  Generate DSA key
-            --ecc                  Generate ECC (ECDSA) key
-            --ecdsa                an alias for the 'ecc' option
-            --hash=str             Hash algorithm to use for signing
-            --inder                Use DER format for input certificates, private keys, and DH parameters
+        -!, --rsa                  Generate RSA key
+        -", --dsa                  Generate DSA key
+        -#, --ecc                  Generate ECC (ECDSA) key
+        -$, --ecdsa                an alias for the 'ecc' option
+        -%, --hash=str             Hash algorithm to use for signing
+        -&, --inder                Use DER format for input certificates, private keys, and DH parameters
                                      - disabled as '--no-inder'
-            --inraw                an alias for the 'inder' option
-            --outder               Use DER format for output certificates, private keys, and DH parameters
+        -', --inraw                an alias for the 'inder' option
+        -(, --outder               Use DER format for output certificates, private keys, and DH parameters
                                      - disabled as '--no-outder'
-            --outraw               an alias for the 'outder' option
-            --bits=num             Specify the number of bits for key generate
-            --sec-param=str        Specify the security level [low, legacy, normal, high, ultra]
-            --disable-quick-random  No effect
-            --template=file        Template file to use for non-interactive operation
+        -), --outraw               an alias for the 'outder' option
+        -*, --bits=num             Specify the number of bits for key generate
+        -+, --sec-param=str        Specify the security level [low, legacy, normal, high, ultra]
+        -,, --disable-quick-random  No effect
+        --, --template=file        Template file to use for non-interactive operation
                                      - file must pre-exist
-            --pkcs-cipher=str      Cipher to use for PKCS #8 and #12 operations
+        -., --ask-pass             Enable interaction for entering password when in batch mode.
+        -/, --pkcs-cipher=str      Cipher to use for PKCS #8 and #12 operations
         -v, --version[=arg]        output version information and exit
         -h, --help                 display extended usage information and exit
         -!, --more-help            extended usage information passed thru pager
@@ -3178,7 +3178,7 @@ to 'more'.  Both will exit with a status code of 0.
      It can be used interactively or non interactively by specifying the
      template command line option.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -3208,13 +3208,9 @@ verify option
 .............
 
 This is the "verify a pem encoded certificate chain using a trusted
-list" option.
-
-This option has some usage constraints.  It:
-   * must appear in combination with the following options:
-     load-ca-certificate.
-
-The trusted certificate list must be loaded with -load-ca-certificate.
+list" option.  The trusted certificate list can be loaded with
+-load-ca-certificate.  If no certificate list is provided, then the
+system's certificate list is used.
 
 verify-crl option
 .................
@@ -3270,9 +3266,9 @@ PKCS #11 URL
 cprint option
 .............
 
-This is the "in certain operations it prints the information is
+This is the "in certain operations it prints the information in
 c-friendly format" option.  In certain operations it prints the
-information is C-friendly format, suitable for including into C
+information in C-friendly format, suitable for including into C
 programs.
 
 null-password option
@@ -3377,6 +3373,14 @@ This is the "specify the security level [low, legacy, normal, high,
 ultra]" option.  This option takes a string argument 'Security
 parameter'.  This is alternative to the bits option.
 
+ask-pass option
+...............
+
+This is the "enable interaction for entering password when in batch
+mode."  option.  This option will enable interaction to enter password
+when in batch mode.  That is useful when the template option has been
+specified.
+
 pkcs-cipher option
 ..................
 
@@ -3577,6 +3581,7 @@ certificate request or a self signed certificate follows.
      #dn = "cn=Nik,st=Attiki,C=GR,surName=Mavrogiannopoulos,2.5.4.9=Arkadias"
 
      # The serial number of the certificate
+     # Comment the field for a time-based serial number.
      serial = 007
 
      # In how many days, counting from today, this certificate will expire.
@@ -3697,6 +3702,7 @@ certificate request or a self signed certificate follows.
      # this is the 5th CRL by this CA
      #crl_number = 5
 
+
 
 File: gnutls.info,  Node: ocsptool Invocation,  Next: danetool Invocation,  Prev: certtool Invocation,  Up: More on certificate authentication
 
@@ -3741,7 +3747,7 @@ to 'more'.  Both will exit with a status code of 0.
         -i, --request-info         Print information on a OCSP request
         -j, --response-info        Print information on a OCSP response
         -q, --generate-request     Generate an OCSP request
-            --nonce                Don't add nonce to OCSP request
+            --nonce                Use (or not) a nonce to OCSP request
                                      - disabled as '--no-nonce'
             --load-issuer=file     Read issuer certificate from file
                                      - file must pre-exist
@@ -3769,7 +3775,7 @@ to 'more'.  Both will exit with a status code of 0.
      Ocsptool is a program that can parse and print information about OCSP
      requests/responses, generate requests and verify responses.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -3992,7 +3998,7 @@ to 'more'.  Both will exit with a status code of 0.
 
      Tool to generate and check DNS resource records for the DANE protocol.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -4348,7 +4354,7 @@ to 'more'.  Both will exit with a status code of 0.
      file that holds the users and the verifiers associated with them and the
      configuration file to hold the group parameters (called tpasswd.conf).
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -4501,7 +4507,7 @@ to 'more'.  Both will exit with a status code of 0.
      Program that generates random keys for use with TLS-PSK.  The keys are
      stored in hexadecimal format in a key file.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -5136,24 +5142,29 @@ File: gnutls.info,  Node: PKCS11 Initialization,  Next: Accessing objects that r
 5.2.1 Initialization
 --------------------
 
-To allow all the GnuTLS applications to access PKCS #11 tokens you can
-use a configuration per module, stored in '/etc/pkcs11/modules/'.  These
-are the configuration files of p11-kit(1).  For example a file that will
-load the OpenSC module, could be named '/etc/pkcs11/modules/opensc' and
-contain the following:
+To allow all GnuTLS applications to transparently access smard cards and
+tokens, PKCS #11 is automatically initialized during the global
+initialization (see *note gnutls_global_init::).  The initialization
+function, to select which modules to load reads certain module
+configuration files.  Those are stored in '/etc/pkcs11/modules/' and are
+the configuration files of p11-kit(1).  For example a file that will
+load the OpenSC module, could be named
+'/etc/pkcs11/modules/opensc.module' and contain the following:
 
      module: /usr/lib/opensc-pkcs11.so
 
-If you use this file, then there is no need for other initialization in
-GnuTLS, except for the PIN and token functions (see next section).  In
-several cases, however, it is desirable to limit badly behaving modules
-(e.g., modules that add an unacceptable delay on initialization) to
-single applications.  That can be done using the "enable-in:" option
-followed by the base name of applications that this module should be
-used.
+If you use these configuration files, then there is no need for other
+initialization in GnuTLS, except for the PIN and token functions (see
+next section).  In several cases, however, it is desirable to limit
+badly behaving modules (e.g., modules that add an unacceptable delay on
+initialization) to single applications.  That can be done using the
+"enable-in:" option followed by the base name of applications that this
+module should be used.
 
-In all cases, you may also manually initialize the PKCS #11 subsystem if
-the default settings are not desirable.
+In all cases, you can also manually initialize the PKCS #11 subsystem if
+the default settings are not desirable.  To completely disable PKCS #11
+support you need to call *note gnutls_pkcs11_init:: with the flag
+'GNUTLS_PKCS11_FLAG_MANUAL' prior to *note gnutls_global_init::.
 
  -- Function: int gnutls_pkcs11_init (unsigned int FLAGS, const char *
           DEPRECATED_CONFIG_FILE)
@@ -5544,6 +5555,8 @@ to 'more'.  Both will exit with a status code of 0.
             --list-all-certs       List all available certificates in a token
             --list-certs           List all certificates that have an associated private key
             --list-all-privkeys    List all available private keys in a token
+            --list-privkeys        an alias for the 'list-all-privkeys' option
+            --list-keys            an alias for the 'list-all-privkeys' option
             --list-all-trusted     List all available certificates marked as trusted
             --initialize           Initializes a PKCS #11 token
             --write                Writes the loaded objects to a PKCS #11 token
@@ -5558,8 +5571,11 @@ to 'more'.  Both will exit with a status code of 0.
             --private              Marks the object to be written as private
                                      - disabled as '--no-private'
                                      - enabled by default
-            --login                Force login to token
+            --login                Force (user) login to token
                                      - disabled as '--no-login'
+            --so-login             Force security officer login to token
+                                     - disabled as '--no-so-login'
+            --admin-login          an alias for the 'so-login' option
             --detailed-url         Print detailed URLs
                                      - disabled as '--no-detailed-url'
             --secret-key=str       Provide a hex encoded secret key
@@ -5572,13 +5588,13 @@ to 'more'.  Both will exit with a status code of 0.
         -8, --pkcs8                Use PKCS #8 format for private keys
             --bits=num             Specify the number of bits for key generate
             --sec-param=str        Specify the security level
-            --inder                Use DER/RAW format for input
+        -!, --inder                Use DER/RAW format for input
                                      - disabled as '--no-inder'
-            --inraw                an alias for the 'inder' option
-            --outder               Use DER format for output certificates, private keys, and DH parameters
+        -", --inraw                an alias for the 'inder' option
+        -#, --outder               Use DER format for output certificates, private keys, and DH parameters
                                      - disabled as '--no-outder'
-            --outraw               an alias for the 'outder' option
-            --provider=file        Specify the PKCS #11 provider library
+        -$, --outraw               an alias for the 'outder' option
+        -%, --provider=file        Specify the PKCS #11 provider library
                                      - file must pre-exist
         -v, --version[=arg]        output version information and exit
         -h, --help                 display extended usage information and exit
@@ -5599,7 +5615,7 @@ to 'more'.  Both will exit with a status code of 0.
      To provide the PIN for all the operations below use the environment
      variable GNUTLS_PIN.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -5615,6 +5631,24 @@ of trust" option.  Exports the certificate specified by the URL and
 generates its chain of trust based on the stored certificates in the
 module.
 
+list-all-privkeys option
+........................
+
+This is the "list all available private keys in a token" option.  Lists
+all the private keys in a token that match the specified URL.
+
+list-privkeys option
+....................
+
+This is an alias for the 'list-all-privkeys' option, *note the
+list-all-privkeys option documentation: p11tool list-all-privkeys.
+
+list-keys option
+................
+
+This is an alias for the 'list-all-privkeys' option, *note the
+list-all-privkeys option documentation: p11tool list-all-privkeys.
+
 write option
 ............
 
@@ -5657,6 +5691,22 @@ This option has some usage constraints.  It:
 
 The written object will require a PIN to be used.
 
+so-login option
+...............
+
+This is the "force security officer login to token" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-so-login.
+
+Forces login to the token as security officer (admin).
+
+admin-login option
+..................
+
+This is an alias for the 'so-login' option, *note the so-login option
+documentation: p11tool so-login.
+
 sec-param option
 ................
 
@@ -5765,6 +5815,9 @@ usage of RSA keys, but has quite some operational differences from PKCS
 #11 module, and thus require different handling.  The basic TPM
 operations supported and used by GnuTLS, are key generation and signing.
 
+The next sections assume that the TPM chip in the system is already
+initialized and in a operational state.
+
 In GnuTLS the TPM functionality is available in 'gnutls/tpm.h'.
 
 * Menu:
@@ -6031,7 +6084,7 @@ to 'more'.  Both will exit with a status code of 0.
 
      Program that allows handling cryptographic data from the TPM chip.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 .................
@@ -6360,6 +6413,10 @@ recommended.  An example of non-native thread usage is shown below.
         gnutls_global_init();
      }
 
+Note that *note gnutls_global_init:: is itself not thread safe.  It is
+also not recommended to initialize it on every available thread, but if
+need to, it should be protected using mutex locks.
+
  -- Function: void gnutls_global_set_mutex (mutex_init_func INIT,
           mutex_deinit_func DEINIT, mutex_lock_func LOCK,
           mutex_unlock_func UNLOCK)
@@ -6439,11 +6496,13 @@ File: gnutls.info,  Node: Initialization,  Next: Version check,  Prev: Headers,
 
 GnuTLS must be initialized before it can be used.  The library is
 initialized by calling *note gnutls_global_init::.  That call typically
-enables CPU-specific acceleration, and performs any requires
-precalculations needed by the library.  The resources allocated by the
-initialization process can be released if the application no longer has
-a need to call GnuTLS functions, this is done by calling *note
-gnutls_global_deinit::.
+enables CPU-specific acceleration, performs any required precalculations
+needed, and initializes subsystems that could be used later (e.g., PKCS
+#11 - see *note PKCS11 Initialization::).
+
+The resources allocated by the initialization process can be released if
+the application no longer has a need to call GnuTLS functions, this is
+done by calling *note gnutls_global_deinit::.
 
 In order to take advantage of the internationalization features in
 GnuTLS, such as translated error messages, the application must set the

data/vendor/local/share/info/gnutls.info-2

@@ -1,7 +1,6 @@
-This is gnutls.info, produced by makeinfo version 5.1 from gnutls.texi.
+This is gnutls.info, produced by makeinfo version 5.2 from gnutls.texi.
 
-This manual is last updated 10 November 2013 for version 3.2.7 of
-GnuTLS.
+This manual is last updated 1 January 2014 for version 3.2.12 of GnuTLS.
 
 Copyright (C) 2001-2013 Free Software Foundation, Inc.\\ Copyright (C)
 2001-2013 Nikos Mavrogiannopoulos
@@ -331,7 +330,7 @@ buffers.
 
      This function checks if there are unread data in the gnutls
      buffers.  If the return value is non-zero the next call to
-     'gnutls_record_recv()' is guarranteed not to block.
+     'gnutls_record_recv()' is guaranteed not to block.
 
      *Returns:* Returns the size of the data or zero.
 'INT *note gnutls_record_get_direction:: (gnutls_session_t SESSION)'
@@ -415,6 +414,11 @@ transmission.  The following functions provide that functionality.
      (i.e., the function will retry on 'GNUTLS_E_AGAIN' and
      'GNUTLS_E_INTERRUPTED' ).
 
+     If the flag 'GNUTLS_RECORD_WAIT' is not specified and the function
+     is interrupted then the 'GNUTLS_E_AGAIN' or 'GNUTLS_E_INTERRUPTED'
+     errors will be returned.  To obtain the data left in the corked
+     buffer use 'gnutls_record_check_corked()' .
+
      *Returns:* On success the number of transmitted data is returned,
      or otherwise a negative error code.
 
@@ -508,11 +512,11 @@ File: gnutls.info,  Node: Priority Strings,  Next: Selecting cryptographic key s
 6.10 Priority strings
 =====================
 
-In order to specify cipher suite preferences on a TLS session there are
-priority functions that accept a string specifying the enabled for the
-handshake algorithms.  That string may contain a single initial keyword
-such as in *note Table 6.2: tab:prio-keywords. and may be followed by
-additional algorithm or special keywords.
+The GnuTLS priority string specifies the TLS session's handshake
+algorithms and options in a compact, easy-to-use format.  That string
+may contain a single initial keyword such as in *note Table 6.2:
+tab:prio-keywords. and may be followed by additional algorithm or
+special keywords.
 
 'INT *note gnutls_priority_set_direct:: (gnutls_session_t SESSION, const char * PRIORITIES, const char ** ERR_POS)'
 'INT *note gnutls_priority_set:: (gnutls_session_t SESSION, gnutls_priority_t PRIORITY)'
@@ -531,6 +535,9 @@ NORMAL         Means all the known to be secure ciphersuites.
                fallback only.  The message authenticity
                security level is of 64 bits or more.
                
+               This priority string implicitly enables DHE and
+               ECDHE.
+               
 PFS            Means all the known to be secure ciphersuites
                that support perfect forward secrecy.  The
                ciphers are sorted by security margin, although
@@ -615,9 +622,12 @@ Key exchange   RSA, DHE-RSA, DHE-DSS, SRP, SRP-RSA, SRP-DSS,
                Catch all name is KX-ALL which will add all the
                algorithms from NORMAL priority.
                
-MAC            MD5, SHA1, SHA256, AEAD (used with GCM ciphers
-               only).  All algorithms from NORMAL priority can
-               be accessed with MAC-ALL.
+               Add '!DHE-RSA:!DHE-DSS' to the priority string
+               to disable DHE.
+               
+MAC            MD5, SHA1, SHA256, SHA384, AEAD (used with GCM
+               ciphers only).  All algorithms from NORMAL
+               priority can be accessed with MAC-ALL.
                
 Compression    COMP-NULL, COMP-DEFLATE. Catch all is COMP-ALL.
 algorithms     
@@ -691,18 +701,6 @@ Keyword                          Description
                                  version record version in
                                  client hello.
                                  
-%NEW_PADDING                     will enable the new padding
-                                 extension negotiation.  If the
-                                 new padding extension is
-                                 negotiated, GnuTLS will use a
-                                 more efficient length-hiding
-                                 mechanism.  Use *note
-                                 gnutls_record_can_use_length_hiding::
-                                 to check whether length-hiding
-                                 can be used in the current
-                                 session.  This is a GnuTLS
-                                 extension to the protocol.
-                                 
 
 Table 6.4: Special priority string keywords.
 
@@ -931,10 +929,10 @@ Client side
 
 To reduce time and roundtrips spent in a handshake the client can
 request session resumption from a server that previously shared a
-session with.  For that the client has to retrieve and store the session
-parameters.  Before establishing a new session to the same server the
-parameters must be re-associated with the GnuTLS session using *note
-gnutls_session_set_data::.
+session with the client.  For that the client has to retrieve and store
+the session parameters.  Before establishing a new session to the same
+server the parameters must be re-associated with the GnuTLS session
+using *note gnutls_session_set_data::.
 
 'INT *note gnutls_session_get_data2:: (gnutls_session_t SESSION, gnutls_datum_t * DATA)'
 'INT *note gnutls_session_get_id2:: (gnutls_session_t SESSION, gnutls_datum_t * SESSION_ID)'
@@ -4567,10 +4565,10 @@ static gnutls_x509_crt_t load_cert(const char *cert_file);
 static void _response_info(const gnutls_datum_t * data);
 static void
 _generate_request(gnutls_datum_t * rdata, gnutls_x509_crt_t cert,
-                  gnutls_x509_crt_t issuer);
+                  gnutls_x509_crt_t issuer, gnutls_datum_t *nonce);
 static int
 _verify_response(gnutls_datum_t * data, gnutls_x509_crt_t cert,
-                 gnutls_x509_crt_t signer);
+                 gnutls_x509_crt_t signer, gnutls_datum_t *nonce);
 
 /* This program queries an OCSP server.
    It expects three files. argv[1] containing the certificate to
@@ -4596,12 +4594,18 @@ int main(int argc, char *argv[])
         const char *issuer_file = argv[2];
         const char *signer_file = argv[3];
         char *hostname = NULL;
+        unsigned char noncebuf[23];
+        gnutls_datum_t nonce = { noncebuf, sizeof(noncebuf) };
 
         gnutls_global_init();
 
         if (argc > 4)
                 hostname = argv[4];
 
+        ret = gnutls_rnd(GNUTLS_RND_NONCE, nonce.data, nonce.size);
+        if (ret < 0)
+                exit(1);
+
         cert = load_cert(cert_file);
         issuer = load_cert(issuer_file);
         signer = load_cert(signer_file);
@@ -4648,7 +4652,7 @@ int main(int argc, char *argv[])
         memset(&ud, 0, sizeof(ud));
         fprintf(stderr, "Connecting to %s\n", hostname);
 
-        _generate_request(&req, cert, issuer);
+        _generate_request(&req, cert, issuer, &nonce);
 
 #ifndef NO_LIBCURL
         curl_global_init(CURL_GLOBAL_ALL);
@@ -4679,7 +4683,7 @@ int main(int argc, char *argv[])
 
         _response_info(&ud);
 
-        v = _verify_response(&ud, cert, signer);
+        v = _verify_response(&ud, cert, signer, &nonce);
 
         gnutls_x509_crt_deinit(cert);
         gnutls_x509_crt_deinit(issuer);
@@ -4745,27 +4749,21 @@ static gnutls_x509_crt_t load_cert(const char *cert_file)
 
 static void
 _generate_request(gnutls_datum_t * rdata, gnutls_x509_crt_t cert,
-                  gnutls_x509_crt_t issuer)
+                  gnutls_x509_crt_t issuer, gnutls_datum_t *nonce)
 {
         gnutls_ocsp_req_t req;
         int ret;
-        unsigned char noncebuf[23];
-        gnutls_datum_t nonce = { noncebuf, sizeof(noncebuf) };
 
         ret = gnutls_ocsp_req_init(&req);
         if (ret < 0)
                 exit(1);
 
-
         ret = gnutls_ocsp_req_add_cert(req, GNUTLS_DIG_SHA1, issuer, cert);
         if (ret < 0)
                 exit(1);
 
-        ret = gnutls_rnd(GNUTLS_RND_RANDOM, nonce.data, nonce.size);
-        if (ret < 0)
-                exit(1);
 
-        ret = gnutls_ocsp_req_set_nonce(req, 0, &nonce);
+        ret = gnutls_ocsp_req_set_nonce(req, 0, nonce);
         if (ret < 0)
                 exit(1);
 
@@ -4780,11 +4778,12 @@ _generate_request(gnutls_datum_t * rdata, gnutls_x509_crt_t cert,
 
 static int
 _verify_response(gnutls_datum_t * data, gnutls_x509_crt_t cert,
-                 gnutls_x509_crt_t signer)
+                 gnutls_x509_crt_t signer, gnutls_datum_t *nonce)
 {
         gnutls_ocsp_resp_t resp;
         int ret;
         unsigned verify;
+        gnutls_datum_t rnonce;
 
         ret = gnutls_ocsp_resp_init(&resp);
         if (ret < 0)
@@ -4798,6 +4797,15 @@ _verify_response(gnutls_datum_t * data, gnutls_x509_crt_t cert,
         if (ret < 0)
                 exit(1);
 
+	ret = gnutls_ocsp_resp_get_nonce(resp, NULL, &rnonce);
+	if (ret < 0)
+		exit(1);
+
+	if (rnonce.size != nonce->size || memcmp(nonce->data, rnonce.data,
+		nonce->size) != 0) {
+		exit(1);
+	}
+
         ret = gnutls_ocsp_resp_verify_direct(resp, signer, &verify, 0);
         if (ret < 0)
                 exit(1);
@@ -4829,6 +4837,7 @@ _verify_response(gnutls_datum_t * data, gnutls_x509_crt_t cert,
         if (verify & GNUTLS_OCSP_VERIFY_CERT_EXPIRED)
                 printf("Signer cert expired\n");
 
+        gnutls_free(rnonce.data);
         gnutls_ocsp_resp_deinit(resp);
 
         return verify;
@@ -5640,6 +5649,8 @@ to 'more'.  Both will exit with a status code of 0.
                                      - may appear multiple times
             --tofu                 Enable trust on first use authentication
                                      - disabled as '--no-tofu'
+            --strict-tofu          Fail to connect if a known certificate has changed
+                                     - disabled as '--no-strict-tofu'
             --dane                 Enable DANE certificate verification (DNSSEC)
                                      - disabled as '--no-dane'
             --local-dns            Use the local DNS server for DNSSEC resolving
@@ -5688,16 +5699,16 @@ to 'more'.  Both will exit with a status code of 0.
         -l, --list                 Print a list of the supported algorithms and modes
             --noticket             Don't allow session tickets
             --srtp-profiles=str    Offer SRTP profiles
-            --alpn=str             Application layer protocol
+        -!, --alpn=str             Application layer protocol
                                      - may appear multiple times
         -b, --heartbeat            Activate heartbeat support
-            --recordsize=num       The maximum record size to advertize
+        -", --recordsize=num       The maximum record size to advertize
                                      - it must be in the range:
                                        0 to 4096
-            --disable-sni          Do not send a Server Name Indication (SNI)
-            --disable-extensions   Disable all the TLS extensions
-            --inline-commands      Inline commands of the form ^<cmd>^
-            --inline-commands-prefix=str Change the default (^) used as a delimiter for inline commands.  The
+        -#, --disable-sni          Do not send a Server Name Indication (SNI)
+        -$, --disable-extensions   Disable all the TLS extensions
+        -%, --inline-commands      Inline commands of the form ^<cmd>^
+        -&, --inline-commands-prefix=str Change the default (^) used as a delimiter for inline commands.  The
      value is a single US-ASCII character (octets 0 - 127).
         -v, --version[=arg]        output version information and exit
         -h, --help                 display extended usage information and exit
@@ -5711,7 +5722,7 @@ to 'more'.  Both will exit with a status code of 0.
      sets up a TLS connection and forwards data from the standard input to the
      secured socket and vice versa.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 -----------------
@@ -5731,6 +5742,18 @@ This option will, in addition to certificate authentication, perform
 authentication based on previously seen public keys, a model similar to
 SSH authentication.
 
+strict-tofu option
+------------------
+
+This is the "fail to connect if a known certificate has changed" option.
+
+This option has some usage constraints.  It:
+   * can be disabled with -no-strict-tofu.
+
+This option will perform authentication as with option -tofu; however,
+while -tofu asks whether to trust a changed certificate, this option
+will fail in case of certificate changes.
+
 dane option
 -----------
 
@@ -5810,7 +5833,7 @@ priority option
 This is the "priorities string" option.  This option takes a string
 argument.  TLS algorithms and protocols to enable.  You can use
 predefined sets of ciphersuites such as PERFORMANCE, NORMAL, SECURE128,
-SECURE256.
+SECURE256.  The default is NORMAL.
 
 Check the GnuTLS manual on section "Priority strings" for more
 information on allowed keywords
@@ -5860,7 +5883,7 @@ inline-commands-prefix option
 -----------------------------
 
 This is the "change the default (^) used as a delimiter for inline
-commands.  the value is a single us-ascii character (octets 0 - 127)."
+commands. 	the value is a single us-ascii character (octets 0 - 127)."
 option.  This option takes a string argument.  Change the default (^)
 delimiter used for inline commands.  The delimiter is expected to be a
 single US-ASCII character (octets 0 - 127).  This option is only
@@ -6043,7 +6066,7 @@ to 'more'.  Both will exit with a status code of 0.
 
      Server program that listens to incoming TLS connections.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 -----------------
@@ -6063,7 +6086,7 @@ priority option
 This is the "priorities string" option.  This option takes a string
 argument.  TLS algorithms and protocols to enable.  You can use
 predefined sets of ciphersuites such as PERFORMANCE, NORMAL, SECURE128,
-SECURE256.
+SECURE256.  The default is NORMAL.
 
 Check the GnuTLS manual on section "Priority strings" for more
 information on allowed keywords
@@ -6105,7 +6128,7 @@ clients and/or GnuTLS itself.  This section describes how to use
 
 The most basic server can be started as:
 
-     gnutls-serv --http
+     gnutls-serv --http --priority "NORMAL:+ANON-ECDH:+ANON-DH"
 
 It will only support anonymous ciphersuites, which many TLS clients
 refuse to use.
@@ -6203,7 +6226,7 @@ be able to use it.
 
 Let's start the server with support for OpenPGP credentials:
 
-     gnutls-serv --http \
+     gnutls-serv --http --priority NORMAL:+CTYPE-OPENPGP \
                  --pgpkeyfile openpgp-server-key.txt \
                  --pgpcertfile openpgp-server.txt
 
@@ -6211,20 +6234,20 @@ The next step is to add support for SRP authentication.  This requires
 an SRP password file created with 'srptool'.  To start the server with
 SRP support:
 
-     gnutls-serv --http \
+     gnutls-serv --http --priority NORMAL:+SRP-RSA:+SRP \
                  --srppasswdconf srp-tpasswd.conf \
                  --srppasswd srp-passwd.txt
 
 Let's also start a server with support for PSK. This would require a
 password file created with 'psktool'.
 
-     gnutls-serv --http \
+     gnutls-serv --http --priority NORMAL:+ECDHE-PSK:+PSK \
                  --pskpasswd psk-passwd.txt
 
 Finally, we start the server with all the earlier parameters and you get
 this command:
 
-     gnutls-serv --http \
+     gnutls-serv --http --priority NORMAL:+PSK:+SRP:+CTYPE-OPENPGP \
                  --x509cafile x509-ca.pem \
                  --x509keyfile x509-server-key.pem \
                  --x509certfile x509-server.pem \
@@ -6292,7 +6315,7 @@ to 'more'.  Both will exit with a status code of 0.
      called with the `-v' parameter more checks will be performed.  Can be used
      to check for servers with special needs or bugs.
 
-     Please send bug reports to:  <bugs@gnutls.org>
+     Please send bug reports to:  <@PACKAGE_BUGREPORT@>
 
 debug option (-d)
 -----------------
@@ -7042,14 +7065,14 @@ B.1 Getting Help
 ================
 
 A mailing list where users may help each other exists, and you can reach
-it by sending e-mail to <help-gnutls@gnu.org>.  Archives of the mailing
-list discussions, and an interface to manage subscriptions, is available
-through the World Wide Web at
-<http://lists.gnu.org/mailman/listinfo/help-gnutls>.
+it by sending e-mail to <gnutls-help@gnutls.org>.  Archives of the
+mailing list discussions, and an interface to manage subscriptions, is
+available through the World Wide Web at
+<http://lists.gnutls.org/pipermail/gnutls-help/>.
 
 A mailing list for developers are also available, see
-<http://www.gnu.org/software/gnutls/lists.html>.  Bug reports should be
-sent to <bug-gnutls@gnu.org>, see *note Bug Reports::.
+<http://www.gnutls.org/lists.html>.  Bug reports should be sent to
+<bugs@gnutls.org>, see *note Bug Reports::.
 
 
 File: gnutls.info,  Node: Commercial Support,  Next: Bug Reports,  Prev: Getting help,  Up: Support
@@ -7115,7 +7138,7 @@ note.
 
 Send your bug report to:
 
-                         'bug-gnutls@gnu.org'
+                           'bugs@gnutls.org'
 
 
 File: gnutls.info,  Node: Contributing,  Next: Certification,  Prev: Bug Reports,  Up: Support
@@ -8878,10 +8901,14 @@ gnutls_certificate_set_x509_simple_pkcs12_file
      are supported.  However, only password based security, and the same
      password for all operations, are supported.
 
-     PKCS'12' file may contain many keys and/or certificates, and there
-     is no way to identify which key/certificate pair you want.  You
-     should make sure the PKCS'12' file only contain one key/certificate
-     pair and/or one CRL.
+     PKCS'12' file may contain many keys and/or certificates, and this
+     function will try to auto-detect based on the key ID the
+     certificate and key pair to use.  If the PKCS'12' file contain the
+     issuer of the selected certificate, it will be appended to the
+     certificate to form a chain.
+
+     If more than one private keys are stored in the PKCS'12' file, then
+     only one key will be read (and it is undefined which one).
 
      It is believed that the limitations of this function is acceptable
      for most usage, and that any more flexibility would introduce
@@ -8915,10 +8942,14 @@ gnutls_certificate_set_x509_simple_pkcs12_mem
      However, only password based security, and the same password for
      all operations, are supported.
 
-     PKCS'12' file may contain many keys and/or certificates, and there
-     is no way to identify which key/certificate pair you want.  You
-     should make sure the PKCS'12' file only contain one key/certificate
-     pair and/or one CRL.
+     PKCS'12' file may contain many keys and/or certificates, and this
+     function will try to auto-detect based on the key ID the
+     certificate and key pair to use.  If the PKCS'12' file contain the
+     issuer of the selected certificate, it will be appended to the
+     certificate to form a chain.
+
+     If more than one private keys are stored in the PKCS'12' file, then
+     only one key will be read (and it is undefined which one).
 
      It is believed that the limitations of this function is acceptable
      for most usage, and that any more flexibility would introduce
@@ -9414,6 +9445,16 @@ gnutls_db_check_entry_time
 
      *Returns:* The time this entry was created, or zero on error.
 
+gnutls_db_get_default_cache_expiration
+--------------------------------------
+
+ -- Function: unsigned gnutls_db_get_default_cache_expiration ( VOID)
+
+     *Returns:* the expiration time (in seconds) of stored sessions for
+     resumption.
+
+     Since 3.2.10
+
 gnutls_db_get_ptr
 -----------------
 
@@ -10316,7 +10357,7 @@ gnutls_handshake_set_private_extensions
 
      This function will enable or disable the use of private cipher
      suites (the ones that start with 0xFF). By default or if 'allow' is
-     0 then these cipher suites will not be advertized nor used.
+     0 then these cipher suites will not be advertised nor used.
 
      Currently GnuTLS does not include such cipher-suites or compression
      algorithms.
@@ -11676,6 +11717,20 @@ gnutls_record_can_use_length_hiding
      *Returns:* true (1) if the current session supports length-hiding
      padding, false (0) if the current session does not.
 
+gnutls_record_check_corked
+--------------------------
+
+ -- Function: size_t gnutls_record_check_corked (gnutls_session_t
+          SESSION)
+     SESSION: is a 'gnutls_session_t' structure.
+
+     This function checks if there pending corked data in the gnutls
+     buffers -see 'gnutls_cork()' .
+
+     *Returns:* Returns the size of the corked data or zero.
+
+     *Since:* 3.2.8
+
 gnutls_record_check_pending
 ---------------------------
 
@@ -11685,7 +11740,7 @@ gnutls_record_check_pending
 
      This function checks if there are unread data in the gnutls
      buffers.  If the return value is non-zero the next call to
-     'gnutls_record_recv()' is guarranteed not to block.
+     'gnutls_record_recv()' is guaranteed not to block.
 
      *Returns:* Returns the size of the data or zero.
 
@@ -11962,6 +12017,11 @@ gnutls_record_uncork
      (i.e., the function will retry on 'GNUTLS_E_AGAIN' and
      'GNUTLS_E_INTERRUPTED' ).
 
+     If the flag 'GNUTLS_RECORD_WAIT' is not specified and the function
+     is interrupted then the 'GNUTLS_E_AGAIN' or 'GNUTLS_E_INTERRUPTED'
+     errors will be returned.  To obtain the data left in the corked
+     buffer use 'gnutls_record_check_corked()' .
+
      *Returns:* On success the number of transmitted data is returned,
      or otherwise a negative error code.