diff --git a/.gitignore b/.gitignore index ea696a1..f0f7092 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,12 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.6.3.tar.xz.sig /gnutls-3.6.3.tar.xz +/gnutls-3.6.4.tar.xz +/gnutls-3.6.4.tar.xz.sig +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.6.5.tar.xz.sig +/gnutls-3.6.5.tar.xz +/gnutls-3.6.6.tar.xz +/gnutls-3.6.6.tar.xz.sig +/gnutls-3.6.7.tar.xz +/gnutls-3.6.7.tar.xz.sig diff --git a/gnutls-3.4.2-no-now-guile.patch b/gnutls-3.4.2-no-now-guile.patch deleted file mode 100644 index 35c7699..0000000 --- a/gnutls-3.4.2-no-now-guile.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up gnutls-3.4.2/guile/src/Makefile.in.jx gnutls-3.4.2/guile/src/Makefile.in ---- gnutls-3.4.2/guile/src/Makefile.in.jx 2015-06-16 12:23:31.000000000 -0400 -+++ gnutls-3.4.2/guile/src/Makefile.in 2015-07-02 14:01:19.415060204 -0400 -@@ -1316,7 +1316,7 @@ guileextension_LTLIBRARIES = guile-gnutl - # Use '-module' to build a "dlopenable module", in Libtool terms. - # Use '-undefined' to placate Libtool on Windows; see - # . --guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -+guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy - - # Linking against GnuTLS. - GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la diff --git a/gnutls-3.6.3-backport-upstream-fixes.patch b/gnutls-3.6.3-backport-upstream-fixes.patch deleted file mode 100644 index a7aad33..0000000 --- a/gnutls-3.6.3-backport-upstream-fixes.patch +++ /dev/null @@ -1,55 +0,0 @@ -diff --git a/lib/cert-cred.c b/lib/cert-cred.c -index d3777e51f..2150e903f 100644 ---- a/lib/cert-cred.c -+++ b/lib/cert-cred.c -@@ -387,6 +387,13 @@ static int call_legacy_cert_cb1(gnutls_session_t session, - if (ret < 0) - return gnutls_assert_val(ret); - -+ if (st2.ncerts == 0) { -+ *pcert_length = 0; -+ *ocsp_length = 0; -+ *privkey = NULL; -+ return 0; -+ } -+ - if (st2.cert_type != GNUTLS_CRT_X509) { - gnutls_assert(); - ret = GNUTLS_E_INVALID_REQUEST; -@@ -503,7 +510,10 @@ void gnutls_certificate_set_retrieve_function - gnutls_certificate_retrieve_function * func) - { - cred->legacy_cert_cb1 = func; -- cred->get_cert_callback3 = call_legacy_cert_cb1; -+ if (!func) -+ cred->get_cert_callback3 = NULL; -+ else -+ cred->get_cert_callback3 = call_legacy_cert_cb1; - } - - static int call_legacy_cert_cb2(gnutls_session_t session, -@@ -578,7 +588,10 @@ void gnutls_certificate_set_retrieve_function2 - gnutls_certificate_retrieve_function2 * func) - { - cred->legacy_cert_cb2 = func; -- cred->get_cert_callback3 = call_legacy_cert_cb2; -+ if (!func) -+ cred->get_cert_callback3 = NULL; -+ else -+ cred->get_cert_callback3 = call_legacy_cert_cb2; - } - - /** -diff --git a/lib/hello_ext.c b/lib/hello_ext.c -index a3027130a..f72afe77f 100644 ---- a/lib/hello_ext.c -+++ b/lib/hello_ext.c -@@ -208,7 +208,7 @@ int hello_ext_parse(void *_ctx, unsigned tls_id, const uint8_t *data, unsigned d - - if (tls_id == PRE_SHARED_KEY_TLS_ID) { - ctx->seen_pre_shared_key = 1; -- } else if (ctx->seen_pre_shared_key) { -+ } else if (ctx->seen_pre_shared_key && session->security_parameters.entity == GNUTLS_SERVER) { - /* the pre-shared key extension must always be the last one, - * draft-ietf-tls-tls13-28: 4.2.11 */ - return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); diff --git a/gnutls-3.6.3-fix-ecdsa.patch b/gnutls-3.6.3-fix-ecdsa.patch deleted file mode 100644 index d34efa0..0000000 --- a/gnutls-3.6.3-fix-ecdsa.patch +++ /dev/null @@ -1,27 +0,0 @@ -diff --git a/lib/pubkey.c b/lib/pubkey.c -index 162ceaa4a..8fc42b95a 100644 ---- a/lib/pubkey.c -+++ b/lib/pubkey.c -@@ -1072,7 +1072,6 @@ gnutls_pubkey_import(gnutls_pubkey_t key, - int result = 0, need_free = 0; - gnutls_datum_t _data; - ASN1_TYPE spk; -- gnutls_ecc_curve_t curve; - - if (key == NULL) { - gnutls_assert(); -@@ -1119,14 +1118,7 @@ gnutls_pubkey_import(gnutls_pubkey_t key, - goto cleanup; - } - -- /* this has already been called by get_asn_mpis() thus it cannot -- * fail. -- */ -- key->params.algo = _gnutls_x509_get_pk_algorithm(spk, "", &curve, NULL); -- -- key->params.curve = curve; - key->bits = pubkey_to_bits(&key->params); -- - result = 0; - - cleanup: diff --git a/gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch b/gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch deleted file mode 100644 index 326999e..0000000 --- a/gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff --git a/tests/priority-init2.c b/tests/priority-init2.c -index 850a6d9..d6b7659 100644 ---- a/tests/priority-init2.c -+++ b/tests/priority-init2.c -@@ -91,8 +91,8 @@ static void start(struct test_st *test) - if (test->exp_err == ret) { - if (ep-test->add_prio != test->err_pos) { - fprintf(stderr, "diff: %d\n", (int)(ep-test->add_prio)); -- fail("error expected error on different position[%d]: %s\n", -- test->err_pos, test->add_prio); -+// fail("error expected error on different position[%d]: %s\n", -+// test->err_pos, test->add_prio); - } - goto cleanup; - } -diff --git a/tests/set-default-prio.c b/tests/set-default-prio.c -index 48e8bf1..16235f8 100644 ---- a/tests/set-default-prio.c -+++ b/tests/set-default-prio.c -@@ -90,8 +90,8 @@ static void start(struct test_st *test) - if (test->exp_err == ret) { - if (ep-test->add_prio != test->err_pos) { - fprintf(stderr, "diff: %d\n", (int)(ep-test->add_prio)); -- fail("error expected error on different position[%d]: %s\n", -- test->err_pos, test->add_prio); -+// fail("error expected error on different position[%d]: %s\n", -+// test->err_pos, test->add_prio); - } - goto cleanup; - } diff --git a/gnutls-3.6.7-no-now-guile.patch b/gnutls-3.6.7-no-now-guile.patch new file mode 100644 index 0000000..d14e8df --- /dev/null +++ b/gnutls-3.6.7-no-now-guile.patch @@ -0,0 +1,11 @@ +--- a/guile/src/Makefile.in 2019-03-27 11:51:55.984398001 +0100 ++++ b/guile/src/Makefile.in 2019-03-27 11:52:27.259626076 +0100 +@@ -1472,7 +1472,7 @@ + # Use '-module' to build a "dlopenable module", in Libtool terms. + # Use '-undefined' to placate Libtool on Windows; see + # . +-guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined ++guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy + + # Linking against GnuTLS. + GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la diff --git a/gnutls.spec b/gnutls.spec index efe9d5d..bbd3b48 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,11 +1,8 @@ # This spec file has been automatically updated -Version: 3.6.3 -Release: 3%{?dist} +Version: 3.6.7 +Release: 1%{?dist} Patch1: gnutls-3.2.7-rpath.patch -Patch2: gnutls-3.4.2-no-now-guile.patch -Patch3: gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch -Patch4: gnutls-3.6.3-backport-upstream-fixes.patch -Patch5: gnutls-3.6.3-fix-ecdsa.patch +Patch2: gnutls-3.6.7-no-now-guile.patch %bcond_without dane %if 0%{?rhel} %bcond_with guile @@ -19,12 +16,11 @@ Summary: A TLS protocol implementation Name: gnutls # The libraries are LGPLv2.1+, utilities are GPLv3+ License: GPLv3+ and LGPLv2+ -Group: System Environment/Libraries BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 BuildRequires: libtool, automake, autoconf, texinfo BuildRequires: autogen-libopts-devel >= 5.18 autogen -BuildRequires: nettle-devel >= 3.1.1 +BuildRequires: nettle-devel >= 3.4.1 BuildRequires: trousers-devel >= 0.3.11.2 BuildRequires: libidn2-devel BuildRequires: libunistring-devel @@ -39,6 +35,7 @@ BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 +Requires: nettle >= 3.4.1 Recommends: trousers >= 0.3.11.2 %if %{with dane} @@ -48,8 +45,8 @@ BuildRequires: unbound-devel unbound-libs BuildRequires: guile-devel %endif URL: http://www.gnutls.org/ -Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz -Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig +Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz +Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -61,20 +58,16 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %package devel Summary: Development files for the %{name} package -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} Requires: %{name}-c++%{?_isa} = %{version}-%{release} %if %{with dane} Requires: %{name}-dane%{?_isa} = %{version}-%{release} %endif Requires: pkgconfig -Requires(post): /sbin/install-info -Requires(preun): /sbin/install-info %package utils License: GPLv3+ Summary: Command line tools for TLS protocol -Group: Applications/System Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with dane} Requires: %{name}-dane%{?_isa} = %{version}-%{release} @@ -89,7 +82,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with guile} %package guile Summary: Guile bindings for the GNUTLS library -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} Requires: guile %endif @@ -150,12 +142,8 @@ This package contains Guile bindings for the library. %prep gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} -%setup -q -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 +%autosetup -p1 +autoreconf sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -163,16 +151,17 @@ rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/ echo "SYSTEM=NORMAL" >> tests/system.prio +# Note that we explicitly enable SHA1, as SHA1 deprecation is handled +# via the crypto policies + %build +CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes" +export CCASFLAGS %configure --with-libtasn1-prefix=%{_prefix} \ -%if (0%{?fedora} <= 28) - --enable-ssl3-support \ -%else - --enable-tls13-support \ -%endif %if %{with fips} --enable-fips140-mode \ %endif + --enable-sha1-support \ --disable-static \ --disable-openssl-compatibility \ --disable-non-suiteb-curves \ @@ -223,36 +212,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %check make check %{?_smp_mflags} -%post -p /sbin/ldconfig - -%postun -p /sbin/ldconfig - -%post c++ -p /sbin/ldconfig - -%postun c++ -p /sbin/ldconfig - -%post devel -if [ -f %{_infodir}/gnutls.info.gz ]; then - /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || : -fi - -%preun devel -if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then - /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || : -fi - -%if %{with dane} -%post dane -p /sbin/ldconfig - -%postun dane -p /sbin/ldconfig -%endif - -%if %{with guile} -%post guile -p /sbin/ldconfig - -%postun guile -p /sbin/ldconfig -%endif - %files -f gnutls.lang %defattr(-,root,root,-) %{_libdir}/libgnutls.so.30* @@ -311,6 +270,43 @@ fi %endif %changelog +* Wed Mar 27 2019 Anderson Toshiyuki Sasaki - 3.6.7-1 +- Update to upstream 3.6.7 release +- Fixed CVE-2019-3836 (#1693214) +- Fixed CVE-2019-3829 (#1693210) + +* Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 +- Update to upstream 3.6.6 release + +* Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 +- Add explicit Requires for nettle >= 3.4.1 + +* Wed Dec 12 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 +- Update to upstream 3.6.5 release + +* Fri Oct 19 2018 Petr Menšík - 3.6.4-4 +- Rebuild for unbound 1.8 again + +* Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-3 +- Fix issue with rehandshake affecting glib-networking (#1634736) + +* Tue Oct 09 2018 Petr Menšík - 3.6.4-2 +- Rebuilt for unbound 1.8 + +* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 +- Updated to upstream 3.6.4 release +- Added support for the latest version of the TLS1.3 protocol +- Enabled SHA1 support as SHA1 deprecation is handled via the + fedora crypto policies. + +* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 +- Fixed gnutls-cli input reading +- Ensure that we do not cause issues with version rollback detection + and TLS1.3. + * Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 - Fixed ECDSA public key import (#1612803) diff --git a/sources b/sources index 609b378..b47599f 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ +SHA512 (gnutls-3.6.7.tar.xz) = ae9b8996eb9b7269d28213f0aca3a4a17890ba8d47e3dc3b8e754ab8e2b4251e9412aaaa161a8bf56167f04cc169b4cada46f55a7bde92b955eb36cd717a99f3 +SHA512 (gnutls-3.6.7.tar.xz.sig) = fd397cab1f658053d52cdd214a9d816262993b572cd4b623f3e276fd6759e2e620bd3f27d5a749a2b066173c6c39fcc357225d3136996b99e2f88d268aef5baf SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (gnutls-3.6.3.tar.xz.sig) = 5377352aa239a4458b0ac6aaada438dce0336b989c4f65949fec3e469531dfb2397bb36dbe69dbc6f479f6944999937ebb4a5cb40e806d0bd4062c5647aa397b -SHA512 (gnutls-3.6.3.tar.xz) = 6238502464d229a9777e3076f4c745d16deaada83c9da756ecdcd370947576e0446bda3a7f85d5a099b745bbf8c0134ebdf6632e4b26d61daf170792fb4f5abe