From 78bcf6341d1b8d5f49e9def4eca2772ccd95bfb3 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 6 Feb 2025 14:25:04 +0100 Subject: [PATCH 1/9] Rebuild gnutls Signed-off-by: Zoltan Fridrich From a07b4eb0761f0866d5262b42e5a3b02ec5afd525 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 10 Feb 2025 11:04:35 +0900 Subject: [PATCH 2/9] Update to gnutls 3.8.9 release Signed-off-by: Daiki Ueno --- .gitignore | 2 ++ gnutls.spec | 8 ++++---- sources | 4 ++-- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 21644a1..368ba7b 100644 --- a/.gitignore +++ b/.gitignore @@ -163,3 +163,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.7.1.tar.xz.sig /gnutls-3.8.8.tar.xz /gnutls-3.8.8.tar.xz.sig +/gnutls-3.8.9.tar.xz +/gnutls-3.8.9.tar.xz.sig diff --git a/gnutls.spec b/gnutls.spec index 01cb70a..80b8a9c 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,7 +12,7 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.8 +Version: 3.8.9 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch @@ -465,7 +465,7 @@ popd %{_libdir}/.libgnutls.so.30*.hmac %endif %doc README.md AUTHORS NEWS THANKS -%license LICENSE doc/COPYING doc/COPYING.LESSER +%license COPYING COPYING.LESSERv2 %files c++ %{_libdir}/libgnutlsxx.so.* @@ -509,7 +509,7 @@ popd %if %{with mingw} %files -n mingw32-%{name} -%license LICENSE doc/COPYING doc/COPYING.LESSER +%license COPYING COPYING.LESSERv2 %{mingw32_bindir}/certtool.exe %{mingw32_bindir}/gnutls-cli-debug.exe %{mingw32_bindir}/gnutls-cli.exe @@ -527,7 +527,7 @@ popd %{mingw32_includedir}/gnutls/ %files -n mingw64-%{name} -%license LICENSE doc/COPYING doc/COPYING.LESSER +%license COPYING COPYING.LESSERv2 %{mingw64_bindir}/certtool.exe %{mingw64_bindir}/gnutls-cli-debug.exe %{mingw64_bindir}/gnutls-cli.exe diff --git a/sources b/sources index a8d7df8..347a95e 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -SHA512 (gnutls-3.8.8.tar.xz) = 4f617c63e8e8392e400d72c9e39989fcd782268b4a4c4e36bbfb0444a4b5bcb0f53054f04a6dce99ab89c0f38f57430c95aaaec6eb9209b8e9329140abf230c3 -SHA512 (gnutls-3.8.8.tar.xz.sig) = fdff792511e9e5de203a1dfd66bf521c12fb74a19de651ffa1f7359dafdd1dad59ae57d0f95fa363c4167f798e6b624b4ae1f84d4e0737ff690c2fb0e5a5bdce +SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b3685246b64bde97b5bd94f463ab376ed817869869714115f4ff11bdc53c32604bb04a8ff8e10daa6d1fc7 +SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 From 7458001e1ae8bf6678b113a6d70639dbdc1513e9 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 10 Feb 2025 17:53:01 +0900 Subject: [PATCH 3/9] Switch from liboqs to leancrypto Signed-off-by: Daiki Ueno --- .gitignore | 1 + gnutls.spec | 62 +++++++++++++++++++++++++++++++++++++++++++++++------ sources | 1 + 3 files changed, 57 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 368ba7b..ce0bef6 100644 --- a/.gitignore +++ b/.gitignore @@ -165,3 +165,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.8.tar.xz.sig /gnutls-3.8.9.tar.xz /gnutls-3.8.9.tar.xz.sig +/leancrypto-1.2.0.tar.gz diff --git a/gnutls.spec b/gnutls.spec index 80b8a9c..2d1ff41 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -26,7 +26,7 @@ Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch %bcond_without tpm2 %bcond_without gost %bcond_without certificate_compression -%bcond_without liboqs +%bcond_without leancrypto %bcond_without tests %if 0%{?fedora} && 0%{?fedora} < 38 @@ -64,13 +64,13 @@ BuildRequires: readline-devel, libtasn1-devel >= 4.3 %if %{with certificate_compression} BuildRequires: zlib-devel, brotli-devel, libzstd-devel %endif -%if %{with liboqs} -BuildRequires: liboqs-devel -%endif %if %{with bootstrap} BuildRequires: automake, autoconf, gperf, libtool, texinfo %endif BuildRequires: nettle-devel >= 3.10 +%if %{with leancrypto} +BuildRequires: meson +%endif %if %{with tpm12} BuildRequires: trousers-devel >= 0.3.11.2 %endif @@ -130,6 +130,10 @@ Source100: gmp-6.2.1.tar.xz Source101: gmp-6.2.1-intel-cet.patch %endif +%if %{with leancrypto} +Source300: leancrypto-1.2.0.tar.gz +%endif + # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -264,6 +268,13 @@ popd %build %define _lto_cflags %{nil} +%if %{with leancrypto} +mkdir -p bundled_leancrypto +pushd bundled_leancrypto +tar --strip-components=1 -xf %{SOURCE300} +popd +%endif + %if %{with bundled_gmp} pushd bundled_gmp autoreconf -ifv @@ -275,6 +286,39 @@ export GMP_CFLAGS="-I$PWD/bundled_gmp" export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a" %endif +%if %{with leancrypto} +pushd bundled_leancrypto +%set_build_flags +meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ + -Ddefault_library=static \ + -Dascon=disabled -Dascon_keccak=disabled \ + -Dbike_5=disabled -Dbike_3=disabled -Dbike_1=disabled \ + -Dkyber_x25519=disabled -Ddilithium_ed25519=disabled \ + -Dx509_parser=disabled -Dx509_generator=disabled \ + -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ + -Dsha2-256=disabled \ + -Dchacha20=disabled -Dchacha20_drng=disabled \ + -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ + -Dhash_crypt=disabled \ + -Dhmac=disabled -Dhkdf=disabled \ + -Dkdf_ctr=disabled -Dkdf_fb=disabled -Dkdf_dpi=disabled \ + -Dpbkdf2=disabled \ + -Dkmac_drng=disabled -Dcshake_drng=disabled \ + -Dhotp=disabled -Dtotp=disabled \ + -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \ + -Daes_kw=disabled -Dapps=disabled \ + _build +meson compile -C _build +meson install -C _build + +popd + +export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install" + +export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include" +export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a" +%endif + %if %{with bootstrap} autoreconf -fi %endif @@ -294,6 +338,7 @@ export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name" mkdir native_build pushd native_build + %global _configure ../configure %configure \ %if %{with fips} @@ -341,15 +386,18 @@ pushd native_build %else --without-zlib --without-brotli --without-zstd \ %endif -%if %{with liboqs} - --with-liboqs \ +%if %{with leancrypto} + --with-leancrypto \ %else - --without-liboqs \ + --without-leancrypto \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" %make_build +%if %{with leancrypto} +sed -i '/^Requires.private:/s/leancrypto[ ,]*//g' lib/gnutls.pc +%endif popd %if %{with mingw} diff --git a/sources b/sources index 347a95e..5becf65 100644 --- a/sources +++ b/sources @@ -2,3 +2,4 @@ SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b368524 SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 +SHA512 (leancrypto-1.2.0.tar.gz) = 0b58644e3362bd512dd2a19a291ef58ba310d688c8d7c5fb2b7b3ac48ec51122311b998786a23cafa3127f3e4c75425babbc61d287e44fe3318ce584cbc87df7 From fa4b79c7e3e1addadc8b3b8b813659e6ea44a219 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 30 Mar 2025 20:51:52 +0100 Subject: [PATCH 4/9] Bump for gmp build From 7075aade55c8c7a7e131d34df03d71742e368870 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 2 Apr 2025 17:34:52 +0900 Subject: [PATCH 5/9] Update leancrypto to 1.3.0 Signed-off-by: Daiki Ueno --- .gitignore | 1 + gnutls.spec | 2 +- sources | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index ce0bef6..45589ae 100644 --- a/.gitignore +++ b/.gitignore @@ -166,3 +166,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.9.tar.xz /gnutls-3.8.9.tar.xz.sig /leancrypto-1.2.0.tar.gz +/leancrypto-1.3.0.tar.gz diff --git a/gnutls.spec b/gnutls.spec index 2d1ff41..32cd225 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -131,7 +131,7 @@ Source101: gmp-6.2.1-intel-cet.patch %endif %if %{with leancrypto} -Source300: leancrypto-1.2.0.tar.gz +Source300: leancrypto-1.3.0.tar.gz %endif # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 diff --git a/sources b/sources index 5becf65..5043ca2 100644 --- a/sources +++ b/sources @@ -2,4 +2,4 @@ SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b368524 SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.2.0.tar.gz) = 0b58644e3362bd512dd2a19a291ef58ba310d688c8d7c5fb2b7b3ac48ec51122311b998786a23cafa3127f3e4c75425babbc61d287e44fe3318ce584cbc87df7 +SHA512 (leancrypto-1.3.0.tar.gz) = 8e0348d09b37fd6eb770505f1e98efdbf9d6f721aa2617d1f32d42ba89709bf374eb9d06aa2266bc7d7b5c56ab3168f12925fd4ec1d2d78951080f74f4a1a085 From 8410ea774555c18d53a46e881c163e7f50b02dde Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 22 Jun 2025 15:07:25 -0400 Subject: [PATCH 6/9] Fix build on kernel 6.14+ kTLS KeyUpdate is supported as of this version, leading to the ktls_keyupdate.sh being able to pass thereon, and therefore the builder's kernel must now be checked here too. https://gitlab.com/gnutls/gnutls/-/merge_requests/1934 --- gnutls-3.8.9-ktls-kernel-check.patch | 1310 ++++++++++++++++++++++++++ gnutls.spec | 17 +- 2 files changed, 1312 insertions(+), 15 deletions(-) create mode 100644 gnutls-3.8.9-ktls-kernel-check.patch diff --git a/gnutls-3.8.9-ktls-kernel-check.patch b/gnutls-3.8.9-ktls-kernel-check.patch new file mode 100644 index 0000000..0299beb --- /dev/null +++ b/gnutls-3.8.9-ktls-kernel-check.patch @@ -0,0 +1,1310 @@ +From 633bea37176f3fe16dd431ccb35112aa970c7db1 Mon Sep 17 00:00:00 2001 +From: Frantisek Krenzelok +Date: Tue, 11 Feb 2025 12:45:44 +0100 +Subject: [PATCH 1/7] kTLS: keyupdate_test improvements + +- ktls_utils.h has helper funtion to create standard sockets required + for ktls support testing. +- key_update test for kTLS is now a flavourt of the tls13/key_update + test instead of being standalone(broadens the testing cases). +- gnutls_ktls.c now uses the aformentioned ktls_utils.h + +Signed-off-by: Frantisek Krenzelok +--- + tests/Makefile.am | 16 +- + tests/gnutls_ktls.c | 60 ++----- + tests/ktls_keyupdate.c | 368 --------------------------------------- + tests/ktls_utils.h | 94 ++++++++++ + tests/tls13/key_update.c | 115 +++++++++++- + 5 files changed, 228 insertions(+), 425 deletions(-) + delete mode 100644 tests/ktls_keyupdate.c + create mode 100644 tests/ktls_utils.h + +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 72926e9da4..9990ee21cc 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -517,12 +517,6 @@ if ENABLE_TPM2 + dist_check_SCRIPTS += tpm2.sh + endif + +-if ENABLE_KTLS +-indirect_tests += gnutls_ktls +-dist_check_SCRIPTS += ktls.sh +-indirect_tests += ktls_keyupdate +-dist_check_SCRIPTS += ktls_keyupdate.sh +-endif + + if !WINDOWS + +@@ -530,6 +524,16 @@ if !WINDOWS + # List of tests not available/functional under windows + # + ++if ENABLE_KTLS ++indirect_tests += gnutls_ktls ++dist_check_SCRIPTS += ktls.sh ++ ++indirect_tests += ktls_keyupdate ++ktls_keyupdate_SOURCES = tls13/key_update.c ++ktls_keyupdate_CFLAGS = -DUSE_KTLS ++dist_check_SCRIPTS += ktls_keyupdate.sh ++endif ++ + dist_check_SCRIPTS += dtls/dtls.sh dtls/dtls-resume.sh #dtls/dtls-nb + + indirect_tests += dtls-stress +diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c +index 90d3e9af91..ca576d42aa 100644 +--- a/tests/gnutls_ktls.c ++++ b/tests/gnutls_ktls.c +@@ -31,6 +31,7 @@ int main(void) + + #include "cert-common.h" + #include "utils.h" ++#include "ktls_utils.h" + + static void server_log_func(int level, const char *str) + { +@@ -94,7 +95,8 @@ static void client(int fd, const char *prio) + } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); + + if (ret == 0) { +- success("client: Peer has closed the TLS connection\n"); ++ if (debug) ++ success("client: Peer has closed the TLS connection\n"); + goto end; + } else if (ret < 0) { + fail("client: Error: %s\n", gnutls_strerror(ret)); +@@ -116,7 +118,8 @@ static void client(int fd, const char *prio) + } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); + + if (ret == 0) { +- success("client: Peer has closed the TLS connection\n"); ++ if (debug) ++ success("client: Peer has closed the TLS connection\n"); + goto end; + } else if (ret < 0) { + fail("client: Error: %s\n", gnutls_strerror(ret)); +@@ -277,35 +280,16 @@ static void ch_handler(int sig) + static void run(const char *prio) + { + int ret; +- struct sockaddr_in saddr; +- socklen_t addrlen; +- int listener; +- int fd; ++ int client_fd, server_fd; + + success("running ktls test with %s\n", prio); + + signal(SIGCHLD, ch_handler); + signal(SIGPIPE, SIG_IGN); + +- listener = socket(AF_INET, SOCK_STREAM, 0); +- if (listener == -1) { +- fail("error in listener(): %s\n", strerror(errno)); +- } +- +- memset(&saddr, 0, sizeof(saddr)); +- saddr.sin_family = AF_INET; +- saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); +- saddr.sin_port = 0; +- +- ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); +- if (ret == -1) { +- fail("error in bind(): %s\n", strerror(errno)); +- } +- +- addrlen = sizeof(saddr); +- ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); +- if (ret == -1) { +- fail("error in getsockname(): %s\n", strerror(errno)); ++ if ((ret = create_socket_pair(&client_fd, &server_fd))) { ++ fail("Error in socket creation: %d\n", ret); ++ exit(1); + } + + child = fork(); +@@ -315,30 +299,20 @@ static void run(const char *prio) + } + + if (child) { +- int status; + /* parent */ +- ret = listen(listener, 1); +- if (ret == -1) { +- fail("error in listen(): %s\n", strerror(errno)); +- } ++ int status; ++ close(client_fd); + +- fd = accept(listener, NULL, NULL); +- if (fd == -1) { +- fail("error in accept(): %s\n", strerror(errno)); +- } +- server(fd, prio); ++ server(server_fd, prio); + + wait(&status); + check_wait_status(status); + } else { +- fd = socket(AF_INET, SOCK_STREAM, 0); +- if (fd == -1) { +- fail("error in socket(): %s\n", strerror(errno)); +- exit(1); +- } +- usleep(1000000); +- connect(fd, (struct sockaddr *)&saddr, addrlen); +- client(fd, prio); ++ close(server_fd); ++ sleep(1); ++ ++ client(client_fd, prio); ++ + exit(0); + } + } +diff --git a/tests/ktls_keyupdate.c b/tests/ktls_keyupdate.c +deleted file mode 100644 +index b439b7df21..0000000000 +--- a/tests/ktls_keyupdate.c ++++ /dev/null +@@ -1,368 +0,0 @@ +-// Copyright (C) 2022 Red Hat, Inc. +-// +-// Author: Frantisek Krenzelok +-// +-// This file is part of GnuTLS. +-// +-// GnuTLS is free software; you can redistribute it and/or modify it +-// under the terms of the GNU General Public License as published by the +-// Free Software Foundation; either version 3 of the License, or (at +-// your option) any later version. +-// +-// GnuTLS is distributed in the hope that it will be useful, but +-// WITHOUT ANY WARRANTY; without even the implied warranty of +-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +-// General Public License for more details. +-// +-// You should have received a copy of the GNU General Public License +-// along with GnuTLS. If not, see . +- +-#ifdef HAVE_CONFIG_H +-#include "config.h" +-#endif +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include "cert-common.h" +-#include "utils.h" +- +-#if defined(_WIN32) +- +-int main(void) +-{ +- exit(77); +-} +- +-#else +- +-#define MAX_BUF 1024 +-#define MSG "Hello world!" +- +-#define HANDSHAKE(session, name, ret) \ +- { \ +- do { \ +- ret = gnutls_handshake(session); \ +- } while (ret < 0 && gnutls_error_is_fatal(ret) == 0); \ +- if (ret < 0) { \ +- fail("%s: Handshake failed\n", name); \ +- goto end; \ +- } \ +- } +- +-#define SEND_MSG(session, name, ret) \ +- { \ +- do { \ +- ret = gnutls_record_send(session, MSG, \ +- strlen(MSG) + 1); \ +- } while (ret == GNUTLS_E_AGAIN || \ +- ret == GNUTLS_E_INTERRUPTED); \ +- if (ret < 0) { \ +- fail("%s: data sending has failed (%s)\n", name, \ +- gnutls_strerror(ret)); \ +- goto end; \ +- } \ +- } +- +-#define RECV_MSG(session, name, buffer, buffer_len, ret) \ +- { \ +- memset(buffer, 0, sizeof(buffer)); \ +- do { \ +- ret = gnutls_record_recv(session, buffer, \ +- sizeof(buffer)); \ +- } while (ret == GNUTLS_E_AGAIN || \ +- ret == GNUTLS_E_INTERRUPTED); \ +- if (ret == 0) { \ +- success("%s: Peer has closed the TLS connection\n", \ +- name); \ +- goto end; \ +- } else if (ret < 0) { \ +- fail("%s: Error -> %s\n", name, gnutls_strerror(ret)); \ +- goto end; \ +- } \ +- if (strncmp(buffer, MSG, ret)) { \ +- fail("%s: Message doesn't match\n", name); \ +- goto end; \ +- } \ +- } +- +-#define KEY_UPDATE(session, name, peer_req, ret) \ +- { \ +- do { \ +- ret = gnutls_session_key_update(session, peer_req); \ +- } while (ret == GNUTLS_E_AGAIN || \ +- ret == GNUTLS_E_INTERRUPTED); \ +- if (ret < 0) { \ +- fail("%s: key update has failed (%s)\n", name, \ +- gnutls_strerror(ret)); \ +- goto end; \ +- } \ +- } +- +-#define CHECK_KTLS_ENABLED(session, ret) \ +- { \ +- ret = gnutls_transport_is_ktls_enabled(session); \ +- if (!(ret & GNUTLS_KTLS_RECV)) { \ +- fail("client: KTLS was not properly initialized\n"); \ +- goto end; \ +- } \ +- } +- +-static void server_log_func(int level, const char *str) +-{ +- fprintf(stderr, "server|<%d>| %s", level, str); +-} +- +-static void client_log_func(int level, const char *str) +-{ +- fprintf(stderr, "client|<%d>| %s", level, str); +-} +- +-static void client(int fd, const char *prio, int pipe) +-{ +- const char *name = "client"; +- int ret; +- char foo; +- char buffer[MAX_BUF + 1]; +- gnutls_certificate_credentials_t x509_cred; +- gnutls_session_t session; +- +- global_init(); +- +- if (debug) { +- gnutls_global_set_log_function(client_log_func); +- gnutls_global_set_log_level(7); +- } +- +- gnutls_certificate_allocate_credentials(&x509_cred); +- +- gnutls_init(&session, GNUTLS_CLIENT); +- gnutls_handshake_set_timeout(session, 0); +- +- assert(gnutls_priority_set_direct(session, prio, NULL) >= 0); +- +- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); +- +- gnutls_transport_set_int(session, fd); +- +- HANDSHAKE(session, name, ret); +- +- CHECK_KTLS_ENABLED(session, ret) +- // Test 0: Try sending/receiving data +- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) +- SEND_MSG(session, name, ret) +- CHECK_KTLS_ENABLED(session, ret) +- // Test 1: Servers does key update +- read(pipe, &foo, 1); +- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) +- SEND_MSG(session, name, ret) +- CHECK_KTLS_ENABLED(session, ret) +- // Test 2: Does key update witch request +- read(pipe, &foo, 1); +- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) +- SEND_MSG(session, name, ret) +- CHECK_KTLS_ENABLED(session, ret) +- ret = gnutls_bye(session, GNUTLS_SHUT_RDWR); +- if (ret < 0) { +- fail("client: error in closing session: %s\n", +- gnutls_strerror(ret)); +- } +- +- ret = 0; +-end: +- +- close(fd); +- +- gnutls_deinit(session); +- +- gnutls_certificate_free_credentials(x509_cred); +- +- gnutls_global_deinit(); +- +- if (ret != 0) +- exit(1); +-} +- +-pid_t child; +-static void terminate(void) +-{ +- assert(child); +- kill(child, SIGTERM); +- exit(1); +-} +- +-static void server(int fd, const char *prio, int pipe) +-{ +- const char *name = "server"; +- int ret; +- char bar = 0; +- char buffer[MAX_BUF + 1]; +- gnutls_certificate_credentials_t x509_cred; +- gnutls_session_t session; +- +- global_init(); +- +- if (debug) { +- gnutls_global_set_log_function(server_log_func); +- gnutls_global_set_log_level(7); +- } +- +- gnutls_certificate_allocate_credentials(&x509_cred); +- ret = gnutls_certificate_set_x509_key_mem( +- x509_cred, &server_cert, &server_key, GNUTLS_X509_FMT_PEM); +- if (ret < 0) +- exit(1); +- +- gnutls_init(&session, GNUTLS_SERVER); +- gnutls_handshake_set_timeout(session, 0); +- +- assert(gnutls_priority_set_direct(session, prio, NULL) >= 0); +- +- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); +- +- gnutls_transport_set_int(session, fd); +- +- HANDSHAKE(session, name, ret) +- CHECK_KTLS_ENABLED(session, ret) +- success("Test 0: sending/receiving data\n"); +- SEND_MSG(session, name, ret) +- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) +- CHECK_KTLS_ENABLED(session, ret) +- success("Test 1: server key update without request\n"); +- KEY_UPDATE(session, name, 0, ret) +- write(pipe, &bar, 1); +- SEND_MSG(session, name, ret) +- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) +- CHECK_KTLS_ENABLED(session, ret) +- success("Test 2: server key update with request\n"); +- KEY_UPDATE(session, name, GNUTLS_KU_PEER, ret) +- write(pipe, &bar, 1); +- SEND_MSG(session, name, ret) +- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) +- CHECK_KTLS_ENABLED(session, ret) +- ret = gnutls_bye(session, GNUTLS_SHUT_RDWR); +- if (ret < 0) { +- fail("server: error in closing session: %s\n", +- gnutls_strerror(ret)); +- } +- +- ret = 0; +-end: +- close(fd); +- gnutls_deinit(session); +- +- gnutls_certificate_free_credentials(x509_cred); +- +- gnutls_global_deinit(); +- +- if (ret) { +- terminate(); +- } +- +- if (debug) +- success("server: finished\n"); +-} +- +-static void ch_handler(int sig) +-{ +- return; +-} +- +-static void run(const char *prio) +-{ +- int ret; +- struct sockaddr_in saddr; +- socklen_t addrlen; +- int listener; +- int fd; +- +- int sync_pipe[2]; //used for synchronization +- pipe(sync_pipe); +- +- success("running ktls test with %s\n", prio); +- +- signal(SIGCHLD, ch_handler); +- signal(SIGPIPE, SIG_IGN); +- +- listener = socket(AF_INET, SOCK_STREAM, 0); +- if (listener == -1) { +- fail("error in listener(): %s\n", strerror(errno)); +- } +- +- memset(&saddr, 0, sizeof(saddr)); +- saddr.sin_family = AF_INET; +- saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); +- saddr.sin_port = 0; +- +- ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); +- if (ret == -1) { +- fail("error in bind(): %s\n", strerror(errno)); +- } +- +- addrlen = sizeof(saddr); +- ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); +- if (ret == -1) { +- fail("error in getsockname(): %s\n", strerror(errno)); +- } +- +- child = fork(); +- if (child < 0) { +- fail("error in fork(): %s\n", strerror(errno)); +- exit(1); +- } +- +- if (child) { +- int status; +- /* parent */ +- ret = listen(listener, 1); +- if (ret == -1) { +- fail("error in listen(): %s\n", strerror(errno)); +- } +- +- fd = accept(listener, NULL, NULL); +- if (fd == -1) { +- fail("error in accept(): %s\n", strerror(errno)); +- } +- +- close(sync_pipe[0]); +- server(fd, prio, sync_pipe[1]); +- +- wait(&status); +- check_wait_status(status); +- } else { +- fd = socket(AF_INET, SOCK_STREAM, 0); +- if (fd == -1) { +- fail("error in socket(): %s\n", strerror(errno)); +- exit(1); +- } +- +- usleep(1000000); +- connect(fd, (struct sockaddr *)&saddr, addrlen); +- +- close(sync_pipe[1]); +- client(fd, prio, sync_pipe[0]); +- exit(0); +- } +-} +- +-void doit(void) +-{ +- run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); +- run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); +-} +- +-#endif /* _WIN32 */ +diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h +new file mode 100644 +index 0000000000..231618d615 +--- /dev/null ++++ b/tests/ktls_utils.h +@@ -0,0 +1,94 @@ ++#ifndef GNUTLS_TESTS_KTLS_UTILS_H ++#define GNUTLS_TESTS_KTLS_UTILS_H ++ ++#include ++#include ++ ++#include ++ ++#include ++#include ++ ++/* Sets the NONBLOCK flag on the socket(fd) */ ++inline static int set_nonblocking(int fd) ++{ ++ int flags = fcntl(fd, F_GETFL, 0); ++ if (flags == -1) { ++ return 1; ++ } ++ ++ if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) { ++ return 2; ++ } ++ ++ return 0; ++} ++ ++/* Creates a pair of TCP connected sockets */ ++static int create_socket_pair(int *client_fd, int *server_fd) ++{ ++ int ret; ++ struct sockaddr_in saddr; ++ socklen_t addrlen; ++ int listener; ++ ++ listener = socket(AF_INET, SOCK_STREAM, 0); ++ if (listener == -1) { ++ fail("error in listener(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ int opt = 0; ++ setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); ++ ++ memset(&saddr, 0, sizeof(saddr)); ++ saddr.sin_family = AF_INET; ++ saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); ++ saddr.sin_port = 0; ++ ++ ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); ++ if (ret == -1) { ++ fail("error in bind(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ addrlen = sizeof(saddr); ++ ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); ++ if (ret == -1) { ++ fail("error in getsockname(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ ret = listen(listener, 1); ++ if (ret == -1) { ++ fail("error in listen(): %s\n", strerror(errno)); ++ close(listener); ++ return 1; ++ } ++ ++ *client_fd = socket(AF_INET, SOCK_STREAM, 0); ++ if (*client_fd < 0) { ++ fail("error in socket(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen); ++ if (ret < 0) { ++ fail("error in connect(): %s\n", strerror(errno)); ++ close(listener); ++ close(*client_fd); ++ return 1; ++ } ++ ++ *server_fd = accept(listener, NULL, NULL); ++ if (*server_fd < 0) { ++ fail("error in accept(): %s\n", strerror(errno)); ++ close(listener); ++ close(*client_fd); ++ return 1; ++ } ++ ++ return 0; ++} ++ ++#endif //GNUTLS_TESTS_KTLS_UTILS_H +diff --git a/tests/tls13/key_update.c b/tests/tls13/key_update.c +index 19bea7b9ac..9c72ee14ab 100644 +--- a/tests/tls13/key_update.c ++++ b/tests/tls13/key_update.c +@@ -47,6 +47,67 @@ static void tls_log_func(int level, const char *str) + #define MSG \ + "Hello TLS, and hi and how are you and more data here... and more... and even more and even more more data..." + ++#ifdef USE_KTLS ++/* For ktls flavour of the test, the test needs to be run with the kTLS enabled ++ * option in the GnuTLS configuration file, in the case of the GnuTLS testing, ++ * the shell script `tests/ktls_keyupdate.sh` does just that. ++ */ ++ ++#include "ktls_utils.h" ++ ++#define RUN(s, n) \ ++ { \ ++ int ret; \ ++ int cfd, sfd; \ ++ if ((ret = create_sockets(&cfd, &sfd))) { \ ++ fail("kTLS: %s\n", errors[ret]); \ ++ exit(1); \ ++ } \ ++ run(s, n, cfd, sfd); \ ++ close(cfd); \ ++ close(sfd); \ ++ } ++ ++/* We could check specificaly but given how the setting of new keys work, let's ++ * check if something had gone sideways on both the receive and sending sockets. ++ */ ++#define CHECK_KTLS_ENABLED(session) \ ++ switch (gnutls_transport_is_ktls_enabled(session)) { \ ++ case GNUTLS_KTLS_RECV: \ ++ fail("kTLS: Only recv support is initiated\n"); \ ++ break; \ ++ case GNUTLS_KTLS_SEND: \ ++ fail("kTLS: Only send support is initiated\n"); \ ++ break; \ ++ case GNUTLS_KTLS_DUPLEX: \ ++ break; \ ++ default: \ ++ fail("kTLS: dissabled\n"); \ ++ } ++ ++/* ktls needs to use real sockets */ ++char *errors[] = { "", "Failed to create the socket pair", ++ "Failed to set the socket non-blocking" }; ++ ++inline static int create_sockets(int *cfd, int *sfd) ++{ ++ int ret = create_socket_pair(cfd, sfd); ++ if (ret) ++ return 1; ++ ++ if (set_nonblocking(*cfd) || set_nonblocking(*sfd)) ++ return 2; ++ ++ return 0; ++} ++ ++#else /* non-kTLS */ ++ ++#define RUN(s, n) run(s, n, -1, -1) ++#define CHECK_KTLS_ENABLED(session) /* No-op */ ++ ++#endif /* non-kTLS */ ++ + static unsigned key_update_msg_inc = 0; + static unsigned key_update_msg_out = 0; + +@@ -68,7 +129,7 @@ static int hsk_callback(gnutls_session_t session, unsigned int htype, + return 0; + } + +-static void run(const char *name, unsigned test) ++static void run(const char *name, unsigned test, int cfd, int sfd) + { + /* Server stuff. */ + gnutls_certificate_credentials_t ccred; +@@ -100,9 +161,14 @@ static void run(const char *name, unsigned test) + exit(1); + + gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE, scred); ++#ifdef USE_KTLS ++ /* for kTLS you can't use custom push/pull functions */ ++ gnutls_transport_set_int(server, sfd); ++#else + gnutls_transport_set_push_function(server, server_push); + gnutls_transport_set_pull_function(server, server_pull); + gnutls_transport_set_ptr(server, server); ++#endif + + /* Init client */ + assert(gnutls_certificate_allocate_credentials(&ccred) >= 0); +@@ -118,14 +184,23 @@ static void run(const char *name, unsigned test) + if (ret < 0) + exit(1); + ++#ifdef USE_KTLS ++ /* for kTLS you can't use custom push/pull functions */ ++ gnutls_transport_set_int(client, cfd); ++#else + gnutls_transport_set_push_function(client, client_push); + gnutls_transport_set_pull_function(client, client_pull); + gnutls_transport_set_ptr(client, client); ++#endif + + HANDSHAKE(client, server); + if (debug) + success("Handshake established\n"); + ++ /* check kTLS initialization (both send and recv should be supported)*/ ++ CHECK_KTLS_ENABLED(client); ++ CHECK_KTLS_ENABLED(server); ++ + switch (test) { + case 0: + case 1: +@@ -134,10 +209,14 @@ static void run(const char *name, unsigned test) + ret = gnutls_session_key_update(client, 0); + } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); + ++ CHECK_KTLS_ENABLED(client); ++ CHECK_KTLS_ENABLED(server); ++ + /* server receives the client key update and sends data */ + TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); + TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); + EMPTY_BUF(server, client, buffer, MAX_BUF); ++ + if (test != 0) + break; + sec_sleep(2); +@@ -151,10 +230,14 @@ static void run(const char *name, unsigned test) + if (ret < 0) + fail("error in key update: %s\n", gnutls_strerror(ret)); + ++ CHECK_KTLS_ENABLED(server); ++ CHECK_KTLS_ENABLED(client); ++ + /* client receives the key update and sends data */ + TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); + TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); + EMPTY_BUF(server, client, buffer, MAX_BUF); ++ + if (test != 0) + break; + sec_sleep(2); +@@ -167,10 +250,14 @@ static void run(const char *name, unsigned test) + if (ret < 0) + fail("error in key update: %s\n", gnutls_strerror(ret)); + ++ CHECK_KTLS_ENABLED(client); ++ CHECK_KTLS_ENABLED(server); ++ + /* server receives the client key update and sends data */ + TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); + TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); + EMPTY_BUF(server, client, buffer, MAX_BUF); ++ + if (test != 0) + break; + sec_sleep(2); +@@ -183,6 +270,9 @@ static void run(const char *name, unsigned test) + if (ret < 0) + fail("error in key update: %s\n", gnutls_strerror(ret)); + ++ CHECK_KTLS_ENABLED(server); ++ CHECK_KTLS_ENABLED(client); ++ + TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); + TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); + EMPTY_BUF(server, client, buffer, MAX_BUF); +@@ -210,6 +300,9 @@ static void run(const char *name, unsigned test) + /* client receives key update */ + EMPTY_BUF(server, client, buffer, MAX_BUF); + ++ CHECK_KTLS_ENABLED(server); ++ CHECK_KTLS_ENABLED(client); ++ + /* client uncorks and sends key update */ + do { + ret = gnutls_record_uncork(client, GNUTLS_RECORD_WAIT); +@@ -217,6 +310,9 @@ static void run(const char *name, unsigned test) + if (ret < 0) + fail("cannot send: %s\n", gnutls_strerror(ret)); + ++ CHECK_KTLS_ENABLED(server); ++ CHECK_KTLS_ENABLED(client); ++ + EMPTY_BUF(server, client, buffer, MAX_BUF); + + sec_sleep(2); +@@ -238,6 +334,9 @@ static void run(const char *name, unsigned test) + if (ret < 0) + fail("error in key update: %s\n", gnutls_strerror(ret)); + ++ CHECK_KTLS_ENABLED(server); ++ CHECK_KTLS_ENABLED(client); ++ + /* server receives the client key update and sends data */ + TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); + TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); +@@ -263,11 +362,11 @@ static void run(const char *name, unsigned test) + + void doit(void) + { +- run("single", 1); +- run("single", 2); +- run("single", 3); +- run("single", 4); +- run("single", 5); +- run("single", 6); +- run("all", 0); /* all one after each other */ ++ RUN("single", 1); ++ RUN("single", 2); ++ RUN("single", 3); ++ RUN("single", 4); ++ RUN("single", 5); ++ RUN("single", 6); ++ RUN("all", 0); /* all one after each other */ + } +-- +GitLab + + +From 247640a84f6aa7dddf6e2380d7189542b5483a4a Mon Sep 17 00:00:00 2001 +From: Frantisek Krenzelok +Date: Tue, 11 Feb 2025 13:35:43 +0100 +Subject: [PATCH 2/7] kTLS: add new keyupdate error return on recv + +kTLS now returns -EKEYEXPIRED when the socket's keys aren't updated after +receiving a keyupdate (this is very unlikely). Currently when this +happens the ktls recv funtion returns GNUTLS_E_AGAIN and the receive +function is called again and again. + +Signed-off-by: Frantisek Krenzelok +--- + lib/system/ktls.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/lib/system/ktls.c b/lib/system/ktls.c +index 432c70c5a2..cb29c5a763 100644 +--- a/lib/system/ktls.c ++++ b/lib/system/ktls.c +@@ -59,6 +59,7 @@ gnutls_transport_is_ktls_enabled(gnutls_session_t session) + { + if (unlikely(!session->internals.initial_negotiation_completed)) { + _gnutls_debug_log("Initial negotiation is not yet complete\n"); ++ gnutls_assert(); + return 0; + } + +@@ -82,7 +83,9 @@ void _gnutls_ktls_enable(gnutls_session_t session) + } + } else { + _gnutls_record_log( +- "Unable to set TCP_ULP for read socket: %d\n", errno); ++ "kTLS: Unable to set TCP_ULP for read socket: %d\n", ++ errno); ++ gnutls_assert(); + } + + if (sockin != sockout) { +@@ -91,8 +94,9 @@ void _gnutls_ktls_enable(gnutls_session_t session) + session->internals.ktls_enabled |= GNUTLS_KTLS_SEND; + } else { + _gnutls_record_log( +- "Unable to set TCP_ULP for write socket: %d\n", ++ "kTLS: Unable to set TCP_ULP for write socket: %d\n", + errno); ++ gnutls_assert(); + } + } + #endif +@@ -1064,6 +1068,13 @@ int _gnutls_ktls_recv_control_msg(gnutls_session_t session, + default: + return GNUTLS_E_PULL_ERROR; + } ++ } else if (unlikely(ret == -EKEYEXPIRED)) { ++ /* This will be received until a keyupdate is performed on the ++ scoket. */ ++ _gnutls_debug_log("kTLS: socket(recv) has not yet received " ++ "updated keys\n"); ++ gnutls_assert(); ++ return GNUTLS_E_AGAIN; + } + + /* connection closed */ +-- +GitLab + + +From 1cf5e7d5748e0a2312b55e9c4bcf252a34765919 Mon Sep 17 00:00:00 2001 +From: Krenzelok Frantisek +Date: Mon, 17 Feb 2025 23:08:57 +0100 +Subject: [PATCH 4/7] kTLS: add rekey kernel version check (Linux) + +Signed-off-by: Krenzelok Frantisek +--- + lib/system/ktls.c | 8 ++++++++ + tests/ktls.sh | 17 ++++++++--------- + tests/ktls_keyupdate.sh | 18 ++++++++++++++---- + tests/scripts/common.sh | 26 ++++++++++++++++++++++++++ + 4 files changed, 56 insertions(+), 13 deletions(-) + +diff --git a/lib/system/ktls.c b/lib/system/ktls.c +index cb29c5a763..66ab24ec7a 100644 +--- a/lib/system/ktls.c ++++ b/lib/system/ktls.c +@@ -507,6 +507,14 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, + return GNUTLS_E_UNIMPLEMENTED_FEATURE; + } + ++ if (major < 6 || (major == 6 && minor < 14)) { ++ _gnutls_debug_log("Linux kernel version %lu.%lu doesn't yet " ++ "support kTLS keyupdate, this will result in " ++ "invalidation of the current session after a " ++ "key-update is performed\n", ++ major, minor); ++ } ++ + /* check whether or not cipher suite supports ktls + */ + switch (cipher) { +diff --git a/tests/ktls.sh b/tests/ktls.sh +index a15d6116d9..ca9ead8df0 100644 +--- a/tests/ktls.sh ++++ b/tests/ktls.sh +@@ -25,19 +25,18 @@ + + case "$host_os" in + FreeBSD) +- if ! sysctl -n kern.ipc.tls.enable | grep 1 > /dev/null; then +- exit 77 ++ if ! sysctl -n kern.ipc.tls.enable | grep 1 > /dev/null; then ++ exit 77 + fi ++ ++ kernel_version_check 13 0 || exit 77 + ;; + Linux) +- if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then +- exit 77 ++ if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then ++ exit 77 + fi +- case "$(uname -r)" in +- 4.* | 5.[0-9].* | 5.10.*) +- exit 77 +- ;; +- esac ++ ++ kernel_version_check 5 10 || exit 77 + ;; + esac + +diff --git a/tests/ktls_keyupdate.sh b/tests/ktls_keyupdate.sh +index ae12a2f102..54706d8d94 100755 +--- a/tests/ktls_keyupdate.sh ++++ b/tests/ktls_keyupdate.sh +@@ -19,13 +19,23 @@ + # You should have received a copy of the GNU General Public License + # along with GnuTLS. If not, see . + +-: ${builddir=.} ++: ${builddir=.} ${host_os=`uname`} + + . "$srcdir/scripts/common.sh" + +-if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then +- exit 77 +-fi ++case "$host_os" in ++ FreeBSD) ++ # key update is not yet supported on FreeBSD ++ exit 77 ++ ;; ++ Linux) ++ if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then ++ exit 77 ++ fi ++ ++ kernel_version_check 6 14 || exit 77 ++ ;; ++esac + + testdir=`create_testdir ktls_keyupdate` + +diff --git a/tests/scripts/common.sh b/tests/scripts/common.sh +index 47355cf025..c5f91b62c4 100644 +--- a/tests/scripts/common.sh ++++ b/tests/scripts/common.sh +@@ -267,3 +267,29 @@ check_if_equal() { + diff -b -B "$1" "$2" + return $? + } ++ ++# works for FreeBSD and Linux ++# $1: the major version to check against ++# $2: the minor version to check against ++kernel_version_check() { ++ local required_major=$1 ++ local required_minor=$2 ++ ++ kernel_version=$(uname -r | sed -E 's/^([0-9]+\.[0-9]+).*/\1/' 2>/dev/null) ++ kernel_major=$(echo $kernel_version | cut -d. -f1 2>/dev/null) ++ kernel_minor=$(echo $kernel_version | cut -d. -f2 2>/dev/null) ++ ++ if ! [[ "$kernel_major" =~ ^[0-9]+$ ]] || ! [[ "$kernel_minor" =~ ^[0-9]+$ ]]; then ++ return 1 ++ fi ++ ++ if [ "$kernel_major" -lt "$required_major" ]; then ++ return 1 ++ fi ++ ++ if [ "$kernel_major" -eq "$required_major" ] && [ "$kernel_minor" -lt "$required_minor" ]; then ++ return 1 ++ fi ++ ++ return 0 ++} +-- +GitLab + + +From 82fac5267fd74196c29e8a8b3e47e17d6ec4c20b Mon Sep 17 00:00:00 2001 +From: Krenzelok Frantisek +Date: Tue, 11 Mar 2025 11:37:33 +0100 +Subject: [PATCH 5/7] kTLS: improve alert messages + +Signed-off-by: Krenzelok Frantisek +--- + lib/system/ktls.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +diff --git a/lib/system/ktls.c b/lib/system/ktls.c +index 66ab24ec7a..2983888d37 100644 +--- a/lib/system/ktls.c ++++ b/lib/system/ktls.c +@@ -1122,8 +1122,44 @@ int _gnutls_ktls_recv_int(gnutls_session_t session, content_type_t type, + GNUTLS_E_UNIMPLEMENTED_FEATURE); + break; + case GNUTLS_ALERT: ++ if (ret < 2) { ++ return gnutls_assert_val( ++ GNUTLS_E_UNEXPECTED_PACKET); ++ } ++ ++ uint8_t level = ((uint8_t *)data)[0]; ++ uint8_t desc = ((uint8_t *)data)[1]; ++ ++ _gnutls_record_log( ++ "REC[%p]: Alert[%d|%d] - %s - was received\n", ++ session, level, desc, ++ gnutls_alert_get_name((int)desc)); ++ ++ session->internals.last_alert = desc; ++ ++ /* if close notify is received and ++ * the alert is not fatal ++ */ ++ if (desc == GNUTLS_A_CLOSE_NOTIFY && ++ level != GNUTLS_AL_FATAL) { ++ /* If we have been expecting for an alert do ++ */ ++ session->internals.read_eof = 1; ++ return 0; ++ } ++ /* if the alert is FATAL or WARNING ++ * return the appropriate message ++ */ ++ gnutls_assert(); ++ if (level == GNUTLS_AL_FATAL) { ++ session->internals.resumable = false; ++ session->internals.invalid_connection = 1; ++ return gnutls_assert_val( ++ GNUTLS_E_FATAL_ALERT_RECEIVED); ++ } ++ ++ ret = GNUTLS_E_WARNING_ALERT_RECEIVED; + session_invalidate(session); +- ret = 0; + break; + case GNUTLS_HANDSHAKE: + ret = gnutls_handshake_write( +-- +GitLab + + +From 93d1fe12e52a382bd024b0db51482f0c7272bb2a Mon Sep 17 00:00:00 2001 +From: Krenzelok Frantisek +Date: Tue, 11 Mar 2025 11:38:47 +0100 +Subject: [PATCH 6/7] kTLS: fix gnutls-cli-debug - test + +Signed-off-by: Krenzelok Frantisek +--- + src/cli-debug.c | 6 ++++++ + src/tests.c | 4 +++- + tests/gnutls-cli-debug.sh | 11 ++++++----- + 3 files changed, 15 insertions(+), 6 deletions(-) + +diff --git a/src/cli-debug.c b/src/cli-debug.c +index ad8e525e30..b140cd3bc4 100644 +--- a/src/cli-debug.c ++++ b/src/cli-debug.c +@@ -67,6 +67,11 @@ static void tls_log_func(int level, const char *str) + fprintf(stderr, "|<%d>| %s", level, str); + } + ++static void tls_audit_log_func(gnutls_session_t session, const char *str) ++{ ++ fprintf(stderr, "|<%p>| %s", session, str); ++} ++ + typedef test_code_t (*TEST_FUNC)(gnutls_session_t); + + typedef struct { +@@ -277,6 +282,7 @@ int main(int argc, char **argv) + } + + gnutls_global_set_log_function(tls_log_func); ++ gnutls_global_set_audit_log_function(tls_audit_log_func); + gnutls_global_set_log_level(debug); + + /* get server name */ +diff --git a/src/tests.c b/src/tests.c +index 6544d1e2e0..2c06c8d669 100644 +--- a/src/tests.c ++++ b/src/tests.c +@@ -1770,7 +1770,9 @@ static test_code_t test_do_handshake_and_send_record(gnutls_session_t session) + return ret; + + gnutls_record_send(session, snd_buf, sizeof(snd_buf) - 1); +- ret = gnutls_record_recv(session, buf, sizeof(buf) - 1); ++ do { ++ ret = gnutls_record_recv(session, buf, sizeof(buf) - 1); ++ } while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN); + if (ret < 0) + return TEST_FAILED; + +diff --git a/tests/gnutls-cli-debug.sh b/tests/gnutls-cli-debug.sh +index c09e676c6a..82f4d4d111 100755 +--- a/tests/gnutls-cli-debug.sh ++++ b/tests/gnutls-cli-debug.sh +@@ -26,6 +26,7 @@ + : ${TIMEOUT=timeout} + OUTFILE=cli-debug.$$.tmp + TMPFILE=config.$$.tmp ++LOGFILE="$(basename "$0" .sh).log" + unset RETCODE + + if ! test -x "${SERV}"; then +@@ -71,7 +72,7 @@ PID=$! + wait_server ${PID} + + "$TIMEOUT" 1800 \ +-"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" ++"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" + + kill ${PID} + wait +@@ -118,7 +119,7 @@ PID=$! + wait_server ${PID} + + "$TIMEOUT" 1800 \ +-"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" ++"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" + + kill ${PID} + wait +@@ -160,7 +161,7 @@ PID=$! + wait_server ${PID} + + "$TIMEOUT" 1800 \ +-"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" ++"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" + + kill ${PID} + wait +@@ -186,7 +187,7 @@ _EOF_ + + GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" \ + "$TIMEOUT" 1800 \ +-"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" ++"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" + + kill ${PID} + wait +@@ -209,7 +210,7 @@ if test "${ENABLE_GOST}" = "1" && test "${GNUTLS_FORCE_FIPS_MODE}" != 1 ; then + wait_server ${PID} + + "$TIMEOUT" 1800 \ +- "${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" ++ "${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" + + kill ${PID} + wait +-- +GitLab + + +From eaa6912f6ee6bd8ff5f1175bbd7ccedd0526695e Mon Sep 17 00:00:00 2001 +From: Krenzelok Frantisek +Date: Mon, 17 Mar 2025 12:41:24 +0100 +Subject: [PATCH 7/7] tests: add enviromental variable + +Signed-off-by: Krenzelok Frantisek +--- + tests/Makefile.am | 2 +- + tests/ktls.sh | 4 ++-- + tests/ktls_keyupdate.sh | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 9990ee21cc..b39a97bac3 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -21,7 +21,7 @@ + + SUBDIRS = . cert-tests slow + +-TESTS_ENVIRONMENT = ++TESTS_ENVIRONMENT = HOST_OS=$$(uname) + + if WINDOWS + SUBDIRS += windows +diff --git a/tests/ktls.sh b/tests/ktls.sh +index ca9ead8df0..c2847be833 100644 +--- a/tests/ktls.sh ++++ b/tests/ktls.sh +@@ -19,11 +19,11 @@ + # You should have received a copy of the GNU General Public License + # along with GnuTLS. If not, see . + +-: ${builddir=.} ${host_os=`uname`} ++: ${builddir=.} + + . "$srcdir/scripts/common.sh" + +-case "$host_os" in ++case "$HOST_OS" in + FreeBSD) + if ! sysctl -n kern.ipc.tls.enable | grep 1 > /dev/null; then + exit 77 +diff --git a/tests/ktls_keyupdate.sh b/tests/ktls_keyupdate.sh +index 54706d8d94..54526727e3 100755 +--- a/tests/ktls_keyupdate.sh ++++ b/tests/ktls_keyupdate.sh +@@ -19,11 +19,11 @@ + # You should have received a copy of the GNU General Public License + # along with GnuTLS. If not, see . + +-: ${builddir=.} ${host_os=`uname`} ++: ${builddir=.} + + . "$srcdir/scripts/common.sh" + +-case "$host_os" in ++case "$HOST_OS" in + FreeBSD) + # key update is not yet supported on FreeBSD + exit 77 +-- +GitLab + diff --git a/gnutls.spec b/gnutls.spec index 32cd225..ea0891e 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -18,6 +18,8 @@ Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch +# https://gitlab.com/gnutls/gnutls/-/merge_requests/1934 +Patch: gnutls-3.8.9-ktls-kernel-check.patch %bcond_without bootstrap %bcond_without dane @@ -488,21 +490,6 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll* %check %if %{with tests} pushd native_build - -# KeyUpdate is not yet supported in the kernel. -xfail_tests=ktls_keyupdate.sh - -# The ktls.sh test currently only supports kernel 5.11+. This needs to -# be checked at run time, as the koji builder might be using a different -# version of kernel on the host than the one indicated by the -# kernel-devel package. - -case "$(uname -r)" in - 4.* | 5.[0-9].* | 5.10.* ) - xfail_tests="$xfail_tests ktls.sh" - ;; -esac - make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests" popd %endif From 5cccaeedc8f732416ced2b743c65d6897341e891 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 9 Jul 2025 18:02:24 +0900 Subject: [PATCH 7/9] Update to 3.8.10 upstream release Also update the bundled leancrypto to 1.5.0. Signed-off-by: Daiki Ueno --- .gitignore | 3 + gnutls-3.8.10-tests-ktls.patch | 114 ++++++++++++++++++++++++++++++++ gnutls-3.8.10-tests-mldsa.patch | 58 ++++++++++++++++ gnutls.spec | 12 ++-- sources | 6 +- 5 files changed, 185 insertions(+), 8 deletions(-) create mode 100644 gnutls-3.8.10-tests-ktls.patch create mode 100644 gnutls-3.8.10-tests-mldsa.patch diff --git a/.gitignore b/.gitignore index 45589ae..f859c71 100644 --- a/.gitignore +++ b/.gitignore @@ -167,3 +167,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.9.tar.xz.sig /leancrypto-1.2.0.tar.gz /leancrypto-1.3.0.tar.gz +/gnutls-3.8.10.tar.xz +/gnutls-3.8.10.tar.xz.sig +/leancrypto-1.5.0.tar.gz diff --git a/gnutls-3.8.10-tests-ktls.patch b/gnutls-3.8.10-tests-ktls.patch new file mode 100644 index 0000000..1b23124 --- /dev/null +++ b/gnutls-3.8.10-tests-ktls.patch @@ -0,0 +1,114 @@ +From e0eb2bbb212a5c9d72311c59e7235832a0075dcc Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Wed, 9 Jul 2025 18:54:48 +0900 +Subject: [PATCH] add tests/ktls_utils.h + +Signed-off-by: rpm-build +--- + tests/ktls_utils.h | 94 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 94 insertions(+) + create mode 100644 tests/ktls_utils.h + +diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h +new file mode 100644 +index 0000000..231618d +--- /dev/null ++++ b/tests/ktls_utils.h +@@ -0,0 +1,94 @@ ++#ifndef GNUTLS_TESTS_KTLS_UTILS_H ++#define GNUTLS_TESTS_KTLS_UTILS_H ++ ++#include ++#include ++ ++#include ++ ++#include ++#include ++ ++/* Sets the NONBLOCK flag on the socket(fd) */ ++inline static int set_nonblocking(int fd) ++{ ++ int flags = fcntl(fd, F_GETFL, 0); ++ if (flags == -1) { ++ return 1; ++ } ++ ++ if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) { ++ return 2; ++ } ++ ++ return 0; ++} ++ ++/* Creates a pair of TCP connected sockets */ ++static int create_socket_pair(int *client_fd, int *server_fd) ++{ ++ int ret; ++ struct sockaddr_in saddr; ++ socklen_t addrlen; ++ int listener; ++ ++ listener = socket(AF_INET, SOCK_STREAM, 0); ++ if (listener == -1) { ++ fail("error in listener(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ int opt = 0; ++ setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); ++ ++ memset(&saddr, 0, sizeof(saddr)); ++ saddr.sin_family = AF_INET; ++ saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); ++ saddr.sin_port = 0; ++ ++ ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); ++ if (ret == -1) { ++ fail("error in bind(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ addrlen = sizeof(saddr); ++ ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); ++ if (ret == -1) { ++ fail("error in getsockname(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ ret = listen(listener, 1); ++ if (ret == -1) { ++ fail("error in listen(): %s\n", strerror(errno)); ++ close(listener); ++ return 1; ++ } ++ ++ *client_fd = socket(AF_INET, SOCK_STREAM, 0); ++ if (*client_fd < 0) { ++ fail("error in socket(): %s\n", strerror(errno)); ++ return 1; ++ } ++ ++ ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen); ++ if (ret < 0) { ++ fail("error in connect(): %s\n", strerror(errno)); ++ close(listener); ++ close(*client_fd); ++ return 1; ++ } ++ ++ *server_fd = accept(listener, NULL, NULL); ++ if (*server_fd < 0) { ++ fail("error in accept(): %s\n", strerror(errno)); ++ close(listener); ++ close(*client_fd); ++ return 1; ++ } ++ ++ return 0; ++} ++ ++#endif //GNUTLS_TESTS_KTLS_UTILS_H +-- +2.49.0 + diff --git a/gnutls-3.8.10-tests-mldsa.patch b/gnutls-3.8.10-tests-mldsa.patch new file mode 100644 index 0000000..158632e --- /dev/null +++ b/gnutls-3.8.10-tests-mldsa.patch @@ -0,0 +1,58 @@ +From 15fb5ad536c375a74cc0d87859c9fc919d924c9d Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Thu, 10 Jul 2025 05:45:06 +0900 +Subject: [PATCH] support VPATH build for mldsa tests + +Signed-off-by: rpm-build +--- + tests/cert-tests/mldsa.sh | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/tests/cert-tests/mldsa.sh b/tests/cert-tests/mldsa.sh +index 7e31e11..55e31ce 100644 +--- a/tests/cert-tests/mldsa.sh ++++ b/tests/cert-tests/mldsa.sh +@@ -130,7 +130,7 @@ for variant in 44 65 87; do + # Check default + TMPKEYDEFAULT=$testdir/key-$algo-$format-default + TMPKEY=$testdir/key-$algo-$format +- ${VALGRIND} "${CERTTOOL}" -k --no-text --infile "data/key-$algo-$format.pem" >"$TMPKEYDEFAULT" ++ ${VALGRIND} "${CERTTOOL}" -k --no-text --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEYDEFAULT" + if [ $? != 0 ]; then + cat "$TMPKEYDEFAULT" + exit 1 +@@ -138,19 +138,19 @@ for variant in 44 65 87; do + + # The "expandedKey" format doesn't have public key part + if [ "$format" = seed ] || [ "$format" = both ]; then +- if ! "${DIFF}" "$TMPKEYDEFAULT" "data/key-$algo-both.pem"; then ++ if ! "${DIFF}" "$TMPKEYDEFAULT" "$srcdir/data/key-$algo-both.pem"; then + exit 1 + fi + fi + + # Check roundtrip with --key-format +- ${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "data/key-$algo-$format.pem" >"$TMPKEY" ++ ${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEY" + if [ $? != 0 ]; then + cat "$TMPKEY" + exit 1 + fi + +- if ! "${DIFF}" "$TMPKEY" "data/key-$algo-$format.pem"; then ++ if ! "${DIFF}" "$TMPKEY" "$srcdir/data/key-$algo-$format.pem"; then + exit 1 + fi + done +@@ -164,7 +164,7 @@ for n in 1; do + fi + + echo "Testing inconsistent ML-DSA key ($n)" +- if "${CERTTOOL}" -k --infile "data/key-mldsa-inconsistent$n.pem"; then ++ if "${CERTTOOL}" -k --infile "$srcdir/data/key-mldsa-inconsistent$n.pem"; then + exit 1 + fi + done +-- +2.49.0 + diff --git a/gnutls.spec b/gnutls.spec index ea0891e..54c2a86 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,14 +12,16 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.9 +Version: 3.8.10 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch -# https://gitlab.com/gnutls/gnutls/-/merge_requests/1934 -Patch: gnutls-3.8.9-ktls-kernel-check.patch +# add tests/ktls_utils.h missing in the distribution +Patch: gnutls-3.8.10-tests-ktls.patch +# run tests/cert-test/mldsa.sh in VPATH build +Patch: gnutls-3.8.10-tests-mldsa.patch %bcond_without bootstrap %bcond_without dane @@ -133,7 +135,7 @@ Source101: gmp-6.2.1-intel-cet.patch %endif %if %{with leancrypto} -Source300: leancrypto-1.3.0.tar.gz +Source300: leancrypto-1.5.0.tar.gz %endif # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -490,7 +492,7 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll* %check %if %{with tests} pushd native_build -make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests" +make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null || { cat tests/test-suite.log tests/cert-tests/test-suite.log tests/slow/test-suite.log src/gl/tests/test-suite.log; exit 1; } popd %endif diff --git a/sources b/sources index 5043ca2..6114eb9 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b3685246b64bde97b5bd94f463ab376ed817869869714115f4ff11bdc53c32604bb04a8ff8e10daa6d1fc7 -SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e +SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92 +SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.3.0.tar.gz) = 8e0348d09b37fd6eb770505f1e98efdbf9d6f721aa2617d1f32d42ba89709bf374eb9d06aa2266bc7d7b5c56ab3168f12925fd4ec1d2d78951080f74f4a1a085 +SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9 From 1f251538bff8c298207f0e7b36062f5996688cbf Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 20 Nov 2025 17:08:14 +0900 Subject: [PATCH 8/9] Update to 3.8.11 upstream release - Resolves: rhbz#2416041 Upstream tag: 3.8.11 Upstream commit: b841c70e Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 3 +++ README.packit | 2 +- gnutls.spec | 45 ++++++++++++++++++++++++++++++++++++--------- sources | 7 +++---- 4 files changed, 43 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index f859c71..1e793de 100644 --- a/.gitignore +++ b/.gitignore @@ -170,3 +170,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.10.tar.xz /gnutls-3.8.10.tar.xz.sig /leancrypto-1.5.0.tar.gz +/gnutls-3.8.11.tar.xz +/gnutls-3.8.11.tar.xz.sig +/leancrypto-1.6.0.tar.gz diff --git a/README.packit b/README.packit index 72e3769..2511bf4 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.102.2. +The file was generated using packit 1.12.0. diff --git a/gnutls.spec b/gnutls.spec index 54c2a86..4b1ad0f 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,25 +12,26 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.10 +Version: 3.8.11 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch -# add tests/ktls_utils.h missing in the distribution -Patch: gnutls-3.8.10-tests-ktls.patch -# run tests/cert-test/mldsa.sh in VPATH build -Patch: gnutls-3.8.10-tests-mldsa.patch %bcond_without bootstrap %bcond_without dane %bcond_without fips %bcond_with tpm12 %bcond_without tpm2 +%if 0%{?rhel} >= 9 +%bcond_with gost +%else %bcond_without gost +%endif %bcond_without certificate_compression %bcond_without leancrypto +%bcond_with crypto_auditing %bcond_without tests %if 0%{?fedora} && 0%{?fedora} < 38 @@ -71,7 +72,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel %if %{with bootstrap} BuildRequires: automake, autoconf, gperf, libtool, texinfo %endif -BuildRequires: nettle-devel >= 3.10 +BuildRequires: nettle-devel >= 3.10.1 %if %{with leancrypto} BuildRequires: meson %endif @@ -86,6 +87,9 @@ BuildRequires: libunistring-devel BuildRequires: net-tools, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 BuildRequires: git-core +%if %{with crypto_auditing} +BuildRequires: systemtap-sdt-devel +%endif # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates @@ -93,7 +97,7 @@ Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 # always bump when a nettle release is packaged -Requires: nettle >= 3.10 +Requires: nettle >= 3.10.1 %if %{with tpm12} Recommends: trousers >= 0.3.11.2 %endif @@ -129,13 +133,20 @@ Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver Source2: https://gnutls.org/gnutls-release-keyring.gpg %if %{with bundled_gmp} +Provides: bundled(gmp) = 6.2.1 Source100: gmp-6.2.1.tar.xz # Taken from the main gmp package Source101: gmp-6.2.1-intel-cet.patch +Source102: gmp-6.2.1-c23.patch +%endif + +%if 0%{?rhel} >= 10 +Source201: gnutls-3.8.8-tests-rsa-default.patch %endif %if %{with leancrypto} -Source300: leancrypto-1.5.0.tar.gz +Provides: bundled(leancrypto) = 1.6.0 +Source300: leancrypto-1.6.0.tar.gz %endif # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -266,9 +277,14 @@ mkdir -p bundled_gmp pushd bundled_gmp tar --strip-components=1 -xf %{SOURCE100} patch -p1 < %{SOURCE101} +patch -p1 < %{SOURCE102} popd %endif +%if 0%{?rhel} >= 10 +patch -p1 < %{SOURCE201} +%endif + %build %define _lto_cflags %{nil} @@ -301,7 +317,8 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dx509_parser=disabled -Dx509_generator=disabled \ -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ -Dsha2-256=disabled \ - -Dchacha20=disabled -Dchacha20_drng=disabled \ + -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ + -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ -Dhash_crypt=disabled \ -Dhmac=disabled -Dhkdf=disabled \ @@ -340,6 +357,11 @@ eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release) export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name" %endif +# F42 MinGW only has Nettle 3.7 +%if %{with mingw} +sed -i 's/NETTLE_MINIMUM=3.10/NETTLE_MINIMUM=3.7/' configure +%endif + mkdir native_build pushd native_build @@ -394,6 +416,11 @@ pushd native_build --with-leancrypto \ %else --without-leancrypto \ +%endif +%if %{with crypto_auditing} + --enable-crypto-auditing \ +%else + --disable-crypto-auditing \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" diff --git a/sources b/sources index 6114eb9..b7486bf 100644 --- a/sources +++ b/sources @@ -1,5 +1,4 @@ -SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92 -SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8 +SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386 +SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a -SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9 +SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100 From 5b5cc6dfa7ad1f4457b02f6a8839522f88f1f669 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Tue, 25 Nov 2025 10:30:02 +0100 Subject: [PATCH 9/9] Disable native assembly to work around bz2416812 --- gnutls.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index 4b1ad0f..0917fd9 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -328,7 +328,10 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dhotp=disabled -Dtotp=disabled \ -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \ -Daes_kw=disabled -Dapps=disabled \ + -Ddisable-asm=true \ _build +# the reason for -Ddisable-asm=true being bz2416812 +# revert once the root cause is fixed meson compile -C _build meson install -C _build