From 0ef77a6c35c53ff7c17c7c254482845adc6d4548 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 14 Feb 2023 16:50:27 +0100 Subject: [PATCH 1/9] Prepare for release Signed-off-by: Zoltan Fridrich --- gnutls-3.7.4.tar.xz.sig | Bin 685 -> 0 bytes gnutls-3.7.5.tar.xz.sig | Bin 685 -> 0 bytes gnutls-3.7.6.tar.xz.sig | Bin 685 -> 0 bytes gnutls-3.7.7.tar.xz.sig | Bin 685 -> 0 bytes gnutls-3.7.8.tar.xz.sig | Bin 1250 -> 0 bytes gnutls-release-keyring.gpg | Bin 26256 -> 0 bytes gnutls.spec | 2 +- sources | 2 ++ 8 files changed, 3 insertions(+), 1 deletion(-) delete mode 100644 gnutls-3.7.4.tar.xz.sig delete mode 100644 gnutls-3.7.5.tar.xz.sig delete mode 100644 gnutls-3.7.6.tar.xz.sig delete mode 100644 gnutls-3.7.7.tar.xz.sig delete mode 100644 gnutls-3.7.8.tar.xz.sig delete mode 100644 gnutls-release-keyring.gpg diff --git a/gnutls-3.7.4.tar.xz.sig b/gnutls-3.7.4.tar.xz.sig deleted file mode 100644 index b9c03b613433c41a237be8218cedfb14bbb47c87..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 685 zcmV;e0#f~mbp!ww3IH7zAp~7U%MW%m1*ZiyR`hyxrbx5-A`ArrVlyr80162ZdUd8q zv-u(n1fT%@6p|Gjsi!d%jZayHA(`cQ<>+~sy4$WtrhapJo4T(K0RXwd%q}q}Ybf;b z%vd1>kQOV+LR^s~^WXqaLUuumtqh3*GXwwu2ml=xAp}MuCBw9DG>4zaNo>{ygpSwd zm~jOHVlz7C0162Z)&+!)*XEdUbkz_26y8?IDiWQ~yL{S3<@MyX0J#&?!B!Hmkuqjr zVjSXJp&OyeF&uRa*1-ZjIZQ|HW5c4yp=uLm>WYU-Ib4Irr?CgoL7fZ1l$y6 z!bx4F4Jylhe5XS-;?wZ38V=L4I0Z)%$ zmHdQpnRXGHNa_UoPKj_Kdd5(Pc!UPKU8^0qG>GF{yJD%H&W;gP{`zG7$PG;qSKAr; Ty-KhOFJ<0WcXPu(BNiKNz}7%A diff --git a/gnutls-3.7.5.tar.xz.sig b/gnutls-3.7.5.tar.xz.sig deleted file mode 100644 index b1e591f3f7c26af957334d33efb4ff3085501d1b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 685 zcmV;e0#f~mbp!ww3IH7zAp~7U%MW%m1*ZiyR`hyxrbx5-A`ArrVtojB0162ZdUd8q zv-u(nw*>(IQVa%7W49>fM5KR_wVg;cFShzNT&Y1NDK&B`xlr5W0RL^^JLh<|DKQ|4 z8}_{OUkD!EFGKQ54zaNo>{ygpSwd zm~jOHVtpTt0162Z)&+!)*XEdUsZ0<5K?NGDVyp9oAj!B=TrD?H!L(8*Fxq>^>+_!( zX?Ub3u#)1@-RqY>v88qw`^m_WEG1$14ofMBfgIz_MmE~pVIAV4$rQ@*RrX*D!`I~a!kAQ(04)dm?K94|16jz}> zv1Z;%Vph$#iMI-N{M`_yC1hz*#vMYUnlMTYmy4bktI6P3Mr)yVC+g%CeKykz{>=HV zND_ePY5}YAhh(x1+mAF^k=^mrDC$^YNHeZrP0JvfqT1%*6w;kw_ zR>R%#rt)OQ;Vb*ELgr&6HSR6|X#6dJvJQ16z>W?Tk(Q1ystr(LRrw!>!4qNj;~>G{y)@OgqHv11 Tgh%PbJ8f@0Zcx^u-OUEF diff --git a/gnutls-3.7.6.tar.xz.sig b/gnutls-3.7.6.tar.xz.sig deleted file mode 100644 index 70cb359cfa200e21bbf41fbe8a97062d6596949b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 685 zcmV;e0#f~n0y6{v0SEvc79j*iA|=DLZ#0LW$VqJ01%!^*=9qB>0%DM=asUbm5Y`2R zj@Raxag~S<|6D@l3C3#|Jf^=OwKKysslXB+p;!Ex&05zgiTPH4f-KUI^0rO|%5HLC zcqlZLJfI{ft90^YHlVmsW)tiIu5|vOl1A3=r=NDpLbuo^P5iV~Z+iBr#DLYG_l^-N z+@%p;65TrGX*i(k0ncB=DN2|=SdBdZ{z}TT7YJzgd1Gl)R-71t9Q>nrlmFsxeI4)7 z>|q#*M2D~Y380*5)@$X#B`lg0oraC@$tlt)#8EE*=!619mLQo7xciwU-KDl|G~PmX zY_{lGs%M0eh}D7x4UyAoekX+{eM$g-=HuV9rmaV_{JKfa+Z~^qu|4^2?Jp0oi>E#I zKXKXFg;k#?1p~(g-e*Y1yN6xR1Hruv@nk8NM7n`s3rV{Hw(j&apnj*?g(n&OGf0Cy zt$0!7N0u;x={}M;VX>uG_`zH0vX4YYSf8wj_pC&#>tiUL{%EMrFH8<(>LG!Ha_@i- z4Fo0C@#5uqcs zZL4w_X10cGjIq8Gs_rimDBxqByOUO7eR~O!%%s8ni;$kT5P65+Hn#qFy(#!8gF{|f z{fKo002T@W9Tp)3T}I0fb~FX21vOUmdUd8qv-u(n1p;D_l4Sr22@ra9rbx5-A`I}} z0RA~Yf@MX8iwd_>M6_sh73C=7B7}?+21`rW9!3W-oTC8%yxSB_;^bY^-$zRA&RE{( THJM||bc2D~!02dd{0%GEs`~V6G5Y`2R zj@RaxaZp+h{w0(&Lqs0#=Rr`Yltw6^=~Xpll_pmFJ(@;wkR?#JYkkc~;cUN{tg>e!cdumtUZiZw9Id-cm35L+ zH1GE`Lk5jGZa3H7uNj$CH1wT~#8IIa_5w0R31S{&SbZ|OcDns3sud2R0OS?H`Lb;$FF)6!eIf&o79oY?B4`J7 za^EV}QKHK1W2;|IOGN#3Z+(>8&LX_VRDl#K9>7P&Q>;nYhMZky8MSOP$qMDmWX9mT zz&&~Jf;uSxZMMIA4&B*Qu)ek{k-=PcyT`!+6GL+iHm{D3iMU84N&*xq z+-iI))|KI`Xfw)#dc2@nQ9GOlH;XWb2oFt5NKO*Fn!9^ES_R<3t^OoM|~pFh~#;>9!IXG45!^IPF15x{Z z%>9$1luWy0Fl>TsjLAAoCJ+>G4l#H#>6faS0^Y;D6)r2R4L$@`I@YLf1 z%7S7ItwE2fYrflloNaOjRw-0Tj=8sU3rpk-2e*%^xD|QuDd*7-arm&kfuo4e^<7cr z^Ur@)_v?cm1;+TDpw4#`Dz0cY-J!Z@&OI(2jbgyqLJXZd=8lgl1lPiV!LL|!(TOlF zjTnd_B?7y&eWj?id8RCDS7vX{{rtM6aksH6l?s#KWk9muyI0v;07er&2x@f;nKW>6 z+}8Vbn@f%eHY(N|One3Zi;!(9e_C1z-1>IVA)v`I-q8+9l6)V2^?ClN)-7Bo zHiz^OD<`br{(ypMrt-TQb)@*Y?MG0itV*mbvkM_w_rx7Y-n-e zJBb1^1ONdD038+~1V$ny!?bTSho8tvY}N&Yj@RaxaRmZnGZRMu3JDO_1%!^*=9qDE zhY$83)3ChQHl^|CKPU9>Lm(>d!#gZ(IH%6kih4DDU^-vk&n@&$`B>uj!}LZfcYetU z%$Uu%yqU!Bn6XRM6JD($xMUgAVw$R&d709h&&zOI3~G|GT&K`Lc8lN9#auCwn?B)O z1M618Xn5?sU9!uftSyb4pT3-bLJH>nykGzIT>O0@88rHof-K$?TzRV{s76zMds z-!bm_R;18`(HE|=fI-^kZb{|yvw3*B8)neHeacnW1K-qkXAgv6kQ~lFaEl=xrG9-3 z=nl?HGI-DWU1xs=W8u%D7!=;Yo$-fkZ}Q+xxeyKupD|AeYf{xG5%FWfkc*`?|Hpaz z$JJu)=Ct~|kB23p^)C>&8N-^Uo6KE%JE}Ka9&)8g$FjQ2sZg+a1vb z>tNw^N@Y~Y7 zLM`u~8315bRytW>m%39$@zCO}?b+d>9O^Cr{T}_sk%m<)aMb!~?OH*MTy=b|$8pw{O8qqV648KF=<`DM}1PB*UCBV(v-^b4)k6oKwI zG*j7G`Vf!=^M@HC3hTN&nLw_9i+h==(notz3Ui+g46_-the2yBAu?Ao%@T*?xcM-F z`7+Z~%~1W+PNYRM-zWt*b!Ka-YjBcvy?Oa5yxdRyr(cKNAL->>2@qj{(3_V$JuLh> z`HkmdtkL7c__b3q5B}9!s`@58 z7SORIUF+@n{A4j`1O1RS_!AOz7F+9S?=afWAzZzo2sA>(I(dJh2Nl5!(pzP8J*ytM zFp)}SDox>#K+i`32n6j-({L_B!cR7vocg-=$6?ir^)(XuY-bayGvqrQENhbFYqAM4 zbT>noXMdyZz|slCD%Svb<~5le%N)!oQ`=K?y?3NPYDmyu`pqCn!0OW7%zNjtA+zaf zIwTc7N4T%_AQ?mcS|>dG)o~O+xhZH#2(&K{tCVPd67cXL<)`3;rlzRZtWl zU;sZb4hS$l5HLm{7z`971PB-!G!!HZ7&xW$1rB7Z{4b`>l%e(faF z2@F`L8oL_|3cHdX4gd{>`0w%SGK5b&fdX2%*crOo15t)nHc0RUgi%@Uo@4YEP8xhG z@;Wv85R@`K<7C*9j|LoejdXWdVdQ!6fDj#$jk`(xs0brQELxa=yA^7Drwg$L(Wy$Q zcsXZaTcKZ&Ma(LTXYIHkjvP1_jzL2WuflQUQ&H=n$p&-Sq)`b^!~zdd$GIRC6+GeX z?oXa*9Vn1ggNg<;#CRWl95<>$jlUhLijzB%Ou;?L`V#4TAb(CpbB36#FG;r}JponG zj*_{<`%dpdNDyJGZG(=}TsUwks}>?5!1#EncUy=`xIOKNY-l{Th2x&X~FO28qd zSTFYPBQIfktZV`Tj?oxn3<4@8pzXi7+i)LVXgVX8kkBy|yQ>!y{UByPlkmR(oi(k&HXP`aa{=jg zJkO)ItPWwMx7w{NA}jkf#ZmhJQa25?m8z1|z#Z7^d>SIZ{P8@NL(kv>lcwZ4q9IK5 zHI13H}u?hJ@OURIghM!&Ho0IoUAob@wRj|A(T$ z6MP*M!h_JCSRz()afSmwQXCW!2^atl1}tsysP>l*P<*a>r|9TWK`#*RR{uR2W2gU&b{|8TC zP&8mj5YWGP{)^iG1kipE;ak>RwXpSD&m@Hmp13XQh_LcW+sF|1s~BICI|C|`UPS%* zcMJxFeRC>jUzk@vQYUK}zsa>3^$(-%wbCI(HW?!5xQf(tES(Vy`c%mlC-n>%xJYeg z17v$8HInx(vR~)d@^)WuD6?Log-Gz>qn$fJPzPG3M%a1v-U4!A($HdHCwrqg(aHnt3B} zoYb~N&{N-?e#jSN`0c)ABK5pMp%243Jcq=hqrN_k3QS~*lzPaR91W96=dk<<(&QtyLt z)t-c^!R7c0x^h%t##L!JEZBQZ65TPqsF^iaLnr9Dt)d!;lV&W*)$k{*B}D#c5ee(3 z86@=^kbz=Vh<``1VSAIhrEqk@6#W?Jg8;IWc{T>??5VD2Sl@|FB*`G%96N-Bk>;RWtco!m_lIagnBkXKku|H?xZS|EYsP@mI$gr?$@uNs&~X z6Oiwul~V1JF=Qy%>T1IO2NP%6|J@jnM`dv>okg9hT+)gSY@GCIY^oh36{!x2hy?R@ zV*NX=``WM?eBovb(K5iEFD^SplGoU!-Q5A1I&unI10}&VoBJW$(V+?^U{C10S%!M5 zs#OZ{iud8sHg~UwZw!&xCmPSbLj0fi1^JI|VfWGB=UYDhT{D2nN2g*6$oG*+!F!-K zi}|{56rL+6A6^Yn%L5ej4?RA%uvIq*9S)G+3n7M@iI{st0po%q0{vU)>#tA*gCnh+ zJy}JKIKmg3#Ck%9WigMdB~?dgchFCwd4^8hqxj}zGCvIRVZL|jnLjJ!-e;TDQ#{%k zL9*VILdghKg2P(^Le#uPS`6k>;;;O+R~6*q-s}1rKd$2KbTF>A!SWb9xQnfvAkmHr zZ3GX?a)t@n)!i;`Kq+;?xycj39p7WxznNT1KEA3B^GopG&*rI( zHLs-sPJ>^-+y39y3doh<-YW$s8RsCTdc_S2o%G>IUSy)HVy}KK{9VXrE{`!Fb@{WV zY_H%P2oH)tPt<6vUG31gy`?jIQ?hU6mZ!Qf?`C1Q%`sqe7F@y30pZ2o6;DO zRp-EQ6!M}v>dx_Y?kqp3kvwr(y0tDLbV9{y^444D)}f3;(neZHc6aT&C668flj*kN zNzvH^{r(+e${Lc_|n!ws&oxln42@Roo%I6yGU3H7Omku$uPHxLP+n<_;As(ebvP$dh^~$lf+dotwr>rD9F)BNWTNV}ZEk z5f6zO}k zUYt+wU#N%H`N! zb_72*A#GQpedm4qFV4Mt9T9olLQw_mvuk!{X?tQ1DKxy+FD)!snx=P22*t#yrU!58 z4IZq?b(>Qce;PoC^w(yBbpjjSw~N_4!5nRyn-?)YBYvW;hxr}r+iQ8{x3Xk z3IF0zw?$-X5CSjlQiJfVlJs2WAL^sb?B#aZDb{d>T$@th4_WTYx;MssF%>F8dO-98 zCWKYIt+ODWQ{7&!8fNfqaWOZ6!!Xg`JHctf=$OZLrUO$~RrQh_A6KJ8sZ@Ym%nkPE zBg1g9%teVGNmExD5S(SHH9@{*U(6vq{gL~wxQ8qhKSW;(!23ah1}+}@)q6B4Oh+*~ z7~V|*nWF&;bQU6mZSj;X*b`ZXhG}7JUlt)a*OyayYW}tl-84l*nzL} zjrwRAp1I}^a>tL5CY3>fTge@;2f>pHRuzK93-WYcM)dlJ^Dn>9Sfho^O=XuccJ-3w zG(kSl@KM0<_{E4EC&)^5Jfa`h!kjG zSD28AHaA4WacT*>)z6tpvf{1D7Ae*}#<}d{Bbxn4Y2~q68*GlrA|;~qUW|j423nnV zME)cZ!*z1uGDb3d=cvuxsED`P!Zk4)w7yC1X1YBWu9aBFcCYF-*s>@e*x!G=VEz(& zj0#65zwx1SLl(BdZ{(d{)BOZ0R)`X><*~Q&IgSnBJihzL9B)z{zuYgl=ENIK3&t4u{a<)I`~Stm&!Ip4N{CQo=NaLP120z!9ae?#VZKGwszlKi%`LVYveCaw z?YJma-S$*WZ!SEU>7Q#)(x~p%E^t72YG$Zn?3nZ(g%8BOu z1egZ}YuQ*TuZd7dh{#$pso1Jus9UN(FD^iAd%tEc4+=9^h%{w<8bk+p0)`rIjU~E2T4y|7H@Hejiyyd z#n-E-lON=FQ?`B%OkpACwW|Yse|Feu+VSL4?>Zrpnn*A<^*40;1HaCH@#-ZYTFvbD z=`e#Z)C)K)g?u6;bs0gZrU<*r59?qDrTWuH3h0rnaH*;h)0_qykR96U?A!B^^=;23 zoq5y3r4LIZb>Cg^w2Y=`bVt)B94|+G!gxCcC%u&zY!d@j_VMF z1glMhC9Yomtoc_s0SFhOp7@0cmzLXkp-WCh-!_L=rJlr__C%!6iba)r5!v0dF^-6t zLO6?sC&f$$J5NEOiL(_HHi%E=GNH3`xA2JvF*zwQ4rKpO)K5) zr67o&E4Q!cYAREYw@;bP(+DbLl@tuZ3!VebVDNr~$C=+XMr{OE3PrqVlp9TEF#wEy zF5QfD0Vp%l^jw^2-fLvUlj3z!D8cS9X4HZq)+dt*c8(8SNpnHTYZ|Hus^Rj(G;hjYdJ8wMY>voxhXbobI1b-1dk~hQ zzD(nBzb!yPEo{=i8lx+siU&@7;l$m(+G)Q0<&SObWlP{D;&uDZlk9zLCjr`$;7qc> znXm62E&5Y}_A$o2%^-iO_MeXHO{E#{OU;sIL>x%uo=#? zX`TpwRrIin-S82PoCEZ}b$;p3OwcjkA!FbLda}zy&_m$*iOeXqi~kYF<;zaPNJ|`o zD-`w-$-)S7d~=2?+v!Zzi%h`Q~Y>M;QAQXSWRtPoxrR3ecW_-UvA(=EPKvn!& zT^2vRzxSdI>Nq#)Iwvf?k5Y1Eky6)(qXh|@^8G3#lIhDCZx-J2jZz@zNt zDRrhk4Qo&sa14u_e0burnN+^VGD%@Xpv$7P;k6C>F!?M2A;WGXK_|hxzLQWdJ(A-F zSk@MExt)@s>P<4HxZhdbv4S^#Pc`EtWnAfaP!1w5oV>}7Tm~UnpJwOFZR>;}%(6ce zU+3k&Q2w+Sn>(roQh}}4EbqN5X;7#GZns7yQ1=cNa4%}z>*LVX)Cw6iMgB8;6n$F# z#baNIJBwiUl(aPx5fImn{KbWv5MwhGif0a#w&_ecKr)(zR-`QB1biRgaq>uP+qIf^ zaDQ%4ZSoAp^Ue_QV@o1c3X)x+fYvi_*tNX6b)80wJ$6Yg9bBf82iTyJ+}Mx8`+iOT z7$fFSueGcI(Q{G+cQB3};F^(3z15NsNIIOLBqvI1wFm3 z#+X_63LgZndYjfvrR+l?)gN<`_YJs9@G6QpG`ssf>{AnTSD1O$pr)YCQ_{79g3M#I z$X(4@n*(ZSlpAZN=^TBmSmeFWv;>dO7oS{z{wNKUz}{#|`1_vsim3SRs8IoS8Slqr#R@%mUn!EXuVUWl7r7 zL^Tb4VwpoPzaDW}1~ct&@#D-Cv2P5{SP;w@nb4S-29}KlLFJv-so8X9vsY4}?=fN~uoE%INNo;s%~)dosuLKz$@XF|Dg2`5 zzxXw$ZV`?!#%{j?B%EmH(ubkMIThJ7SIv#eS z$qT$&iqo6h=-@Rxa+Z9GfDu;LG6dd6P%F5m2R-wIs)JZu1=C>WGA;Lb1@HSNR-k_+ zQUhLpTJ)LyrWG~H%fQ9}6!i7B!hlsBipL*Lj;Zze*Re%6k6H}?WPW)mT04cVy;mV? zb{XhOmH20%+ZJVak?t-Z*Ajc8mNc5KRK)1Sp&j~jTA9YOcA?-+@7VRpIC=x7l|N3+ z3^n)}+0m#i<&_hKsMIXng;(QZ2JAN$rC5e`;mTI9tb(f3;B&^0!e{V7f$>shD9jaO z`8K+CQ(JT_i>TutgPTfwaf?o^%V}o2em-Ls8D%geV`51|>Q~^LiQCv8wH-Wh(jojJJ z$}zuU9NhslAdhuyR{jOEaqh?|sm;u#G#tj0mG3_>E1ie@D^zq@x6t+qEF^`D@QIJl zT@%M@6!#Nd#lLYyd)v_$R*CAQ94l2zDPQLCgqkCL&HzMRJ3Ps9j!ryS<}H#I460aj zPG(d^M}fU%ZW*pw9EOB#XBktn)AlpJG)0@{dDq&G= zz-`qAPqmO(5=LFh8wsLyzYBd(q4HEr?;`=)ZS=~|WhiQ>artu)K^|jEzWk!xG|X{1 zR){xW^sMM%B0?#&Fp*1|JDyvgEiDkIa3#wL<*WI(4c_8ypkIw$XVnVpl=0+t#_YE# zEuJn*6Mb^R6TLdYd6Fcdmq>)E|?agj^IILi8f{^k@n1cR@f6xaV!@D3Rx`IBL z)wEHicg~aPH530O9U*mmx9sAt57mz{d|s+8GK#5tbk$q%Q&H1x22uS0J`$=g^&GLN zUIGe&f+4~GqJ`};oF+=Z1lW!OEA4$n04pT4eQ0m#gQ-XNmWCN##2*56aPr;FOyy!{<>yJei zu%~Kq@tiCc@b6??WHhOj?l^?f$-z5a-Ctc~M0ojl{4HXZ=9L$F(g}|+D=J9S77kRJ z4Z9v@-((=|b$cOVx^qFF0%!>_#fRb~s!Yw$1lbss3!&#EbKegL2%O5>E@t>o^E}u{FL~>rdfI3Lfo=5?npUQgZd@5OhHtLd ziy}R4vKqqLuVwy}2n6X_)5v5q#8M7~tuOJ#4-#vTyGqX^Q5H%v>ppB~cMaX}C zKL0}53D-n`4B(v%+R*qn?)mSuU~XORAxObgl&vYRq{q zZ?Sl`#E*hlSn`OS;Kfr>DmIxOL7GoB7_yMaJab*c5M&@Ut!p`gQ(caVpS)AI>rV)Luy%-^#bkvjTU5s$0 z^V4Tvy;s5qbUM}m?^oI%YEeIjCXb=9U~BN?2_D}>pMH2uj%lun7Oagevj=jRR^3$u z;7%zPt2}S^Nh4G%F4H0ZtPD}}W7&{jb+i(*nmm7?h+}@mPYHY|dG4Hy-rTk)w7@Oo zS=em5EZ%+z>^>LmKd!oI()EWEt8g<-;WkC+8r+G8z&Hv-+IhV!a$rC4YT3}gk7RQ< zgJy~EDtuQhgHbLWRG#&f1y*Lp9XwGP;v&!rg6${tV(+xnS77UfRj6l&*OKvRKGI{Z zkj6m09N!~S6XGPvt#%u>$9vyYY%KgJ6$6nOCn$~Oz5sjv1bLGV#+1LGPK|>uiriP? z*t#~A)_SL$+Q^?EInT6~*NX!B@0x?^b*jr>JOC~Fy|U$9eb4d`Z@^WFli@Ob1U&tn zHD*x$q6zBZ9Vy{j~ULYD&=IRlK9DyeWztJ^s_Yq-^( z2?eiVD_qLo2AuBgTwgS;f#QE}Rk6g09i4w|R2&hn`Nw3!OtfJA9~J-$d$<3p{;T~{ zUKRMC!YVi#Brp^-%zu`-_eM1pKpiSkj$x%a*reII;@@F_lN4%EB#qC+$)8Gpz~GHJ zJIV|ShfeCK9CqO56*+8Q86pVI%_ltM*+!&w9o`UXIRD>FZ8x#3B&l;s4T_LT+sPlEA1`aGE&g2D;w*$ux*0M3+R6$!$n$+fC zYblG<+|Y%gFRbwR#Y|Pw1?D=2VUlr{85L(y7Rg&8D=09XU2X$(;rGV=u-c)u1v8v= zm7ynVglC+5(GS$gLl9`~g6kErhGYLF!_bg~KQHPW622b~3A31Kq zw~ch!X;pH;k-~%i$yq$dvn3fW*hwSA&_=1zi&p!CAV(R@LN2C?2G1iYvOkycU@5f7 ziYD_yiqYy={Ls=}%%GzRTvmU*b_Kpg<@PZ?^+Rp(R<;AyBuq2dmYlBdW#7JN>it<7 zYIrkmK;&)pogq4b4=aYT@{WvIl{sLg4L$pklLg0;*HS!g9?L*Boc-sf(;d=tphIt? zAFFi?>1U!;D49H+fRJwZ!T%*;>y99Nizro(9JijHh(o=@K+X1FQ}t915X`Cchmv`8 zRoL5rPLWvM)I+yK=ei?id+j*IGxSjl?eV;?YLljpypNyTbMx;=qa6tG-RG1{qIV{# zgiw-|CZgH^bBpU*; zg`q>(t?kbH`Rg_$1OQLiAe~h$q^I!(_cmQ* zY)A`+^)uGz$vU3KzFJ&8HcFHRKXs16YA-m-_Jx#m)$l6o7f_280+Q)7UNGnfTV0?{ z#K?tVO(ZAEVl(iqfV?ENg3)hU#5{wmR#)B7W;DyGDF(lljV>+8c(~R`DM8z{tGkt^ zFDOIA45)pjP+&*eo@8GW4mb}%XdL+Xg$jpv^oQX3;}GtX!MkkC+F$dX#mP)+P``V_ z;~UxYF&5)t#tVw36&gUD6qk%c%^4`tVs4k)2Ek;tCz2TJ`-O+PcttSs>8W4NWqA#? z%Jz$##NO_ZAt|T^EZu9}qX!m|l;MEUMmt30AZ)FG8dS{R=bsCrWqTzjy#5?iHYd8Zd$S&{r%Hcnh=siZA9BdLvgNg z7)=Q|F_?WuXee)vI9|Dqhmg9*bJsDe?m1gmNex$3*0Xbmn$)jfv#Uc5za4%24w(u6 z0gtdDer^78jpybhQuYU>lX_#Cn4%$Jb`MF=DmX~I$18^ZuXm0iI_IPYT% z?l6;oK*eq9ct*Wk@PetROdX7{iYG%m8IzD=QfOEBB6pwHLDh2s=4_sfyEJ2x1SR*^ zA8h3nN?R*a=D@s~zev5bo!sE;A^rl7(=_+!gd$UZ2&{qs;7`=JBL46%2N~hV~i%lv%&gRxY z5(_9Bx0qT{M;mO!TV-WMNcz0S_aWU6!l*r(Yk8l)p7Q(#P#b91?~J;yialqtfEtZx z7o$VbfCGU7ZAu^j0YL~JD*!u$%NkN%1J%`5Eapg{Jxq?YMRw23SP|PAKKos_kZC*E zx*FLNiaT4GI$N1o67qVR|LaiD+04|^$d%s2!Hz#N8x#c{8X$~L1ga-Kjo{7-Ru0Cd z{^;#iCfWQ-3=0PQ_s+mLAYf1+Ll%I4+@ruC#K1t{|2Rm2|7#%$0gUmFNAKU4S*-&B zid1$5JY%RVc<(gy&!^Oz05Z?Jv-Z@l;>9XtYoyhtK!7{AY5<|R8@H-|SUauVPtrKD z6_=O9L3&L_W0qNvP2djBf8s`l{wMAXH6XCRfsa&hPX}^8m%O`&p2o~QP#-i2mX2_t zt3Ym>I{Uu3d4m8!LPYw5VxmI>$p3$$g8f%if9Ko3pL}iv@QKDTyE<5m%K@%C6#@Q1 zU~p(4S;WM2Bl5r)D3tm_2MqX@c+1X&vIqu%%$m0H68XNHbs@L&eBgjHqHDf+J zN3QK8O|?3{4~ASp`Mg3|M5eu67{9~1TA5gEY&k4ErO1@nEi$}!T`q{`E*x-8bW>C5 zNYuLs2If|f4pi&pSI;EWCf3W2y#0swxNv`ue;x=jvPC}_9*gkw6_ueZqkqlY2wb4e zZ br3mjnvaYXfYvewcG^Fk=qVN7@G@ z4>qUIU<0ZhXmGMfJN{#}VD5QM4pCZC;W_q)4jbwdi-C9ot0O#%>yZO+9Sje^EQfuwQFsiTBDgwNd3E7EB9pZ7 zrQsFHtBr+zV7K)%q~OIQhyw~}fCrO2uNo}G(7>~%lkA^E_ZW)w{M z6o1+Imrt8e)yj@gdAP^Y#mt_N*VW37-r3FU?}?y=ohQAi8GjToA1DeCG=KsO_%AsB zd&d1QzxMw)Vj&sn+KMbdDK(rB0j-Dc5F?(dA`LF|$2uiJLqZab?;p(>Gk+v6*tE7 zc#r(O$5ZE1|Kr2Hv_{I8kdN3M#{pX~4yh0|W@_LW8S0i>K?+e~O*j*iaVRiXW-qjSV<|FxnUwG(pxT>WON~`y8I#Z_K@Bkf#+6c(D z<4Dy&{ZAu!cz%ch@|$$2mp9oz9~A~q_isjn()Sqk`e_!<+T>vX`;$2(Z)Ft* znT`x8o#LYf$QN{f+PG#QMVXAJt3T`Djr}p)8TYTf-G2#f?fez`0*TjBY%LbaB1HIN zs4IE&9{^>PtklJA5`%P+d3%6UW+8z^_WfYcFTzp0`BWb|?P;O(^07=I(wxrCCwL2u zs1c~iOUqqcGh_SDtz zqtz>&4L zZr{q`6>Uh`AdeTwnV$+tG-o1JeWzhF-i`tLey@4Qk3R?et33n+VgGbc@Q=lvDWmaF z#1gafEoFO98>fR|=lmvzr8Ta7xw2xmmivnJ0%H~Ewrn1ws%8w_#+WPiUkxSD|1^~R zpRFYSN=@iQptwzbJ()%_beck@cK^;&V8FWW+vQ+TuyKqSf3f=a_!&3C2c!=W#*Z}% zZxHw!=9?M29ef{9y5kSBUT@3-uga91G=7w=LUG2nbg)(|m!{gDn5OmCMJx$(RDIc4 zyL!!B&PBdoS2S7LpZ2~&>w230y$XSZtxIrIyQbpg*kP9`&55i`z+k)+OU@P6TXni# zy5C(^q~BZCE2{~IPno}(kTmzJNPnRap4{OfrK?Pxg?r&HeO|ND$}Ui>@oFDwq(v}5 z%GBPmexAxDCV`X%t3^jLbXS1QZs^Cu2z|SF#cS79Qtw6M4<5e?fjbDYvJ9bbw$mI$ zUD|9UbX7O72;?j1WH2O`CJlYeg71des%Y&R*%rIdN8GlxTMfp?zb5jVF3 zE;+U(Y_QGN&wCBVXz%-Ia*xBfVGm5V7Ya_$k8kI2S{v_0SRo7XClH3>j!Bam*0DeN zptH9Dj>+d384V3Rci9J`c9CgP)*q1Jok^J1YYj;8!rDs#KtGg6yO)HeO|gsK$^2s! zb7yhdVAv{;*ox8)+zu#Vrs4~&1a=Q#KY!$p>WGy_EsLMJFywSbHP9dNyo z&nbXT|7j#D&NWE|v z)&^-yD1z@i__7kCeUVtm%V@T#KGjYlR7{5RlY*Bths^1RZtaAk&JaS9`H#ubf%Mmq zVJ00~cq;+!eaDrSci*LvdPyur?>$e=pa^>yWqz#81I{_f3+N!9jk(>~FiUOb?XFxj zo=J$WbH*)S1ZK@?dP<$^`x(U}NnBf%x>i!5Qs9-?pI9wB^Qj8SG2b?eRrRj|Cx%)} z1XwMr6=3~-*uTIfFaKQ6V)>jkU0f(zvzpVCh#xzyo?QeEPP2=HI>b@L&G}p8`hego zPYkKQ9Zj@j5|exKBh3=)Ced%pSKGQy8lf9PG^EliNe>Ci?cYu3&V6#;(q=w6k3(K` z{s$f!Gh0r7@z}ca_9k4uJRHD8`1Ts^uq{MeG!}Y%0_MDATp^Y%FZqoy6-35r;e<&W z6G5oZy62C^>`V^{VDI5sJXktBZG?#U8TaTDa8@b#OkW0iq?2#q zeR&o!8)3CL0OkeH!N<|5y*}!am3d|vc1@xra8nHOjg&7;yE>OJfm5@qu(JH&SuUu~ zIel~*u_%v}p8eV0dhWC;kKk3;W!n{poq0n@EV{b1D_067kh?nmnYPk7#OU%%X>2=X zKzTsc40kIhy?qmpVBH{Qa+^Pt5P$DxVMBN1X(w>~-8g!-$nK4*pAC*Bg_*g^B{oezkv^2==2QJ~V89ZWhHYZky zJk1Z%Z`TcVZT$n1|5*44V`s5daxSs`c-!Ydw8J+Cj^x z6#J}WxaWzDW#Cq9r;BD^hdwMm;pNc=?OPlUTJeTSio+alhs4ol;075b2|{L-MH%eX z;CjV1^SnFr^2JO>{FD89$7_KG&>*iGRI=YeM(au8S+JW*Nh}IR*r-TGc z3q?ux$#ny#GEf4slOXi#C17^)GkFB{IR31;G`xr~GY7?}dtN{XS4UaROU%yu?u2UR z{zGdXIn5z2ebzEj*`%7ntjO6l6LKjk(vsGeHIU3}Ows6N=Z$RW5OXzk#`hgO_EiD+ z1FYwY8hH+f8sS!Y1uo?A;SoX$aG|=Y8Gg>H8=(cq96OWP@7zJLNrCPCwe478OVYKk zf6=J#^u^TOA7MPK5k9n!96gDvSYALaev$+&Da7(zWXY`c{Z1DWfXEzH8U}CJqN<=u zJtCjq5MI83*r56`z3If%`C3`y^z#m$u&oKw#_7%g(%A0Y=eL0lISO#tdo(8;*oXEd zio~GFd$n9yGM;pEd8Z9d!ek$sX@^97#P!1kogCPCCCT#8Pg}82!lL36O3|X|KMmi@ zGF~3gtE{boo((x!b|nWn#LVlHwh-Agd>27JdWi<9@2!f4A$V12! zUE>I2y;9dT33l5nAEE4feu7weuFcfrp1fxC0rx~tBSnTA4U}Pk;zBbnZ@IaVaQ{&1 z21|18YB9lL?BRKDFQck{`V*ex6Eo?dq9T(J-Cv^7o;-RteK{^PjXSV6Qm^vn2zzUj z(x{yyV2t%>I2xyNx8d%ATM3-HeCSt;40{k|Q)c!Vp5Q5$8-9&1aI9Z4w>E!T7tToK zGuwV0b~Ec;FI24jWe6-2&CW_WA@muQ`1@SF^Lh*Er{X>~GK2l51qZ@n_7Cj?!&?zm6oDVdobj(6eOjW(elH{Xt7sFLV0u|KBB znaX$X6ED_bQUjRryuj}?K^aMKq1DTa=H#Rcq>|$JC;er`xmWf5H}29n+54VLh&~%l z=qS=#*}0LV#{M7~VKp;daVlawFS#2qiQi}9dzWnW^5)=Fry}$j`V>#P``NgTYCsSZ zLN*u}wSyeL+bLsabs;xVekm?qo%7Ib9Vu1~q`odNG$qkNvZh|0He3Y8#B4Z%t_N?Vh!l#q$L)gWQlg07FxB0}Ecqp01Q9Yl~BR}E^{&Bo9Vb^U4 zZKw_BV2zt}%mD7GCS|<3^m8D*Ag?d4YeKuX{UFsfeKf9jWQRK%)SVM0Zg)L%GqFHU z)qI()u59tssF&Vo5HdO-(Vnea zkPsK3NGnRiy=Pz6Oj=_M&!XIBp@`fo5R&Wj$3*swc*t&5P!d_ZBu8x-M`T$mo26!@ zNHOCgrJ*5T9xBqMn`o>py`zBzrLC)QiEY#fn;DYOKD@9E&NO7R1AmsYJN}E-I%->0^fIsA_>D{Ipy#VLfi5VA;-@q@X8(NaMEln@!1p zj7z}nDdU^u?dLlg9*VGk>;6ZbIYpp0)es)8$ET7hc%jR@y{5W96RjaAk_}7C!`8;- zO<1)UeHXIg*bfnMIt1>W-?1#=grLC04bKrW--PH}yfJG?o3TGBXJR1+`12^?n)Jy@ z#Y?9?8FOE3{+k~#V3qEc|F{1<7D|YK8mw(8f}2x%R0Tg{X&$OaI`h{=LX?3G{&D%Q zCY3O2sz0@1B+rcFo$O}Q!bM8L`~);!qMVAICRaFVGdGZE^wgyjK3X(eQO5YG>34D0 zu+lu674p`5r2C3>c@;C6YDFe+NCX9yn@hK`c|ble%siRaLmVAD@n}~vMBf67ac3>o z;IM1t@_21dZske>YLZt~A5@m?PV%sexP6uv$@l+%kH>M2V%| zLa8SQ4O|0a5Kv*}8}@a$=MgD#xeS?#|G!ecDyR-+X?L-3mjrjW1P|_R3wL*S2=2k% zgUiAR?(XgccPF?L9RAAL``okZo~r-h-hP;euCAV$s;RGiN>YU*mv?nk362wj5>47R z&@?_L8a_9rn6JPRv)U7VNN6VNCuG@!no>`5r5W)H)jkl>2)kMG+gM~=cYTgOTrEI1 zwN?o4bSJ!2upS|q)h2N}RX0W)!HGGrn!jxp&XWi@?dkfK(Bd5@-Aq%q{F>CPCts5; znrGL1;O>;t)|E4QyUlrtpRblSt%u97278+v!hk3~ko$MqZw9=K|!{eoO z&Em!w7n%`mIo)P_!W`<~NdE1%x7m?Q%F}`DK1>hl!(VwG&9ZU1Kj>01o+82f*c6y6 z0(jRlMx8}*H?QZ6??Ugm@&p6~?cGCMYT*Lj+vhisq0qi0a>^&tvXwg*WQqnq>Pix zu*%j)n(2Tn0v=Q8HQ`3vcVdVPd z<d67uB&ifd3#n5|;`R$&(NlWkD(0E#ep z;Xt`wj5>aMxq8Zky)Z8F3%oBz#9xDVOP>f&DOKkh9;mD#Q?V`VnZ&C&B^;N!I^>ue z?LzaUs}~!Pkp_YMsY>+Ea)PwP_Ng!+oVz)wgq0UzowBoG@Gaq^iyoyKnL-c(2hhe z=@}VR78XsD?Stmxcf1pQhj8Zc{oVHSnSi8Q87C$$&dVK|a<{Id64jjy@RSs!hx|tK z*xW3BF0Iu@McHX5tSx7UfQ-Gs#We&Wcbhl|ce&rB{&_QNo|mg;jaFlJj3#Ad8m2F*J0E%>q)h*Yd!MN~SLK?r zpD5NPW>!Fa@2HzGpu+x~lR-(Wy9ZXrM{>E)KAIO%#0izul_GPs391$W>kGa|^^4=Bt5neriDk0<|o5+HzTR)BHwgUn-a}NHu=~`t*EW!PBJu6TpQtHmO$$KQ;oH!1Uqb6XOLw zgil^{j67DMM+pkZSWe~atS|xC=|*AO=m0G)T`)6pu%92emFhQZjA_9Wv4NKg2WrPZ z>CvSEhFeGuDXo58OsJrf1X>~fMa*=!Vit)z}_eX(g){w#U@a3^RCEqI%%(~J%BeF zrU2ekaz}|OO_y_rnd0@V<@AMEQ(l2b@`&lKjWnEp24E@1rVS4J6kmBdYr%p24bT_X zykgKm9ebeCpMC$$nFpc1AXXt{B>(uuv;EQzzKfL5oDbrUgKPg3Sulst*e!S?k~T0i znVZU`XI|!s9x8>qTiq}FWxXf4*kby#kidG`M}m?UzeLnnIf+X`i{98nMgc^^>+h%$ z$poYZKHuJMsr^bklr;~ysUHfh<+Q&dPcio(p5BRySrx5GCBW)-e)x66nP$qa%PMBN zcUklxnPDK}AnR6uBz>%abCS?aB_}l>!}p~8SS8WeS>(DX*(bGfDa|hhWN8KzwU{W1E-ne}=v#my zYQZUr6dp#F^G$Eqm&jLC6~~!jIk~9zEiq7|1beuf?1`_y=M!$Y$5Fa7oGZ(e`GB80 zWVPe0M&Fpt*k*1soXW;Quv5LPfrE~xjn45y%k39w%UUmXPvK#tY~JN?_QM7YVg-UUs1c)NkEBFtm3hB%j^niQ7UPTqmpcSnE_Ge(=nw?f zpxxOuPInWSn<@Xla>-hcMr;0v)I@j+r6(Faq9n;Zpm9GfN`3Q#f!&uXc8q3qpV_PhEuodA_~WXG#~0anug+2z0>PA`bu-y~ zXp5-#8+P`BUUjB|m#c!fW`1^wZkEG{)VD9S`aNovyypoup~%@M7P}N@kdrk6*|9SY zQML)R+Ag*0X!wV*&KpvON2o?P?$G8@;kW0armC@N1nTEU`f$HD&&i_=c*Im7x|&uF zSIiuYX7wDgymN7eWEc%kv2JEighimY!wp+^^PlhJd)PJQznZnL&fm`V>3G({UQp{b zshl{2d{ze)Oig-3NuPfd6~DfZj$KvU9k+O|%_`C3oeUIndm{!l(d6%UwFk)ygL2!Y z!<6&X`|mBCB=g?aE-L$FGUQv~+TzE`WnM$BEY2h1P*!%0MyB7g6e##PQ~M#$Pi_}e zo5hVDMY^mm>IYH4}BaP??H zCi|nH_E?f>r?IsUK@o%nN!Twwa)(>xOjFB(Nxb86-)%?&z3#aJhPfXxWU3b$5Ln0s zeW2%E?Xt$5H@rp}F~?dU+6kyX?%All^JR=OQ{<-aTS;a1$eu?K4L56DNEO%EkI^h` zRPOmPX6yyTefsEZPYKf-1h=E&?$Zv3jg+b#Pon|-dTA+6*+&x#{oM&YBV&N{`YG36 z3YuiI)opoCd9gKHU&Z7#QNj>L;o*j9destB&BUZ|%n={fZCDP1b@NojV|2@#9(J=s z-^6O5nzc^=5${&?;_18^hmSD7J?>k~d!2FXbQP7*Am6nTc5{c`rA{7#iEN-4U%6e8 z+$@}OG7{395ivU}tJTe1vRACjV%M)0?@?+O|Hg2hes;{7uP5PQ)aj9tXYZNFZtAJE z%zTNSpGui%yZkCZ0{0)zyFNDlVoC_)%)Pk{MxU!VK|H+=Ka%#1cQSR1Oa{#@HIwuk z2>Wj9#YaGJ$sSU0EbC1}CA#hyio*ZhU&RB31Azdb0^%e6Z>6c8f0d?~{|P5mfvES6 z6OGlP5#8zC&P~KI1d@7Bu{Aq_*`Pw2w%CEI`tb->qz}^`YtI0(p`XAIQ=5UEBE?U5 z{k}TmFNFh*5;8$E+#h&-=6%`kwyLuwJ9}QTkplV`!0d zTJz`qpNZomEi-^)7={EzzRe&=u^WpazrMsD25Uo8pV*yiHm;UaKm20bkCiy>-Tuks zR3MuC%ffp*+CBI=K-^3|s@frCbq(XF3SetDDxNu*K4e@On3j&nYY0E1rh!8fNV|$l z&O#u1mMq0(XTOa7L5tXdjo6;)yMY$XuLMT^>CTy%{Fu2S#Q}@S?3iR33$fm_q}nsT zeMhovT{6`wFkfqz(fVPUY2V&@ee<`*AhUwlXQrE$^@#;VHwOPNaf#bjy93tfZ+WhR zWMbC8*TF4r!%ewI@CoMVk-_ zk+K#S18hUl@5?$qhtpUJ2HRza9AOIgi?(7G5#w)A`GTUa{&y8=OuHR_I(gKO*}p@e z0ScpZ^qHN*Y*w83<@Cy5p?3OIU;K@PCs%_CnlY7%$F5r9hSqK8^i~V+gg9QPsxa3y z*oEahG})BA=ky;T$?4}efl&0p7U&a031QzwXzt4?vD7{&>?X`3^qTL)|#rV=x)KY&9IFgr#A0km?Swj6JB=JPJ23c`XXYZT4q@3&?Zb zqd8oW@R}*^N1uhvFa&OIwO=@9Py?j8K(Mjnzp|KdtVP$1AQmY%K6<9?VfLX(PKZ1?H!w>7LvXaEg7l7~%I%5gAnQ|)AAcK@=^?Yc40Qyv46BFeg~9O(vv$S#=FlY2;3Q4cyKGBh1&9UIfYmSMUJE;*EWD)& zB+gdkVvwrvNBq{xstT1gm41*pqt58Vq?!ak^NQ9DH_vmDa5e~jug)z>s ztol=X2IVFSON;R#^MR~TgnI#yhJtJ4(g0U5*}-PT#tdH?40l$NJL3I@O#fFW54Dhu zsk@<_iK!Ebvc0pZiM6F239qfaoweXsJ0p8b8&eYoOFJ`r{%|12ztYR3|M_|msD8}h z^503rKZsL(v`$i+^O40@0rg#rv#o%!9nT*!DB@~s3qE((yVN#{>v4tGo$^IUOa13N zhxycKEb^DdFiBU6GNVStPCFBGX?K*8tGAjfg$~(gXU;6eD_=Qnm#DMp*9?!B!;ny~ zt<>WU*g!6ag9%*t#FxRAT83yJwvV&N6dmikN4KClL}UTGMC_xs0BYBZ+lE(5n9mpA zl%zX-f_LGTA4+KW=#~T(YE4Wn0tKuN6CWG--wy?Tc5 z{TOrc2)R7E`!+_DSkFjNitfMO0WG^O0}e3!EiPH>LsOF=UoG#66#Ut%PjXykDDVd* zfx+l3K?Vz#R8aTvdAtjs#GDQm#^ViZlVNMb9qEgqCGQJ6x znOOqoIG;v@IC;7y=5k^~qFGgM`{$V~=XB6bk~mVP)YsoMi~L5-8Mb1E;v`=@t6HtC z8@K}K-)Ew&kntuu=MkIq>!m}wGq}BX=!(}&bYIposQHayvs!&^Jv9P2m|CG=ZSo%l znjuhBt(7Gh3KS25S6)kprleqF_=qQ;`_NVg zQ=PEc-Udxy-wqm;&-Bsv(L$gBARqw$p!cQsEdZLdxRf{m0s;uo1Ly$&@2db203`4a z{aGO)At9k)p#BgX3=A|3JRAZ7JRCec0um|`0wM|`JUlWwG72gh8af&R62=D%v=69g zXlU=<07N)|KfoUX0v+()4#78 z&Zz1m*A@T(aB+#5+n{(AvzQFdHau&#Co*9UQ``9?$UV=SE%?QCu3gRr000mYk~eUK z3n+TB=9#B@+2IeRAsJydSDu^FqcqOEN+MLQWcB|7000m(KY5fKg?+)dvHvC5@P7&7 z|0NhzH_q3DygMGkjIgHe#*!SaW${)3sctK`O-PKN^c2xw`+pNv1+hNeB7ie+$O>mz|Za$vOP*H);4O{11I9F>{$x zPmwzDIk;F}p^e+^9&v-D+7agmO4TQ-6BNgSs;+bA)SLhS03{?rf1et|2Yee1Eug*6OG`SlrM^&=us(g#ZBsb@a;38ggpaiFe(3^X!$NGeOt~rQAw+nj zcELPWqq!!=mP)*|*fM1e-vMz#9L`28bHnOd4i?-<hLu9L-wAI-akPMa$P~U3;E?;-E51rTM}4(5$PJa!5i9yJV%6;{?Tr?;gx`9dyV_`5m%23ET1a z2d8-KGwW}b*%i{nBSVMo^7lfuIkRPUx_FU8Qz%?qO9)yFJPU-R9OH#VoK5%xLW!+w z9oL5XuAD%zc%UC<4%L_|&G zjySg7-uM0lx_`T-{ZQnPoQ;WJerbJu8ipr}W~2DYZ*6Jz{A@y7S@uRAq8%kjrEkzM)KQACB*+DOhnmdOw?O zd^}2`5{>hhr{z2JkQRp-dM^2{KSfhV3Z+{Fe=Z@m;EA>vW@-A41}P&azM*>wO@rAe3&b9B zTSg`<)&SCRarzn5MY;rcgZZ_d9QXFbi)4(X%?xNR?~PKwK@u0yYxmJ(IQi&K6q9?6 z%>>KOE5SnnZ#g`Wp_U|7jWC>#;c~D-kg)!No~)C1_gmA46p-wfdPA<1Mv3EW^DT4* z6_M9#{vIUyw`V!CkNS#nB+VgV&hAJpNmGF}5ijl=l}^GSQ3{ij<29!baNn5k3V)xRT2L%+*5_ZG;S?nwY^B-#plCchRW8yn zf+Ba!_yvAYT(nGcb6sKiW`FfaO+Hv!FYQgY#%)ctJD*tb>%9PR$|CkQnLG$8`&3%% zt#+7!H)#n02RFg>qiDFx%>=<Qoh(ktR`N@`k2$COvuSG55i z$VuI5X%*pSToG2=N`%^QkVHD?`n0R>b%z5?x zltv_5y>HQ7r^9{^U7sJKF_Yd80t>a-m*mRz_T>@d+gF3UQ_f|2sR*;!!=|~CoODZe zNa`O)l`yHxaY?h5o#4XPp?2vuZl-f~B+lXC?3Dzq1EM}|7|Om38xSu^oc8*sVd`fb zJFp#b#bp zFJuneGT4)GHaOO)h0xj|6lhks)0N(EFH+?OzGOLEvw~H9)+#vq{HGAbnnI86umhrr6I@x|7&(BHH}{ zHZ@HqYJVldK#n>NUb**@VVVa;QfR+11GB+Ve6E3o1=v zX$|$>^r@~X046@2vTo%G3Zwe_KED0P7=tLjUvTrw@glVOW_(TOR#p%)f!Mr6Xt`Gl zd)k0NuUCy3f_jWD@CoJ0g7wvz zZZGZl^EwVx#bTw#kf~7eC7J5D`hI6u>y=@`l|fP9|C4s{IYZO5Jn8V{w zm?}gqS%C1;`waVr21us8QRJOeKJ|KeBNo8*VQrGp>fa=*J)RMfE@icyK_SsO8=YBd?nf;7O|)oY8(P+$`~^3i`s zO#2>u-=tiHvgw!Z^pv#U)BL`N+=Yy~^9p8`>H(p&Br@P;Mt98uwI$l=7~HRAUN9EXFU$$LNoT zCrX0#h7c+C+P+!(%y*#0a118sCo$Onw5t^Uo42(hER^BE#^l;PWm_9-pCu{Nm{#If zw6=dPj@g|j!x%6#4s@t1@ms3WWvibu{}|M{`0%L;9nfk5x*!KvS|mx$v;Cxd6m+B) z7sW3~M{s-ST_9kLOi}~xzQR!5J>hS_6sW29t7f`NJCv0ZMgwP2#H7E39d*6P0nVf?4QOj&iHRO17~tqWh5F5856O{Qf>#4{+(24uH> zQ0gF0p~moG3S8Ls=CE4(X!CjT-aK)9IME>4;4a3(yt}J$_2PG5EmgC}^~fo=(=ZV< z`#nY;%UT~){f0!(@`2Y~5B6hSHWke@e}088Ac=S7)Z%hG5@qm&on6BjW}qgGTf=Hy zLCT&09WHGT4Uo0t_LDLJQ~zPGq24DEGB0ab5JRjZ2T;?Cm`{zr$48gT)OcBMVNWww z9JHIXD6FQ*S85KnH{_iWy>|FMMy(HN+BGw3eK(if$|GrA7>1NSoi#^~FHX7XJAC*u zNAOFSOA}k4rHmO}K%K=4z7i)GsuU!LtjHy$mTyWCQ+Oeo#rFYi!A3%=@F_v)Zg+wDVG@uV2~@MMJRd30Q^}o+&DpTK%^rXvHfHY6a3Br8?lBGjkkv z?$^lY>FXnti2!B0dsqB8zRqxM9 zC3z+_L7q&c^$!UdJ)9-squ!FkMf**_t7_x(D~cxe7vQ2l3`MZc<**(R*)Q(LMU=Rc z-u4;U90lMhibr%WL_uWn9CTC`CFO_=UM7i{Qa;Sn--&#Pp1YrW32edvit<=~E`;O* zT*tmY+dG4R5RE^w)%oykYc-J6)`_Gz>T^8&3QHKHz#tu&h7fqj7*583X^BEm$&=~e HbI<<(@*qUZ diff --git a/gnutls.spec b/gnutls.spec index f264ae2..4277ccd 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -115,7 +115,7 @@ URL: http://www.gnutls.org/ %define short_version %(echo %{version} | grep -m1 -o "[0-9]*\.[0-9]*" | head -1) Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig -Source2: gnutls-release-keyring.gpg +Source2: https://gnutls.org/gnutls-release-keyring.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 diff --git a/sources b/sources index ee8a251..0ceeebf 100644 --- a/sources +++ b/sources @@ -1 +1,3 @@ SHA512 (gnutls-3.7.8.tar.xz) = 4199bcf7c9e3aab2f52266aadceefc563dfe2d938d0ea1f3ec3be95d66f4a8c8e5494d3a800c03dd02ad386dec1738bd63e1fe0d8b394a2ccfc7d6c6a0cc9359 +SHA512 (gnutls-3.7.8.tar.xz.sig) = cecf9843e8683a278d065b663dc98ac2b5fcad1905ee25333038c93c2289b518c974629367e77e66552ac1c9d122d551616edba35cb0c4204202ec676f1a2db7 +SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d From aabb95f9d61f324256c7c1d60d496199b9fcc4f8 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Wed, 15 Feb 2023 09:06:24 +0100 Subject: [PATCH 2/9] [packit] 3.8.0 upstream release Upstream tag: 3.8.0 Upstream commit: 516e466b Signed-off-by: Zoltan Fridrich --- .gitignore | 3 + .packit.yaml | 1 - README.packit | 2 +- gnutls-3.6.7-no-now-guile.patch | 11 - ...3.7.8-gcc_analyzer-suppress_warnings.patch | 132 --- gnutls-3.7.8-ktls_add_ciphersuites.patch | 273 ----- gnutls-3.7.8-ktls_invalidate_session.patch | 62 -- gnutls-3.7.8-ktls_key_update.patch | 957 ------------------ gnutls-3.7.8-ktls_minor_fixes.patch | 155 --- gnutls.spec | 84 +- sources | 4 +- 11 files changed, 26 insertions(+), 1658 deletions(-) delete mode 100644 gnutls-3.6.7-no-now-guile.patch delete mode 100644 gnutls-3.7.8-gcc_analyzer-suppress_warnings.patch delete mode 100644 gnutls-3.7.8-ktls_add_ciphersuites.patch delete mode 100644 gnutls-3.7.8-ktls_invalidate_session.patch delete mode 100644 gnutls-3.7.8-ktls_key_update.patch delete mode 100644 gnutls-3.7.8-ktls_minor_fixes.patch diff --git a/.gitignore b/.gitignore index 1d6ef56..690d3fe 100644 --- a/.gitignore +++ b/.gitignore @@ -141,3 +141,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.7.6.tar.xz /gnutls-3.7.7.tar.xz /gnutls-3.7.8.tar.xz +/gnutls-3.8.0.tar.xz +/gnutls-3.8.0.tar.xz.sig +/gnutls-release-keyring.gpg diff --git a/.packit.yaml b/.packit.yaml index a27df63..2a7dee2 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -15,7 +15,6 @@ actions: post-upstream-clone: - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls.spec" - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.2.7-rpath.patch" - - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.6.7-no-now-guile.patch" get-current-version: - "git describe --abbrev=0" create-archive: diff --git a/README.packit b/README.packit index 44d1757..c83811d 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.60.0. +The file was generated using packit 0.67.0. diff --git a/gnutls-3.6.7-no-now-guile.patch b/gnutls-3.6.7-no-now-guile.patch deleted file mode 100644 index d14e8df..0000000 --- a/gnutls-3.6.7-no-now-guile.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/guile/src/Makefile.in 2019-03-27 11:51:55.984398001 +0100 -+++ b/guile/src/Makefile.in 2019-03-27 11:52:27.259626076 +0100 -@@ -1472,7 +1472,7 @@ - # Use '-module' to build a "dlopenable module", in Libtool terms. - # Use '-undefined' to placate Libtool on Windows; see - # . --guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -+guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy - - # Linking against GnuTLS. - GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la diff --git a/gnutls-3.7.8-gcc_analyzer-suppress_warnings.patch b/gnutls-3.7.8-gcc_analyzer-suppress_warnings.patch deleted file mode 100644 index d8a6f4a..0000000 --- a/gnutls-3.7.8-gcc_analyzer-suppress_warnings.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 7fa942e08e64b761b19753ae74503de43cc1ff91 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Thu, 6 Oct 2022 18:44:48 +0900 -Subject: build: suppress GCC analyzer warnings - -Signed-off-by: Daiki Ueno - -diff --git a/lib/auth/cert.c b/lib/auth/cert.c -index 228d98468..f122049e1 100644 ---- a/lib/auth/cert.c -+++ b/lib/auth/cert.c -@@ -1636,6 +1636,10 @@ _gnutls_select_server_cert(gnutls_session_t session, const gnutls_cipher_suite_e - if (session->internals.selected_cert_list_length == 0) - return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_CREDENTIALS); - -+ if (unlikely(session->internals.selected_cert_list == NULL)) { -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ } -+ - _gnutls_debug_log("Selected (%s) cert\n", - gnutls_pk_get_name(session->internals.selected_cert_list[0].pubkey->params.algo)); - } -diff --git a/lib/nettle/int/provable-prime.c b/lib/nettle/int/provable-prime.c -index 585cd031e..3a626a2c8 100644 ---- a/lib/nettle/int/provable-prime.c -+++ b/lib/nettle/int/provable-prime.c -@@ -1173,7 +1173,7 @@ st_provable_prime(mpz_t p, - if (iterations > 0) { - storage_length = iterations * DIGEST_SIZE; - -- storage = malloc(storage_length); -+ storage = gnutls_malloc(storage_length); - if (storage == NULL) - goto fail; - -@@ -1307,7 +1307,7 @@ st_provable_prime(mpz_t p, - mpz_clear(t); - mpz_clear(tmp); - mpz_clear(c); -- free(pseed); -- free(storage); -+ gnutls_free(pseed); -+ gnutls_free(storage); - return ret; - } -diff --git a/lib/pk.c b/lib/pk.c -index c5600a32a..753cecd18 100644 ---- a/lib/pk.c -+++ b/lib/pk.c -@@ -93,6 +93,7 @@ _gnutls_encode_ber_rs_raw(gnutls_datum_t * sig_value, - } - - if (r->data[0] >= 0x80) { -+ assert(tmp); - tmp[0] = 0; - memcpy(&tmp[1], r->data, r->size); - result = asn1_write_value(sig, "r", tmp, 1+r->size); -@@ -108,6 +109,7 @@ _gnutls_encode_ber_rs_raw(gnutls_datum_t * sig_value, - - - if (s->data[0] >= 0x80) { -+ assert(tmp); - tmp[0] = 0; - memcpy(&tmp[1], s->data, s->size); - result = asn1_write_value(sig, "s", tmp, 1+s->size); -@@ -598,6 +600,10 @@ encode_ber_digest_info(const mac_entry_st * e, - uint8_t *tmp_output; - int tmp_output_size; - -+ if (unlikely(e == NULL)) { -+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); -+ } -+ - /* prevent asn1_write_value() treating input as string */ - if (digest->size == 0) - return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); -diff --git a/lib/x509/pkcs7-crypt.c b/lib/x509/pkcs7-crypt.c -index 59eddcd2a..6f528a911 100644 ---- a/lib/x509/pkcs7-crypt.c -+++ b/lib/x509/pkcs7-crypt.c -@@ -1211,6 +1211,10 @@ _gnutls_pkcs_raw_decrypt_data(schema_id schema, asn1_node pkcs8_asn, - } - - ce = cipher_to_entry(enc_params->cipher); -+ if (unlikely(ce == NULL)) { -+ ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_CIPHER_TYPE); -+ goto error; -+ } - block_size = _gnutls_cipher_get_block_size(ce); - - if (ce->type == CIPHER_BLOCK) { -diff --git a/src/tests.c b/src/tests.c -index 85c4b6699..8526b6943 100644 ---- a/src/tests.c -+++ b/src/tests.c -@@ -1613,7 +1613,9 @@ test_code_t test_chain_order(gnutls_session_t session) - - gnutls_free(t.data); - } -- *pos = 0; -+ if (pos) { -+ *pos = 0; -+ } - - t.size = p_size; - t.data = (void*)p; -diff --git a/src/tpmtool.c b/src/tpmtool.c -index 171b7fd41..1b230c2ff 100644 ---- a/src/tpmtool.c -+++ b/src/tpmtool.c -@@ -263,15 +263,15 @@ static void tpm_generate(FILE * out, unsigned int key_type, - gnutls_datum_t privkey, pubkey; - - if (!srk_well_known) { -- srk_pass = getpass("Enter SRK password: "); -- if (srk_pass != NULL) -- srk_pass = strdup(srk_pass); -+ char *pass = getpass("Enter SRK password: "); -+ if (pass != NULL) -+ srk_pass = strdup(pass); - } - - if (!(flags & GNUTLS_TPM_REGISTER_KEY)) { -- key_pass = getpass("Enter key password: "); -- if (key_pass != NULL) -- key_pass = strdup(key_pass); -+ char *pass = getpass("Enter key password: "); -+ if (pass != NULL) -+ key_pass = strdup(pass); - } - - ret = diff --git a/gnutls-3.7.8-ktls_add_ciphersuites.patch b/gnutls-3.7.8-ktls_add_ciphersuites.patch deleted file mode 100644 index 88ae1aa..0000000 --- a/gnutls-3.7.8-ktls_add_ciphersuites.patch +++ /dev/null @@ -1,273 +0,0 @@ -From 4380f347b2fff4af10537930400b68df61bee442 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Thu, 1 Dec 2022 15:37:33 +0100 -Subject: [PATCH 1/2] KTLS: add ciphersuites - -* TLS_AES_128_CCM_SHA256 -* TLS_CHACHA20_POLY1305_SHA256 - -Signed-off-by: Frantisek Krenzelok ---- - lib/system/ktls.c | 159 ++++++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 153 insertions(+), 6 deletions(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 703775960..792d09ccf 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -86,7 +86,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - gnutls_datum_t mac_key; - gnutls_datum_t iv; - gnutls_datum_t cipher_key; -- unsigned char seq_number[8]; -+ unsigned char seq_number[12]; - int sockin, sockout; - int ret; - -@@ -97,7 +97,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - int version = gnutls_protocol_get_version(session); - if ((version != GNUTLS_TLS1_3 && version != GNUTLS_TLS1_2) || - (gnutls_cipher_get(session) != GNUTLS_CIPHER_AES_128_GCM && -- gnutls_cipher_get(session) != GNUTLS_CIPHER_AES_256_GCM)) { -+ gnutls_cipher_get(session) != GNUTLS_CIPHER_AES_256_GCM && -+ gnutls_cipher_get(session) != GNUTLS_CIPHER_AES_128_CCM && -+ gnutls_cipher_get(session) != GNUTLS_CIPHER_CHACHA20_POLY1305)) { - return GNUTLS_E_UNIMPLEMENTED_FEATURE; - } - -@@ -114,7 +116,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - case GNUTLS_CIPHER_AES_128_GCM: - { - struct tls12_crypto_info_aes_gcm_128 crypto_info; -- memset(&crypto_info, 0, sizeof(crypto_info)); -+ memset(&crypto_info, 0, sizeof (crypto_info)); - - crypto_info.info.cipher_type = TLS_CIPHER_AES_GCM_128; - assert(cipher_key.size == TLS_CIPHER_AES_GCM_128_KEY_SIZE); -@@ -150,7 +152,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - case GNUTLS_CIPHER_AES_256_GCM: - { - struct tls12_crypto_info_aes_gcm_256 crypto_info; -- memset(&crypto_info, 0, sizeof(crypto_info)); -+ memset(&crypto_info, 0, sizeof (crypto_info)); - - crypto_info.info.cipher_type = TLS_CIPHER_AES_GCM_256; - assert (cipher_key.size == TLS_CIPHER_AES_GCM_256_KEY_SIZE); -@@ -182,9 +184,83 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - } - } - break; -+ case GNUTLS_CIPHER_AES_128_CCM: -+ { -+ struct tls12_crypto_info_aes_ccm_128 crypto_info; -+ memset(&crypto_info, 0, sizeof (crypto_info)); -+ -+ crypto_info.info.cipher_type = TLS_CIPHER_AES_CCM_128; -+ assert(cipher_key.size == TLS_CIPHER_AES_CCM_128_KEY_SIZE); -+ -+ /* for TLS 1.2 IV is generated in kernel */ -+ if (version == GNUTLS_TLS1_2) { -+ crypto_info.info.version = TLS_1_2_VERSION; -+ memcpy(crypto_info.iv, seq_number, TLS_CIPHER_AES_CCM_128_IV_SIZE); -+ } else { -+ crypto_info.info.version = TLS_1_3_VERSION; -+ assert(iv.size == TLS_CIPHER_AES_CCM_128_SALT_SIZE -+ + TLS_CIPHER_AES_CCM_128_IV_SIZE); -+ -+ memcpy(crypto_info.iv, iv.data + -+ TLS_CIPHER_AES_CCM_128_SALT_SIZE, -+ TLS_CIPHER_AES_CCM_128_IV_SIZE); -+ } -+ -+ memcpy(crypto_info.salt, iv.data, -+ TLS_CIPHER_AES_CCM_128_SALT_SIZE); -+ memcpy(crypto_info.rec_seq, seq_number, -+ TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE); -+ memcpy(crypto_info.key, cipher_key.data, -+ TLS_CIPHER_AES_CCM_128_KEY_SIZE); -+ -+ if (setsockopt (sockin, SOL_TLS, TLS_RX, -+ &crypto_info, sizeof (crypto_info))) { -+ session->internals.ktls_enabled &= ~GNUTLS_KTLS_RECV; -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ } -+ } -+ break; -+ case GNUTLS_CIPHER_CHACHA20_POLY1305: -+ { -+ struct tls12_crypto_info_chacha20_poly1305 crypto_info; -+ memset(&crypto_info, 0, sizeof (crypto_info)); -+ -+ crypto_info.info.cipher_type = TLS_CIPHER_CHACHA20_POLY1305; -+ assert(cipher_key.size == TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE); -+ -+ /* for TLS 1.2 IV is generated in kernel */ -+ if (version == GNUTLS_TLS1_2) { -+ crypto_info.info.version = TLS_1_2_VERSION; -+ memcpy(crypto_info.iv, seq_number, TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); -+ } else { -+ crypto_info.info.version = TLS_1_3_VERSION; -+ assert(iv.size == TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE -+ + TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); -+ -+ memcpy(crypto_info.iv, iv.data + -+ TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE, -+ TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); -+ } -+ -+ memcpy(crypto_info.salt, iv.data, -+ TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE); -+ memcpy(crypto_info.rec_seq, seq_number, -+ TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE); -+ memcpy(crypto_info.key, cipher_key.data, -+ TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE); -+ -+ if (setsockopt (sockin, SOL_TLS, TLS_RX, -+ &crypto_info, sizeof (crypto_info))) { -+ session->internals.ktls_enabled &= ~GNUTLS_KTLS_RECV; -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ } -+ } -+ break; - default: - assert(0); - } -+ -+ - } - - ret = gnutls_record_get_state (session, 0, &mac_key, &iv, &cipher_key, -@@ -198,7 +274,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - case GNUTLS_CIPHER_AES_128_GCM: - { - struct tls12_crypto_info_aes_gcm_128 crypto_info; -- memset(&crypto_info, 0, sizeof(crypto_info)); -+ memset(&crypto_info, 0, sizeof (crypto_info)); - - crypto_info.info.cipher_type = TLS_CIPHER_AES_GCM_128; - -@@ -234,7 +310,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - case GNUTLS_CIPHER_AES_256_GCM: - { - struct tls12_crypto_info_aes_gcm_256 crypto_info; -- memset(&crypto_info, 0, sizeof(crypto_info)); -+ memset(&crypto_info, 0, sizeof (crypto_info)); - - crypto_info.info.cipher_type = TLS_CIPHER_AES_GCM_256; - assert (cipher_key.size == TLS_CIPHER_AES_GCM_256_KEY_SIZE); -@@ -266,10 +342,81 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - } - } - break; -+ case GNUTLS_CIPHER_AES_128_CCM: -+ { -+ struct tls12_crypto_info_aes_ccm_128 crypto_info; -+ memset(&crypto_info, 0, sizeof (crypto_info)); -+ -+ crypto_info.info.cipher_type = TLS_CIPHER_AES_CCM_128; -+ assert (cipher_key.size == TLS_CIPHER_AES_CCM_128_KEY_SIZE); -+ -+ /* for TLS 1.2 IV is generated in kernel */ -+ if (version == GNUTLS_TLS1_2) { -+ crypto_info.info.version = TLS_1_2_VERSION; -+ memcpy(crypto_info.iv, seq_number, TLS_CIPHER_AES_CCM_128_IV_SIZE); -+ } else { -+ crypto_info.info.version = TLS_1_3_VERSION; -+ assert (iv.size == TLS_CIPHER_AES_CCM_128_SALT_SIZE + -+ TLS_CIPHER_AES_CCM_128_IV_SIZE); -+ -+ memcpy (crypto_info.iv, iv.data + TLS_CIPHER_AES_CCM_128_SALT_SIZE, -+ TLS_CIPHER_AES_CCM_128_IV_SIZE); -+ } -+ -+ memcpy (crypto_info.salt, iv.data, -+ TLS_CIPHER_AES_CCM_128_SALT_SIZE); -+ memcpy (crypto_info.rec_seq, seq_number, -+ TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE); -+ memcpy (crypto_info.key, cipher_key.data, -+ TLS_CIPHER_AES_CCM_128_KEY_SIZE); -+ -+ if (setsockopt (sockout, SOL_TLS, TLS_TX, -+ &crypto_info, sizeof (crypto_info))) { -+ session->internals.ktls_enabled &= ~GNUTLS_KTLS_SEND; -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ } -+ } -+ break; -+ case GNUTLS_CIPHER_CHACHA20_POLY1305: -+ { -+ struct tls12_crypto_info_chacha20_poly1305 crypto_info; -+ memset(&crypto_info, 0, sizeof (crypto_info)); -+ -+ crypto_info.info.cipher_type = TLS_CIPHER_CHACHA20_POLY1305; -+ assert (cipher_key.size == TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE); -+ -+ /* for TLS 1.2 IV is generated in kernel */ -+ if (version == GNUTLS_TLS1_2) { -+ crypto_info.info.version = TLS_1_2_VERSION; -+ memcpy(crypto_info.iv, seq_number, TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); -+ } else { -+ crypto_info.info.version = TLS_1_3_VERSION; -+ assert (iv.size == TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE + -+ TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); -+ -+ memcpy (crypto_info.iv, iv.data + TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE, -+ TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE); -+ } -+ -+ memcpy (crypto_info.salt, iv.data, -+ TLS_CIPHER_CHACHA20_POLY1305_SALT_SIZE); -+ memcpy (crypto_info.rec_seq, seq_number, -+ TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE); -+ memcpy (crypto_info.key, cipher_key.data, -+ TLS_CIPHER_CHACHA20_POLY1305_KEY_SIZE); -+ -+ if (setsockopt (sockout, SOL_TLS, TLS_TX, -+ &crypto_info, sizeof (crypto_info))) { -+ session->internals.ktls_enabled &= ~GNUTLS_KTLS_SEND; -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ } -+ } -+ break; - default: - assert(0); - } - -+ - // set callback for sending handshake messages - gnutls_handshake_set_read_function(session, - _gnutls_ktls_send_handshake_msg); --- -2.38.1 - - -From 24bd0559302f8a7adf9f072f61f2aa03efa664f6 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Fri, 2 Dec 2022 11:07:48 +0100 -Subject: [PATCH 2/2] KTLS: add ciphersuites (tests) - -Signed-off-by: Frantisek Krenzelok ---- - tests/gnutls_ktls.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c -index 8f9c5fa36..919270778 100644 ---- a/tests/gnutls_ktls.c -+++ b/tests/gnutls_ktls.c -@@ -350,8 +350,12 @@ void doit(void) - { - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM"); -+ run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CCM"); -+ run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); -+ run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-CCM"); -+ run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305"); - } - - #endif /* _WIN32 */ --- -2.38.1 - diff --git a/gnutls-3.7.8-ktls_invalidate_session.patch b/gnutls-3.7.8-ktls_invalidate_session.patch deleted file mode 100644 index aaa4793..0000000 --- a/gnutls-3.7.8-ktls_invalidate_session.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 9533fcbacdb5532425568e3874cfea9f0a9b55d5 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Nov 2022 11:10:58 +0900 -Subject: [PATCH 1/2] src: fix memory leak in print_rawpk_info - -Signed-off-by: Daiki Ueno ---- - src/common.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/common.c b/src/common.c -index 6d2056f95..20327b41c 100644 ---- a/src/common.c -+++ b/src/common.c -@@ -222,7 +222,7 @@ print_rawpk_info(gnutls_session_t session, FILE *out, int flag, int print_cert, - if (ret < 0) { - fprintf(stderr, "Encoding error: %s\n", - gnutls_strerror(ret)); -- return; -+ goto cleanup; - } - - log_msg(out, "\n%s\n", (char*)pem.data); -@@ -230,6 +230,8 @@ print_rawpk_info(gnutls_session_t session, FILE *out, int flag, int print_cert, - gnutls_free(pem.data); - } - -+ cleanup: -+ gnutls_pcert_deinit(&pk_cert); - } - - /* returns false (0) if not verified, or true (1) otherwise --- -2.38.1 - - -From ceac5211c073ba8dc86fe7cfb25504db33729fa9 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Nov 2022 11:14:53 +0900 -Subject: [PATCH 2/2] tests: fix memory leak in resume-with-previous-stek - -Signed-off-by: Daiki Ueno ---- - tests/resume-with-previous-stek.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/tests/resume-with-previous-stek.c b/tests/resume-with-previous-stek.c -index 94f165627..98aba8d84 100644 ---- a/tests/resume-with-previous-stek.c -+++ b/tests/resume-with-previous-stek.c -@@ -127,6 +127,8 @@ static void client(int fd, int *resume, unsigned rounds, const char *prio) - - gnutls_deinit(session); - } -+ -+ gnutls_free(session_data.data); - } - - typedef void (* gnutls_stek_rotation_callback_t) (const gnutls_datum_t *prev_key, --- -2.38.1 - diff --git a/gnutls-3.7.8-ktls_key_update.patch b/gnutls-3.7.8-ktls_key_update.patch deleted file mode 100644 index 5ca8a37..0000000 --- a/gnutls-3.7.8-ktls_key_update.patch +++ /dev/null @@ -1,957 +0,0 @@ -From c83b9ecbe8e7e5442867281236d8c9e1bd227204 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Tue, 2 Aug 2022 15:00:50 +0200 -Subject: [PATCH 1/7] KTLS: set key on specific interfaces - -It is now possible to set key on specific interface. -If interface given is not ktls enabled then it will be ignored. - -Signed-off-by: Frantisek Krenzelok ---- - lib/handshake.c | 2 +- - lib/system/ktls.c | 12 +++++++----- - lib/system/ktls.h | 7 ++++++- - 3 files changed, 14 insertions(+), 7 deletions(-) - -diff --git a/lib/handshake.c b/lib/handshake.c -index 21edc5ece..cb2bc3ae9 100644 ---- a/lib/handshake.c -+++ b/lib/handshake.c -@@ -2924,7 +2924,7 @@ int gnutls_handshake(gnutls_session_t session) - - #ifdef ENABLE_KTLS - if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_DUPLEX)) { -- _gnutls_ktls_set_keys(session); -+ _gnutls_ktls_set_keys(session, GNUTLS_KTLS_DUPLEX); - } - #endif - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index ddf27fac7..70b9b9b3a 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -80,7 +80,7 @@ void _gnutls_ktls_enable(gnutls_session_t session) - } - } - --int _gnutls_ktls_set_keys(gnutls_session_t session) -+int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable_flags_t in) - { - gnutls_cipher_algorithm_t cipher = gnutls_cipher_get(session); - gnutls_datum_t mac_key; -@@ -107,7 +107,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session) - return ret; - } - -- if(session->internals.ktls_enabled & GNUTLS_KTLS_RECV){ -+ in &= session->internals.ktls_enabled; -+ -+ if(in & GNUTLS_KTLS_RECV){ - switch (cipher) { - case GNUTLS_CIPHER_AES_128_GCM: - { -@@ -191,7 +193,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session) - return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); - } - -- if(session->internals.ktls_enabled & GNUTLS_KTLS_SEND){ -+ if(in & GNUTLS_KTLS_SEND){ - switch (cipher) { - case GNUTLS_CIPHER_AES_128_GCM: - { -@@ -269,7 +271,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session) - } - } - -- return 0; -+ return in; - } - - ssize_t _gnutls_ktls_send_file(gnutls_session_t session, int fd, -@@ -465,7 +467,7 @@ gnutls_transport_is_ktls_enabled(gnutls_session_t session) { - void _gnutls_ktls_enable(gnutls_session_t session) { - } - --int _gnutls_ktls_set_keys(gnutls_session_t session) { -+int _gnutls_ktls_set_keys(gnutls_session_t sessioni, gnutls_transport_ktls_enable_flags_t in) { - return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); - } - -diff --git a/lib/system/ktls.h b/lib/system/ktls.h -index 8a98a8eb8..c8059092d 100644 ---- a/lib/system/ktls.h -+++ b/lib/system/ktls.h -@@ -4,14 +4,19 @@ - #include "gnutls_int.h" - - void _gnutls_ktls_enable(gnutls_session_t session); --int _gnutls_ktls_set_keys(gnutls_session_t session); -+ -+int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable_flags_t in); -+ - ssize_t _gnutls_ktls_send_file(gnutls_session_t session, int fd, - off_t *offset, size_t count); -+ - int _gnutls_ktls_send_control_msg(gnutls_session_t session, unsigned char record_type, - const void *data, size_t data_size); - #define _gnutls_ktls_send(x, y, z) _gnutls_ktls_send_control_msg(x, GNUTLS_APPLICATION_DATA, y, z); -+ - int _gnutls_ktls_recv_control_msg(gnutls_session_t session, unsigned char *record_type, - void *data, size_t data_size); -+ - int _gnutls_ktls_recv_int(gnutls_session_t session, content_type_t type, void *data, size_t data_size); - #define _gnutls_ktls_recv(x, y, z) _gnutls_ktls_recv_int(x, GNUTLS_APPLICATION_DATA, y, z) - --- -2.39.0 - - -From f8c71030151e3a0d397e9712541236f1a76434a3 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Tue, 2 Aug 2022 13:35:39 +0200 -Subject: [PATCH 2/7] KTLS: set new keys for keyupdate - -set new keys durring gnutls_session_key_update() -setting keys - -Signed-off-by: Frantisek Krenzelok ---- - lib/tls13/key_update.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/lib/tls13/key_update.c b/lib/tls13/key_update.c -index c6f6e0aa1..10c0a9110 100644 ---- a/lib/tls13/key_update.c -+++ b/lib/tls13/key_update.c -@@ -27,6 +27,7 @@ - #include "mem.h" - #include "mbuffers.h" - #include "secrets.h" -+#include "system/ktls.h" - - #define KEY_UPDATES_WINDOW 1000 - #define KEY_UPDATES_PER_WINDOW 8 -@@ -49,8 +50,16 @@ static int update_keys(gnutls_session_t session, hs_stage_t stage) - * write keys */ - if (session->internals.recv_state == RECV_STATE_EARLY_START) { - ret = _tls13_write_connection_state_init(session, stage); -+ if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND)) -+ ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_SEND); - } else { - ret = _tls13_connection_state_init(session, stage); -+ -+ if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND) && stage == STAGE_UPD_OURS) -+ ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_SEND); -+ else if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_RECV) && stage == STAGE_UPD_PEERS) -+ ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_RECV); -+ - } - if (ret < 0) - return gnutls_assert_val(ret); --- -2.39.0 - - -From b93af37d972e02b095e14d4209bf5d5520a4893c Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Wed, 3 Aug 2022 14:20:35 +0200 -Subject: [PATCH 3/7] KTLS: send update key request - -Set hanshake send function after interface initialization -TODO: handel setting function differently - -Signed-off-by: Frantisek Krenzelok ---- - lib/record.c | 23 ++++++++++++++++------- - lib/system/ktls.c | 21 +++++++++++++++++++++ - lib/system/ktls.h | 5 +++++ - 3 files changed, 42 insertions(+), 7 deletions(-) - -diff --git a/lib/record.c b/lib/record.c -index fd24acaf1..aad128e1f 100644 ---- a/lib/record.c -+++ b/lib/record.c -@@ -2065,11 +2065,17 @@ gnutls_record_send2(gnutls_session_t session, const void *data, - session->internals.rsend_state = RECORD_SEND_KEY_UPDATE_3; - FALLTHROUGH; - case RECORD_SEND_KEY_UPDATE_3: -- ret = _gnutls_send_int(session, GNUTLS_APPLICATION_DATA, -- -1, EPOCH_WRITE_CURRENT, -- session->internals.record_key_update_buffer.data, -- session->internals.record_key_update_buffer.length, -- MBUFFER_FLUSH); -+ if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND)) { -+ return _gnutls_ktls_send(session, -+ session->internals.record_key_update_buffer.data, -+ session->internals.record_key_update_buffer.length); -+ } else { -+ ret = _gnutls_send_int(session, GNUTLS_APPLICATION_DATA, -+ -1, EPOCH_WRITE_CURRENT, -+ session->internals.record_key_update_buffer.data, -+ session->internals.record_key_update_buffer.length, -+ MBUFFER_FLUSH); -+ } - _gnutls_buffer_clear(&session->internals.record_key_update_buffer); - session->internals.rsend_state = RECORD_SEND_NORMAL; - if (ret < 0) -@@ -2494,8 +2500,11 @@ gnutls_handshake_write(gnutls_session_t session, - return gnutls_assert_val(0); - - /* When using this, the outgoing handshake messages should -- * also be handled manually */ -- if (!session->internals.h_read_func) -+ * also be handled manually unless KTLS is enabled exclusively -+ * in GNUTLS_KTLS_RECV mode in which case the outgoing messages -+ * are handled by GnuTLS. -+ */ -+ if (!session->internals.h_read_func && !IS_KTLS_ENABLED(session, GNUTLS_KTLS_RECV)) - return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); - - if (session->internals.initial_negotiation_completed) { -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 70b9b9b3a..5da0a8069 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -269,6 +269,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - default: - assert(0); - } -+ // set callback for sending handshake messages -+ gnutls_handshake_set_read_function(session, -+ _gnutls_ktls_send_handshake_msg); - } - - return in; -@@ -355,6 +358,15 @@ int _gnutls_ktls_send_control_msg(gnutls_session_t session, - return data_size; - } - -+int _gnutls_ktls_send_handshake_msg(gnutls_session_t session, -+ gnutls_record_encryption_level_t level, -+ gnutls_handshake_description_t htype, -+ const void *data, size_t data_size) -+{ -+ return _gnutls_ktls_send_control_msg(session, GNUTLS_HANDSHAKE, -+ data, data_size); -+} -+ - int _gnutls_ktls_recv_control_msg(gnutls_session_t session, - unsigned char *record_type, void *data, size_t data_size) - { -@@ -481,6 +493,15 @@ int _gnutls_ktls_send_control_msg(gnutls_session_t session, - return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); - } - -+int _gnutls_ktls_send_handshake_msg(gnutls_session_t session, -+ gnutls_record_encryption_level_t level, -+ gnutls_handshake_description_t htype, -+ const void *data, size_t data_size) -+{ -+ (void)level; -+ return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); -+} -+ - int _gnutls_ktls_recv_int(gnutls_session_t session, content_type_t type, - void *data, size_t data_size) { - return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); -diff --git a/lib/system/ktls.h b/lib/system/ktls.h -index c8059092d..8d61a49df 100644 ---- a/lib/system/ktls.h -+++ b/lib/system/ktls.h -@@ -10,6 +10,11 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - ssize_t _gnutls_ktls_send_file(gnutls_session_t session, int fd, - off_t *offset, size_t count); - -+int _gnutls_ktls_send_handshake_msg(gnutls_session_t session, -+ gnutls_record_encryption_level_t level, -+ gnutls_handshake_description_t htype, -+ const void *data, size_t data_size); -+ - int _gnutls_ktls_send_control_msg(gnutls_session_t session, unsigned char record_type, - const void *data, size_t data_size); - #define _gnutls_ktls_send(x, y, z) _gnutls_ktls_send_control_msg(x, GNUTLS_APPLICATION_DATA, y, z); --- -2.39.0 - - -From 7128338208d092275ac72785f85019d16951fab9 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Mon, 22 Aug 2022 10:50:37 +0200 -Subject: [PATCH 4/7] KTLS: receive key update - -handle received GNUTLS_HANDSHAKE_KEY_UPDATE set keys accordingly - -Signed-off-by: Frantisek Krenzelok ---- - lib/system/ktls.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 5da0a8069..f3cb343ae 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -452,7 +452,13 @@ int _gnutls_ktls_recv_int(gnutls_session_t session, content_type_t type, - ret = 0; - break; - case GNUTLS_HANDSHAKE: -- // ignore post-handshake messages -+ ret = gnutls_handshake_write(session, -+ GNUTLS_ENCRYPTION_LEVEL_APPLICATION, -+ data, ret); -+ -+ if (ret < 0) -+ return gnutls_assert_val(ret); -+ - if (type != record_type) - return GNUTLS_E_AGAIN; - break; --- -2.39.0 - - -From 14eadde1f2cdfaf858dc2029dac5503e48a49935 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Fri, 5 Aug 2022 16:38:02 +0200 -Subject: [PATCH 5/7] KTLS: set write alert callback - -Use callback for sending alerts. - -Signed-off-by: Frantisek Krenzelok ---- - lib/alert.c | 13 ++++--------- - lib/system/ktls.c | 15 +++++++++++++++ - lib/system/ktls.h | 5 +++++ - 3 files changed, 24 insertions(+), 9 deletions(-) - -diff --git a/lib/alert.c b/lib/alert.c -index 50bd1d3de..fda8cd79f 100644 ---- a/lib/alert.c -+++ b/lib/alert.c -@@ -182,15 +182,10 @@ gnutls_alert_send(gnutls_session_t session, gnutls_alert_level_t level, - return ret; - } - -- if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND)) { -- ret = -- _gnutls_ktls_send_control_msg(session, GNUTLS_ALERT, data, 2); -- } else { -- ret = -- _gnutls_send_int(session, GNUTLS_ALERT, -1, -- EPOCH_WRITE_CURRENT, data, 2, -- MBUFFER_FLUSH); -- } -+ ret = _gnutls_send_int(session, GNUTLS_ALERT, -1, -+ EPOCH_WRITE_CURRENT, data, 2, -+ MBUFFER_FLUSH); -+ - return (ret < 0) ? ret : 0; - } - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index f3cb343ae..703775960 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -269,9 +269,13 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, gnutls_transport_ktls_enable - default: - assert(0); - } -+ - // set callback for sending handshake messages - gnutls_handshake_set_read_function(session, - _gnutls_ktls_send_handshake_msg); -+ -+ // set callback for sending alert messages -+ gnutls_alert_set_read_function(session, _gnutls_ktls_send_alert_msg); - } - - return in; -@@ -367,6 +371,17 @@ int _gnutls_ktls_send_handshake_msg(gnutls_session_t session, - data, data_size); - } - -+int _gnutls_ktls_send_alert_msg(gnutls_session_t session, -+ gnutls_record_encryption_level_t level, -+ gnutls_alert_level_t alert_level, -+ gnutls_alert_description_t alert_desc) -+{ -+ uint8_t data[2]; -+ data[0] = (uint8_t) alert_level; -+ data[1] = (uint8_t) alert_desc; -+ return _gnutls_ktls_send_control_msg(session, GNUTLS_ALERT, data, 2); -+} -+ - int _gnutls_ktls_recv_control_msg(gnutls_session_t session, - unsigned char *record_type, void *data, size_t data_size) - { -diff --git a/lib/system/ktls.h b/lib/system/ktls.h -index 8d61a49df..64e1c9c1c 100644 ---- a/lib/system/ktls.h -+++ b/lib/system/ktls.h -@@ -15,6 +15,11 @@ int _gnutls_ktls_send_handshake_msg(gnutls_session_t session, - gnutls_handshake_description_t htype, - const void *data, size_t data_size); - -+int _gnutls_ktls_send_alert_msg(gnutls_session_t session, -+ gnutls_record_encryption_level_t level, -+ gnutls_alert_level_t alert_level, -+ gnutls_alert_description_t alert_desc); -+ - int _gnutls_ktls_send_control_msg(gnutls_session_t session, unsigned char record_type, - const void *data, size_t data_size); - #define _gnutls_ktls_send(x, y, z) _gnutls_ktls_send_control_msg(x, GNUTLS_APPLICATION_DATA, y, z); --- -2.39.0 - - -From 38b8708d66e592c09edf2745c921436f56607a96 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Tue, 9 Aug 2022 12:11:16 +0200 -Subject: [PATCH 6/7] KTLS: rekey test - -Signed-off-by: Frantisek Krenzelok ---- - tests/Makefile.am | 2 + - tests/ktls_keyupdate.c | 381 ++++++++++++++++++++++++++++++++++++++++ - tests/ktls_keyupdate.sh | 46 +++++ - 3 files changed, 429 insertions(+) - create mode 100644 tests/ktls_keyupdate.c - create mode 100755 tests/ktls_keyupdate.sh - -diff --git a/tests/Makefile.am b/tests/Makefile.am -index 1122886b3..2d345d478 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -500,6 +500,8 @@ endif - if ENABLE_KTLS - indirect_tests += gnutls_ktls - dist_check_SCRIPTS += ktls.sh -+indirect_tests += ktls_keyupdate -+dist_check_SCRIPTS += ktls_keyupdate.sh - endif - - if !WINDOWS -diff --git a/tests/ktls_keyupdate.c b/tests/ktls_keyupdate.c -new file mode 100644 -index 000000000..9fbff38ae ---- /dev/null -+++ b/tests/ktls_keyupdate.c -@@ -0,0 +1,381 @@ -+// Copyright (C) 2022 Red Hat, Inc. -+// -+// Author: Frantisek Krenzelok -+// -+// This file is part of GnuTLS. -+// -+// GnuTLS is free software; you can redistribute it and/or modify it -+// under the terms of the GNU General Public License as published by the -+// Free Software Foundation; either version 3 of the License, or (at -+// your option) any later version. -+// -+// GnuTLS is distributed in the hope that it will be useful, but -+// WITHOUT ANY WARRANTY; without even the implied warranty of -+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+// General Public License for more details. -+// -+// You should have received a copy of the GNU General Public License -+// along with GnuTLS; if not, write to the Free Software Foundation, -+// Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -+ -+#ifdef HAVE_CONFIG_H -+#include -+#endif -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#include "cert-common.h" -+#include "utils.h" -+ -+#if defined(_WIN32) -+ -+int main(void) -+{ -+ exit(77); -+} -+ -+#else -+ -+ -+#define MAX_BUF 1024 -+#define MSG "Hello world!" -+ -+#define HANDSHAKE(session, name, ret)\ -+{\ -+ do {\ -+ ret = gnutls_handshake(session);\ -+ }\ -+ while (ret < 0 && gnutls_error_is_fatal(ret) == 0);\ -+ if (ret < 0) {\ -+ fail("%s: Handshake failed\n", name);\ -+ goto end;\ -+ }\ -+} -+ -+#define SEND_MSG(session, name, ret)\ -+{\ -+ do {\ -+ ret = gnutls_record_send(session, MSG, strlen(MSG)+1);\ -+ } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);\ -+ if (ret < 0) {\ -+ fail("%s: data sending has failed (%s)\n",name,\ -+ gnutls_strerror(ret));\ -+ goto end;\ -+ }\ -+} -+ -+#define RECV_MSG(session, name, buffer, buffer_len, ret)\ -+{\ -+ memset(buffer, 0, sizeof(buffer));\ -+ do{\ -+ ret = gnutls_record_recv(session, buffer, sizeof(buffer));\ -+ }\ -+ while(ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);\ -+ if (ret == 0) {\ -+ success("%s: Peer has closed the TLS connection\n", name);\ -+ goto end;\ -+ } else if (ret < 0) {\ -+ fail("%s: Error -> %s\n", name, gnutls_strerror(ret));\ -+ goto end;\ -+ }\ -+ if(strncmp(buffer, MSG, ret)){\ -+ fail("%s: Message doesn't match\n", name);\ -+ goto end;\ -+ }\ -+} -+ -+#define KEY_UPDATE(session, name, peer_req, ret)\ -+{\ -+ do {\ -+ ret = gnutls_session_key_update(session, peer_req);\ -+ } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);\ -+ if (ret < 0) {\ -+ fail("%s: key update has failed (%s)\n", name, \ -+ gnutls_strerror(ret));\ -+ goto end;\ -+ }\ -+} -+ -+#define CHECK_KTLS_ENABLED(session, ret)\ -+{\ -+ ret = gnutls_transport_is_ktls_enabled(session);\ -+ if (!(ret & GNUTLS_KTLS_RECV)){\ -+ fail("client: KTLS was not properly initialized\n");\ -+ goto end;\ -+ }\ -+} -+ -+static void server_log_func(int level, const char *str) -+{ -+ fprintf(stderr, "server|<%d>| %s", level, str); -+} -+ -+static void client_log_func(int level, const char *str) -+{ -+ fprintf(stderr, "client|<%d>| %s", level, str); -+} -+ -+ -+static void client(int fd, const char *prio, int pipe) -+{ -+ const char *name = "client"; -+ int ret; -+ char foo; -+ char buffer[MAX_BUF + 1]; -+ gnutls_certificate_credentials_t x509_cred; -+ gnutls_session_t session; -+ -+ global_init(); -+ -+ if (debug) { -+ gnutls_global_set_log_function(client_log_func); -+ gnutls_global_set_log_level(7); -+ } -+ -+ gnutls_certificate_allocate_credentials(&x509_cred); -+ -+ gnutls_init(&session, GNUTLS_CLIENT); -+ gnutls_handshake_set_timeout(session, 0); -+ -+ assert(gnutls_priority_set_direct(session, prio, NULL) >= 0); -+ -+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); -+ -+ gnutls_transport_set_int(session, fd); -+ -+ HANDSHAKE(session, name, ret); -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ // Test 0: Try sending/receiving data -+ RECV_MSG(session, name, buffer, MAX_BUF+1, ret) -+ SEND_MSG(session, name, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ // Test 1: Servers does key update -+ read(pipe, &foo, 1); -+ RECV_MSG(session, name, buffer, MAX_BUF+1, ret) -+ SEND_MSG(session, name, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ // Test 2: Does key update witch request -+ read(pipe, &foo, 1); -+ RECV_MSG(session, name, buffer, MAX_BUF+1, ret) -+ SEND_MSG(session, name, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ ret = gnutls_bye(session, GNUTLS_SHUT_RDWR); -+ if (ret < 0) { -+ fail("client: error in closing session: %s\n", gnutls_strerror(ret)); -+ } -+ -+ ret = 0; -+ end: -+ -+ close(fd); -+ -+ gnutls_deinit(session); -+ -+ gnutls_certificate_free_credentials(x509_cred); -+ -+ gnutls_global_deinit(); -+ -+ if (ret != 0) -+ exit(1); -+} -+ -+pid_t child; -+static void terminate(void) -+{ -+ assert(child); -+ kill(child, SIGTERM); -+ exit(1); -+} -+ -+static void server(int fd, const char *prio, int pipe) -+{ -+ const char *name = "server"; -+ int ret; -+ char bar = 0; -+ char buffer[MAX_BUF + 1]; -+ gnutls_certificate_credentials_t x509_cred; -+ gnutls_session_t session; -+ -+ global_init(); -+ -+ if (debug) { -+ gnutls_global_set_log_function(server_log_func); -+ gnutls_global_set_log_level(7); -+ } -+ -+ gnutls_certificate_allocate_credentials(&x509_cred); -+ ret = gnutls_certificate_set_x509_key_mem(x509_cred, &server_cert, -+ &server_key, -+ GNUTLS_X509_FMT_PEM); -+ if (ret < 0) -+ exit(1); -+ -+ gnutls_init(&session, GNUTLS_SERVER); -+ gnutls_handshake_set_timeout(session, 0); -+ -+ assert(gnutls_priority_set_direct(session, prio, NULL)>=0); -+ -+ gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); -+ -+ gnutls_transport_set_int(session, fd); -+ -+ HANDSHAKE(session, name, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ success("Test 0: sending/receiving data\n"); -+ SEND_MSG(session, name, ret) -+ RECV_MSG(session, name, buffer, MAX_BUF+1, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ success("Test 1: server key update without request\n"); -+ KEY_UPDATE(session, name, 0, ret) -+ write(pipe, &bar, 1); -+ SEND_MSG(session, name, ret) -+ RECV_MSG(session, name, buffer, MAX_BUF+1, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ success("Test 2: server key update with request\n"); -+ KEY_UPDATE(session, name, GNUTLS_KU_PEER, ret) -+ write(pipe, &bar, 1); -+ SEND_MSG(session, name, ret) -+ RECV_MSG(session, name, buffer, MAX_BUF+1, ret) -+ -+ CHECK_KTLS_ENABLED(session, ret) -+ -+ ret = gnutls_bye(session, GNUTLS_SHUT_RDWR); -+ if (ret < 0) { -+ fail("server: error in closing session: %s\n", gnutls_strerror(ret)); -+ } -+ -+ ret = 0; -+end: -+ close(fd); -+ gnutls_deinit(session); -+ -+ gnutls_certificate_free_credentials(x509_cred); -+ -+ gnutls_global_deinit(); -+ -+ if (ret){ -+ terminate(); -+ } -+ -+ if (debug) -+ success("server: finished\n"); -+} -+ -+static void ch_handler(int sig) -+{ -+ return; -+} -+ -+static void run(const char *prio) -+{ -+ int ret; -+ struct sockaddr_in saddr; -+ socklen_t addrlen; -+ int listener; -+ int fd; -+ -+ int sync_pipe[2]; //used for synchronization -+ pipe(sync_pipe); -+ -+ success("running ktls test with %s\n", prio); -+ -+ signal(SIGCHLD, ch_handler); -+ signal(SIGPIPE, SIG_IGN); -+ -+ listener = socket(AF_INET, SOCK_STREAM, 0); -+ if (listener == -1){ -+ fail("error in listener(): %s\n", strerror(errno)); -+ } -+ -+ memset(&saddr, 0, sizeof(saddr)); -+ saddr.sin_family = AF_INET; -+ saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); -+ saddr.sin_port = 0; -+ -+ ret = bind(listener, (struct sockaddr*)&saddr, sizeof(saddr)); -+ if (ret == -1){ -+ fail("error in bind(): %s\n", strerror(errno)); -+ } -+ -+ addrlen = sizeof(saddr); -+ ret = getsockname(listener, (struct sockaddr*)&saddr, &addrlen); -+ if (ret == -1){ -+ fail("error in getsockname(): %s\n", strerror(errno)); -+ } -+ -+ child = fork(); -+ if (child < 0) { -+ fail("error in fork(): %s\n", strerror(errno)); -+ exit(1); -+ } -+ -+ if (child) { -+ int status; -+ /* parent */ -+ ret = listen(listener, 1); -+ if (ret == -1) { -+ fail("error in listen(): %s\n", strerror(errno)); -+ } -+ -+ fd = accept(listener, NULL, NULL); -+ if (fd == -1) { -+ fail("error in accept(): %s\n", strerror(errno)); -+ } -+ -+ close(sync_pipe[0]); -+ server(fd, prio, sync_pipe[1]); -+ -+ wait(&status); -+ check_wait_status(status); -+ } else { -+ fd = socket(AF_INET, SOCK_STREAM, 0); -+ if (fd == -1){ -+ fail("error in socket(): %s\n", strerror(errno)); -+ exit(1); -+ } -+ -+ usleep(1000000); -+ connect(fd, (struct sockaddr*)&saddr, addrlen); -+ -+ close(sync_pipe[1]); -+ client(fd, prio, sync_pipe[0]); -+ exit(0); -+ } -+} -+ -+void doit(void) -+{ -+ run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); -+ run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); -+} -+ -+#endif /* _WIN32 */ -diff --git a/tests/ktls_keyupdate.sh b/tests/ktls_keyupdate.sh -new file mode 100755 -index 000000000..d072acafc ---- /dev/null -+++ b/tests/ktls_keyupdate.sh -@@ -0,0 +1,46 @@ -+#!/bin/sh -+ -+# Copyright (C) 2022 Red Hat, Inc. -+# -+# Author: Daiki Ueno -+# -+# This file is part of GnuTLS. -+# -+# GnuTLS is free software; you can redistribute it and/or modify it -+# under the terms of the GNU General Public License as published by the -+# Free Software Foundation; either version 3 of the License, or (at -+# your option) any later version. -+# -+# GnuTLS is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with GnuTLS; if not, write to the Free Software Foundation, -+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -+ -+: ${builddir=.} -+ -+. "$srcdir/scripts/common.sh" -+ -+if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then -+ exit 77 -+fi -+ -+testdir=`create_testdir ktls_keyupdate` -+ -+cfg="$testdir/config" -+ -+cat < "$cfg" -+[global] -+ktls = true -+EOF -+ -+GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1 \ -+GNUTLS_SYSTEM_PRIORITY_FILE="$cfg" \ -+"$builddir/ktls_keyupdate" "$@" -+rc=$? -+ -+rm -rf "$testdir" -+exit $rc --- -2.39.0 - - -From 67843b3a8e28e4c74296caea2d1019065c87afb3 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Mon, 5 Sep 2022 13:05:17 +0200 -Subject: [PATCH 7/7] KTLS: fallback to default - -If an error occurs during setting of keys either initial or key update -then fallback to default mode of operation (disable ktls) and let the -user know - -Signed-off-by: Frantisek Krenzelok ---- - lib/handshake.c | 7 ++++++- - lib/tls13/key_update.c | 23 +++++++++++++++++++---- - 2 files changed, 25 insertions(+), 5 deletions(-) - -diff --git a/lib/handshake.c b/lib/handshake.c -index cb2bc3ae9..14bcdea56 100644 ---- a/lib/handshake.c -+++ b/lib/handshake.c -@@ -2924,7 +2924,12 @@ int gnutls_handshake(gnutls_session_t session) - - #ifdef ENABLE_KTLS - if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_DUPLEX)) { -- _gnutls_ktls_set_keys(session, GNUTLS_KTLS_DUPLEX); -+ ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_DUPLEX); -+ if (ret < 0) { -+ session->internals.ktls_enabled = 0; -+ _gnutls_audit_log(session, -+ "disabling KTLS: failed to set keys\n"); -+ } - } - #endif - -diff --git a/lib/tls13/key_update.c b/lib/tls13/key_update.c -index 10c0a9110..acfda4129 100644 ---- a/lib/tls13/key_update.c -+++ b/lib/tls13/key_update.c -@@ -32,6 +32,20 @@ - #define KEY_UPDATES_WINDOW 1000 - #define KEY_UPDATES_PER_WINDOW 8 - -+/* -+ * Sets kTLS keys if enabled. -+ * If this operation fails with GNUTLS_E_INTERNAL_ERROR, KTLS is disabled -+ * because KTLS most likely doesn't support key update. -+ */ -+#define SET_KTLS_KEYS(session, interface)\ -+{\ -+ if(_gnutls_ktls_set_keys(session, interface) < 0) {\ -+ session->internals.ktls_enabled = 0;\ -+ _gnutls_audit_log(session, \ -+ "disabling KTLS: couldn't update keys\n");\ -+ }\ -+} -+ - static int update_keys(gnutls_session_t session, hs_stage_t stage) - { - int ret; -@@ -51,15 +65,16 @@ static int update_keys(gnutls_session_t session, hs_stage_t stage) - if (session->internals.recv_state == RECV_STATE_EARLY_START) { - ret = _tls13_write_connection_state_init(session, stage); - if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND)) -- ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_SEND); -+ SET_KTLS_KEYS(session, GNUTLS_KTLS_SEND) - } else { - ret = _tls13_connection_state_init(session, stage); -+ if (ret < 0) -+ return gnutls_assert_val(ret); - - if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND) && stage == STAGE_UPD_OURS) -- ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_SEND); -+ SET_KTLS_KEYS(session, GNUTLS_KTLS_SEND) - else if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_RECV) && stage == STAGE_UPD_PEERS) -- ret = _gnutls_ktls_set_keys(session, GNUTLS_KTLS_RECV); -- -+ SET_KTLS_KEYS(session, GNUTLS_KTLS_RECV) - } - if (ret < 0) - return gnutls_assert_val(ret); --- -2.39.0 - diff --git a/gnutls-3.7.8-ktls_minor_fixes.patch b/gnutls-3.7.8-ktls_minor_fixes.patch deleted file mode 100644 index 99749a1..0000000 --- a/gnutls-3.7.8-ktls_minor_fixes.patch +++ /dev/null @@ -1,155 +0,0 @@ -From ccf4463f343a9394a22833ee1de7886e459d3c91 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Nov 2022 12:17:12 +0900 -Subject: [PATCH 1/3] includes: move KTLS function definition out of - - - is meant for the functions that depend on -, which is not available on Windows platforms. - -As the KTLS API doesn't rely on , move the function and -enum to . - -Signed-off-by: Daiki Ueno ---- - lib/includes/gnutls/gnutls.h.in | 21 +++++++++++++++++++++ - lib/includes/gnutls/socket.h | 21 --------------------- - 2 files changed, 21 insertions(+), 21 deletions(-) - -diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in -index 394d465e3..830ce5f95 100644 ---- a/lib/includes/gnutls/gnutls.h.in -+++ b/lib/includes/gnutls/gnutls.h.in -@@ -3421,6 +3421,27 @@ int gnutls_fips140_pop_context(void); - - int gnutls_fips140_run_self_tests(void); - -+/** -+ * gnutls_transport_ktls_enable_flags_t: -+ * @GNUTLS_KTLS_RECV: ktls enabled for recv function. -+ * @GNUTLS_KTLS_SEND: ktls enabled for send function. -+ * @GNUTLS_KTLS_DUPLEX: ktls enabled for both recv and send functions. -+ * -+ * Flag enumeration of ktls enable status for recv and send functions. -+ * This is used by gnutls_transport_is_ktls_enabled(). -+ * -+ * Since: 3.7.3 -+ */ -+typedef enum { -+ GNUTLS_KTLS_RECV = 1 << 0, -+ GNUTLS_KTLS_SEND = 1 << 1, -+ GNUTLS_KTLS_DUPLEX = GNUTLS_KTLS_RECV | GNUTLS_KTLS_SEND, -+} gnutls_transport_ktls_enable_flags_t; -+ -+ -+gnutls_transport_ktls_enable_flags_t -+gnutls_transport_is_ktls_enabled(gnutls_session_t session); -+ - /* Gnutls error codes. The mapping to a TLS alert is also shown in - * comments. - */ -diff --git a/lib/includes/gnutls/socket.h b/lib/includes/gnutls/socket.h -index 4df7bb2e0..64eb19f89 100644 ---- a/lib/includes/gnutls/socket.h -+++ b/lib/includes/gnutls/socket.h -@@ -37,27 +37,6 @@ extern "C" { - #endif - /* *INDENT-ON* */ - --/** -- * gnutls_transport_ktls_enable_flags_t: -- * @GNUTLS_KTLS_RECV: ktls enabled for recv function. -- * @GNUTLS_KTLS_SEND: ktls enabled for send function. -- * @GNUTLS_KTLS_DUPLEX: ktls enabled for both recv and send functions. -- * -- * Flag enumeration of ktls enable status for recv and send functions. -- * This is used by gnutls_transport_is_ktls_enabled(). -- * -- * Since: 3.7.3 -- */ --typedef enum { -- GNUTLS_KTLS_RECV = 1 << 0, -- GNUTLS_KTLS_SEND = 1 << 1, -- GNUTLS_KTLS_DUPLEX = GNUTLS_KTLS_RECV | GNUTLS_KTLS_SEND, --} gnutls_transport_ktls_enable_flags_t; -- -- --gnutls_transport_ktls_enable_flags_t --gnutls_transport_is_ktls_enabled(gnutls_session_t session); -- - void gnutls_transport_set_fastopen(gnutls_session_t session, - int fd, - struct sockaddr *connect_addr, --- -2.38.1 - - -From 90b036e82a95f9379d99d5cabd0e33905d1e3ddc Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Nov 2022 12:13:31 +0900 -Subject: [PATCH 2/3] src: print KTLS enablement status in - gnutls-serv/gnutls-cli - -Signed-off-by: Daiki Ueno ---- - src/common.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/src/common.c b/src/common.c -index 6d2056f95..d357c7fb8 100644 ---- a/src/common.c -+++ b/src/common.c -@@ -498,6 +498,7 @@ int print_info(gnutls_session_t session, int verbose, int flags) - gnutls_datum_t p; - char *desc; - gnutls_protocol_t version; -+ gnutls_transport_ktls_enable_flags_t ktls_flags; - int rc; - - desc = gnutls_session_get_desc(session); -@@ -646,6 +647,15 @@ int print_info(gnutls_session_t session, int verbose, int flags) - - print_channel_bindings(session, verbose); - -+ ktls_flags = gnutls_transport_is_ktls_enabled(session); -+ if (ktls_flags != 0) { -+ log_msg(stdout, "- KTLS: %s\n", -+ (ktls_flags & GNUTLS_KTLS_DUPLEX) == GNUTLS_KTLS_DUPLEX ? "send, recv" : -+ (ktls_flags & GNUTLS_KTLS_SEND) == GNUTLS_KTLS_SEND ? "send" : -+ (ktls_flags & GNUTLS_KTLS_RECV) == GNUTLS_KTLS_RECV ? "recv" : -+ "unknown"); -+ } -+ - fflush(stdout); - - return 0; --- -2.38.1 - - -From aefd7319c0b7b2410d06238246b7755b289e4837 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 28 Nov 2022 12:15:26 +0900 -Subject: [PATCH 3/3] priority: accept "ktls = false" in configuration file - -Signed-off-by: Daiki Ueno ---- - lib/priority.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/priority.c b/lib/priority.c -index 97831e63b..6266bb571 100644 ---- a/lib/priority.c -+++ b/lib/priority.c -@@ -1548,6 +1548,8 @@ static int global_ini_handler(void *ctx, const char *section, const char *name, - p = clear_spaces(value, str); - if (c_strcasecmp(p, "true") == 0) { - cfg->ktls_enabled = true; -+ } else if (c_strcasecmp(p, "false") == 0) { -+ cfg->ktls_enabled = false; - } else { - _gnutls_debug_log("cfg: unknown ktls mode %s\n", - p); --- -2.38.1 - diff --git a/gnutls.spec b/gnutls.spec index 4277ccd..55c9277 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,21 +12,16 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } +%global with_srp 0%{?fedora} < 38 + %global with_mingw 0 %if 0%{?fedora} %global with_mingw 0%{!?_without_mingw:1} %endif -Version: 3.7.8 +Version: 3.8.0 Release: %{?autorelease}%{!?autorelease:1%{?dist}} -Patch: gnutls-3.7.8-gcc_analyzer-suppress_warnings.patch Patch: gnutls-3.2.7-rpath.patch -Patch: gnutls-3.6.7-no-now-guile.patch - -Patch: gnutls-3.7.8-ktls_key_update.patch -Patch: gnutls-3.7.8-ktls_add_ciphersuites.patch -Patch: gnutls-3.7.8-ktls_minor_fixes.patch -Patch: gnutls-3.7.8-ktls_invalidate_session.patch # Delete only after the kernel has been patched for thested systems Patch: gnutls-3.7.8-ktls_disable_keyupdate_test.patch @@ -36,13 +31,7 @@ Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch %bcond_without bootstrap %bcond_without dane -%if 0%{?rhel} -%bcond_with guile %bcond_without fips -%else -%bcond_without guile -%bcond_without fips -%endif %bcond_with tpm12 %bcond_without tpm2 %bcond_without gost @@ -87,9 +76,6 @@ Recommends: trousers >= 0.3.11.2 %if %{with dane} BuildRequires: unbound-devel unbound-libs %endif -%if %{with guile} -BuildRequires: guile22-devel -%endif BuildRequires: make gtk-doc %if %{with_mingw} @@ -147,13 +133,6 @@ Summary: A DANE protocol implementation for GnuTLS Requires: %{name}%{?_isa} = %{version}-%{release} %endif -%if %{with guile} -%package guile -Summary: Guile bindings for the GNUTLS library -Requires: %{name}%{?_isa} = %{version}-%{release} -Requires: guile22 -%endif - %description GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language @@ -197,16 +176,6 @@ This package contains library that implements the DANE protocol for verifying TLS certificates through DNSSEC. %endif -%if %{with guile} -%description guile -GnuTLS is a secure communications library implementing the SSL, TLS and DTLS -protocols and technologies around them. It provides a simple C language -application programming interface (API) to access the secure communications -protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and -other required structures. -This package contains Guile bindings for the library. -%endif - %if %{with_mingw} %package -n mingw32-%{name} Summary: MinGW GnuTLS TLS/SSL encryption library @@ -251,15 +220,6 @@ echo "SYSTEM=NORMAL" >> tests/system.prio CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes" export CCASFLAGS -%if %{with guile} -# These should be checked by m4/guile.m4 instead of configure.ac -# taking into account of _guile_suffix -guile_snarf=%{_bindir}/guile-snarf2.2 -export guile_snarf -GUILD=%{_bindir}/guild2.2 -export GUILD -%endif - %if %{with fips} eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release) export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name" @@ -278,6 +238,9 @@ pushd native_build --enable-gost \ %else --disable-gost \ +%endif +%if %{with_srp} + --enable-srp-authentication \ %endif --enable-sha1-support \ --disable-static \ @@ -297,12 +260,6 @@ pushd native_build %endif --enable-ktls \ --htmldir=%{_docdir}/manual \ -%if %{with guile} - --enable-guile \ - --with-guile-extension-dir=%{_libdir}/guile/2.2 \ -%else - --disable-guile \ -%endif %if %{with dane} --with-unbound-root-key-file=/var/lib/unbound/root.key \ --enable-libdane \ @@ -324,11 +281,13 @@ popd # MinGW does not support CCASFLAGS export CCASFLAGS="" %mingw_configure \ +%if %{with_srp} + --enable-srp-authentication \ +%endif --enable-sha1-support \ --disable-static \ --disable-openssl-compatibility \ --disable-non-suiteb-curves \ - --disable-guile \ --disable-libdane \ --disable-rpath \ --disable-nls \ @@ -348,8 +307,6 @@ pushd native_build make -C doc install-html DESTDIR=$RPM_BUILD_ROOT rm -f $RPM_BUILD_ROOT%{_infodir}/dir rm -f $RPM_BUILD_ROOT%{_libdir}/*.la -rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a -rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la %if %{without dane} rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %endif @@ -358,8 +315,10 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc # doing it twice should be a no-op the second time, # and this way we avoid redefining it and missing a future change %{__spec_install_post} -./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac -sed -i "s^$RPM_BUILD_ROOT/usr^^" $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac +fname=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.*` +./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac" +sed -i "s^$RPM_BUILD_ROOT/usr^^" "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac" +ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac" %endif %if %{with fips} @@ -412,7 +371,7 @@ popd %files -f native_build/gnutls.lang %{_libdir}/libgnutls.so.30* %if %{with fips} -%{_libdir}/.gnutls.hmac +%{_libdir}/.libgnutls.so.30*.hmac %endif %doc README.md AUTHORS NEWS THANKS %license LICENSE doc/COPYING doc/COPYING.LESSER @@ -438,7 +397,9 @@ popd %{_bindir}/ocsptool %{_bindir}/psktool %{_bindir}/p11tool +%if %{with_srp} %{_bindir}/srptool +%endif %if %{with dane} %{_bindir}/danetool %endif @@ -451,15 +412,6 @@ popd %{_libdir}/libgnutls-dane.so.* %endif -%if %{with guile} -%files guile -%{_libdir}/guile/2.2/guile-gnutls*.so* -%{_libdir}/guile/2.2/site-ccache/gnutls.go -%{_libdir}/guile/2.2/site-ccache/gnutls/extra.go -%{_datadir}/guile/site/2.2/gnutls.scm -%{_datadir}/guile/site/2.2/gnutls/extra.scm -%endif - %if %{with_mingw} %files -n mingw32-%{name} %license LICENSE doc/COPYING doc/COPYING.LESSER @@ -471,7 +423,9 @@ popd %{mingw32_bindir}/ocsptool.exe %{mingw32_bindir}/p11tool.exe %{mingw32_bindir}/psktool.exe +%if %{with_srp} %{mingw32_bindir}/srptool.exe +%endif %{mingw32_libdir}/libgnutls.dll.a %{mingw32_libdir}/libgnutls-30.def %{mingw32_libdir}/pkgconfig/gnutls.pc @@ -487,7 +441,9 @@ popd %{mingw64_bindir}/ocsptool.exe %{mingw64_bindir}/p11tool.exe %{mingw64_bindir}/psktool.exe +%if %{with_srp} %{mingw64_bindir}/srptool.exe +%endif %{mingw64_libdir}/libgnutls.dll.a %{mingw64_libdir}/libgnutls-30.def %{mingw64_libdir}/pkgconfig/gnutls.pc diff --git a/sources b/sources index 0ceeebf..f6b15ed 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.7.8.tar.xz) = 4199bcf7c9e3aab2f52266aadceefc563dfe2d938d0ea1f3ec3be95d66f4a8c8e5494d3a800c03dd02ad386dec1738bd63e1fe0d8b394a2ccfc7d6c6a0cc9359 -SHA512 (gnutls-3.7.8.tar.xz.sig) = cecf9843e8683a278d065b663dc98ac2b5fcad1905ee25333038c93c2289b518c974629367e77e66552ac1c9d122d551616edba35cb0c4204202ec676f1a2db7 +SHA512 (gnutls-3.8.0.tar.xz) = 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629 +SHA512 (gnutls-3.8.0.tar.xz.sig) = 9db8db74aa0ebd871287b07b6a8a9f4ce90188633618e669fe07cb8bb314b624c14761f6fe1970e2fbffa87f7c0d6daa4b0fa838bd05f74b8b18cd1b5325c654 SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d From ae52b0f1bdaa6951b426cd61cde905cbb616296d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 2 Mar 2023 11:14:44 +0000 Subject: [PATCH 3/9] Disable GNULIB's year2038 support for 64-bit time_t MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GNUTLS exposes time_t in its public API and thus the size of time_t is ABI relevant. It can't be changed in size without breaking ABI compatibility with applications built against GNUTLS that use the default time_t size. https://gitlab.com/gnutls/gnutls/-/issues/1466 https://bugzilla.redhat.com/show_bug.cgi?id=2174758 Signed-off-by: Daniel P. Berrangé --- gnutls.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index 55c9277..23c169a 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -241,6 +241,9 @@ pushd native_build %endif %if %{with_srp} --enable-srp-authentication \ +%endif +%ifarch %{ix86} + --disable-year2038 \ %endif --enable-sha1-support \ --disable-static \ From c28bd0b2168362116b205112b20b8b2e82d5625e Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Fri, 4 Aug 2023 14:20:31 +0200 Subject: [PATCH 4/9] [packit] 3.8.1 upstream release Upstream tag: 3.8.1 Upstream commit: 513570a5 --- .gitignore | 2 ++ README.packit | 2 +- gnutls.spec | 48 +++++++++++++++++++++++++++--------------------- sources | 4 ++-- 4 files changed, 32 insertions(+), 24 deletions(-) diff --git a/.gitignore b/.gitignore index 690d3fe..fbacd72 100644 --- a/.gitignore +++ b/.gitignore @@ -144,3 +144,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.0.tar.xz /gnutls-3.8.0.tar.xz.sig /gnutls-release-keyring.gpg +/gnutls-3.8.1.tar.xz +/gnutls-3.8.1.tar.xz.sig diff --git a/README.packit b/README.packit index c83811d..7f24510 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.67.0. +The file was generated using packit 0.78.0. diff --git a/gnutls.spec b/gnutls.spec index 23c169a..2b20dac 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,14 +12,7 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -%global with_srp 0%{?fedora} < 38 - -%global with_mingw 0 -%if 0%{?fedora} -%global with_mingw 0%{!?_without_mingw:1} -%endif - -Version: 3.8.0 +Version: 3.8.1 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch @@ -38,10 +31,23 @@ Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch %bcond_with certificate_compression %bcond_without tests +%if 0%{?fedora} < 38 +%bcond_without srp +%else +%bcond_with srp +%endif + +%if 0%{?fedora} +%bcond_without mingw +%else +%bcond_with mingw +%endif + + Summary: A TLS protocol implementation Name: gnutls # The libraries are LGPLv2.1+, utilities are GPLv3+ -License: GPLv3+ and LGPLv2+ +License: GPL-3.0-or-later AND LGPL-2.1-or-later BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: readline-devel, libtasn1-devel >= 4.3 %if %{with certificate_compression} @@ -59,7 +65,7 @@ BuildRequires: tpm2-tss-devel >= 3.0.3 %endif BuildRequires: libidn2-devel BuildRequires: libunistring-devel -BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++ +BuildRequires: net-tools, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 BuildRequires: git-core @@ -78,7 +84,7 @@ BuildRequires: unbound-devel unbound-libs %endif BuildRequires: make gtk-doc -%if %{with_mingw} +%if %{with mingw} BuildRequires: mingw32-filesystem >= 95 BuildRequires: mingw32-gcc BuildRequires: mingw32-gcc-c++ @@ -120,7 +126,7 @@ Requires: %{name}-dane%{?_isa} = %{version}-%{release} Requires: pkgconfig %package utils -License: GPLv3+ +License: GPL-3.0-or-later Summary: Command line tools for TLS protocol Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with dane} @@ -176,7 +182,7 @@ This package contains library that implements the DANE protocol for verifying TLS certificates through DNSSEC. %endif -%if %{with_mingw} +%if %{with mingw} %package -n mingw32-%{name} Summary: MinGW GnuTLS TLS/SSL encryption library Requires: pkgconfig @@ -239,7 +245,7 @@ pushd native_build %else --disable-gost \ %endif -%if %{with_srp} +%if %{with srp} --enable-srp-authentication \ %endif %ifarch %{ix86} @@ -280,11 +286,11 @@ pushd native_build %make_build popd -%if %{with_mingw} +%if %{with mingw} # MinGW does not support CCASFLAGS export CCASFLAGS="" %mingw_configure \ -%if %{with_srp} +%if %{with srp} --enable-srp-authentication \ %endif --enable-sha1-support \ @@ -335,7 +341,7 @@ ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac" %find_lang gnutls popd -%if %{with_mingw} +%if %{with mingw} %mingw_make_install # Remove .la files @@ -400,7 +406,7 @@ popd %{_bindir}/ocsptool %{_bindir}/psktool %{_bindir}/p11tool -%if %{with_srp} +%if %{with srp} %{_bindir}/srptool %endif %if %{with dane} @@ -415,7 +421,7 @@ popd %{_libdir}/libgnutls-dane.so.* %endif -%if %{with_mingw} +%if %{with mingw} %files -n mingw32-%{name} %license LICENSE doc/COPYING doc/COPYING.LESSER %{mingw32_bindir}/certtool.exe @@ -426,7 +432,7 @@ popd %{mingw32_bindir}/ocsptool.exe %{mingw32_bindir}/p11tool.exe %{mingw32_bindir}/psktool.exe -%if %{with_srp} +%if %{with srp} %{mingw32_bindir}/srptool.exe %endif %{mingw32_libdir}/libgnutls.dll.a @@ -444,7 +450,7 @@ popd %{mingw64_bindir}/ocsptool.exe %{mingw64_bindir}/p11tool.exe %{mingw64_bindir}/psktool.exe -%if %{with_srp} +%if %{with srp} %{mingw64_bindir}/srptool.exe %endif %{mingw64_libdir}/libgnutls.dll.a diff --git a/sources b/sources index f6b15ed..05f8aa7 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.8.0.tar.xz) = 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629 -SHA512 (gnutls-3.8.0.tar.xz.sig) = 9db8db74aa0ebd871287b07b6a8a9f4ce90188633618e669fe07cb8bb314b624c14761f6fe1970e2fbffa87f7c0d6daa4b0fa838bd05f74b8b18cd1b5325c654 +SHA512 (gnutls-3.8.1.tar.xz) = 22e78db86b835843df897d14ad633d8a553c0f9b1389daa0c2f864869c6b9ca889028d434f9552237dc4f1b37c978fbe0cce166e3768e5d4e8850ff69a6fc872 +SHA512 (gnutls-3.8.1.tar.xz.sig) = f03fde611927c83f6b57af695d5610ba3cefbb88a261cf5485c94b3fb32c7480a77c68a353a6a28185337195e30011d6b5578c53ea4180a656cf7b175156f7f1 SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d From 2c603ad0a948add94a2cecdea5ae4b50f2b31838 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 22 Nov 2023 15:10:25 +0900 Subject: [PATCH 5/9] [packit] 3.8.2 upstream release Upstream tag: 3.8.2 Upstream commit: e840a07f --- .gitignore | 2 ++ README.packit | 2 +- ....7.8-ktls_skip_tls12_chachapoly_test.patch | 21 ++++++++++++---- gnutls.spec | 24 ++++++++++++++----- sources | 4 ++-- 5 files changed, 40 insertions(+), 13 deletions(-) diff --git a/.gitignore b/.gitignore index fbacd72..b67cb46 100644 --- a/.gitignore +++ b/.gitignore @@ -146,3 +146,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-release-keyring.gpg /gnutls-3.8.1.tar.xz /gnutls-3.8.1.tar.xz.sig +/gnutls-3.8.2.tar.xz +/gnutls-3.8.2.tar.xz.sig diff --git a/README.packit b/README.packit index 7f24510..5998f60 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.78.0. +The file was generated using packit 0.85.0. diff --git a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch b/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch index d986a36..c3a5ace 100644 --- a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch +++ b/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch @@ -1,12 +1,25 @@ +From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Wed, 22 Nov 2023 15:21:49 +0900 +Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch + +Signed-off-by: rpm-build +--- + tests/gnutls_ktls.c | 1 - + 1 file changed, 1 deletion(-) + diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c -index 919270778..778a2f94a 100644 +index ccbe566..049c888 100644 --- a/tests/gnutls_ktls.c +++ b/tests/gnutls_ktls.c -@@ -351,7 +351,6 @@ void doit(void) +@@ -347,7 +347,6 @@ void doit(void) + { run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM"); run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305"); run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-CCM"); + run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305"); +-- +2.41.0 + diff --git a/gnutls.spec b/gnutls.spec index 2b20dac..14e0019 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,13 +12,10 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.1 +Version: 3.8.2 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch -# Delete only after the kernel has been patched for thested systems -Patch: gnutls-3.7.8-ktls_disable_keyupdate_test.patch - # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch @@ -31,7 +28,7 @@ Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch %bcond_with certificate_compression %bcond_without tests -%if 0%{?fedora} < 38 +%if 0%{?fedora} && 0%{?fedora} < 38 %bcond_without srp %else %bcond_with srp @@ -373,7 +370,22 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll* %check %if %{with tests} pushd native_build -make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null + +# KeyUpdate is not yet supported in the kernel. +xfail_tests=ktls_keyupdate.sh + +# The ktls.sh test currently only supports kernel 5.11+. This needs to +# be checked at run time, as the koji builder might be using a different +# version of kernel on the host than the one indicated by the +# kernel-devel package. + +case "$(uname -r)" in + 4.* | 5.[0-9].* | 5.10.* ) + xfail_tests="$xfail_tests ktls.sh" + ;; +esac + +make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests" popd %endif diff --git a/sources b/sources index 05f8aa7..ea8384c 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.8.1.tar.xz) = 22e78db86b835843df897d14ad633d8a553c0f9b1389daa0c2f864869c6b9ca889028d434f9552237dc4f1b37c978fbe0cce166e3768e5d4e8850ff69a6fc872 -SHA512 (gnutls-3.8.1.tar.xz.sig) = f03fde611927c83f6b57af695d5610ba3cefbb88a261cf5485c94b3fb32c7480a77c68a353a6a28185337195e30011d6b5578c53ea4180a656cf7b175156f7f1 +SHA512 (gnutls-3.8.2.tar.xz) = b3aa6e0fa7272cfca0bb0d364fe5dc9ca70cfd41878631d57271ba0a597cf6020a55a19e97a2c02f13a253455b119d296cf6f701be2b4e6880ebeeb07c93ef38 +SHA512 (gnutls-3.8.2.tar.xz.sig) = 9feb30bfccb8c83e83d3d6df009f2a61f4c48eb357c988789c93b2e5a06a34cb490f33741ad0fd4f881fcd34747b3cf9c5aa45bbb15da680ebba35e07ba602f6 SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d From f4a77f72023e5b8cedd335c44db8b2987af59902 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 1 Dec 2023 17:44:03 +0900 Subject: [PATCH 6/9] Tentatively revert newly added Ed448 keys support in PKCS#11 To fix regression with Ed25519 reported in: https://gitlab.com/gnutls/gnutls/-/issues/1515 Signed-off-by: Daiki Ueno --- gnutls-3.8.2-revert-pkcs11-ed448.patch | 701 +++++++++++++++++++++++++ gnutls.spec | 3 + 2 files changed, 704 insertions(+) create mode 100644 gnutls-3.8.2-revert-pkcs11-ed448.patch diff --git a/gnutls-3.8.2-revert-pkcs11-ed448.patch b/gnutls-3.8.2-revert-pkcs11-ed448.patch new file mode 100644 index 0000000..33a9b09 --- /dev/null +++ b/gnutls-3.8.2-revert-pkcs11-ed448.patch @@ -0,0 +1,701 @@ +From 8b7065ed5c72d34d3bf3e0bb803d81fb3abdcb8b Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Fri, 1 Dec 2023 17:42:09 +0900 +Subject: [PATCH] Revert "pkcs11: support Ed448 keys" + +This reverts commit 8cd6e84edaad4a826e481ae045548587f98bd9f7. +--- + lib/pkcs11.c | 23 +--- + lib/pkcs11_int.h | 23 +++- + lib/pkcs11_privkey.c | 67 +--------- + lib/pkcs11_write.c | 9 +- + lib/pubkey.c | 1 - + tests/cert-common.h | 47 +------ + tests/pkcs11/pkcs11-eddsa-privkey-test.c | 160 +++++++++++------------ + tests/pkcs11/pkcs11-privkey-generate.c | 17 +-- + tests/tls13/ocsp-client.c | 4 +- + 9 files changed, 114 insertions(+), 237 deletions(-) + +diff --git a/lib/pkcs11.c b/lib/pkcs11.c +index c46d1f7e61..a96605da60 100644 +--- a/lib/pkcs11.c ++++ b/lib/pkcs11.c +@@ -1796,7 +1796,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, + pobj->pubkey[1].size = a[1].value_len; + + pobj->pubkey_size = 2; +- pobj->pk_algorithm = GNUTLS_PK_RSA; + } else { + gnutls_assert(); + ret = GNUTLS_E_PKCS11_ERROR; +@@ -1852,7 +1851,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, + pobj->pubkey[3].size = a[1].value_len; + + pobj->pubkey_size = 4; +- pobj->pk_algorithm = GNUTLS_PK_DSA; + } else { + gnutls_assert(); + ret = pkcs11_rv_to_err(rv); +@@ -1877,7 +1875,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, + pobj->pubkey[1].size = a[1].value_len; + + pobj->pubkey_size = 2; +- pobj->pk_algorithm = GNUTLS_PK_EC; + } else { + gnutls_assert(); + +@@ -1898,9 +1895,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, + + if ((rv = pkcs11_get_attribute_value(module, pks, ctx, a, 2)) == + CKR_OK) { +- gnutls_ecc_curve_t curve; +- const gnutls_ecc_curve_entry_st *ce; +- + pobj->pubkey[0].data = a[0].value; + pobj->pubkey[0].size = a[0].value_len; + +@@ -1908,26 +1902,13 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, + pobj->pubkey[1].size = a[1].value_len; + + pobj->pubkey_size = 2; +- +- ret = _gnutls_x509_read_ecc_params(pobj->pubkey[0].data, +- pobj->pubkey[0].size, +- &curve); +- if (ret < 0) { +- ret = GNUTLS_E_INVALID_REQUEST; +- goto cleanup; +- } +- ce = _gnutls_ecc_curve_get_params(curve); +- if (unlikely(ce == NULL)) { +- ret = GNUTLS_E_INVALID_REQUEST; +- goto cleanup; +- } +- pobj->pk_algorithm = ce->pk; + } else { + gnutls_assert(); + + ret = pkcs11_rv_to_err(rv); + goto cleanup; + } ++ + break; + #endif + default: +@@ -1964,6 +1945,8 @@ pkcs11_obj_import_pubkey(struct ck_function_list *module, + a[0].value_len = sizeof(key_type); + + if (pkcs11_get_attribute_value(module, pks, ctx, a, 1) == CKR_OK) { ++ pobj->pk_algorithm = key_type_to_pk(key_type); ++ + ret = pkcs11_read_pubkey(module, pks, ctx, key_type, pobj); + if (ret < 0) + return gnutls_assert_val(ret); +diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h +index 891e98f962..9a3380f9cc 100644 +--- a/lib/pkcs11_int.h ++++ b/lib/pkcs11_int.h +@@ -247,7 +247,7 @@ static inline int pk_to_mech(gnutls_pk_algorithm_t pk) + else if (pk == GNUTLS_PK_RSA_PSS) + return CKM_RSA_PKCS_PSS; + #ifdef HAVE_PKCS11_EDDSA +- else if (pk == GNUTLS_PK_EDDSA_ED25519 || pk == GNUTLS_PK_EDDSA_ED448) ++ else if (pk == GNUTLS_PK_EDDSA_ED25519) + return CKM_EDDSA; + #endif + else +@@ -263,13 +263,29 @@ static inline int pk_to_key_type(gnutls_pk_algorithm_t pk) + else if (pk == GNUTLS_PK_RSA_PSS || pk == GNUTLS_PK_RSA) + return CKK_RSA; + #ifdef HAVE_PKCS11_EDDSA +- else if (pk == GNUTLS_PK_EDDSA_ED25519 || pk == GNUTLS_PK_EDDSA_ED448) ++ else if (pk == GNUTLS_PK_EDDSA_ED25519) + return CKK_EC_EDWARDS; + #endif + else + return -1; + } + ++static inline gnutls_pk_algorithm_t key_type_to_pk(ck_key_type_t m) ++{ ++ if (m == CKK_RSA) ++ return GNUTLS_PK_RSA; ++ else if (m == CKK_DSA) ++ return GNUTLS_PK_DSA; ++ else if (m == CKK_ECDSA) ++ return GNUTLS_PK_EC; ++#ifdef HAVE_PKCS11_EDDSA ++ else if (m == CKK_EC_EDWARDS) ++ return GNUTLS_PK_EDDSA_ED25519; ++#endif ++ else ++ return GNUTLS_PK_UNKNOWN; ++} ++ + static inline int pk_to_genmech(gnutls_pk_algorithm_t pk, ck_key_type_t *type) + { + if (pk == GNUTLS_PK_DSA) { +@@ -282,8 +298,7 @@ static inline int pk_to_genmech(gnutls_pk_algorithm_t pk, ck_key_type_t *type) + *type = CKK_RSA; + return CKM_RSA_PKCS_KEY_PAIR_GEN; + #ifdef HAVE_PKCS11_EDDSA +- } else if (pk == GNUTLS_PK_EDDSA_ED25519 || +- pk == GNUTLS_PK_EDDSA_ED448) { ++ } else if (pk == GNUTLS_PK_EDDSA_ED25519) { + *type = CKK_EC_EDWARDS; + return CKM_EC_EDWARDS_KEY_PAIR_GEN; + #endif +diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c +index b9f36c0a62..a30e44084c 100644 +--- a/lib/pkcs11_privkey.c ++++ b/lib/pkcs11_privkey.c +@@ -486,61 +486,6 @@ cleanup: + return ret; + } + +-static inline gnutls_pk_algorithm_t +-key_type_to_pk(struct ck_function_list *module, ck_session_handle_t pks, +- ck_object_handle_t ctx, ck_key_type_t m) +-{ +- switch (m) { +- case CKK_RSA: +- return GNUTLS_PK_RSA; +- case CKK_DSA: +- return GNUTLS_PK_DSA; +- case CKK_ECDSA: +- return GNUTLS_PK_EC; +-#ifdef HAVE_PKCS11_EDDSA +- case CKK_EC_EDWARDS: { +- struct ck_attribute a[1]; +- uint8_t *tmp1; +- size_t tmp1_size; +- gnutls_pk_algorithm_t pk = GNUTLS_PK_UNKNOWN; +- +- tmp1_size = MAX_PK_PARAM_SIZE; +- tmp1 = gnutls_calloc(1, tmp1_size); +- if (tmp1 == NULL) +- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); +- +- a[0].type = CKA_EC_PARAMS; +- a[0].value = tmp1; +- a[0].value_len = tmp1_size; +- +- if (pkcs11_get_attribute_value(module, pks, ctx, a, 1) == +- CKR_OK) { +- gnutls_ecc_curve_t curve; +- const gnutls_ecc_curve_entry_st *ce; +- int ret; +- +- ret = _gnutls_x509_read_ecc_params( +- a[0].value, a[0].value_len, &curve); +- if (ret < 0) { +- goto edwards_cleanup; +- } +- ce = _gnutls_ecc_curve_get_params(curve); +- if (unlikely(ce == NULL)) { +- goto edwards_cleanup; +- } +- pk = ce->pk; +- } +- +- edwards_cleanup: +- gnutls_free(tmp1); +- return pk; +- } +-#endif +- default: +- return GNUTLS_PK_UNKNOWN; +- } +-} +- + /** + * gnutls_pkcs11_privkey_import_url: + * @pkey: The private key +@@ -616,9 +561,7 @@ int gnutls_pkcs11_privkey_import_url(gnutls_pkcs11_privkey_t pkey, + a[0].value_len = sizeof(key_type); + if (pkcs11_get_attribute_value(pkey->sinfo.module, pkey->sinfo.pks, + pkey->ref, a, 1) == CKR_OK) { +- pkey->pk_algorithm = key_type_to_pk(pkey->sinfo.module, +- pkey->sinfo.pks, pkey->ref, +- key_type); ++ pkey->pk_algorithm = key_type_to_pk(key_type); + } + + if (pkey->pk_algorithm == GNUTLS_PK_UNKNOWN) { +@@ -1245,7 +1188,6 @@ int gnutls_pkcs11_privkey_generate3(const char *url, gnutls_pk_algorithm_t pk, + + break; + case GNUTLS_PK_EDDSA_ED25519: +- case GNUTLS_PK_EDDSA_ED448: + p[p_val].type = CKA_SIGN; + p[p_val].value = (void *)&tval; + p[p_val].value_len = sizeof(tval); +@@ -1256,11 +1198,8 @@ int gnutls_pkcs11_privkey_generate3(const char *url, gnutls_pk_algorithm_t pk, + a[a_val].value_len = sizeof(tval); + a_val++; + +- ret = _gnutls_x509_write_ecc_params( +- pk == GNUTLS_PK_EDDSA_ED25519 ? +- GNUTLS_ECC_CURVE_ED25519 : +- GNUTLS_ECC_CURVE_ED448, +- &der); ++ ret = _gnutls_x509_write_ecc_params(GNUTLS_ECC_CURVE_ED25519, ++ &der); + if (ret < 0) { + gnutls_assert(); + goto cleanup; +diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c +index a3201ddeba..3090721db5 100644 +--- a/lib/pkcs11_write.c ++++ b/lib/pkcs11_write.c +@@ -355,8 +355,7 @@ static int add_pubkey(gnutls_pubkey_t pubkey, struct ck_attribute *a, + (*a_val)++; + break; + } +- case GNUTLS_PK_EDDSA_ED25519: +- case GNUTLS_PK_EDDSA_ED448: { ++ case GNUTLS_PK_EDDSA_ED25519: { + gnutls_datum_t params, ecpoint; + + ret = _gnutls_x509_write_ecc_params(pubkey->params.curve, +@@ -936,8 +935,7 @@ int gnutls_pkcs11_copy_x509_privkey2(const char *token_url, + break; + } + #ifdef HAVE_PKCS11_EDDSA +- case GNUTLS_PK_EDDSA_ED25519: +- case GNUTLS_PK_EDDSA_ED448: { ++ case GNUTLS_PK_EDDSA_ED25519: { + ret = _gnutls_x509_write_ecc_params(key->params.curve, &p); + if (ret < 0) { + gnutls_assert(); +@@ -1003,8 +1001,7 @@ cleanup: + break; + } + case GNUTLS_PK_EC: +- case GNUTLS_PK_EDDSA_ED25519: +- case GNUTLS_PK_EDDSA_ED448: { ++ case GNUTLS_PK_EDDSA_ED25519: { + gnutls_free(p.data); + gnutls_free(x.data); + break; +diff --git a/lib/pubkey.c b/lib/pubkey.c +index 1139ad99fc..59ca194f1a 100644 +--- a/lib/pubkey.c ++++ b/lib/pubkey.c +@@ -700,7 +700,6 @@ int gnutls_pubkey_import_pkcs11(gnutls_pubkey_t key, gnutls_pkcs11_obj_t obj, + &obj->pubkey[1]); + break; + case GNUTLS_PK_EDDSA_ED25519: +- case GNUTLS_PK_EDDSA_ED448: + ret = gnutls_pubkey_import_ecc_eddsa(key, &obj->pubkey[0], + &obj->pubkey[1]); + break; +diff --git a/tests/cert-common.h b/tests/cert-common.h +index 57cf6c0c4f..33b3ee3b68 100644 +--- a/tests/cert-common.h ++++ b/tests/cert-common.h +@@ -36,8 +36,7 @@ + * IPv4 server (SAN: IPAddr: 127.0.0.1): server_ca3_ipaddr_cert, server_ca3_key + * IPv4 server (RSA-PSS, SAN: localhost IPAddr: 127.0.0.1): server_ca3_rsa_pss_cert, server_ca3_rsa_pss_key + * IPv4 server (RSA-PSS key, SAN: localhost IPAddr: 127.0.0.1): server_ca3_rsa_pss2_cert, server_ca3_rsa_pss2_key +- * IPv4 server (Ed25519, SAN: localhost IPAddr: 127.0.0.1): server_ca3_eddsa_cert, server_ca3_eddsa_key +- * IPv4 server (Ed448, SAN: localhost IPAddr: 127.0.0.1): server_ca3_ed448_cert, server_ca3_ed448_key ++ * IPv4 server (EdDSA, SAN: localhost IPAddr: 127.0.0.1): server_ca3_eddsa_cert, server_ca3_eddsa_key + * IPv4 server (GOST R 34.10-2001, SAN: localhost): server_ca3_gost01_cert, server_ca3_gost01_key + * IPv4 server (GOST R 34.10-2012-256, SAN: localhost): server_ca3_gost12-256_cert, server_ca3_gost12-256_key + * IPv4 server (GOST R 34.10-2012-512, SAN: localhost): server_ca3_gost12-512_cert, server_ca3_gost12-512_key +@@ -350,7 +349,7 @@ static unsigned char ca2_cert_pem[] = + + const gnutls_datum_t ca2_cert = { ca2_cert_pem, sizeof(ca2_cert_pem) - 1 }; + +-static unsigned char cli_cert_pem[] = ++static unsigned char cert_pem[] = + "-----BEGIN CERTIFICATE-----\n" + "MIICHjCCAYmgAwIBAgIERiYdNzALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" + "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTI3WhcNMDgwNDE3MTMyOTI3WjAdMRsw\n" +@@ -365,9 +364,9 @@ static unsigned char cli_cert_pem[] = + "U7jyOsBJ44SEQITbin2yUeJMIm1tievvdNXBDfW95AM507ShzP12sfiJkJfjjdhy\n" + "dc8Siq5JojruiMizAf0pA7in\n" + "-----END CERTIFICATE-----\n"; +-const gnutls_datum_t cli_cert = { cli_cert_pem, sizeof(cli_cert_pem) - 1 }; ++const gnutls_datum_t cli_cert = { cert_pem, sizeof(cert_pem) - 1 }; + +-static unsigned char cli_key_pem[] = ++static unsigned char key_pem[] = + "-----BEGIN RSA PRIVATE KEY-----\n" + "MIICXAIBAAKBgQC7ZkP18sXXtozMxd/1iDuxyUtqDqGtIFBACIChT1yj0Phsz+Y8\n" + "9+wEdhMXi2SJIlvA3VN8O+18BLuAuSi+jpvGjqClEsv1Vx6i57u3M0mf47tKrmpN\n" +@@ -383,7 +382,7 @@ static unsigned char cli_key_pem[] = + "/iVX2cmMTSh3w3z8MaECQEp0XJWDVKOwcTW6Ajp9SowtmiZ3YDYo1LF9igb4iaLv\n" + "sWZGfbnU3ryjvkb6YuFjgtzbZDZHWQCo8/cOtOBmPdk=\n" + "-----END RSA PRIVATE KEY-----\n"; +-const gnutls_datum_t cli_key = { cli_key_pem, sizeof(cli_key_pem) - 1 }; ++const gnutls_datum_t cli_key = { key_pem, sizeof(key_pem) - 1 }; + + static char dsa_key_pem[] = + "-----BEGIN DSA PRIVATE KEY-----\n" +@@ -1082,42 +1081,6 @@ const gnutls_datum_t server_ca3_eddsa_cert = { + sizeof(server_ca3_eddsa_cert_pem) - 1 + }; + +-/* server Ed448 key */ +-static char server_ca3_ed448_key_pem[] = +- "-----BEGIN PRIVATE KEY-----\n" +- "MEcCAQAwBQYDK2VxBDsEOXPoCtsxxy7itrHfeuQ2bG7oh3uerkBwhabkeSsNFYoS\n" +- "QYy6KKYld8lnhlYQQmMo6lx28x9GmpTiag==\n" +- "-----END PRIVATE KEY-----\n"; +- +-const gnutls_datum_t server_ca3_ed448_key = { +- (unsigned char *)server_ca3_ed448_key_pem, +- sizeof(server_ca3_ed448_key_pem) - 1 +-}; +- +-static char server_ca3_ed448_cert_pem[] = +- "-----BEGIN CERTIFICATE-----\n" +- "MIICqzCCAROgAwIBAgIUAvQ9bcei1eNZ9viV1kP7MKODp9YwDQYJKoZIhvcNAQEL\n" +- "BQAwDzENMAsGA1UEAxMEQ0EtMzAgFw0yMzA5MjgwNjU1NThaGA85OTk5MTIzMTIz\n" +- "NTk1OVowDTELMAkGA1UEBhMCR1IwQzAFBgMrZXEDOgAYxZxGeKtoWUL20zvrFClm\n" +- "irhECIIdccq6x0uZccYHfmRVkFoUI7iOFj6Mlsp5vg24XZ2tGF5MBACjYDBeMAwG\n" +- "A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBTYq6RhA2qMWmYM\n" +- "UAEx3AlNSnhWHDAfBgNVHSMEGDAWgBT5qIYZY7akFBNgdg8BmjU27/G0rzANBgkq\n" +- "hkiG9w0BAQsFAAOCAYEAhEd0coRahGvMx8gLS8biuaqh50+9RJIjMpf+/0IQJ4DV\n" +- "FHT5E70YyaQ0YOsvyxGa04d+KyhdVLppD1pDztLGXYZWxzmowopwpgnpPNT25M+0\n" +- "aQOvCZZvRlqmwgUiRXdhSxqPsUj/73uUBPIjFknrxajoox7sOLris9ujmidqgBGa\n" +- "H1FVbQQQgDOBCKcKXTAllVKzS/ZLwlRHibbm+4UDxGk1tJv1dbnQhJk0FYSQZn3h\n" +- "ZVmSSfP4ZB+U+lsCshypBJ9qVZEqMM2b4m1wv/VAOuw0lGA2SiPub5q91hFYRdeL\n" +- "9FB78/WlrSCTbGeMzzDPXBf/Y2KvFAv3o7K0tsMg1vBsDJBARHEzo4GMRsYDZzvI\n" +- "JXb5tSmJOi/PBfup8GPiG0WbZV9nuvW8V/zmfaP3s9YBfYOtL/+nZch9VdSee2xp\n" +- "T8arukB/s2jLaXQUduD3hoFvFNgCvWJwAWQWNNyHN3ivArqNQpfl2Gtftmb6xCdW\n" +- "Xwt1/q2XKqqLpnF1N2wU\n" +- "-----END CERTIFICATE-----\n"; +- +-const gnutls_datum_t server_ca3_ed448_cert = { +- (unsigned char *)server_ca3_ed448_cert_pem, +- sizeof(server_ca3_ed448_cert_pem) - 1 +-}; +- + static char server_ca3_gost01_key_pem[] = + "-----BEGIN PRIVATE KEY-----\n" + "MEUCAQAwHAYGKoUDAgITMBIGByqFAwICJAAGByqFAwICHgEEIgQgR1lBLIr4WBpn\n" +diff --git a/tests/pkcs11/pkcs11-eddsa-privkey-test.c b/tests/pkcs11/pkcs11-eddsa-privkey-test.c +index 1b7732e884..d3cd9a97c7 100644 +--- a/tests/pkcs11/pkcs11-eddsa-privkey-test.c ++++ b/tests/pkcs11/pkcs11-eddsa-privkey-test.c +@@ -64,8 +64,8 @@ static int pin_func(void *userdata, int attempt, const char *url, + return -1; + } + +-#define myfail(fmt, ...) \ +- fail("%s (iter %zu): " fmt, gnutls_sign_get_name(sigalgo), i, \ ++#define myfail(fmt, ...) \ ++ fail("%s (iter %d): " fmt, gnutls_sign_get_name(sigalgo), i, \ + ##__VA_ARGS__) + + static unsigned verify_eddsa_presence(void) +@@ -85,10 +85,11 @@ static unsigned verify_eddsa_presence(void) + return 0; + } + +-static void test(const char *name, const gnutls_datum_t *cert_pem, +- const gnutls_datum_t *key_pem, gnutls_sign_algorithm_t sigalgo) ++void doit(void) + { ++ char buf[128]; + int ret; ++ const char *lib, *bin; + gnutls_x509_crt_t crt; + gnutls_x509_privkey_t key; + gnutls_datum_t tmp, sig; +@@ -97,16 +98,51 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + gnutls_pubkey_t pubkey2; + gnutls_pubkey_t pubkey3; + gnutls_pubkey_t pubkey4; +- char buf[256]; +- size_t i; ++ unsigned i, sigalgo; ++ ++ bin = softhsm_bin(); ++ ++ lib = softhsm_lib(); ++ ++ ret = global_init(); ++ if (ret != 0) { ++ fail("%d: %s\n", ret, gnutls_strerror(ret)); ++ } ++ ++ if (gnutls_fips140_mode_enabled()) { ++ gnutls_global_deinit(); ++ return; ++ } ++ ++ gnutls_pkcs11_set_pin_function(pin_func, NULL); ++ gnutls_global_set_log_function(tls_log_func); ++ if (debug) ++ gnutls_global_set_log_level(4711); ++ ++ set_softhsm_conf(CONFIG); ++ snprintf(buf, sizeof(buf), ++ "%s --init-token --slot 0 --label test --so-pin " PIN ++ " --pin " PIN, ++ bin); ++ system(buf); ++ ++ ret = gnutls_pkcs11_add_provider(lib, NULL); ++ if (ret < 0) { ++ fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret)); ++ } + +- success("%s\n", name); ++ if (verify_eddsa_presence() == 0) { ++ fprintf(stderr, ++ "Skipping test as no EDDSA mech is supported\n"); ++ exit(77); ++ } + + ret = gnutls_x509_crt_init(&crt); + if (ret < 0) + fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret)); + +- ret = gnutls_x509_crt_import(crt, cert_pem, GNUTLS_X509_FMT_PEM); ++ ret = gnutls_x509_crt_import(crt, &server_ca3_eddsa_cert, ++ GNUTLS_X509_FMT_PEM); + if (ret < 0) + fail("gnutls_x509_crt_import: %s\n", gnutls_strerror(ret)); + +@@ -122,12 +158,25 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + fail("gnutls_x509_privkey_init: %s\n", gnutls_strerror(ret)); + } + +- ret = gnutls_x509_privkey_import(key, key_pem, GNUTLS_X509_FMT_PEM); ++ ret = gnutls_x509_privkey_import(key, &server_ca3_eddsa_key, ++ GNUTLS_X509_FMT_PEM); + if (ret < 0) { + fail("gnutls_x509_privkey_import: %s\n", gnutls_strerror(ret)); + } + +- ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, name, ++ /* initialize softhsm token */ ++ ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test"); ++ if (ret < 0) { ++ fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret)); ++ } ++ ++ ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, ++ GNUTLS_PIN_USER); ++ if (ret < 0) { ++ fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret)); ++ } ++ ++ ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, "cert", + GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE | + GNUTLS_PKCS11_OBJ_FLAG_LOGIN); + if (ret < 0) { +@@ -135,7 +184,7 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + } + + ret = gnutls_pkcs11_copy_x509_privkey( +- SOFTHSM_URL, key, name, ++ SOFTHSM_URL, key, "cert", + GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, + GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE | + GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE | +@@ -150,7 +199,7 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + assert(gnutls_pubkey_import_x509(pubkey, crt, 0) == 0); + + ret = gnutls_pkcs11_copy_pubkey( +- SOFTHSM_URL, pubkey, name, NULL, ++ SOFTHSM_URL, pubkey, "cert", NULL, + GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 0); + if (ret < 0) { + fail("gnutls_pkcs11_copy_pubkey: %s\n", gnutls_strerror(ret)); +@@ -161,13 +210,11 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + gnutls_pubkey_deinit(pubkey); + gnutls_pkcs11_set_pin_function(NULL, NULL); + +- assert(snprintf(buf, sizeof(buf), +- "%s;object=%s;object-type=private?pin-value=" PIN, +- SOFTHSM_URL, name) < (int)sizeof(buf)); +- + assert(gnutls_privkey_init(&pkey) == 0); + +- ret = gnutls_privkey_import_pkcs11_url(pkey, buf); ++ ret = gnutls_privkey_import_pkcs11_url( ++ pkey, ++ SOFTHSM_URL ";object=cert;object-type=private;pin-value=" PIN); + if (ret < 0) { + fail("error in gnutls_privkey_import_pkcs11_url: %s\n", + gnutls_strerror(ret)); +@@ -176,7 +223,10 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + /* Try to read the public key with public key URI */ + assert(gnutls_pubkey_init(&pubkey3) == 0); + +- ret = gnutls_pubkey_import_pkcs11_url(pubkey3, buf, 0); ++ ret = gnutls_pubkey_import_pkcs11_url( ++ pubkey3, ++ SOFTHSM_URL ";object=cert;object-type=public;pin-value=" PIN, ++ 0); + if (ret < 0) { + fail("error in gnutls_pubkey_import_pkcs11_url: %s\n", + gnutls_strerror(ret)); +@@ -185,7 +235,9 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + /* Try to read the public key with certificate URI */ + assert(gnutls_pubkey_init(&pubkey4) == 0); + +- ret = gnutls_pubkey_import_pkcs11_url(pubkey4, buf, 0); ++ ret = gnutls_pubkey_import_pkcs11_url( ++ pubkey4, ++ SOFTHSM_URL ";object=cert;object-type=cert;pin-value=" PIN, 0); + if (ret < 0) { + fail("error in gnutls_pubkey_import_pkcs11_url: %s\n", + gnutls_strerror(ret)); +@@ -195,9 +247,12 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + assert(gnutls_pubkey_import_privkey(pubkey, pkey, 0, 0) == 0); + + assert(gnutls_pubkey_init(&pubkey2) == 0); +- assert(gnutls_pubkey_import_x509_raw(pubkey2, cert_pem, ++ assert(gnutls_pubkey_import_x509_raw(pubkey2, &server_ca3_eddsa_cert, + GNUTLS_X509_FMT_PEM, 0) == 0); + ++ /* this is the algorithm supported by the certificate */ ++ sigalgo = GNUTLS_SIGN_EDDSA_ED25519; ++ + for (i = 0; i < 20; i++) { + /* check whether privkey and pubkey are operational + * by signing and verifying */ +@@ -229,71 +284,6 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, + gnutls_pubkey_deinit(pubkey2); + gnutls_pubkey_deinit(pubkey); + gnutls_privkey_deinit(pkey); +-} +- +-void doit(void) +-{ +- char buf[256]; +- int ret; +- const char *lib, *bin; +- +- bin = softhsm_bin(); +- +- lib = softhsm_lib(); +- +- ret = global_init(); +- if (ret != 0) { +- fail("%d: %s\n", ret, gnutls_strerror(ret)); +- } +- +- if (gnutls_fips140_mode_enabled()) { +- gnutls_global_deinit(); +- return; +- } +- +- gnutls_pkcs11_set_pin_function(pin_func, NULL); +- gnutls_global_set_log_function(tls_log_func); +- if (debug) +- gnutls_global_set_log_level(4711); +- +- set_softhsm_conf(CONFIG); +- assert(snprintf(buf, sizeof(buf), +- "%s --init-token --slot 0 --label test --so-pin " PIN +- " --pin " PIN, +- bin) < (int)sizeof(buf)); +- system(buf); +- +- ret = gnutls_pkcs11_add_provider(lib, NULL); +- if (ret < 0) { +- fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret)); +- } +- +- if (verify_eddsa_presence() == 0) { +- fprintf(stderr, +- "Skipping test as no EDDSA mech is supported\n"); +- exit(77); +- } +- +- /* initialize softhsm token */ +- ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test"); +- if (ret < 0) { +- fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret)); +- } +- +- ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, +- GNUTLS_PIN_USER); +- if (ret < 0) { +- fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret)); +- } +- +- test("ed25519", &server_ca3_eddsa_cert, &server_ca3_eddsa_key, +- GNUTLS_SIGN_EDDSA_ED25519); +- +- /* test clears PIN function to check "?pin-value" works */ +- gnutls_pkcs11_set_pin_function(pin_func, NULL); +- +- test("ed448", &server_ca3_ed448_cert, &server_ca3_ed448_key, +- GNUTLS_SIGN_EDDSA_ED448); + + gnutls_global_deinit(); + +diff --git a/tests/pkcs11/pkcs11-privkey-generate.c b/tests/pkcs11/pkcs11-privkey-generate.c +index 7de0c35426..bd54fad8d2 100644 +--- a/tests/pkcs11/pkcs11-privkey-generate.c ++++ b/tests/pkcs11/pkcs11-privkey-generate.c +@@ -98,7 +98,8 @@ static void generate_keypair(gnutls_pk_algorithm_t algo, size_t bits, + fail("%d: %s\n", ret, gnutls_strerror(ret)); + } + +- success("generated %s key (%s)\n", gnutls_pk_get_name(algo), ++ success("generated %s key (%s)\n", ++ gnutls_pk_get_name(algo), + sensitive ? "sensitive" : "non sensitive"); + + assert(gnutls_pkcs11_obj_init(&obj) >= 0); +@@ -130,9 +131,6 @@ void doit(void) + char buf[128]; + int ret; + const char *lib, *bin; +-#ifdef CKM_EC_EDWARDS_KEY_PAIR_GEN +- CK_MECHANISM_INFO minfo; +-#endif + + if (gnutls_fips140_mode_enabled()) + exit(77); +@@ -176,20 +174,13 @@ void doit(void) + generate_keypair(GNUTLS_PK_RSA, 2048, "rsa-non-sensitive", false); + + #ifdef CKM_EC_EDWARDS_KEY_PAIR_GEN +- ret = gnutls_pkcs11_token_check_mechanism("pkcs11:token=test", +- CKM_EC_EDWARDS_KEY_PAIR_GEN, +- &minfo, sizeof(minfo), 0); ++ ret = gnutls_pkcs11_token_check_mechanism( ++ "pkcs11:token=test", CKM_EC_EDWARDS_KEY_PAIR_GEN, NULL, 0, 0); + if (ret != 0) { + generate_keypair(GNUTLS_PK_EDDSA_ED25519, 256, + "ed25519-sensitive", true); + generate_keypair(GNUTLS_PK_EDDSA_ED25519, 256, + "ed25519-non-sensitive", false); +- if (minfo.ulMaxKeySize >= 456) { +- generate_keypair(GNUTLS_PK_EDDSA_ED448, 456, +- "ed448-sensitive", true); +- generate_keypair(GNUTLS_PK_EDDSA_ED448, 456, +- "ed448-non-sensitive", false); +- } + } + #endif + +diff --git a/tests/tls13/ocsp-client.c b/tests/tls13/ocsp-client.c +index c7e7e2e410..1064a17752 100644 +--- a/tests/tls13/ocsp-client.c ++++ b/tests/tls13/ocsp-client.c +@@ -169,8 +169,8 @@ void doit(void) + fp = fopen(certfile3, "wb"); + if (fp == NULL) + fail("error in fopen\n"); +- assert(fwrite(cli_cert_pem, 1, strlen((char *)cli_cert_pem), fp) > 0); +- assert(fwrite(cli_key_pem, 1, strlen((char *)cli_key_pem), fp) > 0); ++ assert(fwrite(cert_pem, 1, strlen((char *)cert_pem), fp) > 0); ++ assert(fwrite(key_pem, 1, strlen((char *)key_pem), fp) > 0); + fclose(fp); + + ret = gnutls_certificate_set_x509_key_file2( +-- +2.43.0 + diff --git a/gnutls.spec b/gnutls.spec index 14e0019..abfff02 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -19,6 +19,9 @@ Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch +# tentatively reverted for https://gitlab.com/gnutls/gnutls/-/issues/1515 +Patch: gnutls-3.8.2-revert-pkcs11-ed448.patch + %bcond_without bootstrap %bcond_without dane %bcond_without fips From 49aa708da98aa02641153d494ccfcc8f27b1cd84 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Wed, 17 Jan 2024 09:44:22 +0100 Subject: [PATCH 7/9] [packit] 3.8.3 upstream release Upstream tag: 3.8.3 Upstream commit: 2f04c14d --- .gitignore | 2 + README.packit | 2 +- gnutls-3.8.2-revert-pkcs11-ed448.patch | 701 ------------------------ gnutls-3.8.3-kernel_version_check.patch | 36 ++ gnutls.spec | 10 +- sources | 6 +- 6 files changed, 46 insertions(+), 711 deletions(-) delete mode 100644 gnutls-3.8.2-revert-pkcs11-ed448.patch create mode 100644 gnutls-3.8.3-kernel_version_check.patch diff --git a/.gitignore b/.gitignore index b67cb46..35f93b3 100644 --- a/.gitignore +++ b/.gitignore @@ -148,3 +148,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.1.tar.xz.sig /gnutls-3.8.2.tar.xz /gnutls-3.8.2.tar.xz.sig +/gnutls-3.8.3.tar.xz +/gnutls-3.8.3.tar.xz.sig diff --git a/README.packit b/README.packit index 5998f60..8c508a5 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.85.0. +The file was generated using packit 0.88.0. diff --git a/gnutls-3.8.2-revert-pkcs11-ed448.patch b/gnutls-3.8.2-revert-pkcs11-ed448.patch deleted file mode 100644 index 33a9b09..0000000 --- a/gnutls-3.8.2-revert-pkcs11-ed448.patch +++ /dev/null @@ -1,701 +0,0 @@ -From 8b7065ed5c72d34d3bf3e0bb803d81fb3abdcb8b Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Fri, 1 Dec 2023 17:42:09 +0900 -Subject: [PATCH] Revert "pkcs11: support Ed448 keys" - -This reverts commit 8cd6e84edaad4a826e481ae045548587f98bd9f7. ---- - lib/pkcs11.c | 23 +--- - lib/pkcs11_int.h | 23 +++- - lib/pkcs11_privkey.c | 67 +--------- - lib/pkcs11_write.c | 9 +- - lib/pubkey.c | 1 - - tests/cert-common.h | 47 +------ - tests/pkcs11/pkcs11-eddsa-privkey-test.c | 160 +++++++++++------------ - tests/pkcs11/pkcs11-privkey-generate.c | 17 +-- - tests/tls13/ocsp-client.c | 4 +- - 9 files changed, 114 insertions(+), 237 deletions(-) - -diff --git a/lib/pkcs11.c b/lib/pkcs11.c -index c46d1f7e61..a96605da60 100644 ---- a/lib/pkcs11.c -+++ b/lib/pkcs11.c -@@ -1796,7 +1796,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, - pobj->pubkey[1].size = a[1].value_len; - - pobj->pubkey_size = 2; -- pobj->pk_algorithm = GNUTLS_PK_RSA; - } else { - gnutls_assert(); - ret = GNUTLS_E_PKCS11_ERROR; -@@ -1852,7 +1851,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, - pobj->pubkey[3].size = a[1].value_len; - - pobj->pubkey_size = 4; -- pobj->pk_algorithm = GNUTLS_PK_DSA; - } else { - gnutls_assert(); - ret = pkcs11_rv_to_err(rv); -@@ -1877,7 +1875,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, - pobj->pubkey[1].size = a[1].value_len; - - pobj->pubkey_size = 2; -- pobj->pk_algorithm = GNUTLS_PK_EC; - } else { - gnutls_assert(); - -@@ -1898,9 +1895,6 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, - - if ((rv = pkcs11_get_attribute_value(module, pks, ctx, a, 2)) == - CKR_OK) { -- gnutls_ecc_curve_t curve; -- const gnutls_ecc_curve_entry_st *ce; -- - pobj->pubkey[0].data = a[0].value; - pobj->pubkey[0].size = a[0].value_len; - -@@ -1908,26 +1902,13 @@ int pkcs11_read_pubkey(struct ck_function_list *module, ck_session_handle_t pks, - pobj->pubkey[1].size = a[1].value_len; - - pobj->pubkey_size = 2; -- -- ret = _gnutls_x509_read_ecc_params(pobj->pubkey[0].data, -- pobj->pubkey[0].size, -- &curve); -- if (ret < 0) { -- ret = GNUTLS_E_INVALID_REQUEST; -- goto cleanup; -- } -- ce = _gnutls_ecc_curve_get_params(curve); -- if (unlikely(ce == NULL)) { -- ret = GNUTLS_E_INVALID_REQUEST; -- goto cleanup; -- } -- pobj->pk_algorithm = ce->pk; - } else { - gnutls_assert(); - - ret = pkcs11_rv_to_err(rv); - goto cleanup; - } -+ - break; - #endif - default: -@@ -1964,6 +1945,8 @@ pkcs11_obj_import_pubkey(struct ck_function_list *module, - a[0].value_len = sizeof(key_type); - - if (pkcs11_get_attribute_value(module, pks, ctx, a, 1) == CKR_OK) { -+ pobj->pk_algorithm = key_type_to_pk(key_type); -+ - ret = pkcs11_read_pubkey(module, pks, ctx, key_type, pobj); - if (ret < 0) - return gnutls_assert_val(ret); -diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h -index 891e98f962..9a3380f9cc 100644 ---- a/lib/pkcs11_int.h -+++ b/lib/pkcs11_int.h -@@ -247,7 +247,7 @@ static inline int pk_to_mech(gnutls_pk_algorithm_t pk) - else if (pk == GNUTLS_PK_RSA_PSS) - return CKM_RSA_PKCS_PSS; - #ifdef HAVE_PKCS11_EDDSA -- else if (pk == GNUTLS_PK_EDDSA_ED25519 || pk == GNUTLS_PK_EDDSA_ED448) -+ else if (pk == GNUTLS_PK_EDDSA_ED25519) - return CKM_EDDSA; - #endif - else -@@ -263,13 +263,29 @@ static inline int pk_to_key_type(gnutls_pk_algorithm_t pk) - else if (pk == GNUTLS_PK_RSA_PSS || pk == GNUTLS_PK_RSA) - return CKK_RSA; - #ifdef HAVE_PKCS11_EDDSA -- else if (pk == GNUTLS_PK_EDDSA_ED25519 || pk == GNUTLS_PK_EDDSA_ED448) -+ else if (pk == GNUTLS_PK_EDDSA_ED25519) - return CKK_EC_EDWARDS; - #endif - else - return -1; - } - -+static inline gnutls_pk_algorithm_t key_type_to_pk(ck_key_type_t m) -+{ -+ if (m == CKK_RSA) -+ return GNUTLS_PK_RSA; -+ else if (m == CKK_DSA) -+ return GNUTLS_PK_DSA; -+ else if (m == CKK_ECDSA) -+ return GNUTLS_PK_EC; -+#ifdef HAVE_PKCS11_EDDSA -+ else if (m == CKK_EC_EDWARDS) -+ return GNUTLS_PK_EDDSA_ED25519; -+#endif -+ else -+ return GNUTLS_PK_UNKNOWN; -+} -+ - static inline int pk_to_genmech(gnutls_pk_algorithm_t pk, ck_key_type_t *type) - { - if (pk == GNUTLS_PK_DSA) { -@@ -282,8 +298,7 @@ static inline int pk_to_genmech(gnutls_pk_algorithm_t pk, ck_key_type_t *type) - *type = CKK_RSA; - return CKM_RSA_PKCS_KEY_PAIR_GEN; - #ifdef HAVE_PKCS11_EDDSA -- } else if (pk == GNUTLS_PK_EDDSA_ED25519 || -- pk == GNUTLS_PK_EDDSA_ED448) { -+ } else if (pk == GNUTLS_PK_EDDSA_ED25519) { - *type = CKK_EC_EDWARDS; - return CKM_EC_EDWARDS_KEY_PAIR_GEN; - #endif -diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c -index b9f36c0a62..a30e44084c 100644 ---- a/lib/pkcs11_privkey.c -+++ b/lib/pkcs11_privkey.c -@@ -486,61 +486,6 @@ cleanup: - return ret; - } - --static inline gnutls_pk_algorithm_t --key_type_to_pk(struct ck_function_list *module, ck_session_handle_t pks, -- ck_object_handle_t ctx, ck_key_type_t m) --{ -- switch (m) { -- case CKK_RSA: -- return GNUTLS_PK_RSA; -- case CKK_DSA: -- return GNUTLS_PK_DSA; -- case CKK_ECDSA: -- return GNUTLS_PK_EC; --#ifdef HAVE_PKCS11_EDDSA -- case CKK_EC_EDWARDS: { -- struct ck_attribute a[1]; -- uint8_t *tmp1; -- size_t tmp1_size; -- gnutls_pk_algorithm_t pk = GNUTLS_PK_UNKNOWN; -- -- tmp1_size = MAX_PK_PARAM_SIZE; -- tmp1 = gnutls_calloc(1, tmp1_size); -- if (tmp1 == NULL) -- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -- -- a[0].type = CKA_EC_PARAMS; -- a[0].value = tmp1; -- a[0].value_len = tmp1_size; -- -- if (pkcs11_get_attribute_value(module, pks, ctx, a, 1) == -- CKR_OK) { -- gnutls_ecc_curve_t curve; -- const gnutls_ecc_curve_entry_st *ce; -- int ret; -- -- ret = _gnutls_x509_read_ecc_params( -- a[0].value, a[0].value_len, &curve); -- if (ret < 0) { -- goto edwards_cleanup; -- } -- ce = _gnutls_ecc_curve_get_params(curve); -- if (unlikely(ce == NULL)) { -- goto edwards_cleanup; -- } -- pk = ce->pk; -- } -- -- edwards_cleanup: -- gnutls_free(tmp1); -- return pk; -- } --#endif -- default: -- return GNUTLS_PK_UNKNOWN; -- } --} -- - /** - * gnutls_pkcs11_privkey_import_url: - * @pkey: The private key -@@ -616,9 +561,7 @@ int gnutls_pkcs11_privkey_import_url(gnutls_pkcs11_privkey_t pkey, - a[0].value_len = sizeof(key_type); - if (pkcs11_get_attribute_value(pkey->sinfo.module, pkey->sinfo.pks, - pkey->ref, a, 1) == CKR_OK) { -- pkey->pk_algorithm = key_type_to_pk(pkey->sinfo.module, -- pkey->sinfo.pks, pkey->ref, -- key_type); -+ pkey->pk_algorithm = key_type_to_pk(key_type); - } - - if (pkey->pk_algorithm == GNUTLS_PK_UNKNOWN) { -@@ -1245,7 +1188,6 @@ int gnutls_pkcs11_privkey_generate3(const char *url, gnutls_pk_algorithm_t pk, - - break; - case GNUTLS_PK_EDDSA_ED25519: -- case GNUTLS_PK_EDDSA_ED448: - p[p_val].type = CKA_SIGN; - p[p_val].value = (void *)&tval; - p[p_val].value_len = sizeof(tval); -@@ -1256,11 +1198,8 @@ int gnutls_pkcs11_privkey_generate3(const char *url, gnutls_pk_algorithm_t pk, - a[a_val].value_len = sizeof(tval); - a_val++; - -- ret = _gnutls_x509_write_ecc_params( -- pk == GNUTLS_PK_EDDSA_ED25519 ? -- GNUTLS_ECC_CURVE_ED25519 : -- GNUTLS_ECC_CURVE_ED448, -- &der); -+ ret = _gnutls_x509_write_ecc_params(GNUTLS_ECC_CURVE_ED25519, -+ &der); - if (ret < 0) { - gnutls_assert(); - goto cleanup; -diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c -index a3201ddeba..3090721db5 100644 ---- a/lib/pkcs11_write.c -+++ b/lib/pkcs11_write.c -@@ -355,8 +355,7 @@ static int add_pubkey(gnutls_pubkey_t pubkey, struct ck_attribute *a, - (*a_val)++; - break; - } -- case GNUTLS_PK_EDDSA_ED25519: -- case GNUTLS_PK_EDDSA_ED448: { -+ case GNUTLS_PK_EDDSA_ED25519: { - gnutls_datum_t params, ecpoint; - - ret = _gnutls_x509_write_ecc_params(pubkey->params.curve, -@@ -936,8 +935,7 @@ int gnutls_pkcs11_copy_x509_privkey2(const char *token_url, - break; - } - #ifdef HAVE_PKCS11_EDDSA -- case GNUTLS_PK_EDDSA_ED25519: -- case GNUTLS_PK_EDDSA_ED448: { -+ case GNUTLS_PK_EDDSA_ED25519: { - ret = _gnutls_x509_write_ecc_params(key->params.curve, &p); - if (ret < 0) { - gnutls_assert(); -@@ -1003,8 +1001,7 @@ cleanup: - break; - } - case GNUTLS_PK_EC: -- case GNUTLS_PK_EDDSA_ED25519: -- case GNUTLS_PK_EDDSA_ED448: { -+ case GNUTLS_PK_EDDSA_ED25519: { - gnutls_free(p.data); - gnutls_free(x.data); - break; -diff --git a/lib/pubkey.c b/lib/pubkey.c -index 1139ad99fc..59ca194f1a 100644 ---- a/lib/pubkey.c -+++ b/lib/pubkey.c -@@ -700,7 +700,6 @@ int gnutls_pubkey_import_pkcs11(gnutls_pubkey_t key, gnutls_pkcs11_obj_t obj, - &obj->pubkey[1]); - break; - case GNUTLS_PK_EDDSA_ED25519: -- case GNUTLS_PK_EDDSA_ED448: - ret = gnutls_pubkey_import_ecc_eddsa(key, &obj->pubkey[0], - &obj->pubkey[1]); - break; -diff --git a/tests/cert-common.h b/tests/cert-common.h -index 57cf6c0c4f..33b3ee3b68 100644 ---- a/tests/cert-common.h -+++ b/tests/cert-common.h -@@ -36,8 +36,7 @@ - * IPv4 server (SAN: IPAddr: 127.0.0.1): server_ca3_ipaddr_cert, server_ca3_key - * IPv4 server (RSA-PSS, SAN: localhost IPAddr: 127.0.0.1): server_ca3_rsa_pss_cert, server_ca3_rsa_pss_key - * IPv4 server (RSA-PSS key, SAN: localhost IPAddr: 127.0.0.1): server_ca3_rsa_pss2_cert, server_ca3_rsa_pss2_key -- * IPv4 server (Ed25519, SAN: localhost IPAddr: 127.0.0.1): server_ca3_eddsa_cert, server_ca3_eddsa_key -- * IPv4 server (Ed448, SAN: localhost IPAddr: 127.0.0.1): server_ca3_ed448_cert, server_ca3_ed448_key -+ * IPv4 server (EdDSA, SAN: localhost IPAddr: 127.0.0.1): server_ca3_eddsa_cert, server_ca3_eddsa_key - * IPv4 server (GOST R 34.10-2001, SAN: localhost): server_ca3_gost01_cert, server_ca3_gost01_key - * IPv4 server (GOST R 34.10-2012-256, SAN: localhost): server_ca3_gost12-256_cert, server_ca3_gost12-256_key - * IPv4 server (GOST R 34.10-2012-512, SAN: localhost): server_ca3_gost12-512_cert, server_ca3_gost12-512_key -@@ -350,7 +349,7 @@ static unsigned char ca2_cert_pem[] = - - const gnutls_datum_t ca2_cert = { ca2_cert_pem, sizeof(ca2_cert_pem) - 1 }; - --static unsigned char cli_cert_pem[] = -+static unsigned char cert_pem[] = - "-----BEGIN CERTIFICATE-----\n" - "MIICHjCCAYmgAwIBAgIERiYdNzALBgkqhkiG9w0BAQUwGTEXMBUGA1UEAxMOR251\n" - "VExTIHRlc3QgQ0EwHhcNMDcwNDE4MTMyOTI3WhcNMDgwNDE3MTMyOTI3WjAdMRsw\n" -@@ -365,9 +364,9 @@ static unsigned char cli_cert_pem[] = - "U7jyOsBJ44SEQITbin2yUeJMIm1tievvdNXBDfW95AM507ShzP12sfiJkJfjjdhy\n" - "dc8Siq5JojruiMizAf0pA7in\n" - "-----END CERTIFICATE-----\n"; --const gnutls_datum_t cli_cert = { cli_cert_pem, sizeof(cli_cert_pem) - 1 }; -+const gnutls_datum_t cli_cert = { cert_pem, sizeof(cert_pem) - 1 }; - --static unsigned char cli_key_pem[] = -+static unsigned char key_pem[] = - "-----BEGIN RSA PRIVATE KEY-----\n" - "MIICXAIBAAKBgQC7ZkP18sXXtozMxd/1iDuxyUtqDqGtIFBACIChT1yj0Phsz+Y8\n" - "9+wEdhMXi2SJIlvA3VN8O+18BLuAuSi+jpvGjqClEsv1Vx6i57u3M0mf47tKrmpN\n" -@@ -383,7 +382,7 @@ static unsigned char cli_key_pem[] = - "/iVX2cmMTSh3w3z8MaECQEp0XJWDVKOwcTW6Ajp9SowtmiZ3YDYo1LF9igb4iaLv\n" - "sWZGfbnU3ryjvkb6YuFjgtzbZDZHWQCo8/cOtOBmPdk=\n" - "-----END RSA PRIVATE KEY-----\n"; --const gnutls_datum_t cli_key = { cli_key_pem, sizeof(cli_key_pem) - 1 }; -+const gnutls_datum_t cli_key = { key_pem, sizeof(key_pem) - 1 }; - - static char dsa_key_pem[] = - "-----BEGIN DSA PRIVATE KEY-----\n" -@@ -1082,42 +1081,6 @@ const gnutls_datum_t server_ca3_eddsa_cert = { - sizeof(server_ca3_eddsa_cert_pem) - 1 - }; - --/* server Ed448 key */ --static char server_ca3_ed448_key_pem[] = -- "-----BEGIN PRIVATE KEY-----\n" -- "MEcCAQAwBQYDK2VxBDsEOXPoCtsxxy7itrHfeuQ2bG7oh3uerkBwhabkeSsNFYoS\n" -- "QYy6KKYld8lnhlYQQmMo6lx28x9GmpTiag==\n" -- "-----END PRIVATE KEY-----\n"; -- --const gnutls_datum_t server_ca3_ed448_key = { -- (unsigned char *)server_ca3_ed448_key_pem, -- sizeof(server_ca3_ed448_key_pem) - 1 --}; -- --static char server_ca3_ed448_cert_pem[] = -- "-----BEGIN CERTIFICATE-----\n" -- "MIICqzCCAROgAwIBAgIUAvQ9bcei1eNZ9viV1kP7MKODp9YwDQYJKoZIhvcNAQEL\n" -- "BQAwDzENMAsGA1UEAxMEQ0EtMzAgFw0yMzA5MjgwNjU1NThaGA85OTk5MTIzMTIz\n" -- "NTk1OVowDTELMAkGA1UEBhMCR1IwQzAFBgMrZXEDOgAYxZxGeKtoWUL20zvrFClm\n" -- "irhECIIdccq6x0uZccYHfmRVkFoUI7iOFj6Mlsp5vg24XZ2tGF5MBACjYDBeMAwG\n" -- "A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBTYq6RhA2qMWmYM\n" -- "UAEx3AlNSnhWHDAfBgNVHSMEGDAWgBT5qIYZY7akFBNgdg8BmjU27/G0rzANBgkq\n" -- "hkiG9w0BAQsFAAOCAYEAhEd0coRahGvMx8gLS8biuaqh50+9RJIjMpf+/0IQJ4DV\n" -- "FHT5E70YyaQ0YOsvyxGa04d+KyhdVLppD1pDztLGXYZWxzmowopwpgnpPNT25M+0\n" -- "aQOvCZZvRlqmwgUiRXdhSxqPsUj/73uUBPIjFknrxajoox7sOLris9ujmidqgBGa\n" -- "H1FVbQQQgDOBCKcKXTAllVKzS/ZLwlRHibbm+4UDxGk1tJv1dbnQhJk0FYSQZn3h\n" -- "ZVmSSfP4ZB+U+lsCshypBJ9qVZEqMM2b4m1wv/VAOuw0lGA2SiPub5q91hFYRdeL\n" -- "9FB78/WlrSCTbGeMzzDPXBf/Y2KvFAv3o7K0tsMg1vBsDJBARHEzo4GMRsYDZzvI\n" -- "JXb5tSmJOi/PBfup8GPiG0WbZV9nuvW8V/zmfaP3s9YBfYOtL/+nZch9VdSee2xp\n" -- "T8arukB/s2jLaXQUduD3hoFvFNgCvWJwAWQWNNyHN3ivArqNQpfl2Gtftmb6xCdW\n" -- "Xwt1/q2XKqqLpnF1N2wU\n" -- "-----END CERTIFICATE-----\n"; -- --const gnutls_datum_t server_ca3_ed448_cert = { -- (unsigned char *)server_ca3_ed448_cert_pem, -- sizeof(server_ca3_ed448_cert_pem) - 1 --}; -- - static char server_ca3_gost01_key_pem[] = - "-----BEGIN PRIVATE KEY-----\n" - "MEUCAQAwHAYGKoUDAgITMBIGByqFAwICJAAGByqFAwICHgEEIgQgR1lBLIr4WBpn\n" -diff --git a/tests/pkcs11/pkcs11-eddsa-privkey-test.c b/tests/pkcs11/pkcs11-eddsa-privkey-test.c -index 1b7732e884..d3cd9a97c7 100644 ---- a/tests/pkcs11/pkcs11-eddsa-privkey-test.c -+++ b/tests/pkcs11/pkcs11-eddsa-privkey-test.c -@@ -64,8 +64,8 @@ static int pin_func(void *userdata, int attempt, const char *url, - return -1; - } - --#define myfail(fmt, ...) \ -- fail("%s (iter %zu): " fmt, gnutls_sign_get_name(sigalgo), i, \ -+#define myfail(fmt, ...) \ -+ fail("%s (iter %d): " fmt, gnutls_sign_get_name(sigalgo), i, \ - ##__VA_ARGS__) - - static unsigned verify_eddsa_presence(void) -@@ -85,10 +85,11 @@ static unsigned verify_eddsa_presence(void) - return 0; - } - --static void test(const char *name, const gnutls_datum_t *cert_pem, -- const gnutls_datum_t *key_pem, gnutls_sign_algorithm_t sigalgo) -+void doit(void) - { -+ char buf[128]; - int ret; -+ const char *lib, *bin; - gnutls_x509_crt_t crt; - gnutls_x509_privkey_t key; - gnutls_datum_t tmp, sig; -@@ -97,16 +98,51 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - gnutls_pubkey_t pubkey2; - gnutls_pubkey_t pubkey3; - gnutls_pubkey_t pubkey4; -- char buf[256]; -- size_t i; -+ unsigned i, sigalgo; -+ -+ bin = softhsm_bin(); -+ -+ lib = softhsm_lib(); -+ -+ ret = global_init(); -+ if (ret != 0) { -+ fail("%d: %s\n", ret, gnutls_strerror(ret)); -+ } -+ -+ if (gnutls_fips140_mode_enabled()) { -+ gnutls_global_deinit(); -+ return; -+ } -+ -+ gnutls_pkcs11_set_pin_function(pin_func, NULL); -+ gnutls_global_set_log_function(tls_log_func); -+ if (debug) -+ gnutls_global_set_log_level(4711); -+ -+ set_softhsm_conf(CONFIG); -+ snprintf(buf, sizeof(buf), -+ "%s --init-token --slot 0 --label test --so-pin " PIN -+ " --pin " PIN, -+ bin); -+ system(buf); -+ -+ ret = gnutls_pkcs11_add_provider(lib, NULL); -+ if (ret < 0) { -+ fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret)); -+ } - -- success("%s\n", name); -+ if (verify_eddsa_presence() == 0) { -+ fprintf(stderr, -+ "Skipping test as no EDDSA mech is supported\n"); -+ exit(77); -+ } - - ret = gnutls_x509_crt_init(&crt); - if (ret < 0) - fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret)); - -- ret = gnutls_x509_crt_import(crt, cert_pem, GNUTLS_X509_FMT_PEM); -+ ret = gnutls_x509_crt_import(crt, &server_ca3_eddsa_cert, -+ GNUTLS_X509_FMT_PEM); - if (ret < 0) - fail("gnutls_x509_crt_import: %s\n", gnutls_strerror(ret)); - -@@ -122,12 +158,25 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - fail("gnutls_x509_privkey_init: %s\n", gnutls_strerror(ret)); - } - -- ret = gnutls_x509_privkey_import(key, key_pem, GNUTLS_X509_FMT_PEM); -+ ret = gnutls_x509_privkey_import(key, &server_ca3_eddsa_key, -+ GNUTLS_X509_FMT_PEM); - if (ret < 0) { - fail("gnutls_x509_privkey_import: %s\n", gnutls_strerror(ret)); - } - -- ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, name, -+ /* initialize softhsm token */ -+ ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test"); -+ if (ret < 0) { -+ fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret)); -+ } -+ -+ ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, -+ GNUTLS_PIN_USER); -+ if (ret < 0) { -+ fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret)); -+ } -+ -+ ret = gnutls_pkcs11_copy_x509_crt(SOFTHSM_URL, crt, "cert", - GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE | - GNUTLS_PKCS11_OBJ_FLAG_LOGIN); - if (ret < 0) { -@@ -135,7 +184,7 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - } - - ret = gnutls_pkcs11_copy_x509_privkey( -- SOFTHSM_URL, key, name, -+ SOFTHSM_URL, key, "cert", - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, - GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE | - GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE | -@@ -150,7 +199,7 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - assert(gnutls_pubkey_import_x509(pubkey, crt, 0) == 0); - - ret = gnutls_pkcs11_copy_pubkey( -- SOFTHSM_URL, pubkey, name, NULL, -+ SOFTHSM_URL, pubkey, "cert", NULL, - GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, 0); - if (ret < 0) { - fail("gnutls_pkcs11_copy_pubkey: %s\n", gnutls_strerror(ret)); -@@ -161,13 +210,11 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - gnutls_pubkey_deinit(pubkey); - gnutls_pkcs11_set_pin_function(NULL, NULL); - -- assert(snprintf(buf, sizeof(buf), -- "%s;object=%s;object-type=private?pin-value=" PIN, -- SOFTHSM_URL, name) < (int)sizeof(buf)); -- - assert(gnutls_privkey_init(&pkey) == 0); - -- ret = gnutls_privkey_import_pkcs11_url(pkey, buf); -+ ret = gnutls_privkey_import_pkcs11_url( -+ pkey, -+ SOFTHSM_URL ";object=cert;object-type=private;pin-value=" PIN); - if (ret < 0) { - fail("error in gnutls_privkey_import_pkcs11_url: %s\n", - gnutls_strerror(ret)); -@@ -176,7 +223,10 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - /* Try to read the public key with public key URI */ - assert(gnutls_pubkey_init(&pubkey3) == 0); - -- ret = gnutls_pubkey_import_pkcs11_url(pubkey3, buf, 0); -+ ret = gnutls_pubkey_import_pkcs11_url( -+ pubkey3, -+ SOFTHSM_URL ";object=cert;object-type=public;pin-value=" PIN, -+ 0); - if (ret < 0) { - fail("error in gnutls_pubkey_import_pkcs11_url: %s\n", - gnutls_strerror(ret)); -@@ -185,7 +235,9 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - /* Try to read the public key with certificate URI */ - assert(gnutls_pubkey_init(&pubkey4) == 0); - -- ret = gnutls_pubkey_import_pkcs11_url(pubkey4, buf, 0); -+ ret = gnutls_pubkey_import_pkcs11_url( -+ pubkey4, -+ SOFTHSM_URL ";object=cert;object-type=cert;pin-value=" PIN, 0); - if (ret < 0) { - fail("error in gnutls_pubkey_import_pkcs11_url: %s\n", - gnutls_strerror(ret)); -@@ -195,9 +247,12 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - assert(gnutls_pubkey_import_privkey(pubkey, pkey, 0, 0) == 0); - - assert(gnutls_pubkey_init(&pubkey2) == 0); -- assert(gnutls_pubkey_import_x509_raw(pubkey2, cert_pem, -+ assert(gnutls_pubkey_import_x509_raw(pubkey2, &server_ca3_eddsa_cert, - GNUTLS_X509_FMT_PEM, 0) == 0); - -+ /* this is the algorithm supported by the certificate */ -+ sigalgo = GNUTLS_SIGN_EDDSA_ED25519; -+ - for (i = 0; i < 20; i++) { - /* check whether privkey and pubkey are operational - * by signing and verifying */ -@@ -229,71 +284,6 @@ static void test(const char *name, const gnutls_datum_t *cert_pem, - gnutls_pubkey_deinit(pubkey2); - gnutls_pubkey_deinit(pubkey); - gnutls_privkey_deinit(pkey); --} -- --void doit(void) --{ -- char buf[256]; -- int ret; -- const char *lib, *bin; -- -- bin = softhsm_bin(); -- -- lib = softhsm_lib(); -- -- ret = global_init(); -- if (ret != 0) { -- fail("%d: %s\n", ret, gnutls_strerror(ret)); -- } -- -- if (gnutls_fips140_mode_enabled()) { -- gnutls_global_deinit(); -- return; -- } -- -- gnutls_pkcs11_set_pin_function(pin_func, NULL); -- gnutls_global_set_log_function(tls_log_func); -- if (debug) -- gnutls_global_set_log_level(4711); -- -- set_softhsm_conf(CONFIG); -- assert(snprintf(buf, sizeof(buf), -- "%s --init-token --slot 0 --label test --so-pin " PIN -- " --pin " PIN, -- bin) < (int)sizeof(buf)); -- system(buf); -- -- ret = gnutls_pkcs11_add_provider(lib, NULL); -- if (ret < 0) { -- fail("gnutls_x509_crt_init: %s\n", gnutls_strerror(ret)); -- } -- -- if (verify_eddsa_presence() == 0) { -- fprintf(stderr, -- "Skipping test as no EDDSA mech is supported\n"); -- exit(77); -- } -- -- /* initialize softhsm token */ -- ret = gnutls_pkcs11_token_init(SOFTHSM_URL, PIN, "test"); -- if (ret < 0) { -- fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret)); -- } -- -- ret = gnutls_pkcs11_token_set_pin(SOFTHSM_URL, NULL, PIN, -- GNUTLS_PIN_USER); -- if (ret < 0) { -- fail("gnutls_pkcs11_token_set_pin: %s\n", gnutls_strerror(ret)); -- } -- -- test("ed25519", &server_ca3_eddsa_cert, &server_ca3_eddsa_key, -- GNUTLS_SIGN_EDDSA_ED25519); -- -- /* test clears PIN function to check "?pin-value" works */ -- gnutls_pkcs11_set_pin_function(pin_func, NULL); -- -- test("ed448", &server_ca3_ed448_cert, &server_ca3_ed448_key, -- GNUTLS_SIGN_EDDSA_ED448); - - gnutls_global_deinit(); - -diff --git a/tests/pkcs11/pkcs11-privkey-generate.c b/tests/pkcs11/pkcs11-privkey-generate.c -index 7de0c35426..bd54fad8d2 100644 ---- a/tests/pkcs11/pkcs11-privkey-generate.c -+++ b/tests/pkcs11/pkcs11-privkey-generate.c -@@ -98,7 +98,8 @@ static void generate_keypair(gnutls_pk_algorithm_t algo, size_t bits, - fail("%d: %s\n", ret, gnutls_strerror(ret)); - } - -- success("generated %s key (%s)\n", gnutls_pk_get_name(algo), -+ success("generated %s key (%s)\n", -+ gnutls_pk_get_name(algo), - sensitive ? "sensitive" : "non sensitive"); - - assert(gnutls_pkcs11_obj_init(&obj) >= 0); -@@ -130,9 +131,6 @@ void doit(void) - char buf[128]; - int ret; - const char *lib, *bin; --#ifdef CKM_EC_EDWARDS_KEY_PAIR_GEN -- CK_MECHANISM_INFO minfo; --#endif - - if (gnutls_fips140_mode_enabled()) - exit(77); -@@ -176,20 +174,13 @@ void doit(void) - generate_keypair(GNUTLS_PK_RSA, 2048, "rsa-non-sensitive", false); - - #ifdef CKM_EC_EDWARDS_KEY_PAIR_GEN -- ret = gnutls_pkcs11_token_check_mechanism("pkcs11:token=test", -- CKM_EC_EDWARDS_KEY_PAIR_GEN, -- &minfo, sizeof(minfo), 0); -+ ret = gnutls_pkcs11_token_check_mechanism( -+ "pkcs11:token=test", CKM_EC_EDWARDS_KEY_PAIR_GEN, NULL, 0, 0); - if (ret != 0) { - generate_keypair(GNUTLS_PK_EDDSA_ED25519, 256, - "ed25519-sensitive", true); - generate_keypair(GNUTLS_PK_EDDSA_ED25519, 256, - "ed25519-non-sensitive", false); -- if (minfo.ulMaxKeySize >= 456) { -- generate_keypair(GNUTLS_PK_EDDSA_ED448, 456, -- "ed448-sensitive", true); -- generate_keypair(GNUTLS_PK_EDDSA_ED448, 456, -- "ed448-non-sensitive", false); -- } - } - #endif - -diff --git a/tests/tls13/ocsp-client.c b/tests/tls13/ocsp-client.c -index c7e7e2e410..1064a17752 100644 ---- a/tests/tls13/ocsp-client.c -+++ b/tests/tls13/ocsp-client.c -@@ -169,8 +169,8 @@ void doit(void) - fp = fopen(certfile3, "wb"); - if (fp == NULL) - fail("error in fopen\n"); -- assert(fwrite(cli_cert_pem, 1, strlen((char *)cli_cert_pem), fp) > 0); -- assert(fwrite(cli_key_pem, 1, strlen((char *)cli_key_pem), fp) > 0); -+ assert(fwrite(cert_pem, 1, strlen((char *)cert_pem), fp) > 0); -+ assert(fwrite(key_pem, 1, strlen((char *)key_pem), fp) > 0); - fclose(fp); - - ret = gnutls_certificate_set_x509_key_file2( --- -2.43.0 - diff --git a/gnutls-3.8.3-kernel_version_check.patch b/gnutls-3.8.3-kernel_version_check.patch new file mode 100644 index 0000000..e4495ed --- /dev/null +++ b/gnutls-3.8.3-kernel_version_check.patch @@ -0,0 +1,36 @@ +From 945c2f10eeda441f32404d1328761e311915add0 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Tue, 23 Jan 2024 11:54:32 +0900 +Subject: [PATCH] ktls: fix kernel version checking using utsname + +Signed-off-by: Daiki Ueno +--- + lib/system/ktls.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/system/ktls.c b/lib/system/ktls.c +index 8efb913cda..432c70c5a2 100644 +--- a/lib/system/ktls.c ++++ b/lib/system/ktls.c +@@ -482,7 +482,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, + return GNUTLS_E_INTERNAL_ERROR; + } + +- if (strcmp(utsname.sysname, "Linux") == 0) { ++ if (strcmp(utsname.sysname, "Linux") != 0) { + return GNUTLS_E_INTERNAL_ERROR; + } + +@@ -495,6 +495,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, + return GNUTLS_E_INTERNAL_ERROR; + } + ++ _gnutls_debug_log("Linux kernel version %lu.%lu has been detected\n", ++ major, minor); ++ + /* setsockopt(SOL_TLS, TLS_RX) support added in 5.10 */ + if (major < 5 || (major == 5 && minor < 10)) { + return GNUTLS_E_UNIMPLEMENTED_FEATURE; +-- +GitLab + diff --git a/gnutls.spec b/gnutls.spec index abfff02..c20f62e 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,15 +12,13 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.2 +Version: 3.8.3 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch - -# tentatively reverted for https://gitlab.com/gnutls/gnutls/-/issues/1515 -Patch: gnutls-3.8.2-revert-pkcs11-ed448.patch +Patch: gnutls-3.8.3-kernel_version_check.patch %bcond_without bootstrap %bcond_without dane @@ -56,7 +54,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel %if %{with bootstrap} BuildRequires: automake, autoconf, gperf, libtool, texinfo %endif -BuildRequires: nettle-devel >= 3.5.1 +BuildRequires: nettle-devel >= 3.8 %if %{with tpm12} BuildRequires: trousers-devel >= 0.3.11.2 %endif @@ -74,7 +72,7 @@ BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 -Requires: nettle >= 3.4.1 +Requires: nettle >= 3.8 %if %{with tpm12} Recommends: trousers >= 0.3.11.2 %endif diff --git a/sources b/sources index ea8384c..b87713f 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.8.2.tar.xz) = b3aa6e0fa7272cfca0bb0d364fe5dc9ca70cfd41878631d57271ba0a597cf6020a55a19e97a2c02f13a253455b119d296cf6f701be2b4e6880ebeeb07c93ef38 -SHA512 (gnutls-3.8.2.tar.xz.sig) = 9feb30bfccb8c83e83d3d6df009f2a61f4c48eb357c988789c93b2e5a06a34cb490f33741ad0fd4f881fcd34747b3cf9c5aa45bbb15da680ebba35e07ba602f6 -SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d +SHA512 (gnutls-3.8.3.tar.xz) = 74eddba01ce4c2ffdca781c85db3bb52c85f1db3c09813ee2b8ceea0608f92ca3912fd9266f55deb36a8ba4d01802895ca5d5d219e7d9caec45e1a8534e45a84 +SHA512 (gnutls-3.8.3.tar.xz.sig) = 5b2ca0648ca5feeda1de933de2bbaf71fadb70e830a8f0d494d2f0380b6d0d7b79445257cc79e59bba1a7ff639ab4573da3e3e124eb80c20ac6141e29a4827ff +SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a From e3bf03edc2ad8cf855df0b764ee79d83022b7e81 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Wed, 20 Mar 2024 11:41:27 +0100 Subject: [PATCH 8/9] [packit] 3.8.4 upstream release - Resolves rhbz#2270320 Upstream tag: 3.8.4 Upstream commit: 4a4cefef --- .gitignore | 2 ++ README.packit | 2 +- ...ls-3.7.8-ktls_disable_keyupdate_test.patch | 13 ------- gnutls-3.8.3-kernel_version_check.patch | 36 ------------------- gnutls.spec | 3 +- sources | 4 +-- 6 files changed, 6 insertions(+), 54 deletions(-) delete mode 100644 gnutls-3.7.8-ktls_disable_keyupdate_test.patch delete mode 100644 gnutls-3.8.3-kernel_version_check.patch diff --git a/.gitignore b/.gitignore index 35f93b3..8ce4710 100644 --- a/.gitignore +++ b/.gitignore @@ -150,3 +150,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.2.tar.xz.sig /gnutls-3.8.3.tar.xz /gnutls-3.8.3.tar.xz.sig +/gnutls-3.8.4.tar.xz +/gnutls-3.8.4.tar.xz.sig diff --git a/README.packit b/README.packit index 8c508a5..31341b6 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.88.0. +The file was generated using packit 0.93.0. diff --git a/gnutls-3.7.8-ktls_disable_keyupdate_test.patch b/gnutls-3.7.8-ktls_disable_keyupdate_test.patch deleted file mode 100644 index cab7547..0000000 --- a/gnutls-3.7.8-ktls_disable_keyupdate_test.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/tests/Makefile.am b/tests/Makefile.am -index 2872cb1aa..247dfd3d8 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -504,8 +504,6 @@ endif - if ENABLE_KTLS - indirect_tests += gnutls_ktls - dist_check_SCRIPTS += ktls.sh --indirect_tests += ktls_keyupdate --dist_check_SCRIPTS += ktls_keyupdate.sh - endif - - if !WINDOWS diff --git a/gnutls-3.8.3-kernel_version_check.patch b/gnutls-3.8.3-kernel_version_check.patch deleted file mode 100644 index e4495ed..0000000 --- a/gnutls-3.8.3-kernel_version_check.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 945c2f10eeda441f32404d1328761e311915add0 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 23 Jan 2024 11:54:32 +0900 -Subject: [PATCH] ktls: fix kernel version checking using utsname - -Signed-off-by: Daiki Ueno ---- - lib/system/ktls.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 8efb913cda..432c70c5a2 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -482,7 +482,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, - return GNUTLS_E_INTERNAL_ERROR; - } - -- if (strcmp(utsname.sysname, "Linux") == 0) { -+ if (strcmp(utsname.sysname, "Linux") != 0) { - return GNUTLS_E_INTERNAL_ERROR; - } - -@@ -495,6 +495,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, - return GNUTLS_E_INTERNAL_ERROR; - } - -+ _gnutls_debug_log("Linux kernel version %lu.%lu has been detected\n", -+ major, minor); -+ - /* setsockopt(SOL_TLS, TLS_RX) support added in 5.10 */ - if (major < 5 || (major == 5 && minor < 10)) { - return GNUTLS_E_UNIMPLEMENTED_FEATURE; --- -GitLab - diff --git a/gnutls.spec b/gnutls.spec index c20f62e..7bc8218 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,13 +12,12 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.3 +Version: 3.8.4 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch -Patch: gnutls-3.8.3-kernel_version_check.patch %bcond_without bootstrap %bcond_without dane diff --git a/sources b/sources index b87713f..d3294e0 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.8.3.tar.xz) = 74eddba01ce4c2ffdca781c85db3bb52c85f1db3c09813ee2b8ceea0608f92ca3912fd9266f55deb36a8ba4d01802895ca5d5d219e7d9caec45e1a8534e45a84 -SHA512 (gnutls-3.8.3.tar.xz.sig) = 5b2ca0648ca5feeda1de933de2bbaf71fadb70e830a8f0d494d2f0380b6d0d7b79445257cc79e59bba1a7ff639ab4573da3e3e124eb80c20ac6141e29a4827ff +SHA512 (gnutls-3.8.4.tar.xz) = af748610392b7eec8a6294d28d088f323450207cdcda1aa2138a0fd71023994c662f7aff72b2b3cd888e7b770750611981c2cde5f2ddc45f852fc0034cdebaff +SHA512 (gnutls-3.8.4.tar.xz.sig) = 3e8ec406a0c736d8b208dd7396294a4bc6e6f0ffaf41d4ae16bc671da575fe6029de548a25fb0e824b2d6fb75b3e47e845b88d9dfa2f88397a48b8e270766d37 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a From 19706ac9e27b4870750f6b0900c459ce1b7d2455 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 4 Apr 2024 14:16:52 +0200 Subject: [PATCH 9/9] [packit] 3.8.5 upstream release Upstream tag: 3.8.5 Upstream commit: 49f4ae21 --- .gitignore | 2 ++ README.packit | 2 +- gnutls.spec | 2 +- sources | 4 ++-- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8ce4710..c639f55 100644 --- a/.gitignore +++ b/.gitignore @@ -152,3 +152,5 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.3.tar.xz.sig /gnutls-3.8.4.tar.xz /gnutls-3.8.4.tar.xz.sig +/gnutls-3.8.5.tar.xz +/gnutls-3.8.5.tar.xz.sig diff --git a/README.packit b/README.packit index 31341b6..8480b61 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.93.0. +The file was generated using packit 0.94.0. diff --git a/gnutls.spec b/gnutls.spec index 7bc8218..6e8b88a 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,7 +12,7 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.4 +Version: 3.8.5 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch diff --git a/sources b/sources index d3294e0..3f14f2f 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (gnutls-3.8.4.tar.xz) = af748610392b7eec8a6294d28d088f323450207cdcda1aa2138a0fd71023994c662f7aff72b2b3cd888e7b770750611981c2cde5f2ddc45f852fc0034cdebaff -SHA512 (gnutls-3.8.4.tar.xz.sig) = 3e8ec406a0c736d8b208dd7396294a4bc6e6f0ffaf41d4ae16bc671da575fe6029de548a25fb0e824b2d6fb75b3e47e845b88d9dfa2f88397a48b8e270766d37 +SHA512 (gnutls-3.8.5.tar.xz) = 4bac1aa7ec1dce9b3445cc515cc287a5af032d34c207399aa9722e3dc53ed652f8a57cfbc9c5e40ccc4a2631245d89ab676e3ba2be9563f60ba855aaacb8e23c +SHA512 (gnutls-3.8.5.tar.xz.sig) = b0f7a8ec348765112cac75fd732e066adaa1595bb83024cfeff6633aba35277d8aceda145c733c3d95f1e0eb4d34fead2479abdb08d6041362094a235460fa67 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a