diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index 1e793de..ea6a2e0 100644 --- a/.gitignore +++ b/.gitignore @@ -126,50 +126,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.6.13.tar.xz /gnutls-3.6.14.tar.xz /gnutls-3.6.14.tar.xz.sig +/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg /gnutls-3.6.15.tar.xz /gnutls-3.6.15.tar.xz.sig -/gnutls-3.7.0.tar.xz -/gnutls-3.7.0.tar.xz.sig -/gnutls-3.7.1.tar.xz -/gnutls-3.7.1.tar.xz.sig -/gnutls-3.7.2.tar.xz -/gnutls-3.7.2.tar.xz.sig -/gnutls-3.7.3.tar.xz -/gnutls-3.7.3.tar.xz.sig -/gnutls-3.7.4.tar.xz -/gnutls-3.7.5.tar.xz -/gnutls-3.7.6.tar.xz -/gnutls-3.7.7.tar.xz -/gnutls-3.7.8.tar.xz -/gnutls-3.8.0.tar.xz -/gnutls-3.8.0.tar.xz.sig -/gnutls-release-keyring.gpg -/gnutls-3.8.1.tar.xz -/gnutls-3.8.1.tar.xz.sig -/gnutls-3.8.2.tar.xz -/gnutls-3.8.2.tar.xz.sig -/gnutls-3.8.3.tar.xz -/gnutls-3.8.3.tar.xz.sig -/gnutls-3.8.4.tar.xz -/gnutls-3.8.4.tar.xz.sig -/gnutls-3.8.5.tar.xz -/gnutls-3.8.5.tar.xz.sig -/gnutls-3.8.6.tar.xz -/gnutls-3.8.6.tar.xz.sig -/gmp-6.2.1.tar.xz -/gnutls-3.8.7.tar.xz -/gnutls-3.8.7.tar.xz.sig -/gnutls-3.8.7.1.tar.xz -/gnutls-3.8.7.1.tar.xz.sig -/gnutls-3.8.8.tar.xz -/gnutls-3.8.8.tar.xz.sig -/gnutls-3.8.9.tar.xz -/gnutls-3.8.9.tar.xz.sig -/leancrypto-1.2.0.tar.gz -/leancrypto-1.3.0.tar.gz -/gnutls-3.8.10.tar.xz -/gnutls-3.8.10.tar.xz.sig -/leancrypto-1.5.0.tar.gz -/gnutls-3.8.11.tar.xz -/gnutls-3.8.11.tar.xz.sig -/leancrypto-1.6.0.tar.gz diff --git a/.packit.yaml b/.packit.yaml deleted file mode 100644 index 31a01eb..0000000 --- a/.packit.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# See the documentation for more information: -# https://packit.dev/docs/configuration/ - -specfile_path: gnutls.spec - -files_to_sync: - - .packit.yaml - - gnutls.spec - -upstream_project_url: https://gitlab.com/gnutls/gnutls -upstream_package_name: gnutls -downstream_package_name: gnutls - -actions: - post-upstream-clone: - - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls.spec" - - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.2.7-rpath.patch" - get-current-version: - - "git describe --abbrev=0" - create-archive: - - | - bash -c "wget https://www.gnupg.org/ftp/gcrypt/gnutls/v$(expr $PACKIT_PROJECT_VERSION : '^\([0-9]*\.[0-9]*\)')/gnutls-${PACKIT_PROJECT_VERSION}.tar.xz" - - | - bash -c "wget https://www.gnupg.org/ftp/gcrypt/gnutls/v$(expr $PACKIT_PROJECT_VERSION : '^\([0-9]*\.[0-9]*\)')/gnutls-${PACKIT_PROJECT_VERSION}.tar.xz.sig" - - bash -c "echo gnutls-${PACKIT_PROJECT_VERSION}.tar.xz" - - bash -c "echo gnutls-${PACKIT_PROJECT_VERSION}.tar.xz.sig" - -jobs: - - job: propose_downstream - trigger: release - dist_git_branches: fedora-all diff --git a/README.packit b/README.packit deleted file mode 100644 index 2511bf4..0000000 --- a/README.packit +++ /dev/null @@ -1,3 +0,0 @@ -This repository is maintained by packit. -https://packit.dev/ -The file was generated using packit 1.12.0. diff --git a/changelog b/changelog deleted file mode 100644 index f1700a7..0000000 --- a/changelog +++ /dev/null @@ -1,815 +0,0 @@ -* Thu Jan 20 2022 Fedora Release Engineering - 3.7.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Jan 18 2022 Daiki Ueno - 3.7.3-1 -- Update to upstream 3.7.3 release -- Remove dependency on autogen -- Add build-time conditionals for TPM 1.2 and GOST cryptography - -* Thu Jul 22 2021 Fedora Release Engineering - 3.7.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Sat May 29 2021 Daiki Ueno - 3.7.2-1 -- Update to upstream 3.7.2 release - -* Sun Mar 28 2021 Daiki Ueno - 3.7.1-3 -- Remove %%defattr invocations which are no longer necessary -- libpkcs11mock1.* is not installed anymore -- hobble-gnutls: Remove SRP removal -- Use correct source URL -- Switch to using %%gpgverify macro - -* Tue Mar 16 2021 Daiki Ueno - 3.7.1-2 -- Restore fipscheck dependency - -* Sat Mar 13 2021 Daiki Ueno - 3.7.1-1 -- Update to upstream 3.7.1 release -- Remove fipscheck dependency, as it is now calculated with an - internal tool - -* Fri Mar 5 2021 Daiki Ueno - 3.7.0-4 -- Tolerate duplicate certs in the chain also with PKCS #11 trust store - -* Tue Mar 2 2021 Daiki Ueno - 3.7.0-3 -- Reduce BRs for non-bootstrapping build - -* Wed Feb 10 2021 Daiki Ueno - 3.7.0-2 -- Tolerate duplicate certs in the chain - -* Mon Feb 8 2021 Daiki Ueno - 3.7.0-1 -- Update to upstream 3.7.0 release -- Temporarily disable LTO - -* Tue Jan 26 2021 Daiki Ueno - 3.6.15-4 -- Fix broken tests on rawhide (#1908110) -- Add BuildRequires: make (by Tom Stellard) - -* Tue Jan 26 2021 Fedora Release Engineering - 3.6.15-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Mon Sep 28 2020 Jeff Law - 3.6.15-2 -- Re-enable LTO now that upstream GCC bugs have been fixed - -* Fri Sep 4 2020 Daiki Ueno - 3.6.15-1 -- Update to upstream 3.6.15 release - -* Mon Aug 17 2020 Jeff Law - 3.6.14-7 -- Disable LTO on ppc64le - -* Tue Aug 4 2020 Daiki Ueno - 3.6.14-6 -- Fix underlinking of libpthread - -* Sat Aug 01 2020 Fedora Release Engineering - 3.6.14-5 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Jul 27 2020 Fedora Release Engineering - 3.6.14-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Thu Jul 02 2020 Anderson Sasaki - 3.6.14-3 -- Rebuild with autogen built with guile-2.2 (#1852706) - -* Tue Jun 09 2020 Anderson Sasaki - 3.6.14-2 -- Fix memory leak when serializing iovec_t (#1845083) -- Fix automatic libraries sonames detection (#1845806) - -* Thu Jun 4 2020 Daiki Ueno - 3.6.14-1 -- Update to upstream 3.6.14 release - -* Sun May 31 2020 Daiki Ueno - 3.6.13-6 -- Update gnutls-3.6.13-superseding-chain.patch - -* Sun May 31 2020 Daiki Ueno - 3.6.13-5 -- Fix cert chain validation behavior if the last cert has expired (#1842178) - -* Mon May 25 2020 Anderson Sasaki - 3.6.13-4 -- Add option to gnutls-cli to wait for resumption under TLS 1.3 - -* Tue May 19 2020 Anderson Sasaki - 3.6.13-3 -- Disable RSA blinding during FIPS self-tests - -* Thu May 14 2020 Anderson Sasaki - 3.6.13-2 -- Bump linked libraries soname to fix FIPS selftests (#1835265) - -* Tue Mar 31 2020 Daiki Ueno - 3.6.13-1 -- Update to upstream 3.6.13 release - -* Thu Mar 26 2020 Anderson Sasaki - 3.6.12-2 -- Fix FIPS POST (#1813384) -- Fix gnutls-serv --echo to not exit when a message is received (#1816583) - -* Sun Feb 02 2020 Nikos Mavrogiannopoulos - 3.6.12-1 -- Update to upstream 3.6.12 release - -* Tue Jan 28 2020 Fedora Release Engineering - 3.6.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Dec 02 2019 Nikos Mavrogiannopoulos - 3.6.11-1 -- Update to upstream 3.6.11 release - -* Sun Sep 29 2019 Nikos Mavrogiannopoulos - 3.6.10-1 -- Update to upstream 3.6.10 release - -* Fri Jul 26 2019 Nikos Mavrogiannopoulos - 3.6.9-1 -- Update to upstream 3.6.9 release - -* Thu Jul 25 2019 Fedora Release Engineering - 3.6.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon Jul 15 2019 Nikos Mavrogiannopoulos - 3.6.8-2 -- Rebuilt with guile-2.2 - -* Tue May 28 2019 Nikos Mavrogiannopoulos - 3.6.8-1 -- Update to upstream 3.6.8 release - -* Wed Mar 27 2019 Anderson Toshiyuki Sasaki - 3.6.7-1 -- Update to upstream 3.6.7 release -- Fixed CVE-2019-3836 (#1693214) -- Fixed CVE-2019-3829 (#1693210) - -* Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 -- Update to upstream 3.6.6 release - -* Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 -- Added explicit Requires for nettle >= 3.4.1 - -* Tue Dec 11 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 -- Update to upstream 3.6.5 release - -* Mon Oct 29 2018 James Antill - 3.6.4-5 -- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc. - -* Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-4 -- Fix issue with rehandshake affecting glib-networking (#1634736) - -* Tue Oct 16 2018 Tomáš Mráz - 3.6.4-3 -- Add missing annobin notes for assembler sources - -* Tue Oct 09 2018 Petr Menšík - 3.6.4-2 -- Rebuilt for unbound 1.8 - -* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 -- Updated to upstream 3.6.4 release -- Added support for the latest version of the TLS1.3 protocol -- Enabled SHA1 support as SHA1 deprecation is handled via the - fedora crypto policies. - -* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 -- Fixed gnutls-cli input reading -- Ensure that we do not cause issues with version rollback detection - and TLS1.3. - -* Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 -- Fixed ECDSA public key import (#1612803) - -* Thu Jul 26 2018 Nikos Mavrogiannopoulos - 3.6.3-2 -- Backported regression fixes from 3.6.2 - -* Mon Jul 16 2018 Nikos Mavrogiannopoulos - 3.6.3-1 -- Update to upstream 3.6.3 release - -* Fri Jul 13 2018 Fedora Release Engineering - 3.6.2-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Wed Jun 13 2018 Nikos Mavrogiannopoulos - 3.6.2-4 -- Enable FIPS140-2 mode in Fedora - -* Wed Jun 06 2018 Nikos Mavrogiannopoulos - 3.6.2-3 -- Update to upstream 3.6.2 release - -* Fri May 25 2018 David Abdurachmanov - 3.6.2-2 -- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep - -* Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.6.2-1 -- Update to upstream 3.6.2 release - -* Wed Feb 07 2018 Fedora Release Engineering - 3.6.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Fri Feb 2 2018 Nikos Mavrogiannopoulos - 3.6.1-4 -- Rebuilt to address incompatibility with new nettle - -* Thu Nov 30 2017 Nikos Mavrogiannopoulos - 3.6.1-3 -- Corrected regression from 3.6.1-2 which prevented the loading of - arbitrary p11-kit modules (#1507402) - -* Mon Nov 6 2017 Nikos Mavrogiannopoulos - 3.6.1-2 -- Prevent the loading of all PKCS#11 modules on certificate verification - but only restrict to p11-kit trust module (#1507402) - -* Sat Oct 21 2017 Nikos Mavrogiannopoulos - 3.6.1-1 -- Update to upstream 3.6.1 release - -* Mon Aug 21 2017 Nikos Mavrogiannopoulos - 3.6.0-1 -- Update to upstream 3.6.0 release - -* Wed Aug 02 2017 Fedora Release Engineering - 3.5.14-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Wed Jul 26 2017 Fedora Release Engineering - 3.5.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Tue Jul 04 2017 Nikos Mavrogiannopoulos - 3.5.14-1 -- Update to upstream 3.5.14 release - -* Wed Jun 07 2017 Nikos Mavrogiannopoulos - 3.5.13-1 -- Update to upstream 3.5.13 release - -* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-2 -- Fix issue with p11-kit-trust arch dependency - -* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-1 -- Update to upstream 3.5.12 release - -* Fri Apr 07 2017 Nikos Mavrogiannopoulos - 3.5.11-1 -- Update to upstream 3.5.11 release - -* Mon Mar 06 2017 Nikos Mavrogiannopoulos - 3.5.10-1 -- Update to upstream 3.5.10 release - -* Wed Feb 15 2017 Nikos Mavrogiannopoulos - 3.5.9-2 -- Work around missing pkg-config file (#1422256) - -* Tue Feb 14 2017 Nikos Mavrogiannopoulos - 3.5.9-1 -- Update to upstream 3.5.9 release - -* Fri Feb 10 2017 Fedora Release Engineering - 3.5.8-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Sat Feb 4 2017 Nikos Mavrogiannopoulos 3.5.8-2 -- Added patch fix initialization issue in gnutls_pkcs11_obj_list_import_url4 - -* Mon Jan 9 2017 Nikos Mavrogiannopoulos 3.5.8-1 -- New upstream release - -* Tue Dec 13 2016 Nikos Mavrogiannopoulos 3.5.7-3 -- Fix PKCS#8 file loading (#1404084) - -* Thu Dec 8 2016 Nikos Mavrogiannopoulos 3.5.7-1 -- New upstream release - -* Fri Nov 4 2016 Nikos Mavrogiannopoulos 3.5.6-1 -- New upstream release - -* Tue Oct 11 2016 walters@redhat.com - 3.5.5-2 -- Apply patch to fix compatibility with ostree (#1383708) - -* Mon Oct 10 2016 Nikos Mavrogiannopoulos 3.5.5-1 -- New upstream release - -* Thu Sep 8 2016 Nikos Mavrogiannopoulos 3.5.4-1 -- New upstream release - -* Mon Aug 29 2016 Nikos Mavrogiannopoulos 3.5.3-2 -- Work around #1371082 for x86 -- Fixed issue with DTLS sliding window implementation (#1370881) - -* Tue Aug 9 2016 Nikos Mavrogiannopoulos 3.5.3-1 -- New upstream release - -* Wed Jul 6 2016 Nikos Mavrogiannopoulos 3.5.2-1 -- New upstream release - -* Wed Jun 15 2016 Nikos Mavrogiannopoulos 3.5.1-1 -- New upstream release - -* Tue Jun 7 2016 Nikos Mavrogiannopoulos 3.4.13-1 -- New upstream release (#1343258) -- Addresses issue with setuid programs introduced in 3.4.12 (#1343342) - -* Fri May 20 2016 Nikos Mavrogiannopoulos 3.4.12-1 -- New upstream release - -* Mon Apr 11 2016 Nikos Mavrogiannopoulos 3.4.11-1 -- New upstream release - -* Fri Mar 4 2016 Nikos Mavrogiannopoulos 3.4.10-1 -- New upstream release (#1314576) - -* Wed Feb 3 2016 Nikos Mavrogiannopoulos 3.4.9-1 -- Fix broken key usage flags introduced in 3.4.8 (#1303355) - -* Mon Jan 11 2016 Nikos Mavrogiannopoulos 3.4.8-1 -- New upstream release (#1297079) - -* Mon Nov 23 2015 Nikos Mavrogiannopoulos 3.4.7-1 -- New upstream release (#1284300) -- Documentation updates (#1282864) -- Adds interface to set unique IDs in certificates (#1281343) -- Allow arbitrary key sizes with ARCFOUR (#1284401) - -* Wed Oct 21 2015 Nikos Mavrogiannopoulos 3.4.6-1 -- New upstream release (#1273672) -- Enhances p11tool to write CKA_ISSUER and CKA_SERIAL_NUMBER (#1272178) - -* Tue Oct 20 2015 Adam Williamson - 3.4.5-2 -- fix interaction with Chrome 45+ (master secret extension) (#1273102) - -* Mon Sep 14 2015 Nikos Mavrogiannopoulos 3.4.5-1 -- New upstream release (#1252192) -- Eliminates hard limits on CRL parsing of certtool. - -* Mon Aug 10 2015 Nikos Mavrogiannopoulos 3.4.4-1 -- new upstream release -- no longer requires trousers patch -- fixes issue in gnutls_x509_privkey_import (#1250020) - -* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-2 -- Don't link against trousers but rather dlopen() it when available. - That avoids a dependency on openssl by the main library. - -* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-1 -- new upstream release - -* Thu Jul 02 2015 Adam Jackson 3.4.2-3 -- Only disable -z now for the guile modules - -* Thu Jun 18 2015 Nikos Mavrogiannopoulos 3.4.2-2 -- rename the symbol version for internal symbols to avoid clashes - with 3.3.x. - -* Wed Jun 17 2015 Nikos Mavrogiannopoulos 3.4.2-1 -- new upstream release - -* Tue May 5 2015 Nikos Mavrogiannopoulos 3.4.1-2 -- Provide missing GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA definition - -* Mon May 4 2015 Nikos Mavrogiannopoulos 3.4.1-1 -- new upstream release - -* Sat May 02 2015 Kalev Lember - 3.3.14-2 -- Rebuilt for GCC 5 C++11 ABI change - -* Mon Mar 30 2015 Nikos Mavrogiannopoulos 3.3.14-1 -- new upstream release -- improved BER decoding of PKCS #12 structures (#1131461) - -* Fri Mar 6 2015 Nikos Mavrogiannopoulos 3.3.13-3 -- Build with hardened flags -- Removed -Wl,--no-add-needed linker flag - -* Fri Feb 27 2015 Till Maas - 3.3.13-2 -- Do not build with hardened flags - -* Thu Feb 26 2015 Nikos Mavrogiannopoulos 3.3.13-1 -- new upstream release - -* Sat Feb 21 2015 Till Maas - 3.3.12-3 -- Make build verbose -- Use %%license - -* Sat Feb 21 2015 Till Maas - 3.3.12-2 -- Rebuilt for Fedora 23 Change - https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code - -* Mon Jan 19 2015 Nikos Mavrogiannopoulos 3.3.12-1 -- new upstream release - -* Mon Jan 5 2015 Nikos Mavrogiannopoulos 3.3.11-2 -- enabled guile bindings (#1177847) - -* Thu Dec 11 2014 Nikos Mavrogiannopoulos 3.3.11-1 -- new upstream release - -* Mon Nov 10 2014 Nikos Mavrogiannopoulos 3.3.10-1 -- new upstream release - -* Thu Oct 23 2014 Nikos Mavrogiannopoulos 3.3.9-2 -- applied fix for issue in get-issuer (#1155901) - -* Mon Oct 13 2014 Nikos Mavrogiannopoulos 3.3.9-1 -- new upstream release - -* Fri Sep 19 2014 Nikos Mavrogiannopoulos 3.3.8-2 -- strip rpath from library - -* Thu Sep 18 2014 Nikos Mavrogiannopoulos 3.3.8-1 -- new upstream release - -* Mon Aug 25 2014 Nikos Mavrogiannopoulos 3.3.7-1 -- new upstream release - -* Sat Aug 16 2014 Fedora Release Engineering - 3.3.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Wed Jul 23 2014 Nikos Mavrogiannopoulos 3.3.6-1 -- new upstream release - -* Tue Jul 01 2014 Nikos Mavrogiannopoulos 3.3.5-2 -- Added work-around for s390 builds with gcc 4.9 (#1102324) - -* Mon Jun 30 2014 Nikos Mavrogiannopoulos 3.3.5-1 -- new upstream release - -* Tue Jun 17 2014 Nikos Mavrogiannopoulos 3.3.4-3 -- explicitly depend on p11-kit-trust - -* Sat Jun 07 2014 Fedora Release Engineering - 3.3.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Mon Jun 02 2014 Nikos Mavrogiannopoulos 3.3.4-1 -- new upstream release - -* Fri May 30 2014 Nikos Mavrogiannopoulos 3.3.3-1 -- new upstream release - -* Wed May 21 2014 Nikos Mavrogiannopoulos 3.3.2-2 -- Require crypto-policies - -* Fri May 09 2014 Nikos Mavrogiannopoulos 3.3.2-1 -- new upstream release - -* Mon May 05 2014 Nikos Mavrogiannopoulos 3.3.1-4 -- Replaced /etc/crypto-profiles/apps with /etc/crypto-policies/back-ends. -- Added support for "very weak" profile. - -* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-2 -- gnutls_global_deinit() will not do anything if the previous - initialization has failed (#1091053) - -* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-1 -- new upstream release - -* Mon Apr 14 2014 Nikos Mavrogiannopoulos 3.3.0-1 -- new upstream release - -* Tue Apr 08 2014 Nikos Mavrogiannopoulos 3.2.13-1 -- new upstream release - -* Wed Mar 05 2014 Nikos Mavrogiannopoulos 3.2.12.1-1 -- new upstream release - -* Mon Mar 03 2014 Nikos Mavrogiannopoulos 3.2.12-1 -- new upstream release - -* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-2 -- use p11-kit trust store for certificate verification - -* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-1 -- new upstream release - -* Tue Jan 14 2014 Tomáš Mráz 3.2.8-2 -- build the crywrap tool - -* Mon Dec 23 2013 Nikos Mavrogiannopoulos 3.2.8-1 -- new upstream release - -* Wed Dec 4 2013 Nikos Mavrogiannopoulos 3.2.7-2 -- Use the correct root key for unbound /var/lib/unbound/root.key (#1012494) -- Pull asm fixes from upstream (#973210) - -* Mon Nov 25 2013 Nikos Mavrogiannopoulos 3.2.7-1 -- new upstream release -- added dependency to autogen-libopts-devel to use the system's - libopts library -- added dependency to trousers-devel to enable TPM support - -* Mon Nov 4 2013 Tomáš Mráz 3.1.16-1 -- new upstream release -- fixes CVE-2013-4466 off-by-one in dane_query_tlsa() - -* Fri Oct 25 2013 Tomáš Mráz 3.1.15-1 -- new upstream release -- fixes CVE-2013-4466 buffer overflow in handling DANE entries - -* Wed Oct 16 2013 Tomáš Mráz 3.1.13-3 -- enable ECC NIST Suite B curves - -* Sat Aug 03 2013 Fedora Release Engineering - 3.1.13-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Mon Jul 15 2013 Tomáš Mráz 3.1.13-1 -- new upstream release - -* Mon May 13 2013 Tomáš Mráz 3.1.11-1 -- new upstream release - -* Mon Mar 25 2013 Tomas Mraz 3.1.10-1 -- new upstream release -- license of the library is back to LGPLv2.1+ - -* Fri Mar 15 2013 Tomas Mraz 3.1.9-1 -- new upstream release - -* Thu Mar 7 2013 Tomas Mraz 3.1.8-3 -- drop the temporary old library - -* Tue Feb 26 2013 Tomas Mraz 3.1.8-2 -- don't send ECC algos as supported (#913797) - -* Thu Feb 21 2013 Tomas Mraz 3.1.8-1 -- new upstream version - -* Wed Feb 6 2013 Tomas Mraz 3.1.7-1 -- new upstream version, requires rebuild of dependencies -- this release temporarily includes old compatibility .so - -* Tue Feb 5 2013 Tomas Mraz 2.12.22-2 -- rebuilt with new libtasn1 -- make guile bindings optional - breaks i686 build and there is - no dependent package - -* Tue Jan 8 2013 Tomas Mraz 2.12.22-1 -- new upstream version - -* Wed Nov 28 2012 Tomas Mraz 2.12.21-2 -- use RSA bit sizes supported by libgcrypt in FIPS mode for security - levels (#879643) - -* Fri Nov 9 2012 Tomas Mraz 2.12.21-1 -- new upstream version - -* Thu Nov 1 2012 Tomas Mraz 2.12.20-4 -- negotiate only FIPS approved algorithms in the FIPS mode (#871826) - -* Wed Aug 8 2012 Tomas Mraz 2.12.20-3 -- fix the gnutls-cli-debug manpage - patch by Peter Schiffer - -* Thu Jul 19 2012 Fedora Release Engineering - 2.12.20-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Mon Jun 18 2012 Tomas Mraz 2.12.20-1 -- new upstream version - -* Fri May 18 2012 Tomas Mraz 2.12.19-1 -- new upstream version - -* Thu Mar 29 2012 Tomas Mraz 2.12.18-1 -- new upstream version - -* Thu Mar 8 2012 Tomas Mraz 2.12.17-1 -- new upstream version -- fix leaks in key generation (#796302) - -* Fri Feb 03 2012 Kevin Fenzi - 2.12.14-3 -- Disable largefile on arm arch. (#787287) - -* Fri Jan 13 2012 Fedora Release Engineering - 2.12.14-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Tue Nov 8 2011 Tomas Mraz 2.12.14-1 -- new upstream version - -* Mon Oct 24 2011 Tomas Mraz 2.12.12-1 -- new upstream version - -* Thu Sep 29 2011 Tomas Mraz 2.12.11-1 -- new upstream version - -* Fri Aug 26 2011 Tomas Mraz 2.12.9-1 -- new upstream version - -* Tue Aug 16 2011 Tomas Mraz 2.12.8-1 -- new upstream version - -* Mon Jul 25 2011 Tomas Mraz 2.12.7-2 -- fix problem when using new libgcrypt -- split libgnutlsxx to a subpackage (#455146) -- drop libgnutls-openssl (#460310) - -* Tue Jun 21 2011 Tomas Mraz 2.12.7-1 -- new upstream version - -* Mon May 9 2011 Tomas Mraz 2.12.4-1 -- new upstream version - -* Tue Apr 26 2011 Tomas Mraz 2.12.3-1 -- new upstream version - -* Mon Apr 18 2011 Tomas Mraz 2.12.2-1 -- new upstream version - -* Thu Mar 3 2011 Tomas Mraz 2.10.5-1 -- new upstream version - -* Tue Feb 08 2011 Fedora Release Engineering - 2.10.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Wed Dec 8 2010 Tomas Mraz 2.10.4-1 -- new upstream version - -* Thu Dec 2 2010 Tomas Mraz 2.10.3-2 -- fix buffer overflow in gnutls-serv (#659259) - -* Fri Nov 19 2010 Tomas Mraz 2.10.3-1 -- new upstream version - -* Thu Sep 30 2010 Tomas Mraz 2.10.2-1 -- new upstream version - -* Wed Sep 29 2010 jkeating - 2.10.1-4 -- Rebuilt for gcc bug 634757 - -* Thu Sep 23 2010 Tomas Mraz 2.10.1-3 -- more patching for internal errors regression (#629858) - patch by Vivek Dasmohapatra - -* Tue Sep 21 2010 Tomas Mraz 2.10.1-2 -- backported patch from upstream git hopefully fixing internal errors - (#629858) - -* Wed Aug 4 2010 Tomas Mraz 2.10.1-1 -- new upstream version - -* Wed Jun 2 2010 Tomas Mraz 2.8.6-2 -- add support for safe renegotiation CVE-2009-3555 (#533125) - -* Wed May 12 2010 Tomas Mraz 2.8.6-1 -- upgrade to a new upstream version - -* Mon Feb 15 2010 Rex Dieter 2.8.5-4 -- FTBFS gnutls-2.8.5-3.fc13: ImplicitDSOLinking (#564624) - -* Thu Jan 28 2010 Tomas Mraz 2.8.5-3 -- drop superfluous rpath from binaries -- do not call autoreconf during build -- specify the license on utils subpackage - -* Mon Jan 18 2010 Tomas Mraz 2.8.5-2 -- do not create static libraries (#556052) - -* Mon Nov 2 2009 Tomas Mraz 2.8.5-1 -- upgrade to a new upstream version - -* Wed Sep 23 2009 Tomas Mraz 2.8.4-1 -- upgrade to a new upstream version - -* Fri Aug 14 2009 Tomas Mraz 2.8.3-1 -- upgrade to a new upstream version - -* Fri Jul 24 2009 Fedora Release Engineering - 2.8.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Wed Jun 10 2009 Tomas Mraz 2.8.1-1 -- upgrade to a new upstream version - -* Wed Jun 3 2009 Tomas Mraz 2.8.0-1 -- upgrade to a new upstream version - -* Mon May 4 2009 Tomas Mraz 2.6.6-1 -- upgrade to a new upstream version - security fixes - -* Tue Apr 14 2009 Tomas Mraz 2.6.5-1 -- upgrade to a new upstream version, minor bugfixes only - -* Fri Mar 6 2009 Tomas Mraz 2.6.4-1 -- upgrade to a new upstream version - -* Tue Feb 24 2009 Fedora Release Engineering - 2.6.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Mon Dec 15 2008 Tomas Mraz 2.6.3-1 -- upgrade to a new upstream version - -* Thu Dec 4 2008 Tomas Mraz 2.6.2-1 -- upgrade to a new upstream version - -* Tue Nov 11 2008 Tomas Mraz 2.4.2-3 -- fix chain verification issue CVE-2008-4989 (#470079) - -* Thu Sep 25 2008 Tomas Mraz 2.4.2-2 -- add guile subpackage (#463735) -- force new libtool through autoreconf to drop unnecessary rpaths - -* Tue Sep 23 2008 Tomas Mraz 2.4.2-1 -- new upstream version - -* Tue Jul 1 2008 Tomas Mraz 2.4.1-1 -- new upstream version -- correct the license tag -- explicit --with-included-opencdk not needed -- use external lzo library, internal not included anymore - -* Tue Jun 24 2008 Tomas Mraz 2.4.0-1 -- upgrade to latest upstream - -* Tue May 20 2008 Tomas Mraz 2.0.4-3 -- fix three security issues in gnutls handshake - GNUTLS-SA-2008-1 - (#447461, #447462, #447463) - -* Mon Feb 4 2008 Joe Orton 2.0.4-2 -- use system libtasn1 - -* Tue Dec 4 2007 Tomas Mraz 2.0.4-1 -- upgrade to latest upstream - -* Tue Aug 21 2007 Tomas Mraz 1.6.3-2 -- license tag fix - -* Wed Jun 6 2007 Tomas Mraz 1.6.3-1 -- upgrade to latest upstream (#232445) - -* Tue Apr 10 2007 Tomas Mraz 1.4.5-2 -- properly require install-info (patch by Ville Skyttä) -- standard buildroot and use dist tag -- add COPYING and README to doc - -* Wed Feb 7 2007 Tomas Mraz 1.4.5-1 -- new upstream version -- drop libtermcap-devel from buildrequires - -* Thu Sep 14 2006 Tomas Mraz 1.4.1-2 -- detect forged signatures - CVE-2006-4790 (#206411), patch - from upstream - -* Tue Jul 18 2006 Tomas Mraz - 1.4.1-1 -- upgrade to new upstream version, only minor changes - -* Wed Jul 12 2006 Jesse Keating - 1.4.0-1.1 -- rebuild - -* Wed Jun 14 2006 Tomas Mraz - 1.4.0-1 -- upgrade to new upstream version (#192070), rebuild - of dependent packages required - -* Tue May 16 2006 Tomas Mraz - 1.2.10-2 -- added missing buildrequires - -* Mon Feb 13 2006 Tomas Mraz - 1.2.10-1 -- updated to new version (fixes CVE-2006-0645) - -* Fri Feb 10 2006 Jesse Keating - 1.2.9-3.2 -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Jesse Keating - 1.2.9-3.1 -- rebuilt for new gcc4.1 snapshot and glibc changes - -* Tue Jan 3 2006 Jesse Keating 1.2.9-3 -- rebuilt - -* Fri Dec 9 2005 Tomas Mraz 1.2.9-2 -- replaced *-config scripts with calls to pkg-config to - solve multilib conflicts - -* Wed Nov 23 2005 Tomas Mraz 1.2.9-1 -- upgrade to newest upstream -- removed .la files (#172635) - -* Sun Aug 7 2005 Tomas Mraz 1.2.6-1 -- upgrade to newest upstream (rebuild of dependencies necessary) - -* Mon Jul 4 2005 Tomas Mraz 1.0.25-2 -- split the command line tools to utils subpackage - -* Sat Apr 30 2005 Tomas Mraz 1.0.25-1 -- new upstream version fixes potential DOS attack - -* Sat Apr 23 2005 Tomas Mraz 1.0.24-2 -- readd the version script dropped by upstream - -* Fri Apr 22 2005 Tomas Mraz 1.0.24-1 -- update to the latest upstream version on the 1.0 branch - -* Wed Mar 2 2005 Warren Togami 1.0.20-6 -- gcc4 rebuild - -* Tue Jan 4 2005 Ivana Varekova 1.0.20-5 -- add gnutls Requires zlib-devel (#144069) - -* Mon Nov 08 2004 Colin Walters 1.0.20-4 -- Make gnutls-devel Require libgcrypt-devel - -* Tue Sep 21 2004 Jeff Johnson 1.0.20-3 -- rebuild with release++, otherwise unchanged. - -* Tue Sep 7 2004 Jeff Johnson 1.0.20-2 -- patent tainted SRP code removed. - -* Sun Sep 5 2004 Jeff Johnson 1.0.20-1 -- update to 1.0.20. -- add --with-included-opencdk --with-included-libtasn1 -- add --with-included-libcfg --with-included-lzo -- add --disable-srp-authentication. -- do "make check" after build. - -* Fri Mar 21 2003 Jeff Johnson 0.9.2-1 -- upgrade to 0.9.2 - -* Tue Jun 25 2002 Jeff Johnson 0.4.4-1 -- update to 0.4.4. - -* Fri Jun 21 2002 Tim Powers -- automated rebuild - -* Sat May 25 2002 Jeff Johnson 0.4.3-1 -- update to 0.4.3. - -* Tue May 21 2002 Jeff Johnson 0.4.2-1 -- update to 0.4.2. -- change license to LGPL. -- include splint annotations patch. - -* Tue Apr 2 2002 Nalin Dahyabhai 0.4.0-1 -- update to 0.4.0 - -* Thu Jan 17 2002 Nalin Dahyabhai 0.3.2-1 -- update to 0.3.2 - -* Thu Jan 10 2002 Nalin Dahyabhai 0.3.0-1 -- add a URL - -* Thu Dec 20 2001 Nalin Dahyabhai -- initial package diff --git a/ci.fmf b/ci.fmf deleted file mode 100644 index c5aa0e0..0000000 --- a/ci.fmf +++ /dev/null @@ -1 +0,0 @@ -resultsdb-testcase: separate diff --git a/gating.yml b/gating.yml deleted file mode 100644 index 0bd5927..0000000 --- a/gating.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- !Policy -product_versions: - - fedora-* -decision_context: bodhi_update_push_testing -subject_type: koji_build -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} ---- !Policy -product_versions: - - fedora-* -decision_context: bodhi_update_push_stable -subject_type: koji_build -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/gmp-6.2.1-c23.patch b/gmp-6.2.1-c23.patch deleted file mode 100644 index 778c62f..0000000 --- a/gmp-6.2.1-c23.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/acinclude.m4 b/acinclude.m4 -index 906071c..a466b7c 100644 ---- a/acinclude.m4 -+++ b/acinclude.m4 -@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long reliability test 1], - - #if defined (__GNUC__) && ! defined (__cplusplus) - typedef unsigned long long t1;typedef t1*t2; --void g(){} -+void g(int, t2, t1, t2, t2, int){} - void h(){} - static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0) - {t1 c,x,r;int i;if(v0){c=1;for(i=1;i -Date: Thu, 18 Aug 2022 15:55:31 +0900 -Subject: [PATCH] gmp-intel-cet.patch - ---- - acinclude.m4 | 100 +++++++++++++++++++++++++ - configure.ac | 1 + - mpn/x86/aors_n.asm | 5 +- - mpn/x86/aorsmul_1.asm | 1 + - mpn/x86/atom/sse2/aorsmul_1.asm | 1 + - mpn/x86/atom/sse2/mul_basecase.asm | 1 + - mpn/x86/atom/sse2/sqr_basecase.asm | 1 + - mpn/x86/bdiv_dbm1c.asm | 1 + - mpn/x86/copyd.asm | 1 + - mpn/x86/copyi.asm | 1 + - mpn/x86/divrem_1.asm | 1 + - mpn/x86/divrem_2.asm | 1 + - mpn/x86/k6/aors_n.asm | 1 + - mpn/x86/k6/aorsmul_1.asm | 1 + - mpn/x86/k6/divrem_1.asm | 1 + - mpn/x86/k6/k62mmx/copyd.asm | 1 + - mpn/x86/k6/k62mmx/lshift.asm | 1 + - mpn/x86/k6/k62mmx/rshift.asm | 1 + - mpn/x86/k6/mmx/com.asm | 1 + - mpn/x86/k6/mmx/logops_n.asm | 1 + - mpn/x86/k6/mmx/lshift.asm | 1 + - mpn/x86/k6/mmx/popham.asm | 1 + - mpn/x86/k6/mmx/rshift.asm | 1 + - mpn/x86/k6/mod_34lsub1.asm | 1 + - mpn/x86/k6/mul_1.asm | 1 + - mpn/x86/k6/mul_basecase.asm | 1 + - mpn/x86/k6/pre_mod_1.asm | 1 + - mpn/x86/k6/sqr_basecase.asm | 1 + - mpn/x86/k7/aors_n.asm | 1 + - mpn/x86/k7/mmx/com.asm | 1 + - mpn/x86/k7/mmx/copyd.asm | 1 + - mpn/x86/k7/mmx/copyi.asm | 1 + - mpn/x86/k7/mmx/divrem_1.asm | 1 + - mpn/x86/k7/mmx/lshift.asm | 1 + - mpn/x86/k7/mmx/popham.asm | 1 + - mpn/x86/k7/mmx/rshift.asm | 1 + - mpn/x86/k7/mod_1_1.asm | 1 + - mpn/x86/k7/mod_1_4.asm | 1 + - mpn/x86/k7/mod_34lsub1.asm | 1 + - mpn/x86/k7/mul_basecase.asm | 1 + - mpn/x86/k7/sqr_basecase.asm | 1 + - mpn/x86/lshift.asm | 1 + - mpn/x86/mmx/sec_tabselect.asm | 1 + - mpn/x86/mod_34lsub1.asm | 1 + - mpn/x86/mul_1.asm | 1 + - mpn/x86/mul_basecase.asm | 1 + - mpn/x86/p6/aors_n.asm | 3 +- - mpn/x86/p6/aorsmul_1.asm | 3 +- - mpn/x86/p6/copyd.asm | 1 + - mpn/x86/p6/gcd_11.asm | 1 + - mpn/x86/p6/lshsub_n.asm | 3 +- - mpn/x86/p6/mmx/divrem_1.asm | 1 + - mpn/x86/p6/mod_34lsub1.asm | 1 + - mpn/x86/p6/mul_basecase.asm | 3 +- - mpn/x86/p6/sqr_basecase.asm | 3 +- - mpn/x86/pentium/aors_n.asm | 1 + - mpn/x86/pentium/aorsmul_1.asm | 1 + - mpn/x86/pentium/com.asm | 1 + - mpn/x86/pentium/copyd.asm | 1 + - mpn/x86/pentium/copyi.asm | 1 + - mpn/x86/pentium/logops_n.asm | 1 + - mpn/x86/pentium/lshift.asm | 1 + - mpn/x86/pentium/mmx/lshift.asm | 1 + - mpn/x86/pentium/mmx/mul_1.asm | 1 + - mpn/x86/pentium/mmx/rshift.asm | 1 + - mpn/x86/pentium/mod_34lsub1.asm | 1 + - mpn/x86/pentium/mul_1.asm | 1 + - mpn/x86/pentium/mul_2.asm | 1 + - mpn/x86/pentium/mul_basecase.asm | 1 + - mpn/x86/pentium/rshift.asm | 1 + - mpn/x86/pentium/sqr_basecase.asm | 1 + - mpn/x86/pentium4/copyd.asm | 1 + - mpn/x86/pentium4/copyi.asm | 1 + - mpn/x86/pentium4/mmx/popham.asm | 1 + - mpn/x86/pentium4/sse2/add_n.asm | 1 + - mpn/x86/pentium4/sse2/addlsh1_n.asm | 1 + - mpn/x86/pentium4/sse2/addmul_1.asm | 1 + - mpn/x86/pentium4/sse2/cnd_add_n.asm | 1 + - mpn/x86/pentium4/sse2/cnd_sub_n.asm | 1 + - mpn/x86/pentium4/sse2/divrem_1.asm | 1 + - mpn/x86/pentium4/sse2/mod_1_1.asm | 1 + - mpn/x86/pentium4/sse2/mod_1_4.asm | 1 + - mpn/x86/pentium4/sse2/mod_34lsub1.asm | 1 + - mpn/x86/pentium4/sse2/mul_1.asm | 1 + - mpn/x86/pentium4/sse2/mul_basecase.asm | 1 + - mpn/x86/pentium4/sse2/rsh1add_n.asm | 1 + - mpn/x86/pentium4/sse2/sqr_basecase.asm | 1 + - mpn/x86/pentium4/sse2/sub_n.asm | 1 + - mpn/x86/pentium4/sse2/submul_1.asm | 1 + - mpn/x86/rshift.asm | 1 + - mpn/x86/sec_tabselect.asm | 1 + - mpn/x86/sqr_basecase.asm | 1 + - mpn/x86/udiv.asm | 1 + - mpn/x86/umul.asm | 1 + - mpn/x86/x86-defs.m4 | 7 +- - mpn/x86_64/addaddmul_1msb0.asm | 1 + - mpn/x86_64/aorrlsh1_n.asm | 1 + - mpn/x86_64/aorrlshC_n.asm | 1 + - mpn/x86_64/aorrlsh_n.asm | 1 + - mpn/x86_64/aors_err1_n.asm | 1 + - mpn/x86_64/aors_err2_n.asm | 1 + - mpn/x86_64/aors_err3_n.asm | 1 + - mpn/x86_64/aors_n.asm | 1 + - mpn/x86_64/aorsmul_1.asm | 1 + - mpn/x86_64/atom/addmul_2.asm | 1 + - mpn/x86_64/atom/aorrlsh1_n.asm | 1 + - mpn/x86_64/atom/aorrlsh2_n.asm | 1 + - mpn/x86_64/atom/lshift.asm | 1 + - mpn/x86_64/atom/lshiftc.asm | 1 + - mpn/x86_64/atom/mul_2.asm | 1 + - mpn/x86_64/atom/rsh1aors_n.asm | 1 + - mpn/x86_64/atom/rshift.asm | 1 + - mpn/x86_64/atom/sublsh1_n.asm | 1 + - mpn/x86_64/bd1/addmul_2.asm | 1 + - mpn/x86_64/bd1/hamdist.asm | 1 + - mpn/x86_64/bd1/mul_2.asm | 1 + - mpn/x86_64/bd1/mul_basecase.asm | 1 + - mpn/x86_64/bd1/popcount.asm | 1 + - mpn/x86_64/bd2/gcd_11.asm | 1 + - mpn/x86_64/bd2/gcd_22.asm | 1 + - mpn/x86_64/bd4/gcd_11.asm | 1 + - mpn/x86_64/bdiv_dbm1c.asm | 1 + - mpn/x86_64/bdiv_q_1.asm | 1 + - mpn/x86_64/bt1/aors_n.asm | 1 + - mpn/x86_64/bt1/aorsmul_1.asm | 1 + - mpn/x86_64/bt1/copyd.asm | 1 + - mpn/x86_64/bt1/copyi.asm | 1 + - mpn/x86_64/bt1/gcd_11.asm | 1 + - mpn/x86_64/bt1/mul_1.asm | 1 + - mpn/x86_64/bt1/mul_basecase.asm | 1 + - mpn/x86_64/bt1/sqr_basecase.asm | 1 + - mpn/x86_64/cnd_aors_n.asm | 1 + - mpn/x86_64/com.asm | 1 + - mpn/x86_64/copyd.asm | 1 + - mpn/x86_64/copyi.asm | 1 + - mpn/x86_64/core2/aors_err1_n.asm | 1 + - mpn/x86_64/core2/aors_n.asm | 1 + - mpn/x86_64/core2/aorsmul_1.asm | 1 + - mpn/x86_64/core2/divrem_1.asm | 1 + - mpn/x86_64/core2/gcd_11.asm | 1 + - mpn/x86_64/core2/gcd_22.asm | 1 + - mpn/x86_64/core2/hamdist.asm | 1 + - mpn/x86_64/core2/logops_n.asm | 1 + - mpn/x86_64/core2/lshift.asm | 1 + - mpn/x86_64/core2/lshiftc.asm | 1 + - mpn/x86_64/core2/mul_basecase.asm | 5 ++ - mpn/x86_64/core2/mullo_basecase.asm | 1 + - mpn/x86_64/core2/popcount.asm | 1 + - mpn/x86_64/core2/rsh1aors_n.asm | 1 + - mpn/x86_64/core2/rshift.asm | 1 + - mpn/x86_64/core2/sqr_basecase.asm | 1 + - mpn/x86_64/core2/sublshC_n.asm | 1 + - mpn/x86_64/coreibwl/addmul_1.asm | 24 ++++-- - mpn/x86_64/coreibwl/mul_1.asm | 24 ++++-- - mpn/x86_64/coreibwl/mul_basecase.asm | 47 ++++++++---- - mpn/x86_64/coreibwl/mullo_basecase.asm | 1 + - mpn/x86_64/coreibwl/sqr_basecase.asm | 49 ++++++++---- - mpn/x86_64/coreihwl/addmul_2.asm | 1 + - mpn/x86_64/coreihwl/aors_n.asm | 1 + - mpn/x86_64/coreihwl/aorsmul_1.asm | 1 + - mpn/x86_64/coreihwl/gcd_22.asm | 1 + - mpn/x86_64/coreihwl/mul_2.asm | 1 + - mpn/x86_64/coreihwl/mul_basecase.asm | 1 + - mpn/x86_64/coreihwl/mullo_basecase.asm | 1 + - mpn/x86_64/coreihwl/redc_1.asm | 1 + - mpn/x86_64/coreihwl/sqr_basecase.asm | 1 + - mpn/x86_64/coreinhm/aorrlsh_n.asm | 1 + - mpn/x86_64/coreinhm/hamdist.asm | 1 + - mpn/x86_64/coreinhm/popcount.asm | 1 + - mpn/x86_64/coreisbr/addmul_2.asm | 1 + - mpn/x86_64/coreisbr/aorrlshC_n.asm | 1 + - mpn/x86_64/coreisbr/aorrlsh_n.asm | 1 + - mpn/x86_64/coreisbr/aors_n.asm | 1 + - mpn/x86_64/coreisbr/cnd_add_n.asm | 1 + - mpn/x86_64/coreisbr/cnd_sub_n.asm | 1 + - mpn/x86_64/coreisbr/mul_1.asm | 1 + - mpn/x86_64/coreisbr/mul_2.asm | 1 + - mpn/x86_64/coreisbr/mul_basecase.asm | 1 + - mpn/x86_64/coreisbr/mullo_basecase.asm | 1 + - mpn/x86_64/coreisbr/rsh1aors_n.asm | 1 + - mpn/x86_64/coreisbr/sqr_basecase.asm | 1 + - mpn/x86_64/div_qr_1n_pi1.asm | 1 + - mpn/x86_64/div_qr_2n_pi1.asm | 1 + - mpn/x86_64/div_qr_2u_pi1.asm | 1 + - mpn/x86_64/dive_1.asm | 1 + - mpn/x86_64/divrem_1.asm | 1 + - mpn/x86_64/divrem_2.asm | 1 + - mpn/x86_64/fastavx/copyd.asm | 1 + - mpn/x86_64/fastavx/copyi.asm | 1 + - mpn/x86_64/fastsse/com-palignr.asm | 1 + - mpn/x86_64/fastsse/com.asm | 1 + - mpn/x86_64/fastsse/copyd-palignr.asm | 1 + - mpn/x86_64/fastsse/copyd.asm | 1 + - mpn/x86_64/fastsse/copyi-palignr.asm | 1 + - mpn/x86_64/fastsse/copyi.asm | 1 + - mpn/x86_64/fastsse/lshift-movdqu2.asm | 1 + - mpn/x86_64/fastsse/lshift.asm | 1 + - mpn/x86_64/fastsse/lshiftc-movdqu2.asm | 1 + - mpn/x86_64/fastsse/lshiftc.asm | 1 + - mpn/x86_64/fastsse/rshift-movdqu2.asm | 1 + - mpn/x86_64/fastsse/sec_tabselect.asm | 1 + - mpn/x86_64/fat/fat_entry.asm | 1 + - mpn/x86_64/gcd_11.asm | 1 + - mpn/x86_64/gcd_22.asm | 1 + - mpn/x86_64/k10/gcd_22.asm | 1 + - mpn/x86_64/k10/hamdist.asm | 1 + - mpn/x86_64/k10/popcount.asm | 5 +- - mpn/x86_64/k8/addmul_2.asm | 1 + - mpn/x86_64/k8/aorrlsh_n.asm | 1 + - mpn/x86_64/k8/bdiv_q_1.asm | 1 + - mpn/x86_64/k8/div_qr_1n_pi1.asm | 1 + - mpn/x86_64/k8/mul_basecase.asm | 8 ++ - mpn/x86_64/k8/mullo_basecase.asm | 12 ++- - mpn/x86_64/k8/mulmid_basecase.asm | 9 +++ - mpn/x86_64/k8/redc_1.asm | 18 +++-- - mpn/x86_64/k8/sqr_basecase.asm | 18 +++-- - mpn/x86_64/logops_n.asm | 1 + - mpn/x86_64/lshift.asm | 1 + - mpn/x86_64/lshiftc.asm | 1 + - mpn/x86_64/lshsub_n.asm | 1 + - mpn/x86_64/missing.asm | 1 + - mpn/x86_64/mod_1_2.asm | 1 + - mpn/x86_64/mod_1_4.asm | 1 + - mpn/x86_64/mod_34lsub1.asm | 28 ++++--- - mpn/x86_64/mode1o.asm | 1 + - mpn/x86_64/mul_1.asm | 1 + - mpn/x86_64/mul_2.asm | 1 + - mpn/x86_64/nano/dive_1.asm | 1 + - mpn/x86_64/pentium4/aors_n.asm | 1 + - mpn/x86_64/pentium4/mod_34lsub1.asm | 1 + - mpn/x86_64/pentium4/rsh1aors_n.asm | 1 + - mpn/x86_64/pentium4/rshift.asm | 1 + - mpn/x86_64/popham.asm | 1 + - mpn/x86_64/rsh1aors_n.asm | 1 + - mpn/x86_64/rshift.asm | 1 + - mpn/x86_64/sec_tabselect.asm | 1 + - mpn/x86_64/sqr_diag_addlsh1.asm | 1 + - mpn/x86_64/sublsh1_n.asm | 1 + - mpn/x86_64/x86_64-defs.m4 | 5 ++ - mpn/x86_64/zen/aorrlsh_n.asm | 25 +++++-- - mpn/x86_64/zen/mul_basecase.asm | 1 + - mpn/x86_64/zen/mullo_basecase.asm | 1 + - mpn/x86_64/zen/sbpi1_bdiv_r.asm | 1 + - mpn/x86_64/zen/sqr_basecase.asm | 1 + - 244 files changed, 537 insertions(+), 89 deletions(-) - -diff --git a/acinclude.m4 b/acinclude.m4 -index 86175ce..84e880b 100644 ---- a/acinclude.m4 -+++ b/acinclude.m4 -@@ -3135,6 +3135,106 @@ __sparc_get_pc_thunk.l7: - GMP_DEFINE_RAW(["define(,<$gmp_cv_asm_sparc_shared_thunks>)"]) - ]) - -+dnl GMP_ASM_X86_CET_MACROS(ABI) -+dnl ------------ -+dnl Define -+dnl 1. X86_ENDBR for endbr32/endbr64. -+dnl 2. X86_NOTRACK for notrack prefix. -+dnl 3. X86_GNU_PROPERTY to add a .note.gnu.property section to mark -+dnl Intel CET support if needed. -+dnl .section ".note.gnu.property", "a" -+dnl .p2align POINTER-ALIGN -+dnl .long 1f - 0f -+dnl .long 4f - 1f -+dnl .long 5 -+dnl 0: -+dnl .asciz "GNU" -+dnl 1: -+dnl .p2align POINTER-ALIGN -+dnl .long 0xc0000002 -+dnl .long 3f - 2f -+dnl 2: -+dnl .long 3 -+dnl 3: -+dnl .p2align POINTER-ALIGN -+dnl 4: -+AC_DEFUN([GMP_ASM_X86_CET_MACROS],[ -+dnl AC_REQUIRE([AC_PROG_CC]) GMP uses something else -+AC_CACHE_CHECK([if Intel CET is enabled], -+ gmp_cv_asm_x86_intel_cet, [dnl -+ cat > conftest.c </dev/null]) -+ then -+ gmp_cv_asm_x86_intel_cet=yes -+ else -+ gmp_cv_asm_x86_intel_cet=no -+ fi -+ rm -f conftest*]) -+ if test "$gmp_cv_asm_x86_intel_cet" = yes; then -+ case $1 in -+ 32) -+ endbr=endbr32 -+ p2align=2 -+ ;; -+ 64) -+ endbr=endbr64 -+ p2align=3 -+ ;; -+ x32) -+ endbr=endbr64 -+ p2align=2 -+ ;; -+ esac -+ AC_CACHE_CHECK([if .note.gnu.property section is needed], -+ gmp_cv_asm_x86_gnu_property, [dnl -+ cat > conftest.c </dev/null]) -+ then -+ gmp_cv_asm_x86_gnu_property=yes -+ else -+ gmp_cv_asm_x86_gnu_property=no -+ fi -+ rm -f conftest*]) -+ echo ["define(,<$endbr>)"] >> $gmp_tmpconfigm4 -+ echo ["define(,)"] >> $gmp_tmpconfigm4 -+ else -+ gmp_cv_asm_x86_gnu_property=no -+ echo ["define(,<>)"] >> $gmp_tmpconfigm4 -+ echo ["define(,<>)"] >> $gmp_tmpconfigm4 -+ fi -+ if test "$gmp_cv_asm_x86_gnu_property" = yes; then -+ echo ["define(, < -+ .section \".note.gnu.property\", \"a\" -+ .p2align $p2align -+ .long 1f - 0f -+ .long 4f - 1f -+ .long 5 -+0: -+ .asciz \"GNU\" -+1: -+ .p2align $p2align -+ .long 0xc0000002 -+ .long 3f - 2f -+2: -+ .long 3 -+3: -+ .p2align $p2align -+4:>)"] >> $gmp_tmpconfigm4 -+ else -+ echo ["define(,<>)"] >> $gmp_tmpconfigm4 -+ fi -+]) -+ - - dnl GMP_C_ATTRIBUTE_CONST - dnl --------------------- -diff --git a/configure.ac b/configure.ac -index cafdb3c..0fb8b21 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -3813,6 +3813,7 @@ yes - esac - ;; - esac -+ GMP_ASM_X86_CET_MACROS($ABI) - ;; - esac - fi -diff --git a/mpn/x86/aors_n.asm b/mpn/x86/aors_n.asm -index 5d359f5..7ea7814 100644 ---- a/mpn/x86/aors_n.asm -+++ b/mpn/x86/aors_n.asm -@@ -112,7 +112,7 @@ L(0a): leal (%eax,%eax,8),%eax - shrl %ebp C shift bit 0 into carry - popl %ebp FRAME_popl() - -- jmp *%eax C jump into loop -+ X86_NOTRACK jmp *%eax C jump into loop - - EPILOGUE() - -@@ -153,7 +153,7 @@ L(0b): leal (%eax,%eax,8),%eax - C Calculate start address in loop for non-PIC. - leal L(oop)-3(%eax,%eax,8),%eax - ') -- jmp *%eax C jump into loop -+ X86_NOTRACK jmp *%eax C jump into loop - - L(oopgo): - pushl %ebp FRAME_pushl() -@@ -200,3 +200,4 @@ L(oop): movl (%esi),%eax - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/aorsmul_1.asm b/mpn/x86/aorsmul_1.asm -index 54a8905..0ab1e01 100644 ---- a/mpn/x86/aorsmul_1.asm -+++ b/mpn/x86/aorsmul_1.asm -@@ -154,3 +154,4 @@ L(end): movl %ebx,%eax - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/atom/sse2/aorsmul_1.asm b/mpn/x86/atom/sse2/aorsmul_1.asm -index 969a14a..20658e1 100644 ---- a/mpn/x86/atom/sse2/aorsmul_1.asm -+++ b/mpn/x86/atom/sse2/aorsmul_1.asm -@@ -172,3 +172,4 @@ PROLOGUE(func_1c) - mov 20(%esp), %edx C carry - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/atom/sse2/mul_basecase.asm b/mpn/x86/atom/sse2/mul_basecase.asm -index 97d3aeb..74171aa 100644 ---- a/mpn/x86/atom/sse2/mul_basecase.asm -+++ b/mpn/x86/atom/sse2/mul_basecase.asm -@@ -499,3 +499,4 @@ L(done): - pop %edi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/atom/sse2/sqr_basecase.asm b/mpn/x86/atom/sse2/sqr_basecase.asm -index af19ed8..0031812 100644 ---- a/mpn/x86/atom/sse2/sqr_basecase.asm -+++ b/mpn/x86/atom/sse2/sqr_basecase.asm -@@ -632,3 +632,4 @@ L(one): pmuludq %mm7, %mm7 - pop %edi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/bdiv_dbm1c.asm b/mpn/x86/bdiv_dbm1c.asm -index 0288c47..7a3b1a6 100644 ---- a/mpn/x86/bdiv_dbm1c.asm -+++ b/mpn/x86/bdiv_dbm1c.asm -@@ -127,3 +127,4 @@ L(b1): add $-4, %ebp - pop %esi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/copyd.asm b/mpn/x86/copyd.asm -index 51fa195..0e588d9 100644 ---- a/mpn/x86/copyd.asm -+++ b/mpn/x86/copyd.asm -@@ -89,3 +89,4 @@ PROLOGUE(mpn_copyd) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/copyi.asm b/mpn/x86/copyi.asm -index f6b0354..6efbb90 100644 ---- a/mpn/x86/copyi.asm -+++ b/mpn/x86/copyi.asm -@@ -97,3 +97,4 @@ PROLOGUE(mpn_copyi) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/divrem_1.asm b/mpn/x86/divrem_1.asm -index 255d493..b1af920 100644 ---- a/mpn/x86/divrem_1.asm -+++ b/mpn/x86/divrem_1.asm -@@ -231,3 +231,4 @@ deflit(`FRAME',8) - popl %edi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/divrem_2.asm b/mpn/x86/divrem_2.asm -index 4c38ad0..c2920c2 100644 ---- a/mpn/x86/divrem_2.asm -+++ b/mpn/x86/divrem_2.asm -@@ -197,3 +197,4 @@ L(35): sub 20(%esp), %ebp - movl $1, 32(%esp) - jmp L(8) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/aors_n.asm b/mpn/x86/k6/aors_n.asm -index 168f9b4..257ba59 100644 ---- a/mpn/x86/k6/aors_n.asm -+++ b/mpn/x86/k6/aors_n.asm -@@ -335,3 +335,4 @@ L(inplace_done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/aorsmul_1.asm b/mpn/x86/k6/aorsmul_1.asm -index eaa92eb..78be9d2 100644 ---- a/mpn/x86/k6/aorsmul_1.asm -+++ b/mpn/x86/k6/aorsmul_1.asm -@@ -389,3 +389,4 @@ Zdisp( M4_inst,%ecx, disp0,(%edi)) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/divrem_1.asm b/mpn/x86/k6/divrem_1.asm -index b4cea4f..ca41a3f 100644 ---- a/mpn/x86/k6/divrem_1.asm -+++ b/mpn/x86/k6/divrem_1.asm -@@ -201,3 +201,4 @@ deflit(`FRAME',8) - popl %edi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/k62mmx/copyd.asm b/mpn/x86/k6/k62mmx/copyd.asm -index f80a5a1..fc329f5 100644 ---- a/mpn/x86/k6/k62mmx/copyd.asm -+++ b/mpn/x86/k6/k62mmx/copyd.asm -@@ -116,3 +116,4 @@ L(zero): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/k62mmx/lshift.asm b/mpn/x86/k6/k62mmx/lshift.asm -index c86575f..728fb5b 100644 ---- a/mpn/x86/k6/k62mmx/lshift.asm -+++ b/mpn/x86/k6/k62mmx/lshift.asm -@@ -292,3 +292,4 @@ deflit(`FRAME',4) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/k62mmx/rshift.asm b/mpn/x86/k6/k62mmx/rshift.asm -index f604a7b..bd673f3 100644 ---- a/mpn/x86/k6/k62mmx/rshift.asm -+++ b/mpn/x86/k6/k62mmx/rshift.asm -@@ -291,3 +291,4 @@ L(finish_even): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mmx/com.asm b/mpn/x86/k6/mmx/com.asm -index b747454..646d16b 100644 ---- a/mpn/x86/k6/mmx/com.asm -+++ b/mpn/x86/k6/mmx/com.asm -@@ -101,3 +101,4 @@ L(no_extra): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mmx/logops_n.asm b/mpn/x86/k6/mmx/logops_n.asm -index e17930b..acfd7df 100644 ---- a/mpn/x86/k6/mmx/logops_n.asm -+++ b/mpn/x86/k6/mmx/logops_n.asm -@@ -224,3 +224,4 @@ L(no_extra): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mmx/lshift.asm b/mpn/x86/k6/mmx/lshift.asm -index 45be582..eee1eb8 100644 ---- a/mpn/x86/k6/mmx/lshift.asm -+++ b/mpn/x86/k6/mmx/lshift.asm -@@ -128,3 +128,4 @@ L(top): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mmx/popham.asm b/mpn/x86/k6/mmx/popham.asm -index 2b19d0b..efeb1b4 100644 ---- a/mpn/x86/k6/mmx/popham.asm -+++ b/mpn/x86/k6/mmx/popham.asm -@@ -234,3 +234,4 @@ HAM(` nop C code alignment') - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mmx/rshift.asm b/mpn/x86/k6/mmx/rshift.asm -index cd0382f..ae53711 100644 ---- a/mpn/x86/k6/mmx/rshift.asm -+++ b/mpn/x86/k6/mmx/rshift.asm -@@ -128,3 +128,4 @@ Zdisp( movd, %mm0, 0,(%ecx,%eax,4)) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mod_34lsub1.asm b/mpn/x86/k6/mod_34lsub1.asm -index 7e30503..05f8979 100644 ---- a/mpn/x86/k6/mod_34lsub1.asm -+++ b/mpn/x86/k6/mod_34lsub1.asm -@@ -188,3 +188,4 @@ L(combine): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mul_1.asm b/mpn/x86/k6/mul_1.asm -index 3ef7ec2..2139f36 100644 ---- a/mpn/x86/k6/mul_1.asm -+++ b/mpn/x86/k6/mul_1.asm -@@ -290,3 +290,4 @@ L(finish_not_one): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/mul_basecase.asm b/mpn/x86/k6/mul_basecase.asm -index 7030001..ab202a2 100644 ---- a/mpn/x86/k6/mul_basecase.asm -+++ b/mpn/x86/k6/mul_basecase.asm -@@ -610,3 +610,4 @@ Zdisp( addl, %ecx, disp0,(%edi)) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/pre_mod_1.asm b/mpn/x86/k6/pre_mod_1.asm -index 34db20d..1e4cb17 100644 ---- a/mpn/x86/k6/pre_mod_1.asm -+++ b/mpn/x86/k6/pre_mod_1.asm -@@ -144,3 +144,4 @@ L(q1_ff): - - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k6/sqr_basecase.asm b/mpn/x86/k6/sqr_basecase.asm -index b7ecb5c..f3a101a 100644 ---- a/mpn/x86/k6/sqr_basecase.asm -+++ b/mpn/x86/k6/sqr_basecase.asm -@@ -678,3 +678,4 @@ L(pic_calc): - - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/aors_n.asm b/mpn/x86/k7/aors_n.asm -index 1a08072..bfdf3d4 100644 ---- a/mpn/x86/k7/aors_n.asm -+++ b/mpn/x86/k7/aors_n.asm -@@ -256,3 +256,4 @@ L(even): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/com.asm b/mpn/x86/k7/mmx/com.asm -index a258c22..cf48fac 100644 ---- a/mpn/x86/k7/mmx/com.asm -+++ b/mpn/x86/k7/mmx/com.asm -@@ -123,3 +123,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/copyd.asm b/mpn/x86/k7/mmx/copyd.asm -index 59ece40..3bc9ff8 100644 ---- a/mpn/x86/k7/mmx/copyd.asm -+++ b/mpn/x86/k7/mmx/copyd.asm -@@ -142,3 +142,4 @@ L(done): - - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/copyi.asm b/mpn/x86/k7/mmx/copyi.asm -index 9a28f92..f0648fa 100644 ---- a/mpn/x86/k7/mmx/copyi.asm -+++ b/mpn/x86/k7/mmx/copyi.asm -@@ -155,3 +155,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/divrem_1.asm b/mpn/x86/k7/mmx/divrem_1.asm -index cf34328..370bfbb 100644 ---- a/mpn/x86/k7/mmx/divrem_1.asm -+++ b/mpn/x86/k7/mmx/divrem_1.asm -@@ -830,3 +830,4 @@ L(fraction_entry): - jmp L(fraction_done) - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/lshift.asm b/mpn/x86/k7/mmx/lshift.asm -index b3383cf..4140e82 100644 ---- a/mpn/x86/k7/mmx/lshift.asm -+++ b/mpn/x86/k7/mmx/lshift.asm -@@ -479,3 +479,4 @@ L(end_even_unaligned): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/popham.asm b/mpn/x86/k7/mmx/popham.asm -index 95965b7..f29540a 100644 ---- a/mpn/x86/k7/mmx/popham.asm -+++ b/mpn/x86/k7/mmx/popham.asm -@@ -211,3 +211,4 @@ L(loaded): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mmx/rshift.asm b/mpn/x86/k7/mmx/rshift.asm -index 345d23a..0da1f93 100644 ---- a/mpn/x86/k7/mmx/rshift.asm -+++ b/mpn/x86/k7/mmx/rshift.asm -@@ -478,3 +478,4 @@ L(end_even_unaligned): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mod_1_1.asm b/mpn/x86/k7/mod_1_1.asm -index 1bbe6f9..8da9519 100644 ---- a/mpn/x86/k7/mod_1_1.asm -+++ b/mpn/x86/k7/mod_1_1.asm -@@ -219,3 +219,4 @@ PROLOGUE(mpn_mod_1_1p_cps) - pop %ebp - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mod_1_4.asm b/mpn/x86/k7/mod_1_4.asm -index bb7597e..fe1da5b 100644 ---- a/mpn/x86/k7/mod_1_4.asm -+++ b/mpn/x86/k7/mod_1_4.asm -@@ -258,3 +258,4 @@ C CAUTION: This is the same code as in pentium4/sse2/mod_1_4.asm - pop %ebp - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mod_34lsub1.asm b/mpn/x86/k7/mod_34lsub1.asm -index ee3ad04..0c1b8c8 100644 ---- a/mpn/x86/k7/mod_34lsub1.asm -+++ b/mpn/x86/k7/mod_34lsub1.asm -@@ -186,3 +186,4 @@ L(combine): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/mul_basecase.asm b/mpn/x86/k7/mul_basecase.asm -index 4dfb500..b96fda7 100644 ---- a/mpn/x86/k7/mul_basecase.asm -+++ b/mpn/x86/k7/mul_basecase.asm -@@ -600,3 +600,4 @@ deflit(`disp1', eval(disp0-0 + 4)) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/k7/sqr_basecase.asm b/mpn/x86/k7/sqr_basecase.asm -index 7b6a97e..df47ee4 100644 ---- a/mpn/x86/k7/sqr_basecase.asm -+++ b/mpn/x86/k7/sqr_basecase.asm -@@ -633,3 +633,4 @@ L(diag): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/lshift.asm b/mpn/x86/lshift.asm -index 6ee6153..95f5321 100644 ---- a/mpn/x86/lshift.asm -+++ b/mpn/x86/lshift.asm -@@ -104,3 +104,4 @@ L(end): shll %cl,%ebx C compute least significant limb - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/mmx/sec_tabselect.asm b/mpn/x86/mmx/sec_tabselect.asm -index aae158a..543dec1 100644 ---- a/mpn/x86/mmx/sec_tabselect.asm -+++ b/mpn/x86/mmx/sec_tabselect.asm -@@ -161,3 +161,4 @@ L(b00): pop %ebp - emms - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/mod_34lsub1.asm b/mpn/x86/mod_34lsub1.asm -index e09e702..df52d37 100644 ---- a/mpn/x86/mod_34lsub1.asm -+++ b/mpn/x86/mod_34lsub1.asm -@@ -181,3 +181,4 @@ L(combine): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/mul_1.asm b/mpn/x86/mul_1.asm -index 421de62..dbbc0e3 100644 ---- a/mpn/x86/mul_1.asm -+++ b/mpn/x86/mul_1.asm -@@ -138,3 +138,4 @@ L(end): movl %ebx,%eax - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/mul_basecase.asm b/mpn/x86/mul_basecase.asm -index 8339732..c32fd7e 100644 ---- a/mpn/x86/mul_basecase.asm -+++ b/mpn/x86/mul_basecase.asm -@@ -221,3 +221,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/aors_n.asm b/mpn/x86/p6/aors_n.asm -index df51c2e..ab172df 100644 ---- a/mpn/x86/p6/aors_n.asm -+++ b/mpn/x86/p6/aors_n.asm -@@ -90,7 +90,7 @@ L(here): - ') - - shr %edx C set cy flag -- jmp *%eax -+ X86_NOTRACK jmp *%eax - - ifdef(`PIC',` - L(pic_calc): -@@ -154,3 +154,4 @@ PROLOGUE(func_nc) - movl 20(%esp), %edx - jmp L(start) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/aorsmul_1.asm b/mpn/x86/p6/aorsmul_1.asm -index bc8c49c..2a3b122 100644 ---- a/mpn/x86/p6/aorsmul_1.asm -+++ b/mpn/x86/p6/aorsmul_1.asm -@@ -240,7 +240,7 @@ L(here): - cmovnz( %ebx, %ecx) C high,low carry other way around - cmovnz( %eax, %ebx) - -- jmp *%edx -+ X86_NOTRACK jmp *%edx - - - ifdef(`PIC',` -@@ -318,3 +318,4 @@ deflit(`disp0', eval(UNROLL_BYTES ifelse(UNROLL_BYTES,256,-128))) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/copyd.asm b/mpn/x86/p6/copyd.asm -index 1be7636..bd42da1 100644 ---- a/mpn/x86/p6/copyd.asm -+++ b/mpn/x86/p6/copyd.asm -@@ -176,3 +176,4 @@ L(zero): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/gcd_11.asm b/mpn/x86/p6/gcd_11.asm -index 80e055e..a7fc6a8 100644 ---- a/mpn/x86/p6/gcd_11.asm -+++ b/mpn/x86/p6/gcd_11.asm -@@ -81,3 +81,4 @@ L(end): mov %edx, %eax - pop %edi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/lshsub_n.asm b/mpn/x86/p6/lshsub_n.asm -index 7ada213..17db5d5 100644 ---- a/mpn/x86/p6/lshsub_n.asm -+++ b/mpn/x86/p6/lshsub_n.asm -@@ -82,7 +82,7 @@ L(here): - pxor %mm1, %mm1 - pxor %mm0, %mm0 - -- jmp *%eax -+ X86_NOTRACK jmp *%eax - - ifdef(`PIC',` - L(pic_calc): -@@ -167,3 +167,4 @@ L(ent): mov 0(up,n,4), %eax - jmp L(top) - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/mmx/divrem_1.asm b/mpn/x86/p6/mmx/divrem_1.asm -index 5300616..b6057dd 100644 ---- a/mpn/x86/p6/mmx/divrem_1.asm -+++ b/mpn/x86/p6/mmx/divrem_1.asm -@@ -765,3 +765,4 @@ L(fraction_top): - jmp L(fraction_done) - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/mod_34lsub1.asm b/mpn/x86/p6/mod_34lsub1.asm -index b88ab5d..46b3806 100644 ---- a/mpn/x86/p6/mod_34lsub1.asm -+++ b/mpn/x86/p6/mod_34lsub1.asm -@@ -188,3 +188,4 @@ L(done_0): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/mul_basecase.asm b/mpn/x86/p6/mul_basecase.asm -index d87bc12..521b31e 100644 ---- a/mpn/x86/p6/mul_basecase.asm -+++ b/mpn/x86/p6/mul_basecase.asm -@@ -524,7 +524,7 @@ L(unroll_outer_entry): - xorl %eax, %ebx C carries other way for odd index - xorl %eax, %ecx - -- jmp *%edx -+ X86_NOTRACK jmp *%edx - - - C ----------------------------------------------------------------------------- -@@ -605,3 +605,4 @@ deflit(`disp1', eval(disp0 + 4)) - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/p6/sqr_basecase.asm b/mpn/x86/p6/sqr_basecase.asm -index 8fc7fdf..f71304f 100644 ---- a/mpn/x86/p6/sqr_basecase.asm -+++ b/mpn/x86/p6/sqr_basecase.asm -@@ -447,7 +447,7 @@ define(cmovX,`ifelse(eval(UNROLL_COUNT%2),1,`cmovz($@)',`cmovnz($@)')') - cmovX( %ebx, %ecx) C high carry reverse - cmovX( %eax, %ebx) C low carry reverse - movl %edx, VAR_JMP -- jmp *%edx -+ X86_NOTRACK jmp *%edx - - - C Must be on an even address here so the low bit of the jump address -@@ -647,3 +647,4 @@ L(pic_calc): - - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/aors_n.asm b/mpn/x86/pentium/aors_n.asm -index 01ebfb9..ca124a5 100644 ---- a/mpn/x86/pentium/aors_n.asm -+++ b/mpn/x86/pentium/aors_n.asm -@@ -201,3 +201,4 @@ L(end2): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/aorsmul_1.asm b/mpn/x86/pentium/aorsmul_1.asm -index d83cc45..5cec8b3 100644 ---- a/mpn/x86/pentium/aorsmul_1.asm -+++ b/mpn/x86/pentium/aorsmul_1.asm -@@ -142,3 +142,4 @@ L(top): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/com.asm b/mpn/x86/pentium/com.asm -index b080545..00064ff 100644 ---- a/mpn/x86/pentium/com.asm -+++ b/mpn/x86/pentium/com.asm -@@ -179,3 +179,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/copyd.asm b/mpn/x86/pentium/copyd.asm -index 72a543b..c7f74b5 100644 ---- a/mpn/x86/pentium/copyd.asm -+++ b/mpn/x86/pentium/copyd.asm -@@ -144,3 +144,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/copyi.asm b/mpn/x86/pentium/copyi.asm -index d983d6b..bc7744e 100644 ---- a/mpn/x86/pentium/copyi.asm -+++ b/mpn/x86/pentium/copyi.asm -@@ -162,3 +162,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/logops_n.asm b/mpn/x86/pentium/logops_n.asm -index 1877317..41a9477 100644 ---- a/mpn/x86/pentium/logops_n.asm -+++ b/mpn/x86/pentium/logops_n.asm -@@ -174,3 +174,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/lshift.asm b/mpn/x86/pentium/lshift.asm -index 2a31f36..68cba52 100644 ---- a/mpn/x86/pentium/lshift.asm -+++ b/mpn/x86/pentium/lshift.asm -@@ -241,3 +241,4 @@ L(L1): movl %edx,(%edi) C store last limb - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mmx/lshift.asm b/mpn/x86/pentium/mmx/lshift.asm -index 04b0ddc..9e18c86 100644 ---- a/mpn/x86/pentium/mmx/lshift.asm -+++ b/mpn/x86/pentium/mmx/lshift.asm -@@ -461,3 +461,4 @@ L(finish_zero_unaligned): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mmx/mul_1.asm b/mpn/x86/pentium/mmx/mul_1.asm -index 4ced577..b04a718 100644 ---- a/mpn/x86/pentium/mmx/mul_1.asm -+++ b/mpn/x86/pentium/mmx/mul_1.asm -@@ -369,3 +369,4 @@ L(small_done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mmx/rshift.asm b/mpn/x86/pentium/mmx/rshift.asm -index e3b274b..5493d20 100644 ---- a/mpn/x86/pentium/mmx/rshift.asm -+++ b/mpn/x86/pentium/mmx/rshift.asm -@@ -466,3 +466,4 @@ L(finish_zero_unaligned): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mod_34lsub1.asm b/mpn/x86/pentium/mod_34lsub1.asm -index 2d88223..0945de8 100644 ---- a/mpn/x86/pentium/mod_34lsub1.asm -+++ b/mpn/x86/pentium/mod_34lsub1.asm -@@ -190,3 +190,4 @@ L(combine): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mul_1.asm b/mpn/x86/pentium/mul_1.asm -index a0858af..2c49130 100644 ---- a/mpn/x86/pentium/mul_1.asm -+++ b/mpn/x86/pentium/mul_1.asm -@@ -175,3 +175,4 @@ L(top): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mul_2.asm b/mpn/x86/pentium/mul_2.asm -index 4c7beb5..e94e071 100644 ---- a/mpn/x86/pentium/mul_2.asm -+++ b/mpn/x86/pentium/mul_2.asm -@@ -148,3 +148,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/mul_basecase.asm b/mpn/x86/pentium/mul_basecase.asm -index e1d0f05..ff269bb 100644 ---- a/mpn/x86/pentium/mul_basecase.asm -+++ b/mpn/x86/pentium/mul_basecase.asm -@@ -140,3 +140,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/rshift.asm b/mpn/x86/pentium/rshift.asm -index 2105c4c..d98080d 100644 ---- a/mpn/x86/pentium/rshift.asm -+++ b/mpn/x86/pentium/rshift.asm -@@ -241,3 +241,4 @@ L(L1): movl %edx,(%edi) C store last limb - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium/sqr_basecase.asm b/mpn/x86/pentium/sqr_basecase.asm -index b11d767..ee64eb3 100644 ---- a/mpn/x86/pentium/sqr_basecase.asm -+++ b/mpn/x86/pentium/sqr_basecase.asm -@@ -526,3 +526,4 @@ L(diag): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/copyd.asm b/mpn/x86/pentium4/copyd.asm -index 82af81c..bf06a05 100644 ---- a/mpn/x86/pentium4/copyd.asm -+++ b/mpn/x86/pentium4/copyd.asm -@@ -69,3 +69,4 @@ L(end): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/copyi.asm b/mpn/x86/pentium4/copyi.asm -index b614887..acbb3f4 100644 ---- a/mpn/x86/pentium4/copyi.asm -+++ b/mpn/x86/pentium4/copyi.asm -@@ -91,3 +91,4 @@ L(replmovs): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/mmx/popham.asm b/mpn/x86/pentium4/mmx/popham.asm -index 9563cb5..f7a6124 100644 ---- a/mpn/x86/pentium4/mmx/popham.asm -+++ b/mpn/x86/pentium4/mmx/popham.asm -@@ -201,3 +201,4 @@ L(loaded): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/add_n.asm b/mpn/x86/pentium4/sse2/add_n.asm -index 8e2380e..e329635 100644 ---- a/mpn/x86/pentium4/sse2/add_n.asm -+++ b/mpn/x86/pentium4/sse2/add_n.asm -@@ -99,3 +99,4 @@ L(top): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/addlsh1_n.asm b/mpn/x86/pentium4/sse2/addlsh1_n.asm -index 93b63b2..e801f7b 100644 ---- a/mpn/x86/pentium4/sse2/addlsh1_n.asm -+++ b/mpn/x86/pentium4/sse2/addlsh1_n.asm -@@ -106,3 +106,4 @@ L(top): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/addmul_1.asm b/mpn/x86/pentium4/sse2/addmul_1.asm -index 7810207..62a7675 100644 ---- a/mpn/x86/pentium4/sse2/addmul_1.asm -+++ b/mpn/x86/pentium4/sse2/addmul_1.asm -@@ -187,3 +187,4 @@ PROLOGUE(mpn_addmul_1c) - movd 20(%esp), %mm6 - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/cnd_add_n.asm b/mpn/x86/pentium4/sse2/cnd_add_n.asm -index b3f3474..7183b94 100644 ---- a/mpn/x86/pentium4/sse2/cnd_add_n.asm -+++ b/mpn/x86/pentium4/sse2/cnd_add_n.asm -@@ -93,3 +93,4 @@ L(top): movd (%ebx,%ecx,4), %mm2 - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/cnd_sub_n.asm b/mpn/x86/pentium4/sse2/cnd_sub_n.asm -index 339a23e..ba0fc47 100644 ---- a/mpn/x86/pentium4/sse2/cnd_sub_n.asm -+++ b/mpn/x86/pentium4/sse2/cnd_sub_n.asm -@@ -112,3 +112,4 @@ L(done_mm1): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/divrem_1.asm b/mpn/x86/pentium4/sse2/divrem_1.asm -index 0146fab..d8619e0 100644 ---- a/mpn/x86/pentium4/sse2/divrem_1.asm -+++ b/mpn/x86/pentium4/sse2/divrem_1.asm -@@ -643,3 +643,4 @@ L(fraction_top): - jmp L(fraction_done) - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/mod_1_1.asm b/mpn/x86/pentium4/sse2/mod_1_1.asm -index ee88bab..2e5a514 100644 ---- a/mpn/x86/pentium4/sse2/mod_1_1.asm -+++ b/mpn/x86/pentium4/sse2/mod_1_1.asm -@@ -164,3 +164,4 @@ C CAUTION: This is the same code as in k7/mod_1_1.asm - pop %ebp - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/mod_1_4.asm b/mpn/x86/pentium4/sse2/mod_1_4.asm -index eb2edb6..5ef3c4a 100644 ---- a/mpn/x86/pentium4/sse2/mod_1_4.asm -+++ b/mpn/x86/pentium4/sse2/mod_1_4.asm -@@ -267,3 +267,4 @@ C CAUTION: This is the same code as in k7/mod_1_4.asm - pop %ebp - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/mod_34lsub1.asm b/mpn/x86/pentium4/sse2/mod_34lsub1.asm -index 31e25b7..5b6b9a7 100644 ---- a/mpn/x86/pentium4/sse2/mod_34lsub1.asm -+++ b/mpn/x86/pentium4/sse2/mod_34lsub1.asm -@@ -173,3 +173,4 @@ L(combine): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/mul_1.asm b/mpn/x86/pentium4/sse2/mul_1.asm -index 6347b8b..9e4f3fc 100644 ---- a/mpn/x86/pentium4/sse2/mul_1.asm -+++ b/mpn/x86/pentium4/sse2/mul_1.asm -@@ -162,3 +162,4 @@ PROLOGUE(mpn_mul_1c) - movd 20(%esp), %mm6 - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/mul_basecase.asm b/mpn/x86/pentium4/sse2/mul_basecase.asm -index 6e3775a..0bad756 100644 ---- a/mpn/x86/pentium4/sse2/mul_basecase.asm -+++ b/mpn/x86/pentium4/sse2/mul_basecase.asm -@@ -660,3 +660,4 @@ L(oel3): - pop %esi C 3 - ret C 3 - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/rsh1add_n.asm b/mpn/x86/pentium4/sse2/rsh1add_n.asm -index f421d13..543a637 100644 ---- a/mpn/x86/pentium4/sse2/rsh1add_n.asm -+++ b/mpn/x86/pentium4/sse2/rsh1add_n.asm -@@ -124,3 +124,4 @@ L(done): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/sqr_basecase.asm b/mpn/x86/pentium4/sse2/sqr_basecase.asm -index 2dd57d2..9695d42 100644 ---- a/mpn/x86/pentium4/sse2/sqr_basecase.asm -+++ b/mpn/x86/pentium4/sse2/sqr_basecase.asm -@@ -703,3 +703,4 @@ L(diag): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/sub_n.asm b/mpn/x86/pentium4/sse2/sub_n.asm -index 5ba1c01..2cd5b22 100644 ---- a/mpn/x86/pentium4/sse2/sub_n.asm -+++ b/mpn/x86/pentium4/sse2/sub_n.asm -@@ -117,3 +117,4 @@ L(done_mm1): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/pentium4/sse2/submul_1.asm b/mpn/x86/pentium4/sse2/submul_1.asm -index 020675b..1172f0a 100644 ---- a/mpn/x86/pentium4/sse2/submul_1.asm -+++ b/mpn/x86/pentium4/sse2/submul_1.asm -@@ -180,3 +180,4 @@ L(eod): paddq %mm6, %mm4 C add 0xFFFFFFFE00000001 - movd %mm0, 8(%edx) C result - jmp L(rt) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/rshift.asm b/mpn/x86/rshift.asm -index a60dcaa..1cedc0d 100644 ---- a/mpn/x86/rshift.asm -+++ b/mpn/x86/rshift.asm -@@ -106,3 +106,4 @@ L(end): shrl %cl,%ebx C compute most significant limb - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/sec_tabselect.asm b/mpn/x86/sec_tabselect.asm -index c7c2e05..3a8fa17 100644 ---- a/mpn/x86/sec_tabselect.asm -+++ b/mpn/x86/sec_tabselect.asm -@@ -113,3 +113,4 @@ L(outer_end): - pop %edi - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/sqr_basecase.asm b/mpn/x86/sqr_basecase.asm -index 39f8a89..3414b05 100644 ---- a/mpn/x86/sqr_basecase.asm -+++ b/mpn/x86/sqr_basecase.asm -@@ -357,3 +357,4 @@ L(diag): - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/udiv.asm b/mpn/x86/udiv.asm -index a3ee088..2531ef7 100644 ---- a/mpn/x86/udiv.asm -+++ b/mpn/x86/udiv.asm -@@ -50,3 +50,4 @@ deflit(`FRAME',0) - movl %edx, (%ecx) - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/umul.asm b/mpn/x86/umul.asm -index 34fe434..5c1da35 100644 ---- a/mpn/x86/umul.asm -+++ b/mpn/x86/umul.asm -@@ -49,3 +49,4 @@ deflit(`FRAME',0) - movl %edx, %eax - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86/x86-defs.m4 b/mpn/x86/x86-defs.m4 -index 81309b2..b3520d2 100644 ---- a/mpn/x86/x86-defs.m4 -+++ b/mpn/x86/x86-defs.m4 -@@ -123,6 +123,7 @@ m4_assert_defined(`WANT_PROFILING') - TYPE($1,`function') - COFF_TYPE($1) - $1: -+ X86_ENDBR - ifelse(WANT_PROFILING,`prof', ` call_mcount') - ifelse(WANT_PROFILING,`gprof', ` call_mcount') - ifelse(WANT_PROFILING,`instrument',` call_instrument(enter)') -@@ -992,7 +993,11 @@ L(movl_eip_`'substr($2,1)): - - dnl ASM_END - --define(`ASM_END',`load_eip') -+define(`ASM_END', -+`load_eip -+X86_GNU_PROPERTY -+') -+ - - define(`load_eip', `') dnl updated in LEA/LEAL - -diff --git a/mpn/x86_64/addaddmul_1msb0.asm b/mpn/x86_64/addaddmul_1msb0.asm -index 87c21b4..2d03ddb 100644 ---- a/mpn/x86_64/addaddmul_1msb0.asm -+++ b/mpn/x86_64/addaddmul_1msb0.asm -@@ -168,3 +168,4 @@ L(end): cmp $1, R32(n) - pop %r12 - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aorrlsh1_n.asm b/mpn/x86_64/aorrlsh1_n.asm -index 6ee0872..1441a6c 100644 ---- a/mpn/x86_64/aorrlsh1_n.asm -+++ b/mpn/x86_64/aorrlsh1_n.asm -@@ -168,3 +168,4 @@ ifdef(`OPERATION_rsblsh1_n',` - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aorrlshC_n.asm b/mpn/x86_64/aorrlshC_n.asm -index de00154..691abde 100644 ---- a/mpn/x86_64/aorrlshC_n.asm -+++ b/mpn/x86_64/aorrlshC_n.asm -@@ -170,3 +170,4 @@ ifelse(ADDSUB,add,` - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aorrlsh_n.asm b/mpn/x86_64/aorrlsh_n.asm -index 5ca128f..57f0e77 100644 ---- a/mpn/x86_64/aorrlsh_n.asm -+++ b/mpn/x86_64/aorrlsh_n.asm -@@ -174,3 +174,4 @@ L(end): add R32(%rbx), R32(%rbx) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aors_err1_n.asm b/mpn/x86_64/aors_err1_n.asm -index 54d0b3f..8c42ea1 100644 ---- a/mpn/x86_64/aors_err1_n.asm -+++ b/mpn/x86_64/aors_err1_n.asm -@@ -223,3 +223,4 @@ L(end): - pop %rbx - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aors_err2_n.asm b/mpn/x86_64/aors_err2_n.asm -index ce5c2a4..0227e5d 100644 ---- a/mpn/x86_64/aors_err2_n.asm -+++ b/mpn/x86_64/aors_err2_n.asm -@@ -170,3 +170,4 @@ L(end): - pop %rbx - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aors_err3_n.asm b/mpn/x86_64/aors_err3_n.asm -index bb6d0c5..37047db 100644 ---- a/mpn/x86_64/aors_err3_n.asm -+++ b/mpn/x86_64/aors_err3_n.asm -@@ -154,3 +154,4 @@ L(end): - pop %rbx - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aors_n.asm b/mpn/x86_64/aors_n.asm -index d5a314a..b516c4d 100644 ---- a/mpn/x86_64/aors_n.asm -+++ b/mpn/x86_64/aors_n.asm -@@ -176,3 +176,4 @@ L(end): lea 32(up), up - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/aorsmul_1.asm b/mpn/x86_64/aorsmul_1.asm -index dfe4dc4..e3bb2f9 100644 ---- a/mpn/x86_64/aorsmul_1.asm -+++ b/mpn/x86_64/aorsmul_1.asm -@@ -188,3 +188,4 @@ IFDOS(``pop %rdi '') - IFDOS(``pop %rsi '') - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/addmul_2.asm b/mpn/x86_64/atom/addmul_2.asm -index c1dcdc4..c1d9451 100644 ---- a/mpn/x86_64/atom/addmul_2.asm -+++ b/mpn/x86_64/atom/addmul_2.asm -@@ -184,3 +184,4 @@ L(end): mul v1 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/aorrlsh1_n.asm b/mpn/x86_64/atom/aorrlsh1_n.asm -index f44de19..693a302 100644 ---- a/mpn/x86_64/atom/aorrlsh1_n.asm -+++ b/mpn/x86_64/atom/aorrlsh1_n.asm -@@ -236,3 +236,4 @@ IFDOS(` mov 56(%rsp), %r8 ') - sbb R32(%rbp), R32(%rbp) C save acy - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/aorrlsh2_n.asm b/mpn/x86_64/atom/aorrlsh2_n.asm -index 02fb29d..c6ded74 100644 ---- a/mpn/x86_64/atom/aorrlsh2_n.asm -+++ b/mpn/x86_64/atom/aorrlsh2_n.asm -@@ -189,3 +189,4 @@ ifdef(`OPERATION_rsblsh2_n',` - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/lshift.asm b/mpn/x86_64/atom/lshift.asm -index 1b37d5d..894b912 100644 ---- a/mpn/x86_64/atom/lshift.asm -+++ b/mpn/x86_64/atom/lshift.asm -@@ -121,3 +121,4 @@ L(end): shl R8(%rcx), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/lshiftc.asm b/mpn/x86_64/atom/lshiftc.asm -index 7385f8f..40d8fff 100644 ---- a/mpn/x86_64/atom/lshiftc.asm -+++ b/mpn/x86_64/atom/lshiftc.asm -@@ -125,3 +125,4 @@ L(end): shl R8(%rcx), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/mul_2.asm b/mpn/x86_64/atom/mul_2.asm -index 4bc22cd..87414d9 100644 ---- a/mpn/x86_64/atom/mul_2.asm -+++ b/mpn/x86_64/atom/mul_2.asm -@@ -188,3 +188,4 @@ L(end): mul v1 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/rsh1aors_n.asm b/mpn/x86_64/atom/rsh1aors_n.asm -index 6f5f638..f3952c0 100644 ---- a/mpn/x86_64/atom/rsh1aors_n.asm -+++ b/mpn/x86_64/atom/rsh1aors_n.asm -@@ -285,3 +285,4 @@ L(cj1): pop %r15 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/rshift.asm b/mpn/x86_64/atom/rshift.asm -index 29c027d..f4c59e1 100644 ---- a/mpn/x86_64/atom/rshift.asm -+++ b/mpn/x86_64/atom/rshift.asm -@@ -119,3 +119,4 @@ L(end): shr R8(cnt), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/atom/sublsh1_n.asm b/mpn/x86_64/atom/sublsh1_n.asm -index 1306acd..762e1ee 100644 ---- a/mpn/x86_64/atom/sublsh1_n.asm -+++ b/mpn/x86_64/atom/sublsh1_n.asm -@@ -240,3 +240,4 @@ IFDOS(` mov 56(%rsp), %r8 ') - sbb R32(%rbp), R32(%rbp) C save acy - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bd1/addmul_2.asm b/mpn/x86_64/bd1/addmul_2.asm -index b54e91a..b1c149b 100644 ---- a/mpn/x86_64/bd1/addmul_2.asm -+++ b/mpn/x86_64/bd1/addmul_2.asm -@@ -233,3 +233,4 @@ L(end): mul v0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bd1/hamdist.asm b/mpn/x86_64/bd1/hamdist.asm -index 29e78a3..f93ce4d 100644 ---- a/mpn/x86_64/bd1/hamdist.asm -+++ b/mpn/x86_64/bd1/hamdist.asm -@@ -204,3 +204,4 @@ DEF_OBJECT(L(cnsts),16,`JUMPTABSECT') - .byte 0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f - END_OBJECT(L(cnsts)) - ') -+ASM_END() -diff --git a/mpn/x86_64/bd1/mul_2.asm b/mpn/x86_64/bd1/mul_2.asm -index 85fa7aa..e910cee 100644 ---- a/mpn/x86_64/bd1/mul_2.asm -+++ b/mpn/x86_64/bd1/mul_2.asm -@@ -193,3 +193,4 @@ L(end): mov -8(up), %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bd1/mul_basecase.asm b/mpn/x86_64/bd1/mul_basecase.asm -index e47ba58..ebae74d 100644 ---- a/mpn/x86_64/bd1/mul_basecase.asm -+++ b/mpn/x86_64/bd1/mul_basecase.asm -@@ -414,3 +414,4 @@ L(ret2):pop %rbp - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bd1/popcount.asm b/mpn/x86_64/bd1/popcount.asm -index 28ce461..063c2cc 100644 ---- a/mpn/x86_64/bd1/popcount.asm -+++ b/mpn/x86_64/bd1/popcount.asm -@@ -189,3 +189,4 @@ DEF_OBJECT(L(cnsts),16,`JUMPTABSECT') - .byte 0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f - END_OBJECT(L(cnsts)) - ') -+ASM_END() -diff --git a/mpn/x86_64/bd2/gcd_11.asm b/mpn/x86_64/bd2/gcd_11.asm -index b167077..3d1c788 100644 ---- a/mpn/x86_64/bd2/gcd_11.asm -+++ b/mpn/x86_64/bd2/gcd_11.asm -@@ -94,3 +94,4 @@ L(end): mov v0, %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bd2/gcd_22.asm b/mpn/x86_64/bd2/gcd_22.asm -index 070cb3e..491f0d9 100644 ---- a/mpn/x86_64/bd2/gcd_22.asm -+++ b/mpn/x86_64/bd2/gcd_22.asm -@@ -140,3 +140,4 @@ L(end): C mov v0, %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bd4/gcd_11.asm b/mpn/x86_64/bd4/gcd_11.asm -index 4176b85..d172e32 100644 ---- a/mpn/x86_64/bd4/gcd_11.asm -+++ b/mpn/x86_64/bd4/gcd_11.asm -@@ -94,3 +94,4 @@ L(end): C rax = result - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bdiv_dbm1c.asm b/mpn/x86_64/bdiv_dbm1c.asm -index a53bd52..c383ee3 100644 ---- a/mpn/x86_64/bdiv_dbm1c.asm -+++ b/mpn/x86_64/bdiv_dbm1c.asm -@@ -104,3 +104,4 @@ L(lo1): sub %rax, %r8 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bdiv_q_1.asm b/mpn/x86_64/bdiv_q_1.asm -index 85538c9..c983c7f 100644 ---- a/mpn/x86_64/bdiv_q_1.asm -+++ b/mpn/x86_64/bdiv_q_1.asm -@@ -193,3 +193,4 @@ L(one): shr R8(%rcx), %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/aors_n.asm b/mpn/x86_64/bt1/aors_n.asm -index 9b6b5c7..04d81dd 100644 ---- a/mpn/x86_64/bt1/aors_n.asm -+++ b/mpn/x86_64/bt1/aors_n.asm -@@ -157,3 +157,4 @@ PROLOGUE(func_nc) - IFDOS(` mov 56(%rsp), %r8 ') - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/aorsmul_1.asm b/mpn/x86_64/bt1/aorsmul_1.asm -index 41e1d8a..d309321 100644 ---- a/mpn/x86_64/bt1/aorsmul_1.asm -+++ b/mpn/x86_64/bt1/aorsmul_1.asm -@@ -189,3 +189,4 @@ IFDOS(` pop %rdi ') - IFDOS(` pop %rsi ') - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/copyd.asm b/mpn/x86_64/bt1/copyd.asm -index 877714e..23fb80b 100644 ---- a/mpn/x86_64/bt1/copyd.asm -+++ b/mpn/x86_64/bt1/copyd.asm -@@ -89,3 +89,4 @@ L(end): cmp $-4, R32(n) - L(ret): FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/copyi.asm b/mpn/x86_64/bt1/copyi.asm -index ee0f578..25718e6 100644 ---- a/mpn/x86_64/bt1/copyi.asm -+++ b/mpn/x86_64/bt1/copyi.asm -@@ -92,3 +92,4 @@ L(end): cmp $4, R32(n) - L(ret): FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/gcd_11.asm b/mpn/x86_64/bt1/gcd_11.asm -index ef53392..03bc06d 100644 ---- a/mpn/x86_64/bt1/gcd_11.asm -+++ b/mpn/x86_64/bt1/gcd_11.asm -@@ -117,3 +117,4 @@ L(count_better): - bsf u0, cnt - jmp L(shr) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/mul_1.asm b/mpn/x86_64/bt1/mul_1.asm -index 4394d6e..634cb35 100644 ---- a/mpn/x86_64/bt1/mul_1.asm -+++ b/mpn/x86_64/bt1/mul_1.asm -@@ -239,3 +239,4 @@ IFDOS(` pop %rdi ') - IFDOS(` pop %rsi ') - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/mul_basecase.asm b/mpn/x86_64/bt1/mul_basecase.asm -index e7d46bf..1726190 100644 ---- a/mpn/x86_64/bt1/mul_basecase.asm -+++ b/mpn/x86_64/bt1/mul_basecase.asm -@@ -484,3 +484,4 @@ L(ret): pop %r13 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/bt1/sqr_basecase.asm b/mpn/x86_64/bt1/sqr_basecase.asm -index 0e417a1..8f665d1 100644 ---- a/mpn/x86_64/bt1/sqr_basecase.asm -+++ b/mpn/x86_64/bt1/sqr_basecase.asm -@@ -563,3 +563,4 @@ L(esd): add %rbx, w0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/cnd_aors_n.asm b/mpn/x86_64/cnd_aors_n.asm -index 13a2ab3..b720ecb 100644 ---- a/mpn/x86_64/cnd_aors_n.asm -+++ b/mpn/x86_64/cnd_aors_n.asm -@@ -181,3 +181,4 @@ L(end): neg R32(%rax) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/com.asm b/mpn/x86_64/com.asm -index 006acaf..ec72e19 100644 ---- a/mpn/x86_64/com.asm -+++ b/mpn/x86_64/com.asm -@@ -93,3 +93,4 @@ L(e10): movq 24(up,n,8), %r9 - L(ret): FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/copyd.asm b/mpn/x86_64/copyd.asm -index a5e6e59..02ab53f 100644 ---- a/mpn/x86_64/copyd.asm -+++ b/mpn/x86_64/copyd.asm -@@ -91,3 +91,4 @@ L(end): shr R32(n) - mov %r9, -16(rp) - 1: ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/copyi.asm b/mpn/x86_64/copyi.asm -index bafce7a..8c6dbdc 100644 ---- a/mpn/x86_64/copyi.asm -+++ b/mpn/x86_64/copyi.asm -@@ -90,3 +90,4 @@ L(end): shr R32(n) - mov %r9, 16(rp) - 1: ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/aors_err1_n.asm b/mpn/x86_64/core2/aors_err1_n.asm -index 3f875ae..c9c6c36 100644 ---- a/mpn/x86_64/core2/aors_err1_n.asm -+++ b/mpn/x86_64/core2/aors_err1_n.asm -@@ -223,3 +223,4 @@ L(end): - pop %rbx - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/aors_n.asm b/mpn/x86_64/core2/aors_n.asm -index f9e0039..7981b7f 100644 ---- a/mpn/x86_64/core2/aors_n.asm -+++ b/mpn/x86_64/core2/aors_n.asm -@@ -148,3 +148,4 @@ PROLOGUE(func_nc) - IFDOS(` mov 56(%rsp), %r8 ') - jmp L(start) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/aorsmul_1.asm b/mpn/x86_64/core2/aorsmul_1.asm -index a7a5d6e..b2b067a 100644 ---- a/mpn/x86_64/core2/aorsmul_1.asm -+++ b/mpn/x86_64/core2/aorsmul_1.asm -@@ -186,3 +186,4 @@ L(n1): mov 8(rp), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/divrem_1.asm b/mpn/x86_64/core2/divrem_1.asm -index 1b3f139..d41c494 100644 ---- a/mpn/x86_64/core2/divrem_1.asm -+++ b/mpn/x86_64/core2/divrem_1.asm -@@ -241,3 +241,4 @@ L(ret): pop %rbx - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/gcd_11.asm b/mpn/x86_64/core2/gcd_11.asm -index b00451f..b730a55 100644 ---- a/mpn/x86_64/core2/gcd_11.asm -+++ b/mpn/x86_64/core2/gcd_11.asm -@@ -91,3 +91,4 @@ L(end): C rax = result - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/gcd_22.asm b/mpn/x86_64/core2/gcd_22.asm -index b5aa73b..0ccde8a 100644 ---- a/mpn/x86_64/core2/gcd_22.asm -+++ b/mpn/x86_64/core2/gcd_22.asm -@@ -135,3 +135,4 @@ L(end): C mov v0, %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/hamdist.asm b/mpn/x86_64/core2/hamdist.asm -index a78753d..be451d7 100644 ---- a/mpn/x86_64/core2/hamdist.asm -+++ b/mpn/x86_64/core2/hamdist.asm -@@ -208,3 +208,4 @@ DEF_OBJECT(L(cnsts),16,`JUMPTABSECT') - .byte 0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f - .byte 0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f - END_OBJECT(L(cnsts)) -+ASM_END() -diff --git a/mpn/x86_64/core2/logops_n.asm b/mpn/x86_64/core2/logops_n.asm -index 5ff174c..451d556 100644 ---- a/mpn/x86_64/core2/logops_n.asm -+++ b/mpn/x86_64/core2/logops_n.asm -@@ -283,3 +283,4 @@ L(ret): FUNC_EXIT() - ret - EPILOGUE() - ') -+ASM_END() -diff --git a/mpn/x86_64/core2/lshift.asm b/mpn/x86_64/core2/lshift.asm -index 9016a71..62053c2 100644 ---- a/mpn/x86_64/core2/lshift.asm -+++ b/mpn/x86_64/core2/lshift.asm -@@ -143,3 +143,4 @@ L(1): shl R8(cnt), %r9 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/lshiftc.asm b/mpn/x86_64/core2/lshiftc.asm -index c428f13..cdd4e11 100644 ---- a/mpn/x86_64/core2/lshiftc.asm -+++ b/mpn/x86_64/core2/lshiftc.asm -@@ -157,3 +157,4 @@ L(1): shl R8(cnt), %r9 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/mul_basecase.asm b/mpn/x86_64/core2/mul_basecase.asm -index d16be85..0dcf0f8 100644 ---- a/mpn/x86_64/core2/mul_basecase.asm -+++ b/mpn/x86_64/core2/mul_basecase.asm -@@ -347,6 +347,7 @@ L(m2e0):mul v1 - jz L(ret2) - - L(do_am0): -+ X86_ENDBR - push %r15 - push vn_param - -@@ -520,6 +521,7 @@ L(m2e1):mul v1 - jz L(ret2) - - L(do_am1): -+ X86_ENDBR - push %r15 - push vn_param - -@@ -693,6 +695,7 @@ L(m2e2):mul v1 - jz L(ret2) - - L(do_am2): -+ X86_ENDBR - push %r15 - push vn_param - -@@ -866,6 +869,7 @@ L(m2e3):mul v1 - jz L(ret2) - - L(do_am3): -+ X86_ENDBR - push %r15 - push vn_param - -@@ -973,3 +977,4 @@ L(lo3): mul v0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/mullo_basecase.asm b/mpn/x86_64/core2/mullo_basecase.asm -index 0f03d86..11814d5 100644 ---- a/mpn/x86_64/core2/mullo_basecase.asm -+++ b/mpn/x86_64/core2/mullo_basecase.asm -@@ -425,3 +425,4 @@ L(n3): mov (vp_param), %r9 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/popcount.asm b/mpn/x86_64/core2/popcount.asm -index 39d8c5d..5e03ef3 100644 ---- a/mpn/x86_64/core2/popcount.asm -+++ b/mpn/x86_64/core2/popcount.asm -@@ -183,3 +183,4 @@ DEF_OBJECT(L(cnsts),16,`JUMPTABSECT') - .byte 0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f - .byte 0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f,0x0f - END_OBJECT(L(cnsts)) -+ASM_END() -diff --git a/mpn/x86_64/core2/rsh1aors_n.asm b/mpn/x86_64/core2/rsh1aors_n.asm -index 27eed37..5b4fe7e 100644 ---- a/mpn/x86_64/core2/rsh1aors_n.asm -+++ b/mpn/x86_64/core2/rsh1aors_n.asm -@@ -167,3 +167,4 @@ L(end): shrd $1, %rbx, %rbp - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/rshift.asm b/mpn/x86_64/core2/rshift.asm -index 7578a53..86cc804 100644 ---- a/mpn/x86_64/core2/rshift.asm -+++ b/mpn/x86_64/core2/rshift.asm -@@ -141,3 +141,4 @@ L(1): shr R8(cnt), %r9 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/sqr_basecase.asm b/mpn/x86_64/core2/sqr_basecase.asm -index a112c1b..65286b0 100644 ---- a/mpn/x86_64/core2/sqr_basecase.asm -+++ b/mpn/x86_64/core2/sqr_basecase.asm -@@ -982,3 +982,4 @@ L(n3): mov %rax, %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/core2/sublshC_n.asm b/mpn/x86_64/core2/sublshC_n.asm -index 272700d..e30562b 100644 ---- a/mpn/x86_64/core2/sublshC_n.asm -+++ b/mpn/x86_64/core2/sublshC_n.asm -@@ -156,3 +156,4 @@ L(end): shr $RSH, %r11 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreibwl/addmul_1.asm b/mpn/x86_64/coreibwl/addmul_1.asm -index ee7e4ee..4ea5580 100644 ---- a/mpn/x86_64/coreibwl/addmul_1.asm -+++ b/mpn/x86_64/coreibwl/addmul_1.asm -@@ -110,33 +110,39 @@ L(tab): JMPENT( L(f0), L(tab)) - JMPENT( L(f7), L(tab)) - TEXT - --L(f0): mulx( (up), %r10, %r8) -+L(f0): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea -8(up), up - lea -8(rp), rp - lea -1(n), n - jmp L(b0) - --L(f3): mulx( (up), %r9, %rax) -+L(f3): X86_ENDBR -+ mulx( (up), %r9, %rax) - lea 16(up), up - lea -48(rp), rp - jmp L(b3) - --L(f4): mulx( (up), %r10, %r8) -+L(f4): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 24(up), up - lea -40(rp), rp - jmp L(b4) - --L(f5): mulx( (up), %r9, %rax) -+L(f5): X86_ENDBR -+ mulx( (up), %r9, %rax) - lea 32(up), up - lea -32(rp), rp - jmp L(b5) - --L(f6): mulx( (up), %r10, %r8) -+L(f6): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 40(up), up - lea -24(rp), rp - jmp L(b6) - --L(f1): mulx( (up), %r9, %rax) -+L(f1): X86_ENDBR -+ mulx( (up), %r9, %rax) - jrcxz L(1) - jmp L(b1) - L(1): add (rp), %r9 -@@ -156,7 +162,8 @@ ifdef(`PIC', - ` nop;nop;nop;nop', - ` nop;nop;nop;nop;nop;nop;nop;nop;nop;nop;nop') - --L(f2): mulx( (up), %r10, %r8) -+L(f2): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 8(up), up - lea 8(rp), rp - mulx( (up), %r9, %rax) -@@ -200,7 +207,8 @@ L(b3): adox( 48,(rp), %r9) - mulx( (up), %r9, %rax) - jmp L(top) - --L(f7): mulx( (up), %r9, %rax) -+L(f7): X86_ENDBR -+ mulx( (up), %r9, %rax) - lea -16(up), up - lea -16(rp), rp - jmp L(b7) -diff --git a/mpn/x86_64/coreibwl/mul_1.asm b/mpn/x86_64/coreibwl/mul_1.asm -index b7fae2f..77121a5 100644 ---- a/mpn/x86_64/coreibwl/mul_1.asm -+++ b/mpn/x86_64/coreibwl/mul_1.asm -@@ -108,48 +108,56 @@ L(tab): JMPENT( L(f0), L(tab)) - JMPENT( L(f7), L(tab)) - TEXT - --L(f0): mulx( (up), %r10, %r8) -+L(f0): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 56(up), up - lea -8(rp), rp - jmp L(b0) - --L(f3): mulx( (up), %r9, %rax) -+L(f3): X86_ENDBR -+ mulx( (up), %r9, %rax) - lea 16(up), up - lea 16(rp), rp - inc n - jmp L(b3) - --L(f4): mulx( (up), %r10, %r8) -+L(f4): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 24(up), up - lea 24(rp), rp - inc n - jmp L(b4) - --L(f5): mulx( (up), %r9, %rax) -+L(f5): X86_ENDBR -+ mulx( (up), %r9, %rax) - lea 32(up), up - lea 32(rp), rp - inc n - jmp L(b5) - --L(f6): mulx( (up), %r10, %r8) -+L(f6): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 40(up), up - lea 40(rp), rp - inc n - jmp L(b6) - --L(f7): mulx( (up), %r9, %rax) -+L(f7): X86_ENDBR -+ mulx( (up), %r9, %rax) - lea 48(up), up - lea 48(rp), rp - inc n - jmp L(b7) - --L(f1): mulx( (up), %r9, %rax) -+L(f1): X86_ENDBR -+ mulx( (up), %r9, %rax) - test n, n - jnz L(b1) - L(1): mov %r9, (rp) - ret - --L(f2): mulx( (up), %r10, %r8) -+L(f2): X86_ENDBR -+ mulx( (up), %r10, %r8) - lea 8(up), up - lea 8(rp), rp - mulx( (up), %r9, %rax) -diff --git a/mpn/x86_64/coreibwl/mul_basecase.asm b/mpn/x86_64/coreibwl/mul_basecase.asm -index 42ca976..c5e60e7 100644 ---- a/mpn/x86_64/coreibwl/mul_basecase.asm -+++ b/mpn/x86_64/coreibwl/mul_basecase.asm -@@ -157,45 +157,53 @@ ifdef(`PIC', - jmp *(%r10,%rax,8) - ') - --L(mf0): mulx( (up), w2, w3) -+L(mf0): X86_ENDBR -+ mulx( (up), w2, w3) - lea 56(up), up - lea -8(rp), rp - jmp L(mb0) - --L(mf3): mulx( (up), w0, w1) -+L(mf3): X86_ENDBR -+ mulx( (up), w0, w1) - lea 16(up), up - lea 16(rp), rp - inc n - jmp L(mb3) - --L(mf4): mulx( (up), w2, w3) -+L(mf4): X86_ENDBR -+ mulx( (up), w2, w3) - lea 24(up), up - lea 24(rp), rp - inc n - jmp L(mb4) - --L(mf5): mulx( (up), w0, w1) -+L(mf5): X86_ENDBR -+ mulx( (up), w0, w1) - lea 32(up), up - lea 32(rp), rp - inc n - jmp L(mb5) - --L(mf6): mulx( (up), w2, w3) -+L(mf6): X86_ENDBR -+ mulx( (up), w2, w3) - lea 40(up), up - lea 40(rp), rp - inc n - jmp L(mb6) - --L(mf7): mulx( (up), w0, w1) -+L(mf7): X86_ENDBR -+ mulx( (up), w0, w1) - lea 48(up), up - lea 48(rp), rp - inc n - jmp L(mb7) - --L(mf1): mulx( (up), w0, w1) -+L(mf1): X86_ENDBR -+ mulx( (up), w0, w1) - jmp L(mb1) - --L(mf2): mulx( (up), w2, w3) -+L(mf2): X86_ENDBR -+ mulx( (up), w2, w3) - lea 8(up), up - lea 8(rp), rp - mulx( (up), w0, w1) -@@ -256,32 +264,39 @@ L(outer): - lea 8(vp), vp - jmp *jaddr - --L(f0): mulx( 8,(up), w2, w3) -+L(f0): X86_ENDBR -+ mulx( 8,(up), w2, w3) - lea 8(rp,unneg,8), rp - lea -1(n), n - jmp L(b0) - --L(f3): mulx( -16,(up), w0, w1) -+L(f3): X86_ENDBR -+ mulx( -16,(up), w0, w1) - lea -56(rp,unneg,8), rp - jmp L(b3) - --L(f4): mulx( -24,(up), w2, w3) -+L(f4): X86_ENDBR -+ mulx( -24,(up), w2, w3) - lea -56(rp,unneg,8), rp - jmp L(b4) - --L(f5): mulx( -32,(up), w0, w1) -+L(f5): X86_ENDBR -+ mulx( -32,(up), w0, w1) - lea -56(rp,unneg,8), rp - jmp L(b5) - --L(f6): mulx( -40,(up), w2, w3) -+L(f6): X86_ENDBR -+ mulx( -40,(up), w2, w3) - lea -56(rp,unneg,8), rp - jmp L(b6) - --L(f7): mulx( 16,(up), w0, w1) -+L(f7): X86_ENDBR -+ mulx( 16,(up), w0, w1) - lea 8(rp,unneg,8), rp - jmp L(b7) - --L(f1): mulx( (up), w0, w1) -+L(f1): X86_ENDBR -+ mulx( (up), w0, w1) - lea 8(rp,unneg,8), rp - jmp L(b1) - -@@ -303,6 +318,7 @@ L(done): - ret - - L(f2): -+ X86_ENDBR - mulx( -8,(up), w2, w3) - lea 8(rp,unneg,8), rp - mulx( (up), w0, w1) -@@ -367,3 +383,4 @@ L(atab):JMPENT( L(f0), L(atab)) - JMPENT( L(f7), L(atab)) - TEXT - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreibwl/mullo_basecase.asm b/mpn/x86_64/coreibwl/mullo_basecase.asm -index 5cdb209..b3e435b 100644 ---- a/mpn/x86_64/coreibwl/mullo_basecase.asm -+++ b/mpn/x86_64/coreibwl/mullo_basecase.asm -@@ -393,3 +393,4 @@ L(mtab):JMPENT( L(mf7), L(mtab)) - JMPENT( L(mf4), L(mtab)) - JMPENT( L(mf5), L(mtab)) - JMPENT( L(mf6), L(mtab)) -+ASM_END() -diff --git a/mpn/x86_64/coreibwl/sqr_basecase.asm b/mpn/x86_64/coreibwl/sqr_basecase.asm -index e81b01b..cd523cf 100644 ---- a/mpn/x86_64/coreibwl/sqr_basecase.asm -+++ b/mpn/x86_64/coreibwl/sqr_basecase.asm -@@ -181,14 +181,16 @@ ifdef(`PIC', - jmp *(%r10,%rax,8) - ') - --L(mf0): mulx( u0, w0, w1) C up[0]^2 -+L(mf0): X86_ENDBR -+ mulx( u0, w0, w1) C up[0]^2 - add u0, u0 - mulx( 8,(up), w2, w3) - lea 64(up), up - add w1, w2 - jmp L(mb0) - --L(mf3): mulx( u0, w2, w3) C up[0]^2 -+L(mf3): X86_ENDBR -+ mulx( u0, w2, w3) C up[0]^2 - add u0, u0 - mov w2, (rp) - mulx( 8,(up), w0, w1) -@@ -197,7 +199,8 @@ L(mf3): mulx( u0, w2, w3) C up[0]^2 - add w3, w0 - jmp L(mb3) - --L(mf4): mulx( u0, w0, w1) C up[0]^2 -+L(mf4): X86_ENDBR -+ mulx( u0, w0, w1) C up[0]^2 - add u0, u0 - mulx( 8,(up), w2, w3) - mov w0, (rp) -@@ -206,7 +209,8 @@ L(mf4): mulx( u0, w0, w1) C up[0]^2 - add w1, w2 - jmp L(mb4) - --L(mf5): mulx( u0, w2, w3) C up[0]^2 -+L(mf5): X86_ENDBR -+ mulx( u0, w2, w3) C up[0]^2 - add u0, u0 - mulx( 8,(up), w0, w1) - mov w2, (rp) -@@ -215,7 +219,8 @@ L(mf5): mulx( u0, w2, w3) C up[0]^2 - add w3, w0 - jmp L(mb5) - --L(mf6): mulx( u0, w0, w1) C up[0]^2 -+L(mf6): X86_ENDBR -+ mulx( u0, w0, w1) C up[0]^2 - add u0, u0 - mulx( 8,(up), w2, w3) - mov w0, (rp) -@@ -224,7 +229,8 @@ L(mf6): mulx( u0, w0, w1) C up[0]^2 - add w1, w2 - jmp L(mb6) - --L(mf7): mulx( u0, w2, w3) C up[0]^2 -+L(mf7): X86_ENDBR -+ mulx( u0, w2, w3) C up[0]^2 - add u0, u0 - mulx( 8,(up), w0, w1) - mov w2, (rp) -@@ -233,7 +239,8 @@ L(mf7): mulx( u0, w2, w3) C up[0]^2 - add w3, w0 - jmp L(mb7) - --L(mf1): mulx( u0, w2, w3) C up[0]^2 -+L(mf1): X86_ENDBR -+ mulx( u0, w2, w3) C up[0]^2 - add u0, u0 - mulx( 8,(up), w0, w1) - mov w2, (rp) -@@ -242,7 +249,8 @@ L(mf1): mulx( u0, w2, w3) C up[0]^2 - add w3, w0 - jmp L(mb1) - --L(mf2): mulx( u0, w0, w1) C up[0]^2 -+L(mf2): X86_ENDBR -+ mulx( u0, w0, w1) C up[0]^2 - add u0, u0 - mulx( 8,(up), w2, w3) - mov w0, (rp) -@@ -300,7 +308,8 @@ ifdef(`PIC', - - L(ed0): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f7): mov w0, (rp) -+L(f7): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea -64(up,un_save,8), up -@@ -356,7 +365,8 @@ L(b0): mov w0, (rp) - - L(ed1): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f0): mov w0, (rp) -+L(f0): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea -64(up,un_save,8), up -@@ -415,7 +425,8 @@ L(b1): mulx( 8,(up), w2, w3) - - L(ed2): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f1): mov w0, (rp) -+L(f1): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea (up,un_save,8), up -@@ -477,7 +488,8 @@ L(b2): adox( 48,(rp), w0) - - L(ed3): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f2): mov w0, (rp) -+L(f2): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea (up,un_save,8), up -@@ -535,7 +547,8 @@ L(b3): mulx( -16,(up), w0, w1) - - L(ed4): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f3): mov w0, (rp) -+L(f3): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea (up,un_save,8), up -@@ -592,7 +605,8 @@ L(b4): mulx( -24,(up), w2, w3) - - L(ed5): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f4): mov w0, (rp) -+L(f4): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea (up,un_save,8), up -@@ -649,7 +663,8 @@ L(b5): mulx( -32,(up), w0, w1) - - L(ed6): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f5): mov w0, (rp) -+L(f5): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea (up,un_save,8), up -@@ -706,7 +721,8 @@ L(b6): adcx( w1, w2) - - L(ed7): adox( (rp), w0) - adox( %rcx, w1) C relies on rcx = 0 --L(f6): mov w0, (rp) -+L(f6): X86_ENDBR -+ mov w0, (rp) - adc %rcx, w1 C relies on rcx = 0 - mov w1, 8(rp) - lea (up,un_save,8), up -@@ -837,3 +853,4 @@ L(atab):JMPENT( L(f6), L(atab)) - JMPENT( L(f5), L(atab)) - TEXT - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/addmul_2.asm b/mpn/x86_64/coreihwl/addmul_2.asm -index 9d1c405..322037e 100644 ---- a/mpn/x86_64/coreihwl/addmul_2.asm -+++ b/mpn/x86_64/coreihwl/addmul_2.asm -@@ -239,3 +239,4 @@ L(end): mulx( v0, %rax, w3) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/aors_n.asm b/mpn/x86_64/coreihwl/aors_n.asm -index fc99627..f9d89f7 100644 ---- a/mpn/x86_64/coreihwl/aors_n.asm -+++ b/mpn/x86_64/coreihwl/aors_n.asm -@@ -259,3 +259,4 @@ L(tab): JMPENT( L(0), L(tab)) - JMPENT( L(5), L(tab)) - JMPENT( L(6), L(tab)) - JMPENT( L(7), L(tab)) -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/aorsmul_1.asm b/mpn/x86_64/coreihwl/aorsmul_1.asm -index 3f43afa..d01c941 100644 ---- a/mpn/x86_64/coreihwl/aorsmul_1.asm -+++ b/mpn/x86_64/coreihwl/aorsmul_1.asm -@@ -199,3 +199,4 @@ L(ret): pop %r13 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/gcd_22.asm b/mpn/x86_64/coreihwl/gcd_22.asm -index b5863b6..e41731e 100644 ---- a/mpn/x86_64/coreihwl/gcd_22.asm -+++ b/mpn/x86_64/coreihwl/gcd_22.asm -@@ -136,3 +136,4 @@ L(end): mov v0, %rax - L(ret): FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/mul_2.asm b/mpn/x86_64/coreihwl/mul_2.asm -index f1f044f..f48e5d8 100644 ---- a/mpn/x86_64/coreihwl/mul_2.asm -+++ b/mpn/x86_64/coreihwl/mul_2.asm -@@ -174,3 +174,4 @@ L(end): mulx( v1, %rdx, %rax) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/mul_basecase.asm b/mpn/x86_64/coreihwl/mul_basecase.asm -index b2656c8..14826e8 100644 ---- a/mpn/x86_64/coreihwl/mul_basecase.asm -+++ b/mpn/x86_64/coreihwl/mul_basecase.asm -@@ -439,3 +439,4 @@ L(ret2):pop %rbp - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/mullo_basecase.asm b/mpn/x86_64/coreihwl/mullo_basecase.asm -index e65559b..b29352c 100644 ---- a/mpn/x86_64/coreihwl/mullo_basecase.asm -+++ b/mpn/x86_64/coreihwl/mullo_basecase.asm -@@ -420,3 +420,4 @@ L(n3): mov (vp), %r9 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/redc_1.asm b/mpn/x86_64/coreihwl/redc_1.asm -index b1d6c0a..3b09a73 100644 ---- a/mpn/x86_64/coreihwl/redc_1.asm -+++ b/mpn/x86_64/coreihwl/redc_1.asm -@@ -435,3 +435,4 @@ L(ret): pop %r15 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreihwl/sqr_basecase.asm b/mpn/x86_64/coreihwl/sqr_basecase.asm -index 641cdf3..b6ea890 100644 ---- a/mpn/x86_64/coreihwl/sqr_basecase.asm -+++ b/mpn/x86_64/coreihwl/sqr_basecase.asm -@@ -504,3 +504,4 @@ L(dend):adc %rbx, %rdx - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreinhm/aorrlsh_n.asm b/mpn/x86_64/coreinhm/aorrlsh_n.asm -index eed64e7..3f25eea 100644 ---- a/mpn/x86_64/coreinhm/aorrlsh_n.asm -+++ b/mpn/x86_64/coreinhm/aorrlsh_n.asm -@@ -198,3 +198,4 @@ IFDOS(` mov 64(%rsp), %r9 ') C cy - sbb R32(%rbx), R32(%rbx) C initialise CF save register - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreinhm/hamdist.asm b/mpn/x86_64/coreinhm/hamdist.asm -index a5a63e4..a84bcbc 100644 ---- a/mpn/x86_64/coreinhm/hamdist.asm -+++ b/mpn/x86_64/coreinhm/hamdist.asm -@@ -194,3 +194,4 @@ L(tab): JMPENT( L(0), L(tab)) - JMPENT( L(1), L(tab)) - JMPENT( L(2), L(tab)) - JMPENT( L(3), L(tab)) -+ASM_END() -diff --git a/mpn/x86_64/coreinhm/popcount.asm b/mpn/x86_64/coreinhm/popcount.asm -index 0a3c867..24c4ebc 100644 ---- a/mpn/x86_64/coreinhm/popcount.asm -+++ b/mpn/x86_64/coreinhm/popcount.asm -@@ -180,3 +180,4 @@ L(tab): JMPENT( L(0), L(tab)) - JMPENT( L(5), L(tab)) - JMPENT( L(6), L(tab)) - JMPENT( L(7), L(tab)) -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/addmul_2.asm b/mpn/x86_64/coreisbr/addmul_2.asm -index 21f0bf4..45c7b15 100644 ---- a/mpn/x86_64/coreisbr/addmul_2.asm -+++ b/mpn/x86_64/coreisbr/addmul_2.asm -@@ -222,3 +222,4 @@ L(end): mul v1 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/aorrlshC_n.asm b/mpn/x86_64/coreisbr/aorrlshC_n.asm -index 23ace41..6af7da8 100644 ---- a/mpn/x86_64/coreisbr/aorrlshC_n.asm -+++ b/mpn/x86_64/coreisbr/aorrlshC_n.asm -@@ -171,3 +171,4 @@ L(end): shr $RSH, %rbp - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/aorrlsh_n.asm b/mpn/x86_64/coreisbr/aorrlsh_n.asm -index db8ee68..56ca497 100644 ---- a/mpn/x86_64/coreisbr/aorrlsh_n.asm -+++ b/mpn/x86_64/coreisbr/aorrlsh_n.asm -@@ -213,3 +213,4 @@ IFDOS(` mov 64(%rsp), %r9 ') C cy - sbb R32(%rbx), R32(%rbx) C initialise CF save register - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/aors_n.asm b/mpn/x86_64/coreisbr/aors_n.asm -index 61fee3e..d466248 100644 ---- a/mpn/x86_64/coreisbr/aors_n.asm -+++ b/mpn/x86_64/coreisbr/aors_n.asm -@@ -201,3 +201,4 @@ PROLOGUE(func_nc) - IFDOS(` mov 56(%rsp), %r8 ') - jmp L(ent) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/cnd_add_n.asm b/mpn/x86_64/coreisbr/cnd_add_n.asm -index 43abcc8..3d72bf8 100644 ---- a/mpn/x86_64/coreisbr/cnd_add_n.asm -+++ b/mpn/x86_64/coreisbr/cnd_add_n.asm -@@ -172,3 +172,4 @@ L(end): neg R32(%rax) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/cnd_sub_n.asm b/mpn/x86_64/coreisbr/cnd_sub_n.asm -index f55492b..3371269 100644 ---- a/mpn/x86_64/coreisbr/cnd_sub_n.asm -+++ b/mpn/x86_64/coreisbr/cnd_sub_n.asm -@@ -198,3 +198,4 @@ L(end): neg R32(%rax) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/mul_1.asm b/mpn/x86_64/coreisbr/mul_1.asm -index a43a117..1f17293 100644 ---- a/mpn/x86_64/coreisbr/mul_1.asm -+++ b/mpn/x86_64/coreisbr/mul_1.asm -@@ -197,3 +197,4 @@ L(00c): add cin, %r10 - mov 8(up,n,8), %rax - jmp L(L0c) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/mul_2.asm b/mpn/x86_64/coreisbr/mul_2.asm -index 781534d..10f1769 100644 ---- a/mpn/x86_64/coreisbr/mul_2.asm -+++ b/mpn/x86_64/coreisbr/mul_2.asm -@@ -165,3 +165,4 @@ L(end): mul v0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/mul_basecase.asm b/mpn/x86_64/coreisbr/mul_basecase.asm -index 35fd1cc..d5c7e5b 100644 ---- a/mpn/x86_64/coreisbr/mul_basecase.asm -+++ b/mpn/x86_64/coreisbr/mul_basecase.asm -@@ -405,3 +405,4 @@ L(ret2):pop %rbp - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/mullo_basecase.asm b/mpn/x86_64/coreisbr/mullo_basecase.asm -index a41a8ac..acf7776 100644 ---- a/mpn/x86_64/coreisbr/mullo_basecase.asm -+++ b/mpn/x86_64/coreisbr/mullo_basecase.asm -@@ -382,3 +382,4 @@ L(n3): mov (vp_param), %r9 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/rsh1aors_n.asm b/mpn/x86_64/coreisbr/rsh1aors_n.asm -index fd2eaea..eefad99 100644 ---- a/mpn/x86_64/coreisbr/rsh1aors_n.asm -+++ b/mpn/x86_64/coreisbr/rsh1aors_n.asm -@@ -191,3 +191,4 @@ L(end): shrd $1, %rbx, %rbp - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/coreisbr/sqr_basecase.asm b/mpn/x86_64/coreisbr/sqr_basecase.asm -index 46a3612..1600e25 100644 ---- a/mpn/x86_64/coreisbr/sqr_basecase.asm -+++ b/mpn/x86_64/coreisbr/sqr_basecase.asm -@@ -482,3 +482,4 @@ L(dend):add %r8, %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/div_qr_1n_pi1.asm b/mpn/x86_64/div_qr_1n_pi1.asm -index b3d45e2..9fd2633 100644 ---- a/mpn/x86_64/div_qr_1n_pi1.asm -+++ b/mpn/x86_64/div_qr_1n_pi1.asm -@@ -245,3 +245,4 @@ L(q_incr_loop): - lea 8(U1), U1 - jmp L(q_incr_loop) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/div_qr_2n_pi1.asm b/mpn/x86_64/div_qr_2n_pi1.asm -index 5e59a0a..c189c33 100644 ---- a/mpn/x86_64/div_qr_2n_pi1.asm -+++ b/mpn/x86_64/div_qr_2n_pi1.asm -@@ -156,3 +156,4 @@ L(fix): C Unlikely update. u2 >= d1 - sbb d1, u2 - jmp L(bck) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/div_qr_2u_pi1.asm b/mpn/x86_64/div_qr_2u_pi1.asm -index 85af96f..f2ac526 100644 ---- a/mpn/x86_64/div_qr_2u_pi1.asm -+++ b/mpn/x86_64/div_qr_2u_pi1.asm -@@ -198,3 +198,4 @@ L(fix_qh): C Unlikely update. u2 >= d1 - sbb d1, u2 - jmp L(bck_qh) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/dive_1.asm b/mpn/x86_64/dive_1.asm -index 988bdab..1929091 100644 ---- a/mpn/x86_64/dive_1.asm -+++ b/mpn/x86_64/dive_1.asm -@@ -156,3 +156,4 @@ L(one): shr R8(%rcx), %rax - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/divrem_1.asm b/mpn/x86_64/divrem_1.asm -index d4d61ad..edfd893 100644 ---- a/mpn/x86_64/divrem_1.asm -+++ b/mpn/x86_64/divrem_1.asm -@@ -312,3 +312,4 @@ L(ret): pop %rbx - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/divrem_2.asm b/mpn/x86_64/divrem_2.asm -index 20811cc..e10f328 100644 ---- a/mpn/x86_64/divrem_2.asm -+++ b/mpn/x86_64/divrem_2.asm -@@ -190,3 +190,4 @@ L(fix): seta %dl - sbb %r11, %rbx - jmp L(bck) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastavx/copyd.asm b/mpn/x86_64/fastavx/copyd.asm -index 56d472f..a69a624 100644 ---- a/mpn/x86_64/fastavx/copyd.asm -+++ b/mpn/x86_64/fastavx/copyd.asm -@@ -170,3 +170,4 @@ L(bc): test $4, R8(n) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastavx/copyi.asm b/mpn/x86_64/fastavx/copyi.asm -index 7607747..f50aa47 100644 ---- a/mpn/x86_64/fastavx/copyi.asm -+++ b/mpn/x86_64/fastavx/copyi.asm -@@ -167,3 +167,4 @@ L(bc): test $4, R8(n) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/com-palignr.asm b/mpn/x86_64/fastsse/com-palignr.asm -index 69027bc..50cd40f 100644 ---- a/mpn/x86_64/fastsse/com-palignr.asm -+++ b/mpn/x86_64/fastsse/com-palignr.asm -@@ -309,3 +309,4 @@ L(end): test $1, R8(n) - 1: FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/com.asm b/mpn/x86_64/fastsse/com.asm -index c867222..aec7d25 100644 ---- a/mpn/x86_64/fastsse/com.asm -+++ b/mpn/x86_64/fastsse/com.asm -@@ -173,3 +173,4 @@ IFDOS(` add $56, %rsp ') - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/copyd-palignr.asm b/mpn/x86_64/fastsse/copyd-palignr.asm -index fac6f8a..fa1e4a4 100644 ---- a/mpn/x86_64/fastsse/copyd-palignr.asm -+++ b/mpn/x86_64/fastsse/copyd-palignr.asm -@@ -252,3 +252,4 @@ L(end): test $1, R8(n) - 1: FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/copyd.asm b/mpn/x86_64/fastsse/copyd.asm -index b3c4706..ce820c5 100644 ---- a/mpn/x86_64/fastsse/copyd.asm -+++ b/mpn/x86_64/fastsse/copyd.asm -@@ -164,3 +164,4 @@ L(sma): test $8, R8(n) - L(don): FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/copyi-palignr.asm b/mpn/x86_64/fastsse/copyi-palignr.asm -index 9876a47..fb4655f 100644 ---- a/mpn/x86_64/fastsse/copyi-palignr.asm -+++ b/mpn/x86_64/fastsse/copyi-palignr.asm -@@ -298,3 +298,4 @@ L(end): test $1, R8(n) - 1: FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/copyi.asm b/mpn/x86_64/fastsse/copyi.asm -index 97f7865..826caad 100644 ---- a/mpn/x86_64/fastsse/copyi.asm -+++ b/mpn/x86_64/fastsse/copyi.asm -@@ -183,3 +183,4 @@ dnl jnc 1b - L(ret): FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/lshift-movdqu2.asm b/mpn/x86_64/fastsse/lshift-movdqu2.asm -index a05e850..217f2cd 100644 ---- a/mpn/x86_64/fastsse/lshift-movdqu2.asm -+++ b/mpn/x86_64/fastsse/lshift-movdqu2.asm -@@ -180,3 +180,4 @@ L(end8):movq (ap), %xmm0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/lshift.asm b/mpn/x86_64/fastsse/lshift.asm -index 6a17b93..79a5554 100644 ---- a/mpn/x86_64/fastsse/lshift.asm -+++ b/mpn/x86_64/fastsse/lshift.asm -@@ -171,3 +171,4 @@ L(end8):movq (ap), %xmm0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/lshiftc-movdqu2.asm b/mpn/x86_64/fastsse/lshiftc-movdqu2.asm -index 8250910..9f14435 100644 ---- a/mpn/x86_64/fastsse/lshiftc-movdqu2.asm -+++ b/mpn/x86_64/fastsse/lshiftc-movdqu2.asm -@@ -191,3 +191,4 @@ L(end8):movq (ap), %xmm0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/lshiftc.asm b/mpn/x86_64/fastsse/lshiftc.asm -index a616075..a6630cb 100644 ---- a/mpn/x86_64/fastsse/lshiftc.asm -+++ b/mpn/x86_64/fastsse/lshiftc.asm -@@ -181,3 +181,4 @@ L(end8):movq (ap), %xmm0 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/rshift-movdqu2.asm b/mpn/x86_64/fastsse/rshift-movdqu2.asm -index 1e270b1..15bcc02 100644 ---- a/mpn/x86_64/fastsse/rshift-movdqu2.asm -+++ b/mpn/x86_64/fastsse/rshift-movdqu2.asm -@@ -199,3 +199,4 @@ L(bc): dec R32(n) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fastsse/sec_tabselect.asm b/mpn/x86_64/fastsse/sec_tabselect.asm -index e7b7feb..f3b76eb 100644 ---- a/mpn/x86_64/fastsse/sec_tabselect.asm -+++ b/mpn/x86_64/fastsse/sec_tabselect.asm -@@ -202,3 +202,4 @@ IFDOS(` add $88, %rsp ') - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/fat/fat_entry.asm b/mpn/x86_64/fat/fat_entry.asm -index 5f244ac..2322be8 100644 ---- a/mpn/x86_64/fat/fat_entry.asm -+++ b/mpn/x86_64/fat/fat_entry.asm -@@ -207,3 +207,4 @@ PROLOGUE(__gmpn_cpuid) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/gcd_11.asm b/mpn/x86_64/gcd_11.asm -index f9b3bcc..1e5ac68 100644 ---- a/mpn/x86_64/gcd_11.asm -+++ b/mpn/x86_64/gcd_11.asm -@@ -112,3 +112,4 @@ L(shift_alot): - mov u0, %rdx - jmp L(mid) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/gcd_22.asm b/mpn/x86_64/gcd_22.asm -index 78f985f..c3b0b89 100644 ---- a/mpn/x86_64/gcd_22.asm -+++ b/mpn/x86_64/gcd_22.asm -@@ -161,3 +161,4 @@ L(end): C mov v0, %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k10/gcd_22.asm b/mpn/x86_64/k10/gcd_22.asm -index f58b4cc..c7fe668 100644 ---- a/mpn/x86_64/k10/gcd_22.asm -+++ b/mpn/x86_64/k10/gcd_22.asm -@@ -140,3 +140,4 @@ L(end): C mov v0, %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k10/hamdist.asm b/mpn/x86_64/k10/hamdist.asm -index f70494a..d885e2d 100644 ---- a/mpn/x86_64/k10/hamdist.asm -+++ b/mpn/x86_64/k10/hamdist.asm -@@ -107,3 +107,4 @@ L(top): mov (ap,n,8), %r8 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k10/popcount.asm b/mpn/x86_64/k10/popcount.asm -index 3814aea..45bcba5 100644 ---- a/mpn/x86_64/k10/popcount.asm -+++ b/mpn/x86_64/k10/popcount.asm -@@ -79,7 +79,7 @@ C neg R32(%rcx) - - lea L(top)(%rip), %rdx - lea (%rdx,%rcx,2), %rdx -- jmp *%rdx -+ X86_NOTRACK jmp *%rdx - ',` - lea (up,n,8), up - -@@ -101,7 +101,7 @@ C lea (%rcx,%rcx,4), %rcx C 10x - - lea L(top)(%rip), %rdx - add %rcx, %rdx -- jmp *%rdx -+ X86_NOTRACK jmp *%rdx - ') - - ALIGN(32) -@@ -136,3 +136,4 @@ C 1 = n mod 8 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/addmul_2.asm b/mpn/x86_64/k8/addmul_2.asm -index 78bcba1..38caa4d 100644 ---- a/mpn/x86_64/k8/addmul_2.asm -+++ b/mpn/x86_64/k8/addmul_2.asm -@@ -193,3 +193,4 @@ L(end): xor R32(w1), R32(w1) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/aorrlsh_n.asm b/mpn/x86_64/k8/aorrlsh_n.asm -index ff3a184..3ab7050 100644 ---- a/mpn/x86_64/k8/aorrlsh_n.asm -+++ b/mpn/x86_64/k8/aorrlsh_n.asm -@@ -215,3 +215,4 @@ L(cj1): mov %r9, 8(rp,n,8) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/bdiv_q_1.asm b/mpn/x86_64/k8/bdiv_q_1.asm -index 1172b0d..606d54f 100644 ---- a/mpn/x86_64/k8/bdiv_q_1.asm -+++ b/mpn/x86_64/k8/bdiv_q_1.asm -@@ -177,3 +177,4 @@ L(one): shr R8(%rcx), %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/div_qr_1n_pi1.asm b/mpn/x86_64/k8/div_qr_1n_pi1.asm -index 86de08c..e91b809 100644 ---- a/mpn/x86_64/k8/div_qr_1n_pi1.asm -+++ b/mpn/x86_64/k8/div_qr_1n_pi1.asm -@@ -247,3 +247,4 @@ L(q_incr_loop): - lea 8(U1), U1 - jmp L(q_incr_loop) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/mul_basecase.asm b/mpn/x86_64/k8/mul_basecase.asm -index ca2efb9..9126c2b 100644 ---- a/mpn/x86_64/k8/mul_basecase.asm -+++ b/mpn/x86_64/k8/mul_basecase.asm -@@ -335,8 +335,10 @@ C addmul_2 for remaining vp's - C adjusted value of n that is reloaded on each iteration - - L(addmul_outer_0): -+ X86_ENDBR - add $3, un - lea 0(%rip), outer_addr -+ X86_ENDBR - - mov un, n - mov -24(up,un,8), %rax -@@ -348,6 +350,7 @@ L(addmul_outer_0): - jmp L(addmul_entry_0) - - L(addmul_outer_1): -+ X86_ENDBR - mov un, n - mov (up,un,8), %rax - mul v0 -@@ -358,8 +361,10 @@ L(addmul_outer_1): - jmp L(addmul_entry_1) - - L(addmul_outer_2): -+ X86_ENDBR - add $1, un - lea 0(%rip), outer_addr -+ X86_ENDBR - - mov un, n - mov -8(up,un,8), %rax -@@ -372,8 +377,10 @@ L(addmul_outer_2): - jmp L(addmul_entry_2) - - L(addmul_outer_3): -+ X86_ENDBR - add $2, un - lea 0(%rip), outer_addr -+ X86_ENDBR - - mov un, n - mov -16(up,un,8), %rax -@@ -467,3 +474,4 @@ L(ret): pop %r15 - ret - - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/mullo_basecase.asm b/mpn/x86_64/k8/mullo_basecase.asm -index fa00f42..4a931a5 100644 ---- a/mpn/x86_64/k8/mullo_basecase.asm -+++ b/mpn/x86_64/k8/mullo_basecase.asm -@@ -99,12 +99,14 @@ dnl JMPENT( L(2m4), L(tab)) C 10 - dnl JMPENT( L(3m4), L(tab)) C 11 - TEXT - --L(1): imul %r8, %rax -+L(1): X86_ENDBR -+ imul %r8, %rax - mov %rax, (rp) - FUNC_EXIT() - ret - --L(2): mov 8(vp_param), %r11 -+L(2): X86_ENDBR -+ mov 8(vp_param), %r11 - imul %rax, %r11 C u0 x v1 - mul %r8 C u0 x v0 - mov %rax, (rp) -@@ -115,7 +117,8 @@ L(2): mov 8(vp_param), %r11 - FUNC_EXIT() - ret - --L(3): mov 8(vp_param), %r9 C v1 -+L(3): X86_ENDBR -+ mov 8(vp_param), %r9 C v1 - mov 16(vp_param), %r11 - mul %r8 C u0 x v0 -> - mov %rax, (rp) C r0 -@@ -335,6 +338,7 @@ L(mul_2_entry_1): - - - L(addmul_outer_1): -+ X86_ENDBR - lea -2(n), j - mov -16(up,n,8), %rax - mul v0 -@@ -346,6 +350,7 @@ L(addmul_outer_1): - jmp L(addmul_entry_1) - - L(addmul_outer_3): -+ X86_ENDBR - lea 0(n), j - mov -16(up,n,8), %rax - xor R32(w3), R32(w3) -@@ -434,3 +439,4 @@ L(ret): pop %r15 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/mulmid_basecase.asm b/mpn/x86_64/k8/mulmid_basecase.asm -index 86f1414..7d5f158 100644 ---- a/mpn/x86_64/k8/mulmid_basecase.asm -+++ b/mpn/x86_64/k8/mulmid_basecase.asm -@@ -329,6 +329,7 @@ C addmul_2 for remaining vp's - - ALIGN(16) - L(addmul_prologue_0): -+ X86_ENDBR - mov -8(up,n,8), %rax - mul v1 - mov %rax, w1 -@@ -338,6 +339,7 @@ L(addmul_prologue_0): - - ALIGN(16) - L(addmul_prologue_1): -+ X86_ENDBR - mov 16(up,n,8), %rax - mul v1 - mov %rax, w0 -@@ -348,6 +350,7 @@ L(addmul_prologue_1): - - ALIGN(16) - L(addmul_prologue_2): -+ X86_ENDBR - mov 8(up,n,8), %rax - mul v1 - mov %rax, w3 -@@ -357,6 +360,7 @@ L(addmul_prologue_2): - - ALIGN(16) - L(addmul_prologue_3): -+ X86_ENDBR - mov (up,n,8), %rax - mul v1 - mov %rax, w2 -@@ -471,6 +475,7 @@ L(diag_prologue_0): - mov vp, vp_inner - mov vn, n - lea 0(%rip), outer_addr -+ X86_ENDBR - mov -8(up,n,8), %rax - jmp L(diag_entry_0) - -@@ -480,6 +485,7 @@ L(diag_prologue_1): - add $3, vn - mov vn, n - lea 0(%rip), outer_addr -+ X86_ENDBR - mov -8(vp_inner), %rax - jmp L(diag_entry_1) - -@@ -489,6 +495,7 @@ L(diag_prologue_2): - add $2, vn - mov vn, n - lea 0(%rip), outer_addr -+ X86_ENDBR - mov 16(vp_inner), %rax - jmp L(diag_entry_2) - -@@ -507,6 +514,7 @@ L(diag_entry_0): - adc %rdx, w1 - adc $0, w2 - L(diag_entry_3): -+ X86_ENDBR - mov -16(up,n,8), %rax - mulq 8(vp_inner) - add %rax, w0 -@@ -557,3 +565,4 @@ L(ret): pop %r15 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/redc_1.asm b/mpn/x86_64/k8/redc_1.asm -index 9327b21..3e241af 100644 ---- a/mpn/x86_64/k8/redc_1.asm -+++ b/mpn/x86_64/k8/redc_1.asm -@@ -125,7 +125,8 @@ L(tab): JMPENT( L(0), L(tab)) - TEXT - - ALIGN(16) --L(1): mov (mp_param), %rax -+L(1): X86_ENDBR -+ mov (mp_param), %rax - mul q0 - add 8(up), %rax - adc 16(up), %rdx -@@ -136,7 +137,8 @@ L(1): mov (mp_param), %rax - - - ALIGN(16) --L(2): mov (mp_param), %rax -+L(2): X86_ENDBR -+ mov (mp_param), %rax - mul q0 - xor R32(%r14), R32(%r14) - mov %rax, %r10 -@@ -171,7 +173,8 @@ L(2): mov (mp_param), %rax - jmp L(ret) - - --L(3): mov (mp_param), %rax -+L(3): X86_ENDBR -+ mov (mp_param), %rax - mul q0 - mov %rax, %rbx - mov %rdx, %r10 -@@ -248,7 +251,7 @@ L(3): mov (mp_param), %rax - - - ALIGN(16) --L(2m4): -+L(2m4): X86_ENDBR - L(lo2): mov (mp,nneg,8), %rax - mul q0 - xor R32(%r14), R32(%r14) -@@ -324,7 +327,7 @@ L(le2): add %r10, (up) - - - ALIGN(16) --L(1m4): -+L(1m4): X86_ENDBR - L(lo1): mov (mp,nneg,8), %rax - xor %r9, %r9 - xor R32(%rbx), R32(%rbx) -@@ -398,7 +401,7 @@ L(le1): add %r10, (up) - - ALIGN(16) - L(0): --L(0m4): -+L(0m4): X86_ENDBR - L(lo0): mov (mp,nneg,8), %rax - mov nneg, i - mul q0 -@@ -463,7 +466,7 @@ L(le0): add %r10, (up) - - - ALIGN(16) --L(3m4): -+L(3m4): X86_ENDBR - L(lo3): mov (mp,nneg,8), %rax - mul q0 - mov %rax, %rbx -@@ -589,3 +592,4 @@ L(ret): pop %r15 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/k8/sqr_basecase.asm b/mpn/x86_64/k8/sqr_basecase.asm -index 60cf945..37858b4 100644 ---- a/mpn/x86_64/k8/sqr_basecase.asm -+++ b/mpn/x86_64/k8/sqr_basecase.asm -@@ -131,7 +131,8 @@ L(tab): JMPENT( L(4), L(tab)) - JMPENT( L(3m4), L(tab)) - TEXT - --L(1): mov (up), %rax -+L(1): X86_ENDBR -+ mov (up), %rax - mul %rax - add $40, %rsp - mov %rax, (rp) -@@ -139,7 +140,8 @@ L(1): mov (up), %rax - FUNC_EXIT() - ret - --L(2): mov (up), %rax -+L(2): X86_ENDBR -+ mov (up), %rax - mov %rax, %r8 - mul %rax - mov 8(up), %r11 -@@ -165,7 +167,8 @@ L(2): mov (up), %rax - FUNC_EXIT() - ret - --L(3): mov (up), %rax -+L(3): X86_ENDBR -+ mov (up), %rax - mov %rax, %r10 - mul %rax - mov 8(up), %r11 -@@ -210,7 +213,8 @@ L(3): mov (up), %rax - FUNC_EXIT() - ret - --L(4): mov (up), %rax -+L(4): X86_ENDBR -+ mov (up), %rax - mov %rax, %r11 - mul %rax - mov 8(up), %rbx -@@ -282,6 +286,7 @@ L(4): mov (up), %rax - - - L(0m4): -+ X86_ENDBR - lea -16(rp,n,8), tp C point tp in middle of result operand - mov (up), v0 - mov 8(up), %rax -@@ -340,6 +345,7 @@ L(L3): xor R32(w1), R32(w1) - - - L(1m4): -+ X86_ENDBR - lea 8(rp,n,8), tp C point tp in middle of result operand - mov (up), v0 C u0 - mov 8(up), %rax C u1 -@@ -418,6 +424,7 @@ L(m2x): mov (up,j,8), %rax - - - L(2m4): -+ X86_ENDBR - lea -16(rp,n,8), tp C point tp in middle of result operand - mov (up), v0 - mov 8(up), %rax -@@ -474,7 +481,7 @@ L(L1): xor R32(w0), R32(w0) - jmp L(dowhile_mid) - - --L(3m4): -+L(3m4): X86_ENDBR - lea 8(rp,n,8), tp C point tp in middle of result operand - mov (up), v0 C u0 - mov 8(up), %rax C u1 -@@ -805,3 +812,4 @@ L(d1): mov %r11, 24(rp,j,8) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/logops_n.asm b/mpn/x86_64/logops_n.asm -index e25854d..b3969ba 100644 ---- a/mpn/x86_64/logops_n.asm -+++ b/mpn/x86_64/logops_n.asm -@@ -258,3 +258,4 @@ L(ret): FUNC_EXIT() - ret - EPILOGUE() - ') -+ASM_END() -diff --git a/mpn/x86_64/lshift.asm b/mpn/x86_64/lshift.asm -index fff3152..4187bdc 100644 ---- a/mpn/x86_64/lshift.asm -+++ b/mpn/x86_64/lshift.asm -@@ -170,3 +170,4 @@ L(ast): mov (up), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/lshiftc.asm b/mpn/x86_64/lshiftc.asm -index c4ba04a..f6fe4c9 100644 ---- a/mpn/x86_64/lshiftc.asm -+++ b/mpn/x86_64/lshiftc.asm -@@ -180,3 +180,4 @@ L(ast): mov (up), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/lshsub_n.asm b/mpn/x86_64/lshsub_n.asm -index 4d428c0..62877d7 100644 ---- a/mpn/x86_64/lshsub_n.asm -+++ b/mpn/x86_64/lshsub_n.asm -@@ -170,3 +170,4 @@ L(end): - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/missing.asm b/mpn/x86_64/missing.asm -index 9b65c89..22dac17 100644 ---- a/mpn/x86_64/missing.asm -+++ b/mpn/x86_64/missing.asm -@@ -128,3 +128,4 @@ PROLOGUE(__gmp_adcx) - ret - EPILOGUE() - PROTECT(__gmp_adcx) -+ASM_END() -diff --git a/mpn/x86_64/mod_1_2.asm b/mpn/x86_64/mod_1_2.asm -index 40fcaeb..fbaae3b 100644 ---- a/mpn/x86_64/mod_1_2.asm -+++ b/mpn/x86_64/mod_1_2.asm -@@ -239,3 +239,4 @@ ifdef(`SHLD_SLOW',` - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/mod_1_4.asm b/mpn/x86_64/mod_1_4.asm -index 6cf304c..8969e42 100644 ---- a/mpn/x86_64/mod_1_4.asm -+++ b/mpn/x86_64/mod_1_4.asm -@@ -270,3 +270,4 @@ ifdef(`SHLD_SLOW',` - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/mod_34lsub1.asm b/mpn/x86_64/mod_34lsub1.asm -index 75421a6..70282b6 100644 ---- a/mpn/x86_64/mod_34lsub1.asm -+++ b/mpn/x86_64/mod_34lsub1.asm -@@ -145,46 +145,55 @@ L(tab): JMPENT( L(0), L(tab)) - JMPENT( L(8), L(tab)) - TEXT - --L(6): add (ap), %rax -+L(6): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - adc 16(ap), %rdx - adc $0, %r9 - add $24, ap --L(3): add (ap), %rax -+L(3): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - adc 16(ap), %rdx - jmp L(cj1) - --L(7): add (ap), %rax -+L(7): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - adc 16(ap), %rdx - adc $0, %r9 - add $24, ap --L(4): add (ap), %rax -+L(4): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - adc 16(ap), %rdx - adc $0, %r9 - add $24, ap --L(1): add (ap), %rax -+L(1): X86_ENDBR -+ add (ap), %rax - adc $0, %rcx - jmp L(cj2) - --L(8): add (ap), %rax -+L(8): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - adc 16(ap), %rdx - adc $0, %r9 - add $24, ap --L(5): add (ap), %rax -+L(5): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - adc 16(ap), %rdx - adc $0, %r9 - add $24, ap --L(2): add (ap), %rax -+L(2): X86_ENDBR -+ add (ap), %rax - adc 8(ap), %rcx - - L(cj2): adc $0, %rdx - L(cj1): adc $0, %r9 --L(0): add %r9, %rax -+L(0): X86_ENDBR -+ add %r9, %rax - adc $0, %rcx - adc $0, %rdx - adc $0, %rax -@@ -213,3 +222,4 @@ L(0): add %r9, %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/mode1o.asm b/mpn/x86_64/mode1o.asm -index 2cd2b08..3377435 100644 ---- a/mpn/x86_64/mode1o.asm -+++ b/mpn/x86_64/mode1o.asm -@@ -169,3 +169,4 @@ L(one): - - EPILOGUE(mpn_modexact_1c_odd) - EPILOGUE(mpn_modexact_1_odd) -+ASM_END() -diff --git a/mpn/x86_64/mul_1.asm b/mpn/x86_64/mul_1.asm -index e1ba89b..44764dd 100644 ---- a/mpn/x86_64/mul_1.asm -+++ b/mpn/x86_64/mul_1.asm -@@ -190,3 +190,4 @@ IFDOS(``pop %rdi '') - IFDOS(``pop %rsi '') - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/mul_2.asm b/mpn/x86_64/mul_2.asm -index d64313b..b6c6bf1 100644 ---- a/mpn/x86_64/mul_2.asm -+++ b/mpn/x86_64/mul_2.asm -@@ -202,3 +202,4 @@ L(m22): mul v1 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/nano/dive_1.asm b/mpn/x86_64/nano/dive_1.asm -index e9a0763..aead4d5 100644 ---- a/mpn/x86_64/nano/dive_1.asm -+++ b/mpn/x86_64/nano/dive_1.asm -@@ -164,3 +164,4 @@ L(one): shr R8(%rcx), %rax - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/pentium4/aors_n.asm b/mpn/x86_64/pentium4/aors_n.asm -index 8e6ee1b..3751e38 100644 ---- a/mpn/x86_64/pentium4/aors_n.asm -+++ b/mpn/x86_64/pentium4/aors_n.asm -@@ -194,3 +194,4 @@ L(ret): mov R32(%rbx), R32(%rax) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/pentium4/mod_34lsub1.asm b/mpn/x86_64/pentium4/mod_34lsub1.asm -index f34b3f0..bf83f62 100644 ---- a/mpn/x86_64/pentium4/mod_34lsub1.asm -+++ b/mpn/x86_64/pentium4/mod_34lsub1.asm -@@ -165,3 +165,4 @@ L(combine): - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/pentium4/rsh1aors_n.asm b/mpn/x86_64/pentium4/rsh1aors_n.asm -index 5528ce4..219a809 100644 ---- a/mpn/x86_64/pentium4/rsh1aors_n.asm -+++ b/mpn/x86_64/pentium4/rsh1aors_n.asm -@@ -332,3 +332,4 @@ L(cj1): or %r14, %rbx - L(c3): mov $1, R8(%rax) - jmp L(rc3) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/pentium4/rshift.asm b/mpn/x86_64/pentium4/rshift.asm -index b7c1ee2..848045f 100644 ---- a/mpn/x86_64/pentium4/rshift.asm -+++ b/mpn/x86_64/pentium4/rshift.asm -@@ -167,3 +167,4 @@ L(ast): movq (up), %mm2 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/popham.asm b/mpn/x86_64/popham.asm -index 3a29b2e..b7ceb17 100644 ---- a/mpn/x86_64/popham.asm -+++ b/mpn/x86_64/popham.asm -@@ -161,3 +161,4 @@ L(end): - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/rsh1aors_n.asm b/mpn/x86_64/rsh1aors_n.asm -index a3e9cc5..797e250 100644 ---- a/mpn/x86_64/rsh1aors_n.asm -+++ b/mpn/x86_64/rsh1aors_n.asm -@@ -187,3 +187,4 @@ L(end): mov %rbx, (rp) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/rshift.asm b/mpn/x86_64/rshift.asm -index 3f344f1..0fc5877 100644 ---- a/mpn/x86_64/rshift.asm -+++ b/mpn/x86_64/rshift.asm -@@ -174,3 +174,4 @@ L(ast): mov (up), %r10 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/sec_tabselect.asm b/mpn/x86_64/sec_tabselect.asm -index e8aed26..5dce3c1 100644 ---- a/mpn/x86_64/sec_tabselect.asm -+++ b/mpn/x86_64/sec_tabselect.asm -@@ -174,3 +174,4 @@ L(b00): pop %r15 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/sqr_diag_addlsh1.asm b/mpn/x86_64/sqr_diag_addlsh1.asm -index f486125..a1d8767 100644 ---- a/mpn/x86_64/sqr_diag_addlsh1.asm -+++ b/mpn/x86_64/sqr_diag_addlsh1.asm -@@ -114,3 +114,4 @@ L(end): add %r10, %r8 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/sublsh1_n.asm b/mpn/x86_64/sublsh1_n.asm -index c6d829f..c18f32a 100644 ---- a/mpn/x86_64/sublsh1_n.asm -+++ b/mpn/x86_64/sublsh1_n.asm -@@ -158,3 +158,4 @@ L(end): add R32(%rbp), R32(%rax) - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/x86_64-defs.m4 b/mpn/x86_64/x86_64-defs.m4 -index 4e08f2a..9fe328e 100644 ---- a/mpn/x86_64/x86_64-defs.m4 -+++ b/mpn/x86_64/x86_64-defs.m4 -@@ -95,6 +95,7 @@ m4_assert_numargs(1) - TYPE($1,`function') - COFF_TYPE($1) - $1: -+ X86_ENDBR - ') - - -@@ -167,6 +168,10 @@ ifdef(`PIC', - `lea $1(%rip), $2') - ') - -+dnl ASM_END -+ -+define(`ASM_END', `X86_GNU_PROPERTY') -+ - - define(`DEF_OBJECT', - m4_assert_numargs_range(2,3) -diff --git a/mpn/x86_64/zen/aorrlsh_n.asm b/mpn/x86_64/zen/aorrlsh_n.asm -index e049b2f..6e6783f 100644 ---- a/mpn/x86_64/zen/aorrlsh_n.asm -+++ b/mpn/x86_64/zen/aorrlsh_n.asm -@@ -102,26 +102,30 @@ ifdef(`PIC',` - jmp *(%r11,%rax,8) - ') - --L(0): lea 32(up), up -+L(0): X86_ENDBR -+ lea 32(up), up - lea 32(vp), vp - lea 32(rp), rp - xor R32(%r11), R32(%r11) - jmp L(e0) - --L(7): mov %r10, %r11 -+L(7): X86_ENDBRmov -+ %r10, %r11 - lea 24(up), up - lea 24(vp), vp - lea 24(rp), rp - xor R32(%r10), R32(%r10) - jmp L(e7) - --L(6): lea 16(up), up -+L(6): X86_ENDBR -+ movlea 16(up), up - lea 16(vp), vp - lea 16(rp), rp - xor R32(%r11), R32(%r11) - jmp L(e6) - --L(5): mov %r10, %r11 -+L(5): X86_ENDBRmov -+ mov %r10, %r11 - lea 8(up), up - lea 8(vp), vp - lea 8(rp), rp -@@ -191,23 +195,27 @@ L(e1): shlx( cnt, %r11, %rax) - lea (%r10,%rax), %rax - jmp L(top) - --L(4): xor R32(%r11), R32(%r11) -+L(4): X86_ENDBRmov -+ xor R32(%r11), R32(%r11) - jmp L(e4) - --L(3): mov %r10, %r11 -+L(3): X86_ENDBRmov -+ mov %r10, %r11 - lea -8(up), up - lea -8(vp), vp - lea -8(rp), rp - xor R32(%r10), R32(%r10) - jmp L(e3) - --L(2): lea -16(up), up -+L(2): X86_ENDBRmov -+ lea -16(up), up - lea -16(vp), vp - lea -16(rp), rp - xor R32(%r11), R32(%r11) - jmp L(e2) - --L(1): mov %r10, %r11 -+L(1): X86_ENDBRmov -+ mov %r10, %r11 - lea -24(up), up - lea 40(vp), vp - lea 40(rp), rp -@@ -224,3 +232,4 @@ L(tab): JMPENT( L(0), L(tab)) - JMPENT( L(5), L(tab)) - JMPENT( L(6), L(tab)) - JMPENT( L(7), L(tab)) -+ASM_END() -diff --git a/mpn/x86_64/zen/mul_basecase.asm b/mpn/x86_64/zen/mul_basecase.asm -index affa3b6..c70d548 100644 ---- a/mpn/x86_64/zen/mul_basecase.asm -+++ b/mpn/x86_64/zen/mul_basecase.asm -@@ -453,3 +453,4 @@ L(wd3): adc %r11, 8(rp) - jne L(3) - jmp L(end) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/zen/mullo_basecase.asm b/mpn/x86_64/zen/mullo_basecase.asm -index 2ae729a..c081698 100644 ---- a/mpn/x86_64/zen/mullo_basecase.asm -+++ b/mpn/x86_64/zen/mullo_basecase.asm -@@ -297,3 +297,4 @@ L(lo0): .byte 0xc4,0xe2,0xe3,0xf6,0x44,0xce,0x18 C mulx 24(up,n,8), %rbx, %rax - inc %r14 - jmp L(outer) - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/zen/sbpi1_bdiv_r.asm b/mpn/x86_64/zen/sbpi1_bdiv_r.asm -index f6e8f9c..277b3c3 100644 ---- a/mpn/x86_64/zen/sbpi1_bdiv_r.asm -+++ b/mpn/x86_64/zen/sbpi1_bdiv_r.asm -@@ -505,3 +505,4 @@ L(ret): mov %rbp, %rax - pop %r15 - ret - EPILOGUE() -+ASM_END() -diff --git a/mpn/x86_64/zen/sqr_basecase.asm b/mpn/x86_64/zen/sqr_basecase.asm -index a7c6127..d185deb 100644 ---- a/mpn/x86_64/zen/sqr_basecase.asm -+++ b/mpn/x86_64/zen/sqr_basecase.asm -@@ -480,3 +480,4 @@ C pop %r14 - FUNC_EXIT() - ret - EPILOGUE() -+ASM_END() --- -2.37.1 - diff --git a/gnutls-3.6.14-configure-fix-soname-detection.patch b/gnutls-3.6.14-configure-fix-soname-detection.patch new file mode 100644 index 0000000..28b33ad --- /dev/null +++ b/gnutls-3.6.14-configure-fix-soname-detection.patch @@ -0,0 +1,60 @@ +From b57b820a3f0464e3151dd675af4f28ad109d683c Mon Sep 17 00:00:00 2001 +From: Vitezslav Cizek +Date: Tue, 9 Jun 2020 13:54:04 +0200 +Subject: [PATCH] configure: improve nettle, gmp, and hogweed soname detection + +Some linkers might optimize away the libraries passed on the +command line if they aren't actually needed, such as gnu ld with +--as-needed. +The ldd output then won't list the shared libraries and the +detection will fail. +Make sure nettle and others are really used. + +Signed-off-by: Vitezslav Cizek +--- + configure.ac | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/configure.ac b/configure.ac +index e4ca66aec..ccbe4e563 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -741,7 +741,10 @@ LIBS=$save_LIBS + save_LIBS=$LIBS + LIBS="$LIBS $GMP_LIBS" + AC_MSG_CHECKING([gmp soname]) +-AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], ++AC_LINK_IFELSE([AC_LANG_PROGRAM([ ++ #include ],[ ++ mpz_t n; ++ mpz_init(n);])], + [gmp_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^libgmp\.so'`], + [gmp_so=none]) + if test -z "$gmp_so"; then +@@ -754,7 +757,10 @@ LIBS=$save_LIBS + save_LIBS=$LIBS + LIBS="$LIBS $NETTLE_LIBS" + AC_MSG_CHECKING([nettle soname]) +-AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], ++AC_LINK_IFELSE([AC_LANG_PROGRAM([ ++ #include ],[ ++ struct sha256_ctx ctx; ++ sha256_init(&ctx);])], + [nettle_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^libnettle\.so'`], + [nettle_so=none]) + if test -z "$nettle_so"; then +@@ -767,7 +773,10 @@ LIBS=$save_LIBS + save_LIBS=$LIBS + LIBS="$LIBS $HOGWEED_LIBS" + AC_MSG_CHECKING([hogweed soname]) +-AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], ++AC_LINK_IFELSE([AC_LANG_PROGRAM([ ++ #include ],[ ++ struct rsa_private_key priv; ++ nettle_rsa_private_key_init(&priv);])], + [hogweed_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^libhogweed\.so'`], + [hogweed_so=none]) + if test -z "$hogweed_so"; then +-- +2.25.4 + diff --git a/gnutls-3.6.14-fix-iovec-memory-leak.patch b/gnutls-3.6.14-fix-iovec-memory-leak.patch new file mode 100644 index 0000000..15b2c51 --- /dev/null +++ b/gnutls-3.6.14-fix-iovec-memory-leak.patch @@ -0,0 +1,152 @@ +From 6fbff7fc8aabeee2254405f254220bbe8c05c67d Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Fri, 5 Jun 2020 16:26:33 +0200 +Subject: [PATCH] crypto-api: always allocate memory when serializing iovec_t + +The AEAD iov interface falls back to serializing the input buffers if +the low-level cipher doesn't support scatter/gather encryption. +However, there was a bug in the functions used for the serialization, +which causes memory leaks under a certain condition (i.e. the number +of input buffers is 1). + +This patch makes the logic of the functions simpler, by removing a +micro-optimization that tries to minimize the number of calls to +malloc/free. + +The original problem was reported by Marius Steffen in: +https://bugzilla.samba.org/show_bug.cgi?id=14399 +and the cause was investigated by Alexander Haase in: +https://gitlab.com/gnutls/gnutls/-/merge_requests/1277 + +Signed-off-by: Daiki Ueno +--- + lib/crypto-api.c | 36 +++++++++++------------------------- + tests/aead-cipher-vec.c | 33 ++++++++++++++++++--------------- + 2 files changed, 29 insertions(+), 40 deletions(-) + +diff --git a/lib/crypto-api.c b/lib/crypto-api.c +index 45be64ed1..8524f5ed4 100644 +--- a/lib/crypto-api.c ++++ b/lib/crypto-api.c +@@ -891,32 +891,23 @@ gnutls_aead_cipher_encrypt(gnutls_aead_cipher_hd_t handle, + struct iov_store_st { + void *data; + size_t size; +- unsigned allocated; + }; + + static void iov_store_free(struct iov_store_st *s) + { +- if (s->allocated) { +- gnutls_free(s->data); +- s->allocated = 0; +- } ++ gnutls_free(s->data); + } + + static int iov_store_grow(struct iov_store_st *s, size_t length) + { +- if (s->allocated || s->data == NULL) { +- s->size += length; +- s->data = gnutls_realloc(s->data, s->size); +- if (s->data == NULL) +- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); +- s->allocated = 1; +- } else { +- void *data = s->data; +- size_t size = s->size + length; +- s->data = gnutls_malloc(size); +- memcpy(s->data, data, s->size); +- s->size += length; +- } ++ void *data; ++ ++ s->size += length; ++ data = gnutls_realloc(s->data, s->size); ++ if (data == NULL) ++ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); ++ ++ s->data = data; + return 0; + } + +@@ -926,11 +917,6 @@ copy_from_iov(struct iov_store_st *dst, const giovec_t *iov, int iovcnt) + memset(dst, 0, sizeof(*dst)); + if (iovcnt == 0) { + return 0; +- } else if (iovcnt == 1) { +- dst->data = iov[0].iov_base; +- dst->size = iov[0].iov_len; +- /* implies: dst->allocated = 0; */ +- return 0; + } else { + int i; + uint8_t *p; +@@ -944,11 +930,11 @@ copy_from_iov(struct iov_store_st *dst, const giovec_t *iov, int iovcnt) + + p = dst->data; + for (i=0;i 0) ++ memcpy(p, iov[i].iov_base, iov[i].iov_len); + p += iov[i].iov_len; + } + +- dst->allocated = 1; + return 0; + } + } +diff --git a/tests/aead-cipher-vec.c b/tests/aead-cipher-vec.c +index fba9010d9..6a30a35f7 100644 +--- a/tests/aead-cipher-vec.c ++++ b/tests/aead-cipher-vec.c +@@ -49,6 +49,7 @@ static void start(const char *name, int algo) + giovec_t auth_iov[2]; + uint8_t tag[64]; + size_t tag_size = 0; ++ size_t i; + + key.data = key16; + key.size = gnutls_cipher_get_key_size(algo); +@@ -82,21 +83,23 @@ static void start(const char *name, int algo) + if (ret < 0) + fail("gnutls_cipher_init: %s\n", gnutls_strerror(ret)); + +- ret = gnutls_aead_cipher_encryptv2(ch, +- iv.data, iv.size, +- auth_iov, 2, +- iov, 3, +- tag, &tag_size); +- if (ret < 0) +- fail("could not encrypt data: %s\n", gnutls_strerror(ret)); +- +- ret = gnutls_aead_cipher_decryptv2(ch, +- iv.data, iv.size, +- auth_iov, 2, +- iov, 3, +- tag, tag_size); +- if (ret < 0) +- fail("could not decrypt data: %s\n", gnutls_strerror(ret)); ++ for (i = 0; i < 2; i++) { ++ ret = gnutls_aead_cipher_encryptv2(ch, ++ iv.data, iv.size, ++ auth_iov, 2, ++ iov, i + 1, ++ tag, &tag_size); ++ if (ret < 0) ++ fail("could not encrypt data: %s\n", gnutls_strerror(ret)); ++ ++ ret = gnutls_aead_cipher_decryptv2(ch, ++ iv.data, iv.size, ++ auth_iov, 2, ++ iov, i + 1, ++ tag, tag_size); ++ if (ret < 0) ++ fail("could not decrypt data: %s\n", gnutls_strerror(ret)); ++ } + + gnutls_aead_cipher_deinit(ch); + } +-- +2.25.4 + diff --git a/gnutls-3.6.15-gnulib-perror-tests.patch b/gnutls-3.6.15-gnulib-perror-tests.patch new file mode 100644 index 0000000..5de2e14 --- /dev/null +++ b/gnutls-3.6.15-gnulib-perror-tests.patch @@ -0,0 +1,46 @@ +From 175e0bc72808d564074c4adcc72aeadb74adfcc6 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 27 Aug 2020 17:52:58 -0700 +Subject: [PATCH] perror, strerror_r: remove unportable tests + +Problem reported by Florian Weimer in: +https://lists.gnu.org/r/bug-gnulib/2020-08/msg00220.html +* tests/test-perror2.c (main): +* tests/test-strerror_r.c (main): Omit unportable tests. +--- + ChangeLog | 8 ++++++++ + tests/test-perror2.c | 3 --- + tests/test-strerror_r.c | 3 --- + 3 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/gl/tests/test-perror2.c b/gl/tests/test-perror2.c +index 1d14eda7b..c6214dd25 100644 +--- a/gl/tests/test-perror2.c ++++ b/gl/tests/test-perror2.c +@@ -79,9 +79,6 @@ main (void) + errno = -5; + perror (""); + ASSERT (!ferror (stderr)); +- ASSERT (msg1 == msg2 || msg1 == msg4 || STREQ (msg1, str1)); +- ASSERT (msg2 == msg4 || STREQ (msg2, str2)); +- ASSERT (msg3 == msg4 || STREQ (msg3, str3)); + ASSERT (STREQ (msg4, str4)); + + free (str1); +diff --git a/gl/tests/test-strerror_r.c b/gl/tests/test-strerror_r.c +index b11d6fd9f..c1dbcf837 100644 +--- a/gl/tests/test-strerror_r.c ++++ b/gl/tests/test-strerror_r.c +@@ -165,9 +165,6 @@ main (void) + + strerror_r (EACCES, buf, sizeof buf); + strerror_r (-5, buf, sizeof buf); +- ASSERT (msg1 == msg2 || msg1 == msg4 || STREQ (msg1, str1)); +- ASSERT (msg2 == msg4 || STREQ (msg2, str2)); +- ASSERT (msg3 == msg4 || STREQ (msg3, str3)); + ASSERT (STREQ (msg4, str4)); + + free (str1); +-- +2.26.2 + diff --git a/gnutls-3.6.7-no-now-guile.patch b/gnutls-3.6.7-no-now-guile.patch new file mode 100644 index 0000000..d14e8df --- /dev/null +++ b/gnutls-3.6.7-no-now-guile.patch @@ -0,0 +1,11 @@ +--- a/guile/src/Makefile.in 2019-03-27 11:51:55.984398001 +0100 ++++ b/guile/src/Makefile.in 2019-03-27 11:52:27.259626076 +0100 +@@ -1472,7 +1472,7 @@ + # Use '-module' to build a "dlopenable module", in Libtool terms. + # Use '-undefined' to placate Libtool on Windows; see + # . +-guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined ++guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy + + # Linking against GnuTLS. + GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la diff --git a/gnutls-3.8.10-tests-ktls.patch b/gnutls-3.8.10-tests-ktls.patch deleted file mode 100644 index 1b23124..0000000 --- a/gnutls-3.8.10-tests-ktls.patch +++ /dev/null @@ -1,114 +0,0 @@ -From e0eb2bbb212a5c9d72311c59e7235832a0075dcc Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Wed, 9 Jul 2025 18:54:48 +0900 -Subject: [PATCH] add tests/ktls_utils.h - -Signed-off-by: rpm-build ---- - tests/ktls_utils.h | 94 ++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 94 insertions(+) - create mode 100644 tests/ktls_utils.h - -diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h -new file mode 100644 -index 0000000..231618d ---- /dev/null -+++ b/tests/ktls_utils.h -@@ -0,0 +1,94 @@ -+#ifndef GNUTLS_TESTS_KTLS_UTILS_H -+#define GNUTLS_TESTS_KTLS_UTILS_H -+ -+#include -+#include -+ -+#include -+ -+#include -+#include -+ -+/* Sets the NONBLOCK flag on the socket(fd) */ -+inline static int set_nonblocking(int fd) -+{ -+ int flags = fcntl(fd, F_GETFL, 0); -+ if (flags == -1) { -+ return 1; -+ } -+ -+ if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) { -+ return 2; -+ } -+ -+ return 0; -+} -+ -+/* Creates a pair of TCP connected sockets */ -+static int create_socket_pair(int *client_fd, int *server_fd) -+{ -+ int ret; -+ struct sockaddr_in saddr; -+ socklen_t addrlen; -+ int listener; -+ -+ listener = socket(AF_INET, SOCK_STREAM, 0); -+ if (listener == -1) { -+ fail("error in listener(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ int opt = 0; -+ setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); -+ -+ memset(&saddr, 0, sizeof(saddr)); -+ saddr.sin_family = AF_INET; -+ saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); -+ saddr.sin_port = 0; -+ -+ ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); -+ if (ret == -1) { -+ fail("error in bind(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ addrlen = sizeof(saddr); -+ ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); -+ if (ret == -1) { -+ fail("error in getsockname(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ ret = listen(listener, 1); -+ if (ret == -1) { -+ fail("error in listen(): %s\n", strerror(errno)); -+ close(listener); -+ return 1; -+ } -+ -+ *client_fd = socket(AF_INET, SOCK_STREAM, 0); -+ if (*client_fd < 0) { -+ fail("error in socket(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen); -+ if (ret < 0) { -+ fail("error in connect(): %s\n", strerror(errno)); -+ close(listener); -+ close(*client_fd); -+ return 1; -+ } -+ -+ *server_fd = accept(listener, NULL, NULL); -+ if (*server_fd < 0) { -+ fail("error in accept(): %s\n", strerror(errno)); -+ close(listener); -+ close(*client_fd); -+ return 1; -+ } -+ -+ return 0; -+} -+ -+#endif //GNUTLS_TESTS_KTLS_UTILS_H --- -2.49.0 - diff --git a/gnutls-3.8.10-tests-mldsa.patch b/gnutls-3.8.10-tests-mldsa.patch deleted file mode 100644 index 158632e..0000000 --- a/gnutls-3.8.10-tests-mldsa.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 15fb5ad536c375a74cc0d87859c9fc919d924c9d Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Thu, 10 Jul 2025 05:45:06 +0900 -Subject: [PATCH] support VPATH build for mldsa tests - -Signed-off-by: rpm-build ---- - tests/cert-tests/mldsa.sh | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/tests/cert-tests/mldsa.sh b/tests/cert-tests/mldsa.sh -index 7e31e11..55e31ce 100644 ---- a/tests/cert-tests/mldsa.sh -+++ b/tests/cert-tests/mldsa.sh -@@ -130,7 +130,7 @@ for variant in 44 65 87; do - # Check default - TMPKEYDEFAULT=$testdir/key-$algo-$format-default - TMPKEY=$testdir/key-$algo-$format -- ${VALGRIND} "${CERTTOOL}" -k --no-text --infile "data/key-$algo-$format.pem" >"$TMPKEYDEFAULT" -+ ${VALGRIND} "${CERTTOOL}" -k --no-text --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEYDEFAULT" - if [ $? != 0 ]; then - cat "$TMPKEYDEFAULT" - exit 1 -@@ -138,19 +138,19 @@ for variant in 44 65 87; do - - # The "expandedKey" format doesn't have public key part - if [ "$format" = seed ] || [ "$format" = both ]; then -- if ! "${DIFF}" "$TMPKEYDEFAULT" "data/key-$algo-both.pem"; then -+ if ! "${DIFF}" "$TMPKEYDEFAULT" "$srcdir/data/key-$algo-both.pem"; then - exit 1 - fi - fi - - # Check roundtrip with --key-format -- ${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "data/key-$algo-$format.pem" >"$TMPKEY" -+ ${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEY" - if [ $? != 0 ]; then - cat "$TMPKEY" - exit 1 - fi - -- if ! "${DIFF}" "$TMPKEY" "data/key-$algo-$format.pem"; then -+ if ! "${DIFF}" "$TMPKEY" "$srcdir/data/key-$algo-$format.pem"; then - exit 1 - fi - done -@@ -164,7 +164,7 @@ for n in 1; do - fi - - echo "Testing inconsistent ML-DSA key ($n)" -- if "${CERTTOOL}" -k --infile "data/key-mldsa-inconsistent$n.pem"; then -+ if "${CERTTOOL}" -k --infile "$srcdir/data/key-mldsa-inconsistent$n.pem"; then - exit 1 - fi - done --- -2.49.0 - diff --git a/gnutls-3.8.6-compression-dlwrap.patch b/gnutls-3.8.6-compression-dlwrap.patch deleted file mode 100644 index 835f151..0000000 --- a/gnutls-3.8.6-compression-dlwrap.patch +++ /dev/null @@ -1,2131 +0,0 @@ -From dd7f8c30ca44695992bbb92146e385b4b700f285 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Sat, 29 Jun 2024 09:52:55 +0900 -Subject: [PATCH 1/4] m4: factor out soname check into a separate macro - -This moves the SONAME detection from configure.ac to m4/hooks.m4 as -the LIBGNUTLS_CHECK_SONAME macro. The new macro doesn't implicitly -set *_LIBRARY_SONAME to "none", so the callers need to adjust -themselves depending on whether the macro is defined. - -Signed-off-by: Daiki Ueno ---- - configure.ac | 50 ++++++++++++-------------------------------------- - lib/fips.c | 26 ++++++++++++++------------ - lib/fipshmac.c | 14 ++++++++++++++ - lib/global.c | 6 ++++++ - m4/hooks.m4 | 20 ++++++++++++++++++++ - 5 files changed, 66 insertions(+), 50 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 1744813b79..3f001998b4 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -810,61 +810,35 @@ save_CFLAGS=$CFLAGS - CFLAGS="$CFLAGS $GMP_CFLAGS" - save_LIBS=$LIBS - LIBS="$LIBS $GMP_LIBS" --AC_MSG_CHECKING([gmp soname]) --AC_LINK_IFELSE([AC_LANG_PROGRAM([ -+LIBGNUTLS_CHECK_SONAME([gmp], [AC_LANG_PROGRAM([ - #include ],[ - mpz_t n; -- mpz_init(n);])], -- [gmp_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^libgmp\.so'`], -- [gmp_so=none]) --if test -z "$gmp_so"; then -- gmp_so=none --fi --AC_MSG_RESULT($gmp_so) --if test "$gmp_so" != none; then -- AC_DEFINE_UNQUOTED([GMP_LIBRARY_SONAME], ["$gmp_so"], [The soname of gmp library]) --fi --LIBS=$save_LIBS --CFLAGS=$save_CFLAGS -+ mpz_init(n);])]) -+LIBS="$save_LIBS" -+CFLAGS="$save_CFLAGS" - - save_CFLAGS=$CFLAGS - CFLAGS="$CFLAGS $NETTLE_CFLAGS" - save_LIBS=$LIBS - LIBS="$LIBS $NETTLE_LIBS" --AC_MSG_CHECKING([nettle soname]) --AC_LINK_IFELSE([AC_LANG_PROGRAM([ -+LIBGNUTLS_CHECK_SONAME([nettle], [AC_LANG_PROGRAM([ - #include ],[ - struct sha256_ctx ctx; -- sha256_init(&ctx);])], -- [nettle_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^libnettle\.so'`], -- [nettle_so=none]) --if test -z "$nettle_so"; then -- nettle_so=none --fi --AC_MSG_RESULT($nettle_so) --AC_DEFINE_UNQUOTED([NETTLE_LIBRARY_SONAME], ["$nettle_so"], [The soname of nettle library]) --LIBS=$save_LIBS --CFLAGS=$save_CFLAGS -+ sha256_init(&ctx);])]) -+LIBS="$save_LIBS" -+CFLAGS="$save_CFLAGS" - - save_CFLAGS=$CFLAGS - # includes - CFLAGS="$CFLAGS $HOGWEED_CFLAGS $GMP_CFLAGS" - save_LIBS=$LIBS - LIBS="$LIBS $HOGWEED_LIBS" --AC_MSG_CHECKING([hogweed soname]) --AC_LINK_IFELSE([AC_LANG_PROGRAM([ -+LIBGNUTLS_CHECK_SONAME([hogweed], [AC_LANG_PROGRAM([ - #include ],[ - struct rsa_private_key priv; -- nettle_rsa_private_key_init(&priv);])], -- [hogweed_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^libhogweed\.so'`], -- [hogweed_so=none]) --if test -z "$hogweed_so"; then -- hogweed_so=none --fi --AC_MSG_RESULT($hogweed_so) --AC_DEFINE_UNQUOTED([HOGWEED_LIBRARY_SONAME], ["$hogweed_so"], [The soname of hogweed library]) --LIBS=$save_LIBS --CFLAGS=$save_CFLAGS -+ nettle_rsa_private_key_init(&priv);])]) -+LIBS="$save_LIBS" -+CFLAGS="$save_CFLAGS" - - gnutls_so=libgnutls.so.`expr "$LT_CURRENT" - "$LT_AGE"` - AC_DEFINE_UNQUOTED([GNUTLS_LIBRARY_SONAME], ["$gnutls_so"], [The soname of gnutls library]) -diff --git a/lib/fips.c b/lib/fips.c -index 1611200be8..e5fce6b1b9 100644 ---- a/lib/fips.c -+++ b/lib/fips.c -@@ -152,15 +152,17 @@ void _gnutls_fips_mode_reset_zombie(void) - } - } - --/* These only works with the platform where SONAME is part of the ABI. -- * For example, *_SONAME will be set to "none" on Windows platforms. */ --#define GNUTLS_LIBRARY_NAME GNUTLS_LIBRARY_SONAME --#define NETTLE_LIBRARY_NAME NETTLE_LIBRARY_SONAME --#define HOGWEED_LIBRARY_NAME HOGWEED_LIBRARY_SONAME -+/* These only works with the platform where SONAME is part of the ABI. */ -+#ifndef GNUTLS_LIBRARY_SONAME -+#define GNUTLS_LIBRARY_SONAME "none" -+#endif - --/* GMP can be statically linked. */ --#ifdef GMP_LIBRARY_SONAME --#define GMP_LIBRARY_NAME GMP_LIBRARY_SONAME -+#ifndef NETTLE_LIBRARY_SONAME -+#define NETTLE_LIBRARY_SONAME "none" -+#endif -+ -+#ifndef HOGWEED_LIBRARY_SONAME -+#define HOGWEED_LIBRARY_SONAME "none" - #endif - - #define HMAC_SIZE 32 -@@ -246,14 +248,14 @@ static int handler(void *user, const char *section, const char *name, - } else { - return 0; - } -- } else if (!strcmp(section, GNUTLS_LIBRARY_NAME)) { -+ } else if (!strcmp(section, GNUTLS_LIBRARY_SONAME)) { - return lib_handler(&p->gnutls, section, name, value); -- } else if (!strcmp(section, NETTLE_LIBRARY_NAME)) { -+ } else if (!strcmp(section, NETTLE_LIBRARY_SONAME)) { - return lib_handler(&p->nettle, section, name, value); -- } else if (!strcmp(section, HOGWEED_LIBRARY_NAME)) { -+ } else if (!strcmp(section, HOGWEED_LIBRARY_SONAME)) { - return lib_handler(&p->hogweed, section, name, value); - #ifdef GMP_LIBRARY_SONAME -- } else if (!strcmp(section, GMP_LIBRARY_NAME)) { -+ } else if (!strcmp(section, GMP_LIBRARY_SONAME)) { - return lib_handler(&p->gmp, section, name, value); - #endif - } else { -diff --git a/lib/fipshmac.c b/lib/fipshmac.c -index 6a4883a131..d3561b4c47 100644 ---- a/lib/fipshmac.c -+++ b/lib/fipshmac.c -@@ -34,6 +34,20 @@ - #include "errors.h" - - #define FORMAT_VERSION 1 -+ -+/* These only works with the platform where SONAME is part of the ABI. */ -+#ifndef GNUTLS_LIBRARY_SONAME -+#define GNUTLS_LIBRARY_SONAME "none" -+#endif -+ -+#ifndef NETTLE_LIBRARY_SONAME -+#define NETTLE_LIBRARY_SONAME "none" -+#endif -+ -+#ifndef HOGWEED_LIBRARY_SONAME -+#define HOGWEED_LIBRARY_SONAME "none" -+#endif -+ - #define HMAC_SIZE 32 - #define HMAC_ALGO GNUTLS_MAC_SHA256 - #define HMAC_STR_SIZE (2 * HMAC_SIZE + 1) -diff --git a/lib/global.c b/lib/global.c -index 718740c103..b434140bbf 100644 ---- a/lib/global.c -+++ b/lib/global.c -@@ -563,9 +563,15 @@ static const struct gnutls_library_config_st _gnutls_library_config[] = { - #ifdef FIPS_MODULE_VERSION - { "fips-module-version", FIPS_MODULE_VERSION }, - #endif -+#ifdef GNUTLS_LIBRARY_SONAME - { "libgnutls-soname", GNUTLS_LIBRARY_SONAME }, -+#endif -+#ifdef NETTLE_LIBRARY_SONAME - { "libnettle-soname", NETTLE_LIBRARY_SONAME }, -+#endif -+#ifdef HOGWEED_LIBRARY_SONAME - { "libhogweed-soname", HOGWEED_LIBRARY_SONAME }, -+#endif - #ifdef GMP_LIBRARY_SONAME - { "libgmp-soname", GMP_LIBRARY_SONAME }, - #endif -diff --git a/m4/hooks.m4 b/m4/hooks.m4 -index cf6064ca1d..a786d35150 100644 ---- a/m4/hooks.m4 -+++ b/m4/hooks.m4 -@@ -421,3 +421,23 @@ dnl #AM_ICONV - dnl m4_ifdef([gl_ICONV_MODULE_INDICATOR], - dnl [gl_ICONV_MODULE_INDICATOR([iconv])]) - ]) -+ -+AC_DEFUN([LIBGNUTLS_CHECK_SONAME], -+[ -+ m4_pushdef([soname], AS_TR_SH([$1])) -+ m4_pushdef([SONAME], AS_TR_CPP([$1])) -+ AC_MSG_CHECKING([$1 [soname]]) -+ AC_LINK_IFELSE([$2], -+ [soname[]_so=`(eval "$LDDPROG conftest$EXEEXT $LDDPOSTPROC") | grep '^lib[]$1\.so'`], -+ [soname[]_so=none]) -+ if test -z "$soname[]_so"; then -+ soname[]_so=none -+ fi -+ AC_MSG_RESULT($soname[]_so) -+ if test "$soname[]_so" != none; then -+ SONAME[]_LIBRARY_SONAME="$soname[]_so" -+ AC_DEFINE_UNQUOTED([SONAME[]_LIBRARY_SONAME], ["$soname[]_so"], [The soname of $1 library]) -+ fi -+ m4_popdef([soname]) -+ m4_popdef([SONAME]) -+]) --- -2.45.2 - - -From 0647139f50b6c14f2f2d22d40a42a8fdfaead5d5 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Sat, 6 Jul 2024 11:59:08 +0900 -Subject: [PATCH 2/4] build: check if dlopen(SONAME) works in configure - -Signed-off-by: Daiki Ueno ---- - configure.ac | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/configure.ac b/configure.ac -index 3f001998b4..8d8c4038b6 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -946,6 +946,27 @@ AM_CONDITIONAL(P11KIT_0_23_11_API, $PKG_CONFIG --atleast-version=0.23.11 p11-kit - - AM_CONDITIONAL(ENABLE_PKCS11, test "$with_p11_kit" != "no") - -+save_LIBS=$LIBS -+LIBS="$LIBS -lm" -+LIBGNUTLS_CHECK_SONAME([m], [AC_LANG_PROGRAM([ -+ #include ],[ -+ trunc (0);])]) -+LIBS="$save_LIBS" -+CFLAGS="$save_CFLAGS" -+ -+AC_RUN_IFELSE( -+ [AC_LANG_PROGRAM( -+ [[#include -+ #include -+ ]], -+ [[void *handle = dlopen("$M_LIBRARY_SONAME", RTLD_LAZY | RTLD_GLOBAL); -+ return handle != NULL ? 0 : 1; -+ ]])], -+ [ac_cv_dlopen_soname_works=yes], -+ [ac_cv_dlopen_soname_works=no], -+ [ac_cv_dlopen_soname_works=cross-compiling]) -+ -+AM_CONDITIONAL([ENABLE_DLOPEN], [test "$ac_cv_dlopen_soname_works" = yes]) - need_ltlibdl=no - - AC_ARG_WITH(tpm2, --- -2.45.2 - - -From 297c83d2830e44a675e8e52d65a66e0ba327f788 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Sat, 29 Jun 2024 13:34:36 +0900 -Subject: [PATCH 3/4] build: detect SONAME for compression libraries at - configure - -Instead of hard-coding the SONAMEs for zlib, libzstd, libbrotlienc, -and libbrotlidec, this checks the actual SONAMEs at configure time, so -the first argument of dlopen is more acurate when a SONAME is bumped. - -Signed-off-by: Daiki Ueno ---- - configure.ac | 82 +++++++++++++++++++++++++++++++++++++++----------- - lib/compress.c | 8 ++--- - 2 files changed, 68 insertions(+), 22 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 8d8c4038b6..28d6895efb 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1048,8 +1048,6 @@ AC_DEFINE_UNQUOTED([TROUSERS_LIB], ["$ac_trousers_lib"], [the location of the tr - AC_SUBST(TROUSERS_LIB) - - --AM_CONDITIONAL(NEED_LTLIBDL, test "$need_ltlibdl" = yes) -- - # For minitasn1. - AC_CHECK_SIZEOF(unsigned long int, 4) - AC_CHECK_SIZEOF(unsigned int, 4) -@@ -1058,35 +1056,45 @@ AC_CHECK_SIZEOF(time_t, 4) - AC_ARG_WITH(zlib, AS_HELP_STRING([--without-zlib], - [disable zlib compression support]), - ac_zlib=$withval, ac_zlib=yes) --AC_MSG_CHECKING([whether to include zlib compression support]) --if test x$ac_zlib != xno; then -- AC_MSG_RESULT(yes) -- AC_LIB_HAVE_LINKFLAGS(z,, [#include ], [compress (0, 0, 0, 0);]) -- if test x$ac_cv_libz != xyes; then -- AC_MSG_WARN( -- *** -- *** ZLIB was not found. You will not be able to use ZLIB compression.) --fi --else -- AC_MSG_RESULT(no) --fi -- --PKG_CHECK_EXISTS(zlib, ZLIB_HAS_PKGCONFIG=y, ZLIB_HAS_PKGCONFIG=n) -- - if test x$ac_zlib != xno; then -+ PKG_CHECK_EXISTS(zlib, ZLIB_HAS_PKGCONFIG=y, ZLIB_HAS_PKGCONFIG=n) - if test "$ZLIB_HAS_PKGCONFIG" = "y" ; then -+ PKG_CHECK_MODULES(ZLIB, [zlib]) - if test "x$GNUTLS_REQUIRES_PRIVATE" = x; then - GNUTLS_REQUIRES_PRIVATE="Requires.private: zlib" - else - GNUTLS_REQUIRES_PRIVATE="$GNUTLS_REQUIRES_PRIVATE, zlib" - fi -- LIBZ_PC="" -+ ac_zlib=yes - else -+ AC_LIB_HAVE_LINKFLAGS(z,, [#include ], [compress (0, 0, 0, 0);]) -+ if test x$ac_cv_libz != xyes; then -+ AC_MSG_WARN([[ -+*** -+*** ZLIB was not found. You will not be able to use ZLIB compression. -+*** ]]) -+ fi -+ ac_zlib=$ac_cv_libz -+ ZLIB_LIBS=$LIBZ - LIBZ_PC=$LIBZ - fi - fi -+if test x$ac_zlib != xno; then -+ AC_DEFINE([HAVE_LIBZ], 1, [Define if ZLIB compression is enabled.]) -+ need_ltlibdl=yes -+fi - AC_SUBST(LIBZ_PC) - -+AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ -+ save_LIBS=$LIBS -+ LIBS="$LIBS $ZLIB_LIBS" -+ LIBGNUTLS_CHECK_SONAME([z], [AC_LANG_PROGRAM([ -+ #include ],[ -+ compress (0, 0, 0, 0);])]) -+ LIBS="$save_LIBS" -+ CFLAGS="$save_CFLAGS" -+]) -+ - AC_ARG_WITH(brotli, - AS_HELP_STRING([--without-brotli], [disable brotli compression support]), - ac_brotli=$withval, ac_brotli=yes) -@@ -1102,6 +1110,7 @@ if test x$ac_brotli != xno; then - else - GNUTLS_REQUIRES_PRIVATE="${GNUTLS_REQUIRES_PRIVATE}, libbrotlienc, libbrotlidec" - fi -+ need_ltlibdl=yes - else - AC_MSG_WARN(*** LIBBROTLI was not found. You will not be able to use BROTLI compression.) - fi -@@ -1110,6 +1119,28 @@ else - fi - AM_CONDITIONAL(HAVE_LIBBROTLI, test "$with_libbrotlienc" != "no" && test "$with_libbrotlidec" != "no") - -+AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ -+ save_CFLAGS=$CFLAGS -+ CFLAGS="$CFLAGS $LIBBROTLIENC_CFLAGS" -+ save_LIBS=$LIBS -+ LIBS="$LIBS $LIBBROTLIENC_LIBS" -+ LIBGNUTLS_CHECK_SONAME([brotlienc], [AC_LANG_PROGRAM([ -+ #include ],[ -+ BrotliEncoderVersion();])]) -+ LIBS="$save_LIBS" -+ CFLAGS="$save_CFLAGS" -+ -+ save_CFLAGS=$CFLAGS -+ CFLAGS="$CFLAGS $LIBBROTLIDEC_CFLAGS" -+ save_LIBS=$LIBS -+ LIBS="$LIBS $LIBBROTLIDEC_LIBS" -+ LIBGNUTLS_CHECK_SONAME([brotlidec], [AC_LANG_PROGRAM([ -+ #include ],[ -+ BrotliDecoderVersion();])]) -+ LIBS="$save_LIBS" -+ CFLAGS="$save_CFLAGS" -+]) -+ - AC_ARG_WITH(zstd, - AS_HELP_STRING([--without-zstd], [disable zstd compression support]), - ac_zstd=$withval, ac_zstd=yes) -@@ -1124,6 +1155,7 @@ if test x$ac_zstd != xno; then - else - GNUTLS_REQUIRES_PRIVATE="${GNUTLS_REQUIRES_PRIVATE}, libzstd" - fi -+ need_ltlibdl=yes - else - AC_MSG_WARN(*** LIBZSTD was not found. You will not be able to use ZSTD compression.) - fi -@@ -1132,6 +1164,20 @@ else - fi - AM_CONDITIONAL(HAVE_LIBZSTD, test "$with_libzstd" != "no") - -+AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ -+ save_CFLAGS=$CFLAGS -+ CFLAGS="$CFLAGS $LIBZSTD_CFLAGS" -+ save_LIBS=$LIBS -+ LIBS="$LIBS $LIBZSTD_LIBS" -+ LIBGNUTLS_CHECK_SONAME([zstd], [AC_LANG_PROGRAM([ -+ #include ],[ -+ ZSTD_versionNumber();])]) -+ LIBS="$save_LIBS" -+ CFLAGS="$save_CFLAGS" -+]) -+ -+AM_CONDITIONAL(NEED_LTLIBDL, test "$need_ltlibdl" = yes) -+ - # export for use in scripts - AC_SUBST(ac_cv_sizeof_time_t) - -diff --git a/lib/compress.c b/lib/compress.c -index a0a7c699c3..26ea2912c2 100644 ---- a/lib/compress.c -+++ b/lib/compress.c -@@ -72,7 +72,7 @@ static int zlib_init(void) - #ifndef _WIN32 - if (_zlib_handle != NULL) - return 0; -- if ((_zlib_handle = dlopen("libz.so.1", RTLD_NOW | RTLD_GLOBAL)) == -+ if ((_zlib_handle = dlopen(Z_LIBRARY_SONAME, RTLD_NOW | RTLD_GLOBAL)) == - NULL) - goto error; - if ((_gnutls_zlib_compressBound = -@@ -135,10 +135,10 @@ static int brotli_init(void) - #ifndef _WIN32 - if (_brotlienc_handle != NULL || _brotlidec_handle != NULL) - return 0; -- if ((_brotlienc_handle = dlopen("libbrotlienc.so.1", -+ if ((_brotlienc_handle = dlopen(BROTLIENC_LIBRARY_SONAME, - RTLD_NOW | RTLD_GLOBAL)) == NULL) - goto error; -- if ((_brotlidec_handle = dlopen("libbrotlidec.so.1", -+ if ((_brotlidec_handle = dlopen(BROTLIDEC_LIBRARY_SONAME, - RTLD_NOW | RTLD_GLOBAL)) == NULL) - goto error; - if ((_gnutls_BrotliEncoderMaxCompressedSize = -@@ -195,7 +195,7 @@ static int zstd_init(void) - #ifndef _WIN32 - if (_zstd_handle != NULL) - return 0; -- if ((_zstd_handle = dlopen("libzstd.so.1", RTLD_NOW | RTLD_GLOBAL)) == -+ if ((_zstd_handle = dlopen(ZSTD_LIBRARY_SONAME, RTLD_NOW | RTLD_GLOBAL)) == - NULL) - goto error; - if ((_gnutls_ZSTD_isError = dlsym(_zstd_handle, "ZSTD_isError")) == --- -2.45.2 - - -From 3e5be1315a15ac6e1e33e08f28030b8215b6d234 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Sat, 29 Jun 2024 13:36:58 +0900 -Subject: [PATCH 4/4] build: switch to using dlwrap for loading compression - libraries - -This switches the logic to load compression libraries from the -hand-written code to the automatically generated code by the dlwrap -tool[1], which enables to select whether to use dlopen or link to the -library at build time. - -1. https://crates.io/crates/dlwrap - -Signed-off-by: Daiki Ueno ---- - cfg.mk | 2 +- - configure.ac | 1 + - devel/check-headers.sh | 4 +- - devel/dlwrap/brotli.license | 4 + - devel/dlwrap/brotlidec.syms | 1 + - devel/dlwrap/brotlienc.syms | 2 + - devel/dlwrap/z.license | 20 ++++ - devel/dlwrap/z.syms | 3 + - devel/dlwrap/zstd.license | 7 ++ - devel/dlwrap/zstd.syms | 4 + - devel/generate-dlwrap.sh | 37 ++++++ - devel/indent-gnutls | 2 +- - lib/Makefile.am | 40 ++++++- - lib/compress.c | 218 ++++++++++-------------------------- - lib/dlwrap/brotlidec.c | 182 ++++++++++++++++++++++++++++++ - lib/dlwrap/brotlidec.h | 47 ++++++++ - lib/dlwrap/brotlidecfuncs.h | 9 ++ - lib/dlwrap/brotlienc.c | 182 ++++++++++++++++++++++++++++++ - lib/dlwrap/brotlienc.h | 47 ++++++++ - lib/dlwrap/brotliencfuncs.h | 10 ++ - lib/dlwrap/zlib.c | 182 ++++++++++++++++++++++++++++++ - lib/dlwrap/zlib.h | 47 ++++++++ - lib/dlwrap/zlibfuncs.h | 27 +++++ - lib/dlwrap/zstd.c | 182 ++++++++++++++++++++++++++++++ - lib/dlwrap/zstd.h | 47 ++++++++ - lib/dlwrap/zstdfuncs.h | 15 +++ - 26 files changed, 1154 insertions(+), 168 deletions(-) - create mode 100644 devel/dlwrap/brotli.license - create mode 100644 devel/dlwrap/brotlidec.syms - create mode 100644 devel/dlwrap/brotlienc.syms - create mode 100644 devel/dlwrap/z.license - create mode 100644 devel/dlwrap/z.syms - create mode 100644 devel/dlwrap/zstd.license - create mode 100644 devel/dlwrap/zstd.syms - create mode 100755 devel/generate-dlwrap.sh - create mode 100644 lib/dlwrap/brotlidec.c - create mode 100644 lib/dlwrap/brotlidec.h - create mode 100644 lib/dlwrap/brotlidecfuncs.h - create mode 100644 lib/dlwrap/brotlienc.c - create mode 100644 lib/dlwrap/brotlienc.h - create mode 100644 lib/dlwrap/brotliencfuncs.h - create mode 100644 lib/dlwrap/zlib.c - create mode 100644 lib/dlwrap/zlib.h - create mode 100644 lib/dlwrap/zlibfuncs.h - create mode 100644 lib/dlwrap/zstd.c - create mode 100644 lib/dlwrap/zstd.h - create mode 100644 lib/dlwrap/zstdfuncs.h - -diff --git a/cfg.mk b/cfg.mk -index 5ef839a2c1..1b94279633 100644 ---- a/cfg.mk -+++ b/cfg.mk -@@ -24,7 +24,7 @@ PACKAGE ?= gnutls - - .PHONY: config glimport - --INDENT_SOURCES = `find . -name \*.[ch] -o -name gnutls.h.in | grep -v -e ^./build-aux/ -e ^./config.h -e ^./devel/ -e ^./gnulib -e ^./lib/minitasn1/ -e ^./lib/includes/gnutls/gnutls.h -e ^./lib/nettle/backport/ -e ^./lib/priority_options.h -e ^./lib/unistring/ -e ^./lib/x509/supported_exts.h -e ^./lib/build-aux/ -e ^./gl/ -e ^./src/gl/ -e ^./src/.*-options.[ch] -e -args.[ch] -e asn1_tab.c -e ^./tests/suite/` -+INDENT_SOURCES = `find . -name \*.[ch] -o -name gnutls.h.in | grep -v -e ^./build-aux/ -e ^./config.h -e ^./devel/ -e ^./gnulib -e ^./lib/minitasn1/ -e ^./lib/includes/gnutls/gnutls.h -e ^./lib/nettle/backport/ -e ^./lib/priority_options.h -e ^./lib/unistring/ -e ^./lib/x509/supported_exts.h -e ^./lib/build-aux/ -e ^./lib/dlwrap/ -e ^./gl/ -e ^./src/gl/ -e ^./src/.*-options.[ch] -e -args.[ch] -e asn1_tab.c -e ^./tests/suite/` - - ifeq ($(.DEFAULT_GOAL),abort-due-to-no-makefile) - .DEFAULT_GOAL := bootstrap -diff --git a/configure.ac b/configure.ac -index 28d6895efb..62a7fbdf66 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1083,6 +1083,7 @@ if test x$ac_zlib != xno; then - AC_DEFINE([HAVE_LIBZ], 1, [Define if ZLIB compression is enabled.]) - need_ltlibdl=yes - fi -+AM_CONDITIONAL(HAVE_ZLIB, test "$ac_zlib" = "yes") - AC_SUBST(LIBZ_PC) - - AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ -diff --git a/devel/dlwrap/brotli.license b/devel/dlwrap/brotli.license -new file mode 100644 -index 0000000000..d65b39b1ac ---- /dev/null -+++ b/devel/dlwrap/brotli.license -@@ -0,0 +1,4 @@ -+Copyright 2013 Google Inc. All Rights Reserved. -+ -+Distributed under MIT license. -+See file LICENSE for detail or copy at https://opensource.org/licenses/MIT -diff --git a/devel/dlwrap/brotlidec.syms b/devel/dlwrap/brotlidec.syms -new file mode 100644 -index 0000000000..97edbad15e ---- /dev/null -+++ b/devel/dlwrap/brotlidec.syms -@@ -0,0 +1 @@ -+BrotliDecoderDecompress -diff --git a/devel/dlwrap/brotlienc.syms b/devel/dlwrap/brotlienc.syms -new file mode 100644 -index 0000000000..d618292047 ---- /dev/null -+++ b/devel/dlwrap/brotlienc.syms -@@ -0,0 +1,2 @@ -+BrotliEncoderMaxCompressedSize -+BrotliEncoderCompress -diff --git a/devel/dlwrap/z.license b/devel/dlwrap/z.license -new file mode 100644 -index 0000000000..94ce4ae9c9 ---- /dev/null -+++ b/devel/dlwrap/z.license -@@ -0,0 +1,20 @@ -+Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler -+ -+This software is provided 'as-is', without any express or implied -+warranty. In no event will the authors be held liable for any damages -+arising from the use of this software. -+ -+Permission is granted to anyone to use this software for any purpose, -+including commercial applications, and to alter it and redistribute it -+freely, subject to the following restrictions: -+ -+1. The origin of this software must not be misrepresented; you must not -+ claim that you wrote the original software. If you use this software -+ in a product, an acknowledgment in the product documentation would be -+ appreciated but is not required. -+2. Altered source versions must be plainly marked as such, and must not be -+ misrepresented as being the original software. -+3. This notice may not be removed or altered from any source distribution. -+ -+Jean-loup Gailly Mark Adler -+jloup@gzip.org madler@alumni.caltech.edu -diff --git a/devel/dlwrap/z.syms b/devel/dlwrap/z.syms -new file mode 100644 -index 0000000000..e3ed6c13f2 ---- /dev/null -+++ b/devel/dlwrap/z.syms -@@ -0,0 +1,3 @@ -+compressBound -+compress -+uncompress -diff --git a/devel/dlwrap/zstd.license b/devel/dlwrap/zstd.license -new file mode 100644 -index 0000000000..4b585386bf ---- /dev/null -+++ b/devel/dlwrap/zstd.license -@@ -0,0 +1,7 @@ -+Copyright (c) Meta Platforms, Inc. and affiliates. -+All rights reserved. -+ -+This source code is licensed under both the BSD-style license (found in the -+LICENSE file in the root directory of this source tree) and the GPLv2 (found -+in the COPYING file in the root directory of this source tree). -+You may select, at your option, one of the above-listed licenses. -diff --git a/devel/dlwrap/zstd.syms b/devel/dlwrap/zstd.syms -new file mode 100644 -index 0000000000..881bdc8135 ---- /dev/null -+++ b/devel/dlwrap/zstd.syms -@@ -0,0 +1,4 @@ -+ZSTD_isError -+ZSTD_compressBound -+ZSTD_compress -+ZSTD_decompress -diff --git a/devel/generate-dlwrap.sh b/devel/generate-dlwrap.sh -new file mode 100755 -index 0000000000..dbcf870612 ---- /dev/null -+++ b/devel/generate-dlwrap.sh -@@ -0,0 +1,37 @@ -+#!/bin/sh -+ -+# This script generates dlopen stubs for optional libraries using dlwrap tool: -+# https://crates.io/crates/dlwrap -+ -+# Copyright (c) 2023 Daiki Ueno -+# License: GPLv3+ -+ -+set +e -+ -+: ${srcdir=.} -+: ${DLWRAP=dlwrap} -+ -+if ! "$DLWRAP" -V >& /dev/null; then -+ echo 1>&2 "$0: "$DLWRAP" is missing" -+ exit 77 -+fi -+ -+SRC="$srcdir/devel/$DLWRAP" -+DST="$srcdir/lib/$DLWRAP" -+ -+echo "Generating $DST/zlib.h" -+ -+"$DLWRAP" --input /usr/include/zlib.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/z.syms" --license-file "$SRC/z.license" --soname Z_LIBRARY_SONAME --prefix gnutls_zlib --header-guard GNUTLS_LIB_DLWRAP_ZLIB_H_ --include "" -+ -+echo "Generating $DST/zstd.h" -+ -+"$DLWRAP" --input /usr/include/zstd.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/zstd.syms" --license-file "$SRC/zstd.license" --soname ZSTD_LIBRARY_SONAME --prefix gnutls_zstd --header-guard GNUTLS_LIB_DLWRAP_ZSTD_H_ --include "" -+ -+echo "Generating $DST/brotlienc.h" -+ -+"$DLWRAP" --input /usr/include/brotli/encode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlienc.syms" --license-file "$SRC/brotli.license" --soname BROTLIENC_LIBRARY_SONAME --prefix gnutls_brotlienc --loader-basename brotlienc --header-guard GNUTLS_LIB_DLWRAP_BROTLIENC_H_ --include "" -+ -+echo "Generating $DST/brotlidec.h" -+ -+"$DLWRAP" --input /usr/include/brotli/decode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlidec.syms" --license-file "$SRC/brotli.license" --soname BROTLIDEC_LIBRARY_SONAME --prefix gnutls_brotlidec --loader-basename brotlidec --header-guard GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ --include "" -+ -diff --git a/lib/Makefile.am b/lib/Makefile.am -index a50d3114ea..d1bd07248e 100644 ---- a/lib/Makefile.am -+++ b/lib/Makefile.am -@@ -33,7 +33,7 @@ localedir = $(datadir)/locale - - include $(top_srcdir)/lib/common.mk - --AM_CPPFLAGS = \ -+AM_CPPFLAGS = \ - -DLOCALEDIR=\"$(localedir)\" \ - -I$(srcdir)/../gl \ - -I$(builddir)/../gl \ -@@ -45,7 +45,8 @@ AM_CPPFLAGS = \ - $(LIBTASN1_CFLAGS) \ - $(P11_KIT_CFLAGS) \ - $(TSS2_CFLAGS) -- $(LIBZSTD_CFLAGS) -+ -+thirdparty_libadd = - - if !HAVE_LIBUNISTRING - SUBDIRS += unistring -@@ -85,6 +86,39 @@ COBJECTS = range.c record.c compress.c debug.c cipher.c gthreads.h handshake-tls - hello_ext_lib.c hello_ext_lib.h ocsp-api.c stek.c cert-cred-rawpk.c \ - iov.c iov.h system/ktls.c system/ktls.h pathbuf.c pathbuf.h - -+if HAVE_ZLIB -+COBJECTS += dlwrap/zlib.c dlwrap/zlibfuncs.h dlwrap/zlib.h -+ -+if ENABLE_DLOPEN -+AM_CPPFLAGS += $(ZLIB_CFLAGS) -DGNUTLS_ZLIB_ENABLE_DLOPEN=1 -+else -+thirdparty_libadd += $(ZLIB_LIBS) -+endif -+endif -+ -+if HAVE_LIBZSTD -+COBJECTS += dlwrap/zstd.c dlwrap/zstdfuncs.h dlwrap/zstd.h -+ -+if ENABLE_DLOPEN -+AM_CPPFLAGS += $(LIBZSTD_CFLAGS) -DGNUTLS_ZSTD_ENABLE_DLOPEN=1 -+else -+thirdparty_libadd += $(LIBZSTD_LIBS) -+endif -+endif -+ -+if HAVE_LIBBROTLI -+COBJECTS += dlwrap/brotlienc.c dlwrap/brotliencfuncs.h dlwrap/brotlienc.h -+COBJECTS += dlwrap/brotlidec.c dlwrap/brotlidecfuncs.h dlwrap/brotlidec.h -+ -+if ENABLE_DLOPEN -+AM_CPPFLAGS += $(LIBBROTLIENC_CFLAGS) -DGNUTLS_BROTLIENC_ENABLE_DLOPEN=1 -+AM_CPPFLAGS += $(LIBBROTLIDEC_CFLAGS) -DGNUTLS_BROTLIDEC_ENABLE_DLOPEN=1 -+else -+thirdparty_libadd += $(LIBBROTLIENC_LIBS) -+thirdparty_libadd += $(LIBBROTLIDEC_LIBS) -+endif -+endif -+ - if ENABLE_GOST - COBJECTS += vko.c - endif -@@ -156,7 +190,7 @@ libgnutls_la_LIBADD = ../gl/libgnu.la x509/libgnutls_x509.la \ - ext/libgnutls_ext.la \ - auth/libgnutls_auth.la algorithms/libgnutls_alg.la \ - extras/libgnutls_extras.la --thirdparty_libadd = $(LTLIBINTL) $(LIBSOCKET) $(LTLIBNSL) \ -+thirdparty_libadd += $(LTLIBINTL) $(LIBSOCKET) $(LTLIBNSL) \ - $(P11_KIT_LIBS) $(LIB_SELECT) $(GNUTLS_LIBS_PRIVATE) - - if HAVE_LIBIDN2 -diff --git a/lib/compress.c b/lib/compress.c -index 26ea2912c2..936a459532 100644 ---- a/lib/compress.c -+++ b/lib/compress.c -@@ -25,198 +25,91 @@ - - #include "compress.h" - --#ifndef _WIN32 -+#ifdef _WIN32 -+#define RTLD_NOW 0 -+#define RTLD_GLOBAL 0 -+#else - #include - #endif - -+#ifndef Z_LIBRARY_SONAME -+#define Z_LIBRARY_SONAME "none" -+#endif -+ -+#ifndef BROTLIENC_LIBRARY_SONAME -+#define BROTLIENC_LIBRARY_SONAME "none" -+#endif -+ -+#ifndef BROTLIDEC_LIBRARY_SONAME -+#define BROTLIDEC_LIBRARY_SONAME "none" -+#endif -+ -+#ifndef ZSTD_LIBRARY_SONAME -+#define ZSTD_LIBRARY_SONAME "none" -+#endif -+ - #ifdef HAVE_LIBZ --#include -+#include "dlwrap/zlib.h" - #endif - - #ifdef HAVE_LIBBROTLI --#include --#include -+#include "dlwrap/brotlienc.h" -+#include "dlwrap/brotlidec.h" - #endif - - #ifdef HAVE_LIBZSTD --#include -+#include "dlwrap/zstd.h" - #endif - - #ifdef HAVE_LIBZ --static void *_zlib_handle; -- --#if HAVE___TYPEOF__ --static __typeof__(compressBound)(*_gnutls_zlib_compressBound); --static __typeof__(compress)(*_gnutls_zlib_compress); --static __typeof__(uncompress)(*_gnutls_zlib_uncompress); --#else --static uLong (*_gnutls_zlib_compressBound)(uLong sourceLen); --static int (*_gnutls_zlib_compress)(Bytef *dest, uLongf *destLen, -- const Bytef *source, uLong sourceLen); --static int (*_gnutls_zlib_uncompress)(Bytef *dest, uLongf *destLen, -- const Bytef *source, uLong sourceLen); --#endif /* HAVE___TYPEOF__ */ -- - static void zlib_deinit(void) - { --#ifndef _WIN32 -- if (_zlib_handle != NULL) { -- dlclose(_zlib_handle); -- _zlib_handle = NULL; -- } --#endif /* _WIN32 */ -+ gnutls_zlib_unload_library(); - } - - static int zlib_init(void) - { --#ifndef _WIN32 -- if (_zlib_handle != NULL) -- return 0; -- if ((_zlib_handle = dlopen(Z_LIBRARY_SONAME, RTLD_NOW | RTLD_GLOBAL)) == -- NULL) -- goto error; -- if ((_gnutls_zlib_compressBound = -- dlsym(_zlib_handle, "compressBound")) == NULL) -- goto error; -- if ((_gnutls_zlib_compress = dlsym(_zlib_handle, "compress")) == NULL) -- goto error; -- if ((_gnutls_zlib_uncompress = dlsym(_zlib_handle, "uncompress")) == -- NULL) -- goto error; -+ if (gnutls_zlib_ensure_library(Z_LIBRARY_SONAME, -+ RTLD_NOW | RTLD_GLOBAL) < 0) -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); - return 0; --error: -- zlib_deinit(); -- return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); --#else -- return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); --#endif /* _WIN32 */ - } - #endif /* HAVE_LIBZ */ - - #ifdef HAVE_LIBBROTLI --static void *_brotlienc_handle; --static void *_brotlidec_handle; -- --#if HAVE___TYPEOF__ --static __typeof__(BrotliEncoderMaxCompressedSize)( -- *_gnutls_BrotliEncoderMaxCompressedSize); --static __typeof__(BrotliEncoderCompress)(*_gnutls_BrotliEncoderCompress); --static __typeof__(BrotliDecoderDecompress)(*_gnutls_BrotliDecoderDecompress); --#else --static size_t (*_gnutls_BrotliEncoderMaxCompressedSize)(size_t input_size); --static BROTLI_BOOL (*_gnutls_BrotliEncoderCompress)( -- int quality, int lgwin, BrotliEncoderMode mode, size_t input_size, -- const uint8_t input_buffer[BROTLI_ARRAY_PARAM(input_size)], -- size_t *encoded_size, -- uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(*encoded_size)]); --static BrotliDecoderResult (*_gnutls_BrotliDecoderDecompress)( -- size_t encoded_size, -- const uint8_t encoded_buffer[BROTLI_ARRAY_PARAM(encoded_size)], -- size_t *decoded_size, -- uint8_t decoded_buffer[BROTLI_ARRAY_PARAM(*decoded_size)]); --#endif /* HAVE___TYPEOF__ */ - - static void brotli_deinit(void) - { --#ifndef _WIN32 -- if (_brotlienc_handle != NULL) { -- dlclose(_brotlienc_handle); -- _brotlienc_handle = NULL; -- } -- if (_brotlidec_handle != NULL) { -- dlclose(_brotlidec_handle); -- _brotlidec_handle = NULL; -- } --#endif /* _WIN32 */ -+ gnutls_brotlienc_unload_library(); -+ gnutls_brotlidec_unload_library(); - } - - static int brotli_init(void) - { --#ifndef _WIN32 -- if (_brotlienc_handle != NULL || _brotlidec_handle != NULL) -- return 0; -- if ((_brotlienc_handle = dlopen(BROTLIENC_LIBRARY_SONAME, -- RTLD_NOW | RTLD_GLOBAL)) == NULL) -- goto error; -- if ((_brotlidec_handle = dlopen(BROTLIDEC_LIBRARY_SONAME, -- RTLD_NOW | RTLD_GLOBAL)) == NULL) -- goto error; -- if ((_gnutls_BrotliEncoderMaxCompressedSize = -- dlsym(_brotlienc_handle, -- "BrotliEncoderMaxCompressedSize")) == NULL) -- goto error; -- if ((_gnutls_BrotliEncoderCompress = -- dlsym(_brotlienc_handle, "BrotliEncoderCompress")) == NULL) -- goto error; -- if ((_gnutls_BrotliDecoderDecompress = dlsym( -- _brotlidec_handle, "BrotliDecoderDecompress")) == NULL) -- goto error; -+ if (gnutls_brotlienc_ensure_library(BROTLIENC_LIBRARY_SONAME, -+ RTLD_NOW | RTLD_GLOBAL) < 0) -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ -+ if (gnutls_brotlidec_ensure_library(BROTLIDEC_LIBRARY_SONAME, -+ RTLD_NOW | RTLD_GLOBAL) < 0) -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); - return 0; --error: -- brotli_deinit(); -- return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); --#else -- return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); --#endif /* _WIN32 */ - } - #endif /* HAVE_LIBBROTLI */ - - #ifdef HAVE_LIBZSTD --static void *_zstd_handle; -- --#if HAVE___TYPEOF__ --static __typeof__(ZSTD_isError)(*_gnutls_ZSTD_isError); --static __typeof__(ZSTD_compressBound)(*_gnutls_ZSTD_compressBound); --static __typeof__(ZSTD_compress)(*_gnutls_ZSTD_compress); --static __typeof__(ZSTD_decompress)(*_gnutls_ZSTD_decompress); --#else --static unsigned (*_gnutls_ZSTD_isError)(size_t code); --static size_t (*_gnutls_ZSTD_compressBound)(size_t srcSize); --static size_t (*_gnutls_ZSTD_compress)(void *dst, size_t dstCapacity, -- const void *src, size_t srcSize, -- int compressionLevel); --static size_t (*_gnutls_ZSTD_decompress)(void *dst, size_t dstCapacity, -- const void *src, -- size_t compressedSize); --#endif /* HAVE___TYPEOF__ */ - - static void zstd_deinit(void) - { --#ifndef _WIN32 -- if (_zstd_handle != NULL) { -- dlclose(_zstd_handle); -- _zstd_handle = NULL; -- } --#endif /* _WIN32 */ -+ gnutls_zstd_unload_library(); - } - - static int zstd_init(void) - { --#ifndef _WIN32 -- if (_zstd_handle != NULL) -- return 0; -- if ((_zstd_handle = dlopen(ZSTD_LIBRARY_SONAME, RTLD_NOW | RTLD_GLOBAL)) == -- NULL) -- goto error; -- if ((_gnutls_ZSTD_isError = dlsym(_zstd_handle, "ZSTD_isError")) == -- NULL) -- goto error; -- if ((_gnutls_ZSTD_compressBound = -- dlsym(_zstd_handle, "ZSTD_compressBound")) == NULL) -- goto error; -- if ((_gnutls_ZSTD_compress = dlsym(_zstd_handle, "ZSTD_compress")) == -- NULL) -- goto error; -- if ((_gnutls_ZSTD_decompress = -- dlsym(_zstd_handle, "ZSTD_decompress")) == NULL) -- goto error; -+ if (gnutls_zstd_ensure_library(ZSTD_LIBRARY_SONAME, -+ RTLD_NOW | RTLD_GLOBAL) < 0) -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); - return 0; --error: -- zstd_deinit(); -- return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); --#else -- return gnutls_assert_val(GNUTLS_E_UNIMPLEMENTED_FEATURE); --#endif /* _WIN32 */ - } - #endif /* HAVE_LIBZSTD */ - -@@ -345,15 +238,16 @@ size_t _gnutls_compress_bound(gnutls_compression_method_t alg, size_t src_len) - switch (alg) { - #ifdef HAVE_LIBZ - case GNUTLS_COMP_ZLIB: -- return _gnutls_zlib_compressBound(src_len); -+ return GNUTLS_ZLIB_FUNC(compressBound)(src_len); - #endif - #ifdef HAVE_LIBBROTLI - case GNUTLS_COMP_BROTLI: -- return _gnutls_BrotliEncoderMaxCompressedSize(src_len); -+ return GNUTLS_BROTLIENC_FUNC(BrotliEncoderMaxCompressedSize)( -+ src_len); - #endif - #ifdef HAVE_LIBZSTD - case GNUTLS_COMP_ZSTD: -- return _gnutls_ZSTD_compressBound(src_len); -+ return GNUTLS_ZSTD_FUNC(ZSTD_compressBound)(src_len); - #endif - default: - return 0; -@@ -372,7 +266,7 @@ int _gnutls_compress(gnutls_compression_method_t alg, uint8_t *dst, - int err; - uLongf comp_len = dst_len; - -- err = _gnutls_zlib_compress(dst, &comp_len, src, src_len); -+ err = GNUTLS_ZLIB_FUNC(compress)(dst, &comp_len, src, src_len); - if (err != Z_OK) - return gnutls_assert_val(GNUTLS_E_COMPRESSION_FAILED); - ret = comp_len; -@@ -383,7 +277,7 @@ int _gnutls_compress(gnutls_compression_method_t alg, uint8_t *dst, - BROTLI_BOOL err; - size_t comp_len = dst_len; - -- err = _gnutls_BrotliEncoderCompress( -+ err = GNUTLS_BROTLIENC_FUNC(BrotliEncoderCompress)( - BROTLI_DEFAULT_QUALITY, BROTLI_DEFAULT_WINDOW, - BROTLI_DEFAULT_MODE, src_len, src, &comp_len, dst); - if (!err) -@@ -395,9 +289,9 @@ int _gnutls_compress(gnutls_compression_method_t alg, uint8_t *dst, - case GNUTLS_COMP_ZSTD: { - size_t comp_len; - -- comp_len = _gnutls_ZSTD_compress(dst, dst_len, src, src_len, -- ZSTD_CLEVEL_DEFAULT); -- if (_gnutls_ZSTD_isError(comp_len)) -+ comp_len = GNUTLS_ZSTD_FUNC(ZSTD_compress)( -+ dst, dst_len, src, src_len, ZSTD_CLEVEL_DEFAULT); -+ if (GNUTLS_ZSTD_FUNC(ZSTD_isError)(comp_len)) - return gnutls_assert_val(GNUTLS_E_COMPRESSION_FAILED); - ret = comp_len; - } break; -@@ -425,7 +319,8 @@ int _gnutls_decompress(gnutls_compression_method_t alg, uint8_t *dst, - int err; - uLongf plain_len = dst_len; - -- err = _gnutls_zlib_uncompress(dst, &plain_len, src, src_len); -+ err = GNUTLS_ZLIB_FUNC(uncompress)(dst, &plain_len, src, -+ src_len); - if (err != Z_OK) - return gnutls_assert_val(GNUTLS_E_DECOMPRESSION_FAILED); - ret = plain_len; -@@ -436,8 +331,8 @@ int _gnutls_decompress(gnutls_compression_method_t alg, uint8_t *dst, - BrotliDecoderResult err; - size_t plain_len = dst_len; - -- err = _gnutls_BrotliDecoderDecompress(src_len, src, &plain_len, -- dst); -+ err = GNUTLS_BROTLIDEC_FUNC( -+ BrotliDecoderDecompress)(src_len, src, &plain_len, dst); - if (err != BROTLI_DECODER_RESULT_SUCCESS) - return gnutls_assert_val(GNUTLS_E_DECOMPRESSION_FAILED); - ret = plain_len; -@@ -447,8 +342,9 @@ int _gnutls_decompress(gnutls_compression_method_t alg, uint8_t *dst, - case GNUTLS_COMP_ZSTD: { - size_t plain_len; - -- plain_len = _gnutls_ZSTD_decompress(dst, dst_len, src, src_len); -- if (_gnutls_ZSTD_isError(plain_len)) -+ plain_len = GNUTLS_ZSTD_FUNC(ZSTD_decompress)(dst, dst_len, src, -+ src_len); -+ if (GNUTLS_ZSTD_FUNC(ZSTD_isError)(plain_len)) - return gnutls_assert_val(GNUTLS_E_DECOMPRESSION_FAILED); - ret = plain_len; - } break; -diff --git a/lib/dlwrap/brotlidec.c b/lib/dlwrap/brotlidec.c -new file mode 100644 -index 0000000000..45c9b4b259 ---- /dev/null -+++ b/lib/dlwrap/brotlidec.c -@@ -0,0 +1,182 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifdef HAVE_CONFIG_H -+#include "config.h" -+#endif -+ -+#include "brotlidec.h" -+ -+#if defined(GNUTLS_BROTLIDEC_ENABLE_DLOPEN) && GNUTLS_BROTLIDEC_ENABLE_DLOPEN -+ -+#include -+#include -+#include -+#include -+ -+/* If BROTLIDEC_LIBRARY_SONAME is defined, dlopen handle can be automatically -+ * set; otherwise, the caller needs to call -+ * gnutls_brotlidec_ensure_library with soname determined at run time. -+ */ -+#ifdef BROTLIDEC_LIBRARY_SONAME -+ -+static void -+ensure_library (void) -+{ -+ if (gnutls_brotlidec_ensure_library (BROTLIDEC_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ abort (); -+} -+ -+#if defined(GNUTLS_BROTLIDEC_ENABLE_PTHREAD) && GNUTLS_BROTLIDEC_ENABLE_PTHREAD -+#include -+ -+static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; -+ -+#define ENSURE_LIBRARY pthread_once(&dlopen_once, ensure_library) -+ -+#else /* GNUTLS_BROTLIDEC_ENABLE_PTHREAD */ -+ -+#define ENSURE_LIBRARY do { \ -+ if (!gnutls_brotlidec_dlhandle) \ -+ ensure_library(); \ -+ } while (0) -+ -+#endif /* !GNUTLS_BROTLIDEC_ENABLE_PTHREAD */ -+ -+#else /* BROTLIDEC_LIBRARY_SONAME */ -+ -+#define ENSURE_LIBRARY do {} while (0) -+ -+#endif /* !BROTLIDEC_LIBRARY_SONAME */ -+ -+static void *gnutls_brotlidec_dlhandle; -+ -+/* Define redirection symbols */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#if (2 <= __GNUC__ || (4 <= __clang_major__)) -+#define FUNC(ret, name, args, cargs) \ -+ static __typeof__(name)(*gnutls_brotlidec_sym_##name); -+#else -+#define FUNC(ret, name, args, cargs) \ -+ static ret(*gnutls_brotlidec_sym_##name)args; -+#endif -+#define VOID_FUNC FUNC -+#include "brotlidecfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+/* Define redirection wrapper functions */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ret gnutls_brotlidec_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_brotlidec_sym_##name); \ -+ return gnutls_brotlidec_sym_##name cargs; \ -+} -+#define VOID_FUNC(ret, name, args, cargs) \ -+ret gnutls_brotlidec_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_brotlidec_sym_##name); \ -+ gnutls_brotlidec_sym_##name cargs; \ -+} -+#include "brotlidecfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+static int -+ensure_symbol (const char *name, void **symp) -+{ -+ if (!*symp) -+ { -+ void *sym = dlsym (gnutls_brotlidec_dlhandle, name); -+ if (!sym) -+ return -errno; -+ *symp = sym; -+ } -+ return 0; -+} -+ -+int -+gnutls_brotlidec_ensure_library (const char *soname, int flags) -+{ -+ int err; -+ -+ if (!gnutls_brotlidec_dlhandle) -+ { -+ gnutls_brotlidec_dlhandle = dlopen (soname, flags); -+ if (!gnutls_brotlidec_dlhandle) -+ return -errno; -+ } -+ -+#define ENSURE_SYMBOL(name) \ -+ ensure_symbol(#name, (void **)&gnutls_brotlidec_sym_##name) -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ return err; -+#define VOID_FUNC FUNC -+#include "brotlidecfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef ENSURE_SYMBOL -+ return 0; -+} -+ -+void -+gnutls_brotlidec_unload_library (void) -+{ -+ if (gnutls_brotlidec_dlhandle) -+ dlclose (gnutls_brotlidec_dlhandle); -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ gnutls_brotlidec_sym_##name = NULL; -+#define VOID_FUNC FUNC -+#include "brotlidecfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef RESET_SYMBOL -+} -+ -+#else /* GNUTLS_BROTLIDEC_ENABLE_DLOPEN */ -+ -+int -+gnutls_brotlidec_ensure_library (const char *soname, int flags) -+{ -+ (void) soname; -+ (void) flags; -+ return 0; -+} -+ -+void -+gnutls_brotlidec_unload_library (void) -+{ -+} -+ -+#endif /* !GNUTLS_BROTLIDEC_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/brotlidec.h b/lib/dlwrap/brotlidec.h -new file mode 100644 -index 0000000000..31397f24cf ---- /dev/null -+++ b/lib/dlwrap/brotlidec.h -@@ -0,0 +1,47 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifndef GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ -+#define GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ -+ -+#include -+ -+#if defined(GNUTLS_BROTLIDEC_ENABLE_DLOPEN) && GNUTLS_BROTLIDEC_ENABLE_DLOPEN -+ -+#define FUNC(ret, name, args, cargs) \ -+ ret gnutls_brotlidec_func_##name args; -+#define VOID_FUNC FUNC -+#include "brotlidecfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#define GNUTLS_BROTLIDEC_FUNC(name) gnutls_brotlidec_func_##name -+ -+#else -+ -+#define GNUTLS_BROTLIDEC_FUNC(name) name -+ -+#endif /* GNUTLS_BROTLIDEC_ENABLE_DLOPEN */ -+ -+/* Ensure SONAME to be loaded with dlopen FLAGS, and all the necessary -+ * symbols are resolved. -+ * -+ * Returns 0 on success; negative error code otherwise. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+int gnutls_brotlidec_ensure_library (const char *soname, int flags); -+ -+/* Unload library and reset symbols. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+void gnutls_brotlidec_unload_library (void); -+ -+#endif /* GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ */ -diff --git a/lib/dlwrap/brotlidecfuncs.h b/lib/dlwrap/brotlidecfuncs.h -new file mode 100644 -index 0000000000..aa033e3a8b ---- /dev/null -+++ b/lib/dlwrap/brotlidecfuncs.h -@@ -0,0 +1,9 @@ -+/* -+ * This file was automatically generated from decode.h, -+ * which is covered by the following license: -+ * Copyright 2013 Google Inc. All Rights Reserved. -+ * -+ * Distributed under MIT license. -+ * See file LICENSE for detail or copy at https://opensource.org/licenses/MIT -+ */ -+FUNC(BrotliDecoderResult, BrotliDecoderDecompress, (size_t encoded_size, const uint8_t encoded_buffer[], size_t *decoded_size, uint8_t decoded_buffer[]), (encoded_size, encoded_buffer, decoded_size, decoded_buffer)) -diff --git a/lib/dlwrap/brotlienc.c b/lib/dlwrap/brotlienc.c -new file mode 100644 -index 0000000000..9dd8ff37c6 ---- /dev/null -+++ b/lib/dlwrap/brotlienc.c -@@ -0,0 +1,182 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifdef HAVE_CONFIG_H -+#include "config.h" -+#endif -+ -+#include "brotlienc.h" -+ -+#if defined(GNUTLS_BROTLIENC_ENABLE_DLOPEN) && GNUTLS_BROTLIENC_ENABLE_DLOPEN -+ -+#include -+#include -+#include -+#include -+ -+/* If BROTLIENC_LIBRARY_SONAME is defined, dlopen handle can be automatically -+ * set; otherwise, the caller needs to call -+ * gnutls_brotlienc_ensure_library with soname determined at run time. -+ */ -+#ifdef BROTLIENC_LIBRARY_SONAME -+ -+static void -+ensure_library (void) -+{ -+ if (gnutls_brotlienc_ensure_library (BROTLIENC_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ abort (); -+} -+ -+#if defined(GNUTLS_BROTLIENC_ENABLE_PTHREAD) && GNUTLS_BROTLIENC_ENABLE_PTHREAD -+#include -+ -+static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; -+ -+#define ENSURE_LIBRARY pthread_once(&dlopen_once, ensure_library) -+ -+#else /* GNUTLS_BROTLIENC_ENABLE_PTHREAD */ -+ -+#define ENSURE_LIBRARY do { \ -+ if (!gnutls_brotlienc_dlhandle) \ -+ ensure_library(); \ -+ } while (0) -+ -+#endif /* !GNUTLS_BROTLIENC_ENABLE_PTHREAD */ -+ -+#else /* BROTLIENC_LIBRARY_SONAME */ -+ -+#define ENSURE_LIBRARY do {} while (0) -+ -+#endif /* !BROTLIENC_LIBRARY_SONAME */ -+ -+static void *gnutls_brotlienc_dlhandle; -+ -+/* Define redirection symbols */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#if (2 <= __GNUC__ || (4 <= __clang_major__)) -+#define FUNC(ret, name, args, cargs) \ -+ static __typeof__(name)(*gnutls_brotlienc_sym_##name); -+#else -+#define FUNC(ret, name, args, cargs) \ -+ static ret(*gnutls_brotlienc_sym_##name)args; -+#endif -+#define VOID_FUNC FUNC -+#include "brotliencfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+/* Define redirection wrapper functions */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ret gnutls_brotlienc_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_brotlienc_sym_##name); \ -+ return gnutls_brotlienc_sym_##name cargs; \ -+} -+#define VOID_FUNC(ret, name, args, cargs) \ -+ret gnutls_brotlienc_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_brotlienc_sym_##name); \ -+ gnutls_brotlienc_sym_##name cargs; \ -+} -+#include "brotliencfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+static int -+ensure_symbol (const char *name, void **symp) -+{ -+ if (!*symp) -+ { -+ void *sym = dlsym (gnutls_brotlienc_dlhandle, name); -+ if (!sym) -+ return -errno; -+ *symp = sym; -+ } -+ return 0; -+} -+ -+int -+gnutls_brotlienc_ensure_library (const char *soname, int flags) -+{ -+ int err; -+ -+ if (!gnutls_brotlienc_dlhandle) -+ { -+ gnutls_brotlienc_dlhandle = dlopen (soname, flags); -+ if (!gnutls_brotlienc_dlhandle) -+ return -errno; -+ } -+ -+#define ENSURE_SYMBOL(name) \ -+ ensure_symbol(#name, (void **)&gnutls_brotlienc_sym_##name) -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ return err; -+#define VOID_FUNC FUNC -+#include "brotliencfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef ENSURE_SYMBOL -+ return 0; -+} -+ -+void -+gnutls_brotlienc_unload_library (void) -+{ -+ if (gnutls_brotlienc_dlhandle) -+ dlclose (gnutls_brotlienc_dlhandle); -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ gnutls_brotlienc_sym_##name = NULL; -+#define VOID_FUNC FUNC -+#include "brotliencfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef RESET_SYMBOL -+} -+ -+#else /* GNUTLS_BROTLIENC_ENABLE_DLOPEN */ -+ -+int -+gnutls_brotlienc_ensure_library (const char *soname, int flags) -+{ -+ (void) soname; -+ (void) flags; -+ return 0; -+} -+ -+void -+gnutls_brotlienc_unload_library (void) -+{ -+} -+ -+#endif /* !GNUTLS_BROTLIENC_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/brotlienc.h b/lib/dlwrap/brotlienc.h -new file mode 100644 -index 0000000000..ed1af45e04 ---- /dev/null -+++ b/lib/dlwrap/brotlienc.h -@@ -0,0 +1,47 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifndef GNUTLS_LIB_DLWRAP_BROTLIENC_H_ -+#define GNUTLS_LIB_DLWRAP_BROTLIENC_H_ -+ -+#include -+ -+#if defined(GNUTLS_BROTLIENC_ENABLE_DLOPEN) && GNUTLS_BROTLIENC_ENABLE_DLOPEN -+ -+#define FUNC(ret, name, args, cargs) \ -+ ret gnutls_brotlienc_func_##name args; -+#define VOID_FUNC FUNC -+#include "brotliencfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#define GNUTLS_BROTLIENC_FUNC(name) gnutls_brotlienc_func_##name -+ -+#else -+ -+#define GNUTLS_BROTLIENC_FUNC(name) name -+ -+#endif /* GNUTLS_BROTLIENC_ENABLE_DLOPEN */ -+ -+/* Ensure SONAME to be loaded with dlopen FLAGS, and all the necessary -+ * symbols are resolved. -+ * -+ * Returns 0 on success; negative error code otherwise. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+int gnutls_brotlienc_ensure_library (const char *soname, int flags); -+ -+/* Unload library and reset symbols. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+void gnutls_brotlienc_unload_library (void); -+ -+#endif /* GNUTLS_LIB_DLWRAP_BROTLIENC_H_ */ -diff --git a/lib/dlwrap/brotliencfuncs.h b/lib/dlwrap/brotliencfuncs.h -new file mode 100644 -index 0000000000..1a4f884d35 ---- /dev/null -+++ b/lib/dlwrap/brotliencfuncs.h -@@ -0,0 +1,10 @@ -+/* -+ * This file was automatically generated from encode.h, -+ * which is covered by the following license: -+ * Copyright 2013 Google Inc. All Rights Reserved. -+ * -+ * Distributed under MIT license. -+ * See file LICENSE for detail or copy at https://opensource.org/licenses/MIT -+ */ -+FUNC(size_t, BrotliEncoderMaxCompressedSize, (size_t input_size), (input_size)) -+FUNC(int, BrotliEncoderCompress, (int quality, int lgwin, BrotliEncoderMode mode, size_t input_size, const uint8_t input_buffer[], size_t *encoded_size, uint8_t encoded_buffer[]), (quality, lgwin, mode, input_size, input_buffer, encoded_size, encoded_buffer)) -diff --git a/lib/dlwrap/zlib.c b/lib/dlwrap/zlib.c -new file mode 100644 -index 0000000000..455485c63f ---- /dev/null -+++ b/lib/dlwrap/zlib.c -@@ -0,0 +1,182 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifdef HAVE_CONFIG_H -+#include "config.h" -+#endif -+ -+#include "zlib.h" -+ -+#if defined(GNUTLS_ZLIB_ENABLE_DLOPEN) && GNUTLS_ZLIB_ENABLE_DLOPEN -+ -+#include -+#include -+#include -+#include -+ -+/* If Z_LIBRARY_SONAME is defined, dlopen handle can be automatically -+ * set; otherwise, the caller needs to call -+ * gnutls_zlib_ensure_library with soname determined at run time. -+ */ -+#ifdef Z_LIBRARY_SONAME -+ -+static void -+ensure_library (void) -+{ -+ if (gnutls_zlib_ensure_library (Z_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ abort (); -+} -+ -+#if defined(GNUTLS_ZLIB_ENABLE_PTHREAD) && GNUTLS_ZLIB_ENABLE_PTHREAD -+#include -+ -+static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; -+ -+#define ENSURE_LIBRARY pthread_once(&dlopen_once, ensure_library) -+ -+#else /* GNUTLS_ZLIB_ENABLE_PTHREAD */ -+ -+#define ENSURE_LIBRARY do { \ -+ if (!gnutls_zlib_dlhandle) \ -+ ensure_library(); \ -+ } while (0) -+ -+#endif /* !GNUTLS_ZLIB_ENABLE_PTHREAD */ -+ -+#else /* Z_LIBRARY_SONAME */ -+ -+#define ENSURE_LIBRARY do {} while (0) -+ -+#endif /* !Z_LIBRARY_SONAME */ -+ -+static void *gnutls_zlib_dlhandle; -+ -+/* Define redirection symbols */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#if (2 <= __GNUC__ || (4 <= __clang_major__)) -+#define FUNC(ret, name, args, cargs) \ -+ static __typeof__(name)(*gnutls_zlib_sym_##name); -+#else -+#define FUNC(ret, name, args, cargs) \ -+ static ret(*gnutls_zlib_sym_##name)args; -+#endif -+#define VOID_FUNC FUNC -+#include "zlibfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+/* Define redirection wrapper functions */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ret gnutls_zlib_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_zlib_sym_##name); \ -+ return gnutls_zlib_sym_##name cargs; \ -+} -+#define VOID_FUNC(ret, name, args, cargs) \ -+ret gnutls_zlib_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_zlib_sym_##name); \ -+ gnutls_zlib_sym_##name cargs; \ -+} -+#include "zlibfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+static int -+ensure_symbol (const char *name, void **symp) -+{ -+ if (!*symp) -+ { -+ void *sym = dlsym (gnutls_zlib_dlhandle, name); -+ if (!sym) -+ return -errno; -+ *symp = sym; -+ } -+ return 0; -+} -+ -+int -+gnutls_zlib_ensure_library (const char *soname, int flags) -+{ -+ int err; -+ -+ if (!gnutls_zlib_dlhandle) -+ { -+ gnutls_zlib_dlhandle = dlopen (soname, flags); -+ if (!gnutls_zlib_dlhandle) -+ return -errno; -+ } -+ -+#define ENSURE_SYMBOL(name) \ -+ ensure_symbol(#name, (void **)&gnutls_zlib_sym_##name) -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ return err; -+#define VOID_FUNC FUNC -+#include "zlibfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef ENSURE_SYMBOL -+ return 0; -+} -+ -+void -+gnutls_zlib_unload_library (void) -+{ -+ if (gnutls_zlib_dlhandle) -+ dlclose (gnutls_zlib_dlhandle); -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ gnutls_zlib_sym_##name = NULL; -+#define VOID_FUNC FUNC -+#include "zlibfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef RESET_SYMBOL -+} -+ -+#else /* GNUTLS_ZLIB_ENABLE_DLOPEN */ -+ -+int -+gnutls_zlib_ensure_library (const char *soname, int flags) -+{ -+ (void) soname; -+ (void) flags; -+ return 0; -+} -+ -+void -+gnutls_zlib_unload_library (void) -+{ -+} -+ -+#endif /* !GNUTLS_ZLIB_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/zlib.h b/lib/dlwrap/zlib.h -new file mode 100644 -index 0000000000..a9666d27f5 ---- /dev/null -+++ b/lib/dlwrap/zlib.h -@@ -0,0 +1,47 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifndef GNUTLS_LIB_DLWRAP_ZLIB_H_ -+#define GNUTLS_LIB_DLWRAP_ZLIB_H_ -+ -+#include -+ -+#if defined(GNUTLS_ZLIB_ENABLE_DLOPEN) && GNUTLS_ZLIB_ENABLE_DLOPEN -+ -+#define FUNC(ret, name, args, cargs) \ -+ ret gnutls_zlib_func_##name args; -+#define VOID_FUNC FUNC -+#include "zlibfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#define GNUTLS_ZLIB_FUNC(name) gnutls_zlib_func_##name -+ -+#else -+ -+#define GNUTLS_ZLIB_FUNC(name) name -+ -+#endif /* GNUTLS_ZLIB_ENABLE_DLOPEN */ -+ -+/* Ensure SONAME to be loaded with dlopen FLAGS, and all the necessary -+ * symbols are resolved. -+ * -+ * Returns 0 on success; negative error code otherwise. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+int gnutls_zlib_ensure_library (const char *soname, int flags); -+ -+/* Unload library and reset symbols. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+void gnutls_zlib_unload_library (void); -+ -+#endif /* GNUTLS_LIB_DLWRAP_ZLIB_H_ */ -diff --git a/lib/dlwrap/zlibfuncs.h b/lib/dlwrap/zlibfuncs.h -new file mode 100644 -index 0000000000..efe01455d2 ---- /dev/null -+++ b/lib/dlwrap/zlibfuncs.h -@@ -0,0 +1,27 @@ -+/* -+ * This file was automatically generated from zlib.h, -+ * which is covered by the following license: -+ * Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler -+ * -+ * This software is provided 'as-is', without any express or implied -+ * warranty. In no event will the authors be held liable for any damages -+ * arising from the use of this software. -+ * -+ * Permission is granted to anyone to use this software for any purpose, -+ * including commercial applications, and to alter it and redistribute it -+ * freely, subject to the following restrictions: -+ * -+ * 1. The origin of this software must not be misrepresented; you must not -+ * claim that you wrote the original software. If you use this software -+ * in a product, an acknowledgment in the product documentation would be -+ * appreciated but is not required. -+ * 2. Altered source versions must be plainly marked as such, and must not be -+ * misrepresented as being the original software. -+ * 3. This notice may not be removed or altered from any source distribution. -+ * -+ * Jean-loup Gailly Mark Adler -+ * jloup@gzip.org madler@alumni.caltech.edu -+ */ -+FUNC(int, compress, (Bytef *dest, uLongf *destLen, const Bytef *source, uLong sourceLen), (dest, destLen, source, sourceLen)) -+FUNC(uLong, compressBound, (uLong sourceLen), (sourceLen)) -+FUNC(int, uncompress, (Bytef *dest, uLongf *destLen, const Bytef *source, uLong sourceLen), (dest, destLen, source, sourceLen)) -diff --git a/lib/dlwrap/zstd.c b/lib/dlwrap/zstd.c -new file mode 100644 -index 0000000000..2ea7252975 ---- /dev/null -+++ b/lib/dlwrap/zstd.c -@@ -0,0 +1,182 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifdef HAVE_CONFIG_H -+#include "config.h" -+#endif -+ -+#include "zstd.h" -+ -+#if defined(GNUTLS_ZSTD_ENABLE_DLOPEN) && GNUTLS_ZSTD_ENABLE_DLOPEN -+ -+#include -+#include -+#include -+#include -+ -+/* If ZSTD_LIBRARY_SONAME is defined, dlopen handle can be automatically -+ * set; otherwise, the caller needs to call -+ * gnutls_zstd_ensure_library with soname determined at run time. -+ */ -+#ifdef ZSTD_LIBRARY_SONAME -+ -+static void -+ensure_library (void) -+{ -+ if (gnutls_zstd_ensure_library (ZSTD_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ abort (); -+} -+ -+#if defined(GNUTLS_ZSTD_ENABLE_PTHREAD) && GNUTLS_ZSTD_ENABLE_PTHREAD -+#include -+ -+static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; -+ -+#define ENSURE_LIBRARY pthread_once(&dlopen_once, ensure_library) -+ -+#else /* GNUTLS_ZSTD_ENABLE_PTHREAD */ -+ -+#define ENSURE_LIBRARY do { \ -+ if (!gnutls_zstd_dlhandle) \ -+ ensure_library(); \ -+ } while (0) -+ -+#endif /* !GNUTLS_ZSTD_ENABLE_PTHREAD */ -+ -+#else /* ZSTD_LIBRARY_SONAME */ -+ -+#define ENSURE_LIBRARY do {} while (0) -+ -+#endif /* !ZSTD_LIBRARY_SONAME */ -+ -+static void *gnutls_zstd_dlhandle; -+ -+/* Define redirection symbols */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#if (2 <= __GNUC__ || (4 <= __clang_major__)) -+#define FUNC(ret, name, args, cargs) \ -+ static __typeof__(name)(*gnutls_zstd_sym_##name); -+#else -+#define FUNC(ret, name, args, cargs) \ -+ static ret(*gnutls_zstd_sym_##name)args; -+#endif -+#define VOID_FUNC FUNC -+#include "zstdfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+/* Define redirection wrapper functions */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ret gnutls_zstd_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_zstd_sym_##name); \ -+ return gnutls_zstd_sym_##name cargs; \ -+} -+#define VOID_FUNC(ret, name, args, cargs) \ -+ret gnutls_zstd_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_zstd_sym_##name); \ -+ gnutls_zstd_sym_##name cargs; \ -+} -+#include "zstdfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+static int -+ensure_symbol (const char *name, void **symp) -+{ -+ if (!*symp) -+ { -+ void *sym = dlsym (gnutls_zstd_dlhandle, name); -+ if (!sym) -+ return -errno; -+ *symp = sym; -+ } -+ return 0; -+} -+ -+int -+gnutls_zstd_ensure_library (const char *soname, int flags) -+{ -+ int err; -+ -+ if (!gnutls_zstd_dlhandle) -+ { -+ gnutls_zstd_dlhandle = dlopen (soname, flags); -+ if (!gnutls_zstd_dlhandle) -+ return -errno; -+ } -+ -+#define ENSURE_SYMBOL(name) \ -+ ensure_symbol(#name, (void **)&gnutls_zstd_sym_##name) -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ return err; -+#define VOID_FUNC FUNC -+#include "zstdfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef ENSURE_SYMBOL -+ return 0; -+} -+ -+void -+gnutls_zstd_unload_library (void) -+{ -+ if (gnutls_zstd_dlhandle) -+ dlclose (gnutls_zstd_dlhandle); -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ gnutls_zstd_sym_##name = NULL; -+#define VOID_FUNC FUNC -+#include "zstdfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef RESET_SYMBOL -+} -+ -+#else /* GNUTLS_ZSTD_ENABLE_DLOPEN */ -+ -+int -+gnutls_zstd_ensure_library (const char *soname, int flags) -+{ -+ (void) soname; -+ (void) flags; -+ return 0; -+} -+ -+void -+gnutls_zstd_unload_library (void) -+{ -+} -+ -+#endif /* !GNUTLS_ZSTD_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/zstd.h b/lib/dlwrap/zstd.h -new file mode 100644 -index 0000000000..80ac2fbd46 ---- /dev/null -+++ b/lib/dlwrap/zstd.h -@@ -0,0 +1,47 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifndef GNUTLS_LIB_DLWRAP_ZSTD_H_ -+#define GNUTLS_LIB_DLWRAP_ZSTD_H_ -+ -+#include -+ -+#if defined(GNUTLS_ZSTD_ENABLE_DLOPEN) && GNUTLS_ZSTD_ENABLE_DLOPEN -+ -+#define FUNC(ret, name, args, cargs) \ -+ ret gnutls_zstd_func_##name args; -+#define VOID_FUNC FUNC -+#include "zstdfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#define GNUTLS_ZSTD_FUNC(name) gnutls_zstd_func_##name -+ -+#else -+ -+#define GNUTLS_ZSTD_FUNC(name) name -+ -+#endif /* GNUTLS_ZSTD_ENABLE_DLOPEN */ -+ -+/* Ensure SONAME to be loaded with dlopen FLAGS, and all the necessary -+ * symbols are resolved. -+ * -+ * Returns 0 on success; negative error code otherwise. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+int gnutls_zstd_ensure_library (const char *soname, int flags); -+ -+/* Unload library and reset symbols. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+void gnutls_zstd_unload_library (void); -+ -+#endif /* GNUTLS_LIB_DLWRAP_ZSTD_H_ */ -diff --git a/lib/dlwrap/zstdfuncs.h b/lib/dlwrap/zstdfuncs.h -new file mode 100644 -index 0000000000..8e3eb9ff59 ---- /dev/null -+++ b/lib/dlwrap/zstdfuncs.h -@@ -0,0 +1,15 @@ -+/* -+ * This file was automatically generated from zstd.h, -+ * which is covered by the following license: -+ * Copyright (c) Meta Platforms, Inc. and affiliates. -+ * All rights reserved. -+ * -+ * This source code is licensed under both the BSD-style license (found in the -+ * LICENSE file in the root directory of this source tree) and the GPLv2 (found -+ * in the COPYING file in the root directory of this source tree). -+ * You may select, at your option, one of the above-listed licenses. -+ */ -+FUNC(size_t, ZSTD_compress, (void *dst, size_t dstCapacity, const void *src, size_t srcSize, int compressionLevel), (dst, dstCapacity, src, srcSize, compressionLevel)) -+FUNC(size_t, ZSTD_decompress, (void *dst, size_t dstCapacity, const void *src, size_t compressedSize), (dst, dstCapacity, src, compressedSize)) -+FUNC(size_t, ZSTD_compressBound, (size_t srcSize), (srcSize)) -+FUNC(unsigned int, ZSTD_isError, (size_t code), (code)) --- -2.45.2 - diff --git a/gnutls-3.8.6-liboqs-x25519-kyber768d00.patch b/gnutls-3.8.6-liboqs-x25519-kyber768d00.patch deleted file mode 100644 index d807f76..0000000 --- a/gnutls-3.8.6-liboqs-x25519-kyber768d00.patch +++ /dev/null @@ -1,3246 +0,0 @@ -From 39dad633e6acb18c3853b7cb182324ccd250ba46 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Fri, 31 May 2024 09:18:27 +0900 -Subject: [PATCH 1/2] build: plumb liboqs as an optional dependency - -This exposes OQS functions necessary to implement Kyber768 through -dlopen with stub implementation for lower-level cryptographic -primitives, such as SHA3 and DRBG. - -Signed-off-by: Daiki Ueno ---- - .gitignore | 1 + - cfg.mk | 2 +- - configure.ac | 37 ++++ - devel/dlwrap/oqs.syms | 9 + - devel/generate-dlwrap.sh | 3 + - devel/indent-gnutls | 2 +- - lib/Makefile.am | 14 ++ - lib/dlwrap/oqs.c | 182 ++++++++++++++++ - lib/dlwrap/oqs.h | 53 +++++ - lib/dlwrap/oqsfuncs.h | 14 ++ - lib/global.c | 8 + - lib/liboqs/Makefile.am | 43 ++++ - lib/liboqs/backport/sha3_ops.h | 256 ++++++++++++++++++++++ - lib/liboqs/liboqs.c | 41 ++++ - lib/liboqs/liboqs.h | 27 +++ - lib/liboqs/rand.c | 43 ++++ - lib/liboqs/rand.h | 27 +++ - lib/liboqs/sha3.c | 373 +++++++++++++++++++++++++++++++++ - lib/liboqs/sha3.h | 27 +++ - 19 files changed, 1160 insertions(+), 2 deletions(-) - create mode 100644 devel/dlwrap/oqs.syms - create mode 100644 lib/dlwrap/oqs.c - create mode 100644 lib/dlwrap/oqs.h - create mode 100644 lib/dlwrap/oqsfuncs.h - create mode 100644 lib/liboqs/Makefile.am - create mode 100644 lib/liboqs/backport/sha3_ops.h - create mode 100644 lib/liboqs/liboqs.c - create mode 100644 lib/liboqs/liboqs.h - create mode 100644 lib/liboqs/rand.c - create mode 100644 lib/liboqs/rand.h - create mode 100644 lib/liboqs/sha3.c - create mode 100644 lib/liboqs/sha3.h - -diff --git a/cfg.mk b/cfg.mk -index 1b94279633..88f6df480d 100644 ---- a/cfg.mk -+++ b/cfg.mk -@@ -24,7 +24,7 @@ PACKAGE ?= gnutls - - .PHONY: config glimport - --INDENT_SOURCES = `find . -name \*.[ch] -o -name gnutls.h.in | grep -v -e ^./build-aux/ -e ^./config.h -e ^./devel/ -e ^./gnulib -e ^./lib/minitasn1/ -e ^./lib/includes/gnutls/gnutls.h -e ^./lib/nettle/backport/ -e ^./lib/priority_options.h -e ^./lib/unistring/ -e ^./lib/x509/supported_exts.h -e ^./lib/build-aux/ -e ^./lib/dlwrap/ -e ^./gl/ -e ^./src/gl/ -e ^./src/.*-options.[ch] -e -args.[ch] -e asn1_tab.c -e ^./tests/suite/` -+INDENT_SOURCES = `find . -name \*.[ch] -o -name gnutls.h.in | grep -v -e ^./build-aux/ -e ^./config.h -e ^./devel/ -e ^./gnulib -e ^./lib/minitasn1/ -e ^./lib/includes/gnutls/gnutls.h -e ^./lib/nettle/backport/ -e ^./lib/priority_options.h -e ^./lib/unistring/ -e ^./lib/x509/supported_exts.h -e ^./lib/build-aux/ -e ^./lib/dlwrap/ -e ^./lib/liboqs/backport/ -e ^./gl/ -e ^./src/gl/ -e ^./src/.*-options.[ch] -e -args.[ch] -e asn1_tab.c -e ^./tests/suite/` - - ifeq ($(.DEFAULT_GOAL),abort-due-to-no-makefile) - .DEFAULT_GOAL := bootstrap -diff --git a/configure.ac b/configure.ac -index fb0aefe1f4..145eada690 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1185,6 +1185,41 @@ AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ - CFLAGS="$save_CFLAGS" - ]) - -+AC_ARG_WITH(liboqs, -+ AS_HELP_STRING([--with-liboqs], -+ [Enable liboqs support.]), -+ [with_liboqs=$withval], [with_liboqs=no]) -+AS_IF([test "$with_liboqs" != "no"], [PKG_CHECK_MODULES(LIBOQS, [liboqs >= 0.10.1], [have_liboqs=yes], [have_liboqs=no])]) -+AS_IF([test "$have_liboqs" = "yes"], [AC_DEFINE([HAVE_LIBOQS], 1, [Have liboqs])], -+ [test "$with_liboqs" = "yes"], [AC_MSG_ERROR([[ -+*** -+*** liboqs support was requested but the required libraries were not found. -+*** ]])]) -+ -+save_CFLAGS=$CFLAGS -+CFLAGS="$CFLAGS $LIBOQS_CFLAGS" -+AC_CHECK_DECLS([OQS_SHA3_set_callbacks]) -+CFLAGS="$save_CFLAGS" -+ -+# liboqs 0.10.1 didn't expose OQS_SHA3_set_callbacks from the header -+# file, so extra treatment is needed: -+# https://github.com/open-quantum-safe/liboqs/pull/1832 -+AM_CONDITIONAL(NEED_LIBOQS_SHA3_OPS_H, test "$ac_cv_have_decl_OQS_SHA3_set_callbacks" != yes) -+ -+AM_CONDITIONAL(ENABLE_LIBOQS, test "$have_liboqs" = "yes") -+ -+AS_IF([test "$ac_cv_dlopen_soname_works" = yes], [ -+ save_CFLAGS=$CFLAGS -+ CFLAGS="$CFLAGS $LIBOQS_CFLAGS" -+ save_LIBS=$LIBS -+ LIBS="$LIBS $LIBOQS_LIBS" -+ LIBGNUTLS_CHECK_SONAME([oqs], [AC_LANG_PROGRAM([ -+ #include ],[ -+ OQS_version ();])]) -+ LIBS="$save_LIBS" -+ CFLAGS="$save_CFLAGS" -+]) -+ - AM_CONDITIONAL(NEED_LTLIBDL, test "$need_ltlibdl" = yes) - - # export for use in scripts -@@ -1382,6 +1417,7 @@ AC_CONFIG_FILES([ - lib/gnutls.pc - lib/includes/Makefile - lib/includes/gnutls/gnutls.h -+ lib/liboqs/Makefile - lib/minitasn1/Makefile - lib/nettle/Makefile - lib/x509/Makefile -@@ -1463,6 +1499,7 @@ if features are disabled) - Non-SuiteB curves: $enable_non_suiteb - FIPS140 mode: $enable_fips - Strict DER time: $ac_strict_der_time -+ liboqs: $have_liboqs - ]) - - AC_MSG_NOTICE([Optional libraries: -diff --git a/devel/dlwrap/oqs.syms b/devel/dlwrap/oqs.syms -new file mode 100644 -index 0000000000..8f067b2dd3 ---- /dev/null -+++ b/devel/dlwrap/oqs.syms -@@ -0,0 +1,9 @@ -+OQS_SHA3_set_callbacks -+OQS_init -+OQS_destroy -+OQS_KEM_new -+OQS_KEM_encaps -+OQS_KEM_decaps -+OQS_KEM_keypair -+OQS_KEM_free -+OQS_randombytes_custom_algorithm -\ No newline at end of file -diff --git a/devel/generate-dlwrap.sh b/devel/generate-dlwrap.sh -index dbcf870612..3e253d9228 100755 ---- a/devel/generate-dlwrap.sh -+++ b/devel/generate-dlwrap.sh -@@ -35,3 +35,6 @@ echo "Generating $DST/brotlidec.h" - - "$DLWRAP" --input /usr/include/brotli/decode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlidec.syms" --license-file "$SRC/brotli.license" --soname BROTLIDEC_LIBRARY_SONAME --prefix gnutls_brotlidec --loader-basename brotlidec --header-guard GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ --include "" - -+echo "Generating $DST/oqs.h" -+ -+"$DLWRAP" --input /usr/include/oqs/oqs.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/oqs.syms" --license "SPDX-License-Identifier: MIT" --soname OQS_LIBRARY_SONAME --prefix gnutls_oqs --header-guard GNUTLS_LIB_DLWRAP_OQS_H_ --include "" -diff --git a/lib/Makefile.am b/lib/Makefile.am -index d1bd07248e..067772c322 100644 ---- a/lib/Makefile.am -+++ b/lib/Makefile.am -@@ -29,6 +29,10 @@ if ENABLE_MINITASN1 - SUBDIRS += minitasn1 - endif - -+if ENABLE_LIBOQS -+SUBDIRS += liboqs -+endif -+ - localedir = $(datadir)/locale - - include $(top_srcdir)/lib/common.mk -@@ -119,6 +123,16 @@ thirdparty_libadd += $(LIBBROTLIDEC_LIBS) - endif - endif - -+if ENABLE_LIBOQS -+COBJECTS += dlwrap/oqs.c dlwrap/oqsfuncs.h dlwrap/oqs.h -+ -+if ENABLE_DLOPEN -+AM_CPPFLAGS += $(LIBOQS_CFLAGS) -DGNUTLS_OQS_ENABLE_DLOPEN=1 -+else -+thirdparty_libadd += $(LIBOQS_LIBS) -+endif -+endif -+ - if ENABLE_GOST - COBJECTS += vko.c - endif -diff --git a/lib/dlwrap/oqs.c b/lib/dlwrap/oqs.c -new file mode 100644 -index 0000000000..d7fcc9c80c ---- /dev/null -+++ b/lib/dlwrap/oqs.c -@@ -0,0 +1,182 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifdef HAVE_CONFIG_H -+#include "config.h" -+#endif -+ -+#include "oqs.h" -+ -+#if defined(GNUTLS_OQS_ENABLE_DLOPEN) && GNUTLS_OQS_ENABLE_DLOPEN -+ -+#include -+#include -+#include -+#include -+ -+/* If OQS_LIBRARY_SONAME is defined, dlopen handle can be automatically -+ * set; otherwise, the caller needs to call -+ * gnutls_oqs_ensure_library with soname determined at run time. -+ */ -+#ifdef OQS_LIBRARY_SONAME -+ -+static void -+ensure_library (void) -+{ -+ if (gnutls_oqs_ensure_library (OQS_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ abort (); -+} -+ -+#if defined(GNUTLS_OQS_ENABLE_PTHREAD) && GNUTLS_OQS_ENABLE_PTHREAD -+#include -+ -+static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; -+ -+#define ENSURE_LIBRARY pthread_once(&dlopen_once, ensure_library) -+ -+#else /* GNUTLS_OQS_ENABLE_PTHREAD */ -+ -+#define ENSURE_LIBRARY do { \ -+ if (!gnutls_oqs_dlhandle) \ -+ ensure_library(); \ -+ } while (0) -+ -+#endif /* !GNUTLS_OQS_ENABLE_PTHREAD */ -+ -+#else /* OQS_LIBRARY_SONAME */ -+ -+#define ENSURE_LIBRARY do {} while (0) -+ -+#endif /* !OQS_LIBRARY_SONAME */ -+ -+static void *gnutls_oqs_dlhandle; -+ -+/* Define redirection symbols */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#if (2 <= __GNUC__ || (4 <= __clang_major__)) -+#define FUNC(ret, name, args, cargs) \ -+ static __typeof__(name)(*gnutls_oqs_sym_##name); -+#else -+#define FUNC(ret, name, args, cargs) \ -+ static ret(*gnutls_oqs_sym_##name)args; -+#endif -+#define VOID_FUNC FUNC -+#include "oqsfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+/* Define redirection wrapper functions */ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ret gnutls_oqs_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_oqs_sym_##name); \ -+ return gnutls_oqs_sym_##name cargs; \ -+} -+#define VOID_FUNC(ret, name, args, cargs) \ -+ret gnutls_oqs_func_##name args \ -+{ \ -+ ENSURE_LIBRARY; \ -+ assert (gnutls_oqs_sym_##name); \ -+ gnutls_oqs_sym_##name cargs; \ -+} -+#include "oqsfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+static int -+ensure_symbol (const char *name, void **symp) -+{ -+ if (!*symp) -+ { -+ void *sym = dlsym (gnutls_oqs_dlhandle, name); -+ if (!sym) -+ return -errno; -+ *symp = sym; -+ } -+ return 0; -+} -+ -+int -+gnutls_oqs_ensure_library (const char *soname, int flags) -+{ -+ int err; -+ -+ if (!gnutls_oqs_dlhandle) -+ { -+ gnutls_oqs_dlhandle = dlopen (soname, flags); -+ if (!gnutls_oqs_dlhandle) -+ return -errno; -+ } -+ -+#define ENSURE_SYMBOL(name) \ -+ ensure_symbol(#name, (void **)&gnutls_oqs_sym_##name) -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ return err; -+#define VOID_FUNC FUNC -+#include "oqsfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef ENSURE_SYMBOL -+ return 0; -+} -+ -+void -+gnutls_oqs_unload_library (void) -+{ -+ if (gnutls_oqs_dlhandle) -+ dlclose (gnutls_oqs_dlhandle); -+ -+#pragma GCC diagnostic push -+#pragma GCC diagnostic ignored "-Wunused-macros" -+ -+#define FUNC(ret, name, args, cargs) \ -+ gnutls_oqs_sym_##name = NULL; -+#define VOID_FUNC FUNC -+#include "oqsfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#pragma GCC diagnostic pop -+ -+#undef RESET_SYMBOL -+} -+ -+#else /* GNUTLS_OQS_ENABLE_DLOPEN */ -+ -+int -+gnutls_oqs_ensure_library (const char *soname, int flags) -+{ -+ (void) soname; -+ (void) flags; -+ return 0; -+} -+ -+void -+gnutls_oqs_unload_library (void) -+{ -+} -+ -+#endif /* !GNUTLS_OQS_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/oqs.h b/lib/dlwrap/oqs.h -new file mode 100644 -index 0000000000..6a1d8e0766 ---- /dev/null -+++ b/lib/dlwrap/oqs.h -@@ -0,0 +1,53 @@ -+/* -+ * Copying and distribution of this file, with or without modification, -+ * are permitted in any medium without royalty provided the copyright -+ * notice and this notice are preserved. This file is offered as-is, -+ * without any warranty. -+ */ -+ -+#ifndef GNUTLS_LIB_DLWRAP_OQS_H_ -+#define GNUTLS_LIB_DLWRAP_OQS_H_ -+ -+/* Local modification: remove this once liboqs 0.10.2 is released */ -+#include "config.h" -+#if !HAVE_DECL_OQS_SHA3_SET_CALLBACKS -+#include "liboqs/backport/sha3_ops.h" -+#endif -+ -+#include -+ -+#if defined(GNUTLS_OQS_ENABLE_DLOPEN) && GNUTLS_OQS_ENABLE_DLOPEN -+ -+#define FUNC(ret, name, args, cargs) \ -+ ret gnutls_oqs_func_##name args; -+#define VOID_FUNC FUNC -+#include "oqsfuncs.h" -+#undef VOID_FUNC -+#undef FUNC -+ -+#define GNUTLS_OQS_FUNC(name) gnutls_oqs_func_##name -+ -+#else -+ -+#define GNUTLS_OQS_FUNC(name) name -+ -+#endif /* GNUTLS_OQS_ENABLE_DLOPEN */ -+ -+/* Ensure SONAME to be loaded with dlopen FLAGS, and all the necessary -+ * symbols are resolved. -+ * -+ * Returns 0 on success; negative error code otherwise. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+int gnutls_oqs_ensure_library (const char *soname, int flags); -+ -+/* Unload library and reset symbols. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+void gnutls_oqs_unload_library (void); -+ -+#endif /* GNUTLS_LIB_DLWRAP_OQS_H_ */ -diff --git a/lib/dlwrap/oqsfuncs.h b/lib/dlwrap/oqsfuncs.h -new file mode 100644 -index 0000000000..95c1b083dc ---- /dev/null -+++ b/lib/dlwrap/oqsfuncs.h -@@ -0,0 +1,14 @@ -+/* -+ * This file was automatically generated from oqs.h, -+ * which is covered by the following license: -+ * SPDX-License-Identifier: MIT -+ */ -+VOID_FUNC(void, OQS_init, (void), ()) -+VOID_FUNC(void, OQS_destroy, (void), ()) -+VOID_FUNC(void, OQS_SHA3_set_callbacks, (struct OQS_SHA3_callbacks *new_callbacks), (new_callbacks)) -+VOID_FUNC(void, OQS_randombytes_custom_algorithm, (void (*algorithm_ptr)(uint8_t *, size_t)), (algorithm_ptr)) -+FUNC(OQS_KEM *, OQS_KEM_new, (const char *method_name), (method_name)) -+FUNC(OQS_STATUS, OQS_KEM_keypair, (const OQS_KEM *kem, uint8_t *public_key, uint8_t *secret_key), (kem, public_key, secret_key)) -+FUNC(OQS_STATUS, OQS_KEM_encaps, (const OQS_KEM *kem, uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key), (kem, ciphertext, shared_secret, public_key)) -+FUNC(OQS_STATUS, OQS_KEM_decaps, (const OQS_KEM *kem, uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key), (kem, shared_secret, ciphertext, secret_key)) -+VOID_FUNC(void, OQS_KEM_free, (OQS_KEM *kem), (kem)) -diff --git a/lib/global.c b/lib/global.c -index b434140bbf..ae2f7f54dc 100644 ---- a/lib/global.c -+++ b/lib/global.c -@@ -41,6 +41,7 @@ - #include "system-keys.h" - #include "str.h" - #include "global.h" -+#include "liboqs/liboqs.h" - - /* Minimum library versions we accept. */ - #define GNUTLS_MIN_LIBTASN1_VERSION "0.3.4" -@@ -328,6 +329,10 @@ static int _gnutls_global_init(unsigned constructor) - goto out; - } - -+#ifdef HAVE_LIBOQS -+ _gnutls_liboqs_init(); -+#endif -+ - #ifndef _WIN32 - ret = _gnutls_register_fork_handler(); - if (ret < 0) { -@@ -444,6 +449,9 @@ static void _gnutls_global_deinit(unsigned destructor) - #ifdef HAVE_TPM2 - _gnutls_tpm2_deinit(); - #endif -+#ifdef HAVE_LIBOQS -+ _gnutls_liboqs_deinit(); -+#endif - - _gnutls_nss_keylog_deinit(); - } else { -diff --git a/lib/liboqs/Makefile.am b/lib/liboqs/Makefile.am -new file mode 100644 -index 0000000000..a20e7cbdf9 ---- /dev/null -+++ b/lib/liboqs/Makefile.am -@@ -0,0 +1,43 @@ -+## Process this file with automake to produce Makefile.in -+# Copyright (C) 2004-2012 Free Software Foundation, Inc. -+# Copyright (C) 2024 Red Hat, Inc. -+# -+# Author: Daiki Ueno -+# -+# This file is part of GNUTLS. -+# -+# The GNUTLS library is free software; you can redistribute it and/or -+# modify it under the terms of the GNU Lesser General Public License -+# as published by the Free Software Foundation; either version 3 of -+# the License, or (at your option) any later version. -+# -+# The GNUTLS library is distributed in the hope that it will be -+# useful, but WITHOUT ANY WARRANTY; without even the implied warranty -+# of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# Lesser General Public License for more details. -+# -+# You should have received a copy of the GNU Lesser General Public License -+# along with this program. If not, see -+ -+include $(top_srcdir)/lib/common.mk -+ -+AM_CFLAGS += $(LIBOQS_CFLAGS) -+ -+AM_CPPFLAGS = \ -+ -I$(srcdir)/../../gl \ -+ -I$(builddir)/../../gl \ -+ -I$(srcdir)/../includes \ -+ -I$(builddir)/../includes \ -+ -I$(srcdir)/.. -+ -+if ENABLE_DLOPEN -+AM_CPPFLAGS += $(LIBOQS_CFLAGS) -DGNUTLS_OQS_ENABLE_DLOPEN=1 -+endif -+ -+noinst_LTLIBRARIES = libcrypto.la -+ -+libcrypto_la_SOURCES = liboqs.h liboqs.c rand.h rand.c sha3.h sha3.c -+ -+if NEED_LIBOQS_SHA3_OPS_H -+libcrypto_la_SOURCES += backport/sha3_ops.h -+endif -diff --git a/lib/liboqs/backport/sha3_ops.h b/lib/liboqs/backport/sha3_ops.h -new file mode 100644 -index 0000000000..694fc21873 ---- /dev/null -+++ b/lib/liboqs/backport/sha3_ops.h -@@ -0,0 +1,256 @@ -+/** -+ * \file sha3_ops.h -+ * \brief Header defining the callback API for OQS SHA3 and SHAKE -+ * -+ * \author John Underhill, Douglas Stebila -+ * -+ * SPDX-License-Identifier: MIT -+ */ -+ -+#ifndef OQS_SHA3_OPS_H -+#define OQS_SHA3_OPS_H -+ -+#include -+#include -+ -+#include -+ -+#if defined(__cplusplus) -+extern "C" { -+#endif -+ -+/** Data structure for the state of the incremental SHA3-256 API. */ -+typedef struct { -+ /** Internal state. */ -+ void *ctx; -+} OQS_SHA3_sha3_256_inc_ctx; -+ -+/** Data structure for the state of the incremental SHA3-384 API. */ -+typedef struct { -+ /** Internal state. */ -+ void *ctx; -+} OQS_SHA3_sha3_384_inc_ctx; -+ -+/** Data structure for the state of the incremental SHA3-512 API. */ -+typedef struct { -+ /** Internal state. */ -+ void *ctx; -+} OQS_SHA3_sha3_512_inc_ctx; -+ -+/** Data structure for the state of the incremental SHAKE-128 API. */ -+typedef struct { -+ /** Internal state. */ -+ void *ctx; -+} OQS_SHA3_shake128_inc_ctx; -+ -+/** Data structure for the state of the incremental SHAKE-256 API. */ -+typedef struct { -+ /** Internal state. */ -+ void *ctx; -+} OQS_SHA3_shake256_inc_ctx; -+ -+/** Data structure implemented by cryptographic provider for SHA-3 operations. -+ */ -+struct OQS_SHA3_callbacks { -+ /** -+ * Implementation of function OQS_SHA3_sha3_256. -+ */ -+ void (*SHA3_sha3_256)(uint8_t *output, const uint8_t *input, size_t inplen); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_256_inc_init. -+ */ -+ void (*SHA3_sha3_256_inc_init)(OQS_SHA3_sha3_256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_256_inc_absorb. -+ */ -+ void (*SHA3_sha3_256_inc_absorb)(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_256_inc_finalize. -+ */ -+ void (*SHA3_sha3_256_inc_finalize)(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_256_inc_ctx_release. -+ */ -+ void (*SHA3_sha3_256_inc_ctx_release)(OQS_SHA3_sha3_256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_256_inc_ctx_reset. -+ */ -+ void (*SHA3_sha3_256_inc_ctx_reset)(OQS_SHA3_sha3_256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_256_inc_ctx_clone. -+ */ -+ void (*SHA3_sha3_256_inc_ctx_clone)(OQS_SHA3_sha3_256_inc_ctx *dest, const OQS_SHA3_sha3_256_inc_ctx *src); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384. -+ */ -+ void (*SHA3_sha3_384)(uint8_t *output, const uint8_t *input, size_t inplen); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384_inc_init. -+ */ -+ void (*SHA3_sha3_384_inc_init)(OQS_SHA3_sha3_384_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384_inc_absorb. -+ */ -+ void (*SHA3_sha3_384_inc_absorb)(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384_inc_finalize. -+ */ -+ void (*SHA3_sha3_384_inc_finalize)(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384_inc_ctx_release. -+ */ -+ void (*SHA3_sha3_384_inc_ctx_release)(OQS_SHA3_sha3_384_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384_inc_ctx_reset. -+ */ -+ void (*SHA3_sha3_384_inc_ctx_reset)(OQS_SHA3_sha3_384_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_384_inc_ctx_clone. -+ */ -+ void (*SHA3_sha3_384_inc_ctx_clone)(OQS_SHA3_sha3_384_inc_ctx *dest, const OQS_SHA3_sha3_384_inc_ctx *src); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512. -+ */ -+ void (*SHA3_sha3_512)(uint8_t *output, const uint8_t *input, size_t inplen); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512_inc_init. -+ */ -+ void (*SHA3_sha3_512_inc_init)(OQS_SHA3_sha3_512_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512_inc_absorb. -+ */ -+ void (*SHA3_sha3_512_inc_absorb)(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512_inc_finalize. -+ */ -+ void (*SHA3_sha3_512_inc_finalize)(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512_inc_ctx_release. -+ */ -+ void (*SHA3_sha3_512_inc_ctx_release)(OQS_SHA3_sha3_512_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512_inc_ctx_reset. -+ */ -+ void (*SHA3_sha3_512_inc_ctx_reset)(OQS_SHA3_sha3_512_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_sha3_512_inc_ctx_clone. -+ */ -+ void (*SHA3_sha3_512_inc_ctx_clone)(OQS_SHA3_sha3_512_inc_ctx *dest, const OQS_SHA3_sha3_512_inc_ctx *src); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128. -+ */ -+ void (*SHA3_shake128)(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_init. -+ */ -+ void (*SHA3_shake128_inc_init)(OQS_SHA3_shake128_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_absorb. -+ */ -+ void (*SHA3_shake128_inc_absorb)(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_finalize. -+ */ -+ void (*SHA3_shake128_inc_finalize)(OQS_SHA3_shake128_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_squeeze. -+ */ -+ void (*SHA3_shake128_inc_squeeze)(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_ctx_release. -+ */ -+ void (*SHA3_shake128_inc_ctx_release)(OQS_SHA3_shake128_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_ctx_clone. -+ */ -+ void (*SHA3_shake128_inc_ctx_clone)(OQS_SHA3_shake128_inc_ctx *dest, const OQS_SHA3_shake128_inc_ctx *src); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake128_inc_ctx_reset. -+ */ -+ void (*SHA3_shake128_inc_ctx_reset)(OQS_SHA3_shake128_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256. -+ */ -+ void (*SHA3_shake256)(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_init. -+ */ -+ void (*SHA3_shake256_inc_init)(OQS_SHA3_shake256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_absorb. -+ */ -+ void (*SHA3_shake256_inc_absorb)(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_finalize. -+ */ -+ void (*SHA3_shake256_inc_finalize)(OQS_SHA3_shake256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_squeeze. -+ */ -+ void (*SHA3_shake256_inc_squeeze)(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_ctx_release. -+ */ -+ void (*SHA3_shake256_inc_ctx_release)(OQS_SHA3_shake256_inc_ctx *state); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_ctx_clone. -+ */ -+ void (*SHA3_shake256_inc_ctx_clone)(OQS_SHA3_shake256_inc_ctx *dest, const OQS_SHA3_shake256_inc_ctx *src); -+ -+ /** -+ * Implementation of function OQS_SHA3_shake256_inc_ctx_reset. -+ */ -+ void (*SHA3_shake256_inc_ctx_reset)(OQS_SHA3_shake256_inc_ctx *state); -+}; -+ -+/** -+ * Set callback functions for SHA3 operations. -+ * -+ * This function may be called before OQS_init to switch the -+ * cryptographic provider for SHA3 operations. If it is not called, -+ * the default provider determined at build time will be used. -+ * -+ * @param new_callbacks Callback functions defined in OQS_SHA3_callbacks struct -+ */ -+OQS_API void OQS_SHA3_set_callbacks(struct OQS_SHA3_callbacks *new_callbacks); -+ -+#if defined(__cplusplus) -+} // extern "C" -+#endif -+ -+#endif // OQS_SHA3_OPS_H -diff --git a/lib/liboqs/liboqs.c b/lib/liboqs/liboqs.c -new file mode 100644 -index 0000000000..88f2369719 ---- /dev/null -+++ b/lib/liboqs/liboqs.c -@@ -0,0 +1,41 @@ -+/* -+ * Copyright (C) 2024 Red Hat, Inc. -+ * -+ * This file is part of GNUTLS. -+ * -+ * The GNUTLS library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public License -+ * as published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public License -+ * along with this program. If not, see -+ * -+ */ -+ -+#include "config.h" -+ -+#include "liboqs/liboqs.h" -+ -+#include "dlwrap/oqs.h" -+#include "liboqs/rand.h" -+#include "liboqs/sha3.h" -+ -+void _gnutls_liboqs_init(void) -+{ -+ _gnutls_liboqs_sha3_init(); -+ GNUTLS_OQS_FUNC(OQS_init)(); -+ _gnutls_liboqs_rand_init(); -+} -+ -+void _gnutls_liboqs_deinit(void) -+{ -+ _gnutls_liboqs_rand_deinit(); -+ _gnutls_liboqs_sha3_deinit(); -+ GNUTLS_OQS_FUNC(OQS_destroy)(); -+} -diff --git a/lib/liboqs/liboqs.h b/lib/liboqs/liboqs.h -new file mode 100644 -index 0000000000..b6c1659212 ---- /dev/null -+++ b/lib/liboqs/liboqs.h -@@ -0,0 +1,27 @@ -+/* -+ * Copyright (C) 2024 Red Hat, Inc. -+ * -+ * This file is part of GNUTLS. -+ * -+ * The GNUTLS library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public License -+ * as published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public License -+ * along with this program. If not, see -+ * -+ */ -+ -+#ifndef GNUTLS_LIB_LIBOQS_LIBOQS_H -+#define GNUTLS_LIB_LIBOQS_LIBOQS_H -+ -+void _gnutls_liboqs_init(void); -+void _gnutls_liboqs_deinit(void); -+ -+#endif /* GNUTLS_LIB_LIBOQS_LIBOQS_H */ -diff --git a/lib/liboqs/rand.c b/lib/liboqs/rand.c -new file mode 100644 -index 0000000000..40496800ad ---- /dev/null -+++ b/lib/liboqs/rand.c -@@ -0,0 +1,43 @@ -+/* -+ * Copyright (C) 2024 Red Hat, Inc. -+ * -+ * This file is part of GNUTLS. -+ * -+ * The GNUTLS library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public License -+ * as published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public License -+ * along with this program. If not, see -+ * -+ */ -+ -+#include "config.h" -+ -+#include "liboqs/rand.h" -+ -+#include "dlwrap/oqs.h" -+#include "fips.h" -+#include -+#include -+ -+static void rand_bytes(uint8_t *data, size_t size) -+{ -+ if (gnutls_rnd(GNUTLS_RND_RANDOM, data, size) < 0) -+ _gnutls_switch_lib_state(LIB_STATE_ERROR); -+} -+ -+void _gnutls_liboqs_rand_init(void) -+{ -+ GNUTLS_OQS_FUNC(OQS_randombytes_custom_algorithm)(rand_bytes); -+} -+ -+void _gnutls_liboqs_rand_deinit(void) -+{ -+} -diff --git a/lib/liboqs/rand.h b/lib/liboqs/rand.h -new file mode 100644 -index 0000000000..b27ac23362 ---- /dev/null -+++ b/lib/liboqs/rand.h -@@ -0,0 +1,27 @@ -+/* -+ * Copyright (C) 2024 Red Hat, Inc. -+ * -+ * This file is part of GNUTLS. -+ * -+ * The GNUTLS library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public License -+ * as published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public License -+ * along with this program. If not, see -+ * -+ */ -+ -+#ifndef GNUTLS_LIB_LIBOQS_RAND_H -+#define GNUTLS_LIB_LIBOQS_RAND_H -+ -+void _gnutls_liboqs_rand_init(void); -+void _gnutls_liboqs_rand_deinit(void); -+ -+#endif /* GNUTLS_LIB_LIBOQS_RAND_H */ -diff --git a/lib/liboqs/sha3.c b/lib/liboqs/sha3.c -new file mode 100644 -index 0000000000..9f5977e425 ---- /dev/null -+++ b/lib/liboqs/sha3.c -@@ -0,0 +1,373 @@ -+/* -+ * Copyright (C) 2024 Red Hat, Inc. -+ * -+ * This file is part of GNUTLS. -+ * -+ * The GNUTLS library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public License -+ * as published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public License -+ * along with this program. If not, see -+ * -+ */ -+ -+#include "config.h" -+ -+#include "liboqs/sha3.h" -+ -+#include "dlwrap/oqs.h" -+#include -+#include -+#include -+ -+/* SHA3-256 */ -+ -+static void SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inplen) -+{ -+ gnutls_hash_fast(GNUTLS_DIG_SHA3_256, input, inplen, output); -+} -+ -+/* SHA3-256 incremental */ -+ -+static void SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHA3_256); -+ assert(ret == 0); -+ state->ctx = hd; -+} -+ -+static void SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, -+ const uint8_t *input, size_t inplen) -+{ -+ int ret; -+ -+ ret = gnutls_hash((gnutls_hash_hd_t)state->ctx, input, inplen); -+ assert(ret == 0); -+} -+ -+static void SHA3_sha3_256_inc_finalize(uint8_t *output, -+ OQS_SHA3_sha3_256_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, output); -+} -+ -+static void SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) -+{ -+ gnutls_hash_deinit((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+static void SHA3_sha3_256_inc_ctx_clone(OQS_SHA3_sha3_256_inc_ctx *dest, -+ const OQS_SHA3_sha3_256_inc_ctx *src) -+{ -+ dest->ctx = gnutls_hash_copy((gnutls_hash_hd_t)src->ctx); -+} -+ -+static void SHA3_sha3_256_inc_ctx_reset(OQS_SHA3_sha3_256_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+/* SHA3-384 */ -+ -+static void SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inplen) -+{ -+ gnutls_hash_fast(GNUTLS_DIG_SHA3_384, input, inplen, output); -+} -+ -+/* SHA3-384 incremental */ -+static void SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHA3_384); -+ assert(ret == 0); -+ state->ctx = hd; -+} -+ -+static void SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, -+ const uint8_t *input, size_t inplen) -+{ -+ int ret; -+ -+ ret = gnutls_hash((gnutls_hash_hd_t)state->ctx, input, inplen); -+ assert(ret == 0); -+} -+ -+static void SHA3_sha3_384_inc_finalize(uint8_t *output, -+ OQS_SHA3_sha3_384_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, output); -+} -+ -+static void SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) -+{ -+ gnutls_hash_deinit((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+static void SHA3_sha3_384_inc_ctx_clone(OQS_SHA3_sha3_384_inc_ctx *dest, -+ const OQS_SHA3_sha3_384_inc_ctx *src) -+{ -+ dest->ctx = gnutls_hash_copy((gnutls_hash_hd_t)src->ctx); -+} -+ -+static void SHA3_sha3_384_inc_ctx_reset(OQS_SHA3_sha3_384_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+/* SHA3-512 */ -+ -+static void SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inplen) -+{ -+ gnutls_hash_fast(GNUTLS_DIG_SHA3_512, input, inplen, output); -+} -+ -+/* SHA3-512 incremental */ -+ -+static void SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHA3_512); -+ assert(ret == 0); -+ state->ctx = hd; -+} -+ -+static void SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, -+ const uint8_t *input, size_t inplen) -+{ -+ int ret; -+ -+ ret = gnutls_hash((gnutls_hash_hd_t)state->ctx, input, inplen); -+ assert(ret == 0); -+} -+ -+static void SHA3_sha3_512_inc_finalize(uint8_t *output, -+ OQS_SHA3_sha3_512_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, output); -+} -+ -+static void SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) -+{ -+ gnutls_hash_deinit((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+static void SHA3_sha3_512_inc_ctx_clone(OQS_SHA3_sha3_512_inc_ctx *dest, -+ const OQS_SHA3_sha3_512_inc_ctx *src) -+{ -+ dest->ctx = gnutls_hash_copy((gnutls_hash_hd_t)src->ctx); -+} -+ -+static void SHA3_sha3_512_inc_ctx_reset(OQS_SHA3_sha3_512_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+/* SHAKE-128 */ -+ -+static void SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, -+ size_t inplen) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHAKE_128); -+ assert(ret == 0); -+ -+ ret = gnutls_hash(hd, input, inplen); -+ assert(ret == 0); -+ -+ ret = gnutls_hash_squeeze(hd, output, outlen); -+ assert(ret == 0); -+ -+ gnutls_hash_deinit(hd, NULL); -+} -+ -+/* SHAKE-128 incremental -+ */ -+ -+static void SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHAKE_128); -+ assert(ret == 0); -+ -+ state->ctx = hd; -+} -+ -+static void SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, -+ const uint8_t *input, size_t inplen) -+{ -+ int ret; -+ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+ ret = gnutls_hash((gnutls_hash_hd_t)state->ctx, input, inplen); -+ assert(ret == 0); -+} -+ -+static void SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) -+{ -+ (void)state; -+} -+ -+static void SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, -+ OQS_SHA3_shake128_inc_ctx *state) -+{ -+ int ret; -+ -+ ret = gnutls_hash_squeeze((gnutls_hash_hd_t)state->ctx, output, outlen); -+ assert(ret == 0); -+} -+ -+static void SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) -+{ -+ gnutls_hash_deinit((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+static void SHA3_shake128_inc_ctx_clone(OQS_SHA3_shake128_inc_ctx *dest, -+ const OQS_SHA3_shake128_inc_ctx *src) -+{ -+ dest->ctx = gnutls_hash_copy((gnutls_hash_hd_t)src->ctx); -+} -+ -+static void SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+/* SHAKE-256 */ -+ -+static void SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, -+ size_t inplen) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHAKE_256); -+ assert(ret == 0); -+ -+ ret = gnutls_hash(hd, input, inplen); -+ assert(ret == 0); -+ -+ ret = gnutls_hash_squeeze(hd, output, outlen); -+ assert(ret == 0); -+ -+ gnutls_hash_deinit(hd, NULL); -+} -+ -+/* SHAKE-256 incremental */ -+ -+static void SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) -+{ -+ gnutls_hash_hd_t hd; -+ int ret; -+ -+ ret = gnutls_hash_init(&hd, GNUTLS_DIG_SHAKE_256); -+ assert(ret == 0); -+ -+ state->ctx = hd; -+} -+ -+static void SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, -+ const uint8_t *input, size_t inplen) -+{ -+ int ret; -+ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+ ret = gnutls_hash((gnutls_hash_hd_t)state->ctx, input, inplen); -+ assert(ret == 0); -+} -+ -+static void SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) -+{ -+ (void)state; -+} -+ -+static void SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, -+ OQS_SHA3_shake256_inc_ctx *state) -+{ -+ int ret; -+ -+ ret = gnutls_hash_squeeze((gnutls_hash_hd_t)state->ctx, output, outlen); -+ assert(ret == 0); -+} -+ -+static void SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) -+{ -+ gnutls_hash_deinit((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+static void SHA3_shake256_inc_ctx_clone(OQS_SHA3_shake256_inc_ctx *dest, -+ const OQS_SHA3_shake256_inc_ctx *src) -+{ -+ dest->ctx = gnutls_hash_copy((gnutls_hash_hd_t)src->ctx); -+} -+ -+static void SHA3_shake256_inc_ctx_reset(OQS_SHA3_shake256_inc_ctx *state) -+{ -+ gnutls_hash_output((gnutls_hash_hd_t)state->ctx, NULL); -+} -+ -+static struct OQS_SHA3_callbacks sha3_callbacks = { -+ SHA3_sha3_256, -+ SHA3_sha3_256_inc_init, -+ SHA3_sha3_256_inc_absorb, -+ SHA3_sha3_256_inc_finalize, -+ SHA3_sha3_256_inc_ctx_release, -+ SHA3_sha3_256_inc_ctx_reset, -+ SHA3_sha3_256_inc_ctx_clone, -+ SHA3_sha3_384, -+ SHA3_sha3_384_inc_init, -+ SHA3_sha3_384_inc_absorb, -+ SHA3_sha3_384_inc_finalize, -+ SHA3_sha3_384_inc_ctx_release, -+ SHA3_sha3_384_inc_ctx_reset, -+ SHA3_sha3_384_inc_ctx_clone, -+ SHA3_sha3_512, -+ SHA3_sha3_512_inc_init, -+ SHA3_sha3_512_inc_absorb, -+ SHA3_sha3_512_inc_finalize, -+ SHA3_sha3_512_inc_ctx_release, -+ SHA3_sha3_512_inc_ctx_reset, -+ SHA3_sha3_512_inc_ctx_clone, -+ SHA3_shake128, -+ SHA3_shake128_inc_init, -+ SHA3_shake128_inc_absorb, -+ SHA3_shake128_inc_finalize, -+ SHA3_shake128_inc_squeeze, -+ SHA3_shake128_inc_ctx_release, -+ SHA3_shake128_inc_ctx_clone, -+ SHA3_shake128_inc_ctx_reset, -+ SHA3_shake256, -+ SHA3_shake256_inc_init, -+ SHA3_shake256_inc_absorb, -+ SHA3_shake256_inc_finalize, -+ SHA3_shake256_inc_squeeze, -+ SHA3_shake256_inc_ctx_release, -+ SHA3_shake256_inc_ctx_clone, -+ SHA3_shake256_inc_ctx_reset, -+}; -+ -+void _gnutls_liboqs_sha3_init(void) -+{ -+ GNUTLS_OQS_FUNC(OQS_SHA3_set_callbacks)(&sha3_callbacks); -+} -+ -+void _gnutls_liboqs_sha3_deinit(void) -+{ -+} -diff --git a/lib/liboqs/sha3.h b/lib/liboqs/sha3.h -new file mode 100644 -index 0000000000..8b9058aa0d ---- /dev/null -+++ b/lib/liboqs/sha3.h -@@ -0,0 +1,27 @@ -+/* -+ * Copyright (C) 2024 Red Hat, Inc. -+ * -+ * This file is part of GNUTLS. -+ * -+ * The GNUTLS library is free software; you can redistribute it and/or -+ * modify it under the terms of the GNU Lesser General Public License -+ * as published by the Free Software Foundation; either version 2.1 of -+ * the License, or (at your option) any later version. -+ * -+ * This library is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * Lesser General Public License for more details. -+ * -+ * You should have received a copy of the GNU Lesser General Public License -+ * along with this program. If not, see -+ * -+ */ -+ -+#ifndef GNUTLS_LIB_LIBOQS_SHA3_H -+#define GNUTLS_LIB_LIBOQS_SHA3_H -+ -+void _gnutls_liboqs_sha3_init(void); -+void _gnutls_liboqs_sha3_deinit(void); -+ -+#endif /* GNUTLS_LIB_LIBOQS_SHA3_H */ --- -2.45.2 - - -From 1bc78c387a9796e8248ffb644576074f8de4e6ad Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Sun, 2 Jun 2024 07:19:14 +0900 -Subject: [PATCH 2/2] key_share: support X25519Kyber768Draft00 - -This implements X25519Kyber768Draft00 hybrid post-quantum key exchange -in TLS 1.3, based on the draft: -https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/ - -Signed-off-by: Daiki Ueno ---- - lib/Makefile.am | 4 + - lib/algorithms/groups.c | 8 ++ - lib/algorithms/publickey.c | 6 ++ - lib/crypto-backend.h | 7 ++ - lib/ext/key_share.c | 148 ++++++++++++++++++++++++++-- - lib/gnutls_int.h | 2 + - lib/includes/gnutls/gnutls.h.in | 12 ++- - lib/nettle/Makefile.am | 4 + - lib/nettle/pk.c | 164 ++++++++++++++++++++++++++++++++ - lib/pk.h | 4 + - lib/state.c | 1 + - tests/Makefile.am | 4 + - tests/pqc-hybrid-kx.sh | 54 +++++++++++ - 13 files changed, 409 insertions(+), 9 deletions(-) - create mode 100644 tests/pqc-hybrid-kx.sh - -diff --git a/lib/Makefile.am b/lib/Makefile.am -index 067772c322..0e89fdf184 100644 ---- a/lib/Makefile.am -+++ b/lib/Makefile.am -@@ -273,6 +273,10 @@ thirdparty_libadd += $(NETTLE_LIBS) $(HOGWEED_LIBS) $(GMP_LIBS) - libgnutls_la_LIBADD += nettle/libcrypto.la - endif - -+if ENABLE_LIBOQS -+libgnutls_la_LIBADD += liboqs/libcrypto.la -+endif -+ - if HAVE_LD_OUTPUT_DEF - libgnutls_la_LDFLAGS += -Wl,--output-def,libgnutls-$(DLL_VERSION).def - libgnutls-$(DLL_VERSION).def: libgnutls.la -diff --git a/lib/algorithms/groups.c b/lib/algorithms/groups.c -index 9093de6eb2..a329c746e9 100644 ---- a/lib/algorithms/groups.c -+++ b/lib/algorithms/groups.c -@@ -169,6 +169,14 @@ static const gnutls_group_entry_st supported_groups[] = { - .q_bits = &gnutls_ffdhe_8192_key_bits, - .pk = GNUTLS_PK_DH, - .tls_id = 0x104 }, -+#endif -+#ifdef HAVE_LIBOQS -+ { .name = "X25519-KYBER768", -+ .id = GNUTLS_GROUP_EXP_X25519_KYBER768, -+ .curve = GNUTLS_ECC_CURVE_X25519, -+ .pk = GNUTLS_PK_ECDH_X25519, -+ .pk2 = GNUTLS_PK_EXP_KYBER768, -+ .tls_id = 0x6399 }, - #endif - { 0, 0, 0 } - }; -diff --git a/lib/algorithms/publickey.c b/lib/algorithms/publickey.c -index 0ef0834933..10938bce0e 100644 ---- a/lib/algorithms/publickey.c -+++ b/lib/algorithms/publickey.c -@@ -202,6 +202,12 @@ static const gnutls_pk_entry pk_algorithms[] = { - .oid = ECDH_X448_OID, - .id = GNUTLS_PK_ECDH_X448, - .curve = GNUTLS_ECC_CURVE_X448 }, -+#ifdef HAVE_LIBOQS -+ { .name = "KYBER768", -+ .oid = NULL, -+ .id = GNUTLS_PK_EXP_KYBER768, -+ .curve = GNUTLS_ECC_CURVE_INVALID }, -+#endif - { .name = "UNKNOWN", - .oid = NULL, - .id = GNUTLS_PK_UNKNOWN, -diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h -index fd8ee0c728..5c0630adaa 100644 ---- a/lib/crypto-backend.h -+++ b/lib/crypto-backend.h -@@ -411,6 +411,13 @@ typedef struct gnutls_crypto_pk { - const gnutls_pk_params_st *pub, - const gnutls_datum_t *nonce, unsigned int flags); - -+ int (*encaps)(gnutls_pk_algorithm_t, gnutls_datum_t *ciphertext, -+ gnutls_datum_t *shared_secret, const gnutls_datum_t *pub); -+ -+ int (*decaps)(gnutls_pk_algorithm_t, gnutls_datum_t *shared_secret, -+ const gnutls_datum_t *ciphertext, -+ const gnutls_datum_t *priv); -+ - int (*curve_exists)(gnutls_ecc_curve_t); /* true/false */ - int (*pk_exists)(gnutls_pk_algorithm_t); /* true/false */ - int (*sign_exists)(gnutls_sign_algorithm_t); /* true/false */ -diff --git a/lib/ext/key_share.c b/lib/ext/key_share.c -index 575ffaf8f2..6926cdd00e 100644 ---- a/lib/ext/key_share.c -+++ b/lib/ext/key_share.c -@@ -120,6 +120,8 @@ static int client_gen_key_share(gnutls_session_t session, - - } else if (group->pk == GNUTLS_PK_ECDH_X25519 || - group->pk == GNUTLS_PK_ECDH_X448) { -+ unsigned int length_pos; -+ - gnutls_pk_params_release(&session->key.kshare.ecdhx_params); - gnutls_pk_params_init(&session->key.kshare.ecdhx_params); - -@@ -129,6 +131,8 @@ static int client_gen_key_share(gnutls_session_t session, - if (ret < 0) - return gnutls_assert_val(ret); - -+ length_pos = extdata->length; -+ - ret = _gnutls_buffer_append_data_prefix( - extdata, 16, - session->key.kshare.ecdhx_params.raw_pub.data, -@@ -141,6 +145,33 @@ static int client_gen_key_share(gnutls_session_t session, - session->key.kshare.ecdhx_params.algo = group->pk; - session->key.kshare.ecdhx_params.curve = group->curve; - -+ if (group->pk2 != GNUTLS_PK_UNKNOWN) { -+ gnutls_pk_params_release( -+ &session->key.kshare.kem_params); -+ gnutls_pk_params_init(&session->key.kshare.kem_params); -+ -+ ret = _gnutls_pk_generate_keys( -+ group->pk2, 0, &session->key.kshare.kem_params, -+ 1); -+ if (ret < 0) { -+ gnutls_assert(); -+ goto cleanup; -+ } -+ -+ ret = _gnutls_buffer_append_data( -+ extdata, -+ session->key.kshare.kem_params.raw_pub.data, -+ session->key.kshare.kem_params.raw_pub.size); -+ if (ret < 0) { -+ gnutls_assert(); -+ goto cleanup; -+ } -+ -+ /* copy actual length */ -+ _gnutls_write_uint16(extdata->length - length_pos - 2, -+ &extdata->data[length_pos]); -+ } -+ - ret = 0; - - } else if (group->pk == GNUTLS_PK_DH) { -@@ -243,6 +274,10 @@ static int server_gen_key_share(gnutls_session_t session, - - } else if (group->pk == GNUTLS_PK_ECDH_X25519 || - group->pk == GNUTLS_PK_ECDH_X448) { -+ unsigned int length_pos; -+ -+ length_pos = extdata->length; -+ - ret = _gnutls_buffer_append_data_prefix( - extdata, 16, - session->key.kshare.ecdhx_params.raw_pub.data, -@@ -250,8 +285,22 @@ static int server_gen_key_share(gnutls_session_t session, - if (ret < 0) - return gnutls_assert_val(ret); - -- ret = 0; -+ if (group->pk2 != GNUTLS_PK_UNKNOWN) { -+ ret = _gnutls_buffer_append_data( -+ extdata, -+ session->key.kshare.kem_params.raw_pub.data, -+ session->key.kshare.kem_params.raw_pub.size); -+ if (ret < 0) { -+ gnutls_assert(); -+ goto cleanup; -+ } - -+ /* copy actual length */ -+ _gnutls_write_uint16(extdata->length - length_pos - 2, -+ &extdata->data[length_pos]); -+ } -+ -+ ret = 0; - } else if (group->pk == GNUTLS_PK_DH) { - ret = _gnutls_buffer_append_prefix(extdata, 16, - group->prime->size); -@@ -333,9 +382,15 @@ static int server_use_key_share(gnutls_session_t session, - - curve = _gnutls_ecc_curve_get_params(group->curve); - -- if (curve->size != data_size) -- return gnutls_assert_val( -- GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); -+ if (group->pk2 != GNUTLS_PK_UNKNOWN) { -+ if (curve->size > data_size) -+ return gnutls_assert_val( -+ GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); -+ } else { -+ if (curve->size != data_size) -+ return gnutls_assert_val( -+ GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); -+ } - - /* generate our key */ - ret = _gnutls_pk_generate_keys( -@@ -351,7 +406,7 @@ static int server_use_key_share(gnutls_session_t session, - pub.curve = curve->id; - - pub.raw_pub.data = (void *)data; -- pub.raw_pub.size = data_size; -+ pub.raw_pub.size = curve->size; - - /* We don't mask the MSB in the final byte as required - * by RFC7748. This will be done internally by nettle 3.3 or later. -@@ -363,6 +418,50 @@ static int server_use_key_share(gnutls_session_t session, - return gnutls_assert_val(ret); - } - -+ if (group->pk2 != GNUTLS_PK_UNKNOWN) { -+ gnutls_datum_t key; -+ gnutls_datum_t peer_pub; -+ -+ gnutls_pk_params_release( -+ &session->key.kshare.kem_params); -+ gnutls_pk_params_init(&session->key.kshare.kem_params); -+ -+ /* generate our key */ -+ ret = _gnutls_pk_generate_keys( -+ group->pk2, 0, &session->key.kshare.kem_params, -+ 1); -+ if (ret < 0) -+ return gnutls_assert_val(ret); -+ -+ /* server's public key is unused, but the raw_pub field -+ * is used to store ciphertext */ -+ gnutls_free( -+ session->key.kshare.kem_params.raw_pub.data); -+ -+ peer_pub.data = (uint8_t *)data + curve->size; -+ peer_pub.size = data_size - curve->size; -+ -+ ret = _gnutls_pk_encaps( -+ group->pk2, -+ &session->key.kshare.kem_params.raw_pub, &key, -+ &peer_pub); -+ if (ret < 0) -+ return gnutls_assert_val(ret); -+ -+ session->key.key.data = gnutls_realloc_fast( -+ session->key.key.data, -+ session->key.key.size + key.size); -+ if (!session->key.key.data) { -+ _gnutls_free_datum(&key); -+ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ } -+ -+ memcpy(session->key.key.data + session->key.key.size, -+ key.data, key.size); -+ session->key.key.size += key.size; -+ _gnutls_free_datum(&key); -+ } -+ - ret = 0; - - } else if (group->pk == GNUTLS_PK_DH) { -@@ -496,9 +595,15 @@ static int client_use_key_share(gnutls_session_t session, - return gnutls_assert_val( - GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); - -- if (curve->size != data_size) -- return gnutls_assert_val( -- GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); -+ if (group->pk2 != GNUTLS_PK_UNKNOWN) { -+ if (curve->size > data_size) -+ return gnutls_assert_val( -+ GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); -+ } else { -+ if (curve->size != data_size) -+ return gnutls_assert_val( -+ GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); -+ } - - /* read the public key and generate shared */ - gnutls_pk_params_init(&pub); -@@ -519,6 +624,33 @@ static int client_use_key_share(gnutls_session_t session, - return gnutls_assert_val(ret); - } - -+ if (group->pk2 != GNUTLS_PK_UNKNOWN) { -+ gnutls_datum_t key; -+ gnutls_datum_t ciphertext; -+ -+ ciphertext.data = (uint8_t *)data + curve->size; -+ ciphertext.size = data_size - curve->size; -+ -+ ret = _gnutls_pk_decaps( -+ group->pk2, &key, &ciphertext, -+ &session->key.kshare.kem_params.raw_priv); -+ if (ret < 0) -+ return gnutls_assert_val(ret); -+ -+ session->key.key.data = gnutls_realloc_fast( -+ session->key.key.data, -+ session->key.key.size + key.size); -+ if (!session->key.key.data) { -+ _gnutls_free_datum(&key); -+ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ } -+ -+ memcpy(session->key.key.data + session->key.key.size, -+ key.data, key.size); -+ session->key.key.size += key.size; -+ _gnutls_free_datum(&key); -+ } -+ - ret = 0; - - } else if (group->pk == GNUTLS_PK_DH) { -diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h -index 258a08c842..5727739bdc 100644 ---- a/lib/gnutls_int.h -+++ b/lib/gnutls_int.h -@@ -594,6 +594,7 @@ struct gnutls_key_st { - gnutls_pk_params_st ecdh_params; - gnutls_pk_params_st ecdhx_params; - gnutls_pk_params_st dh_params; -+ gnutls_pk_params_st kem_params; - } kshare; - - /* The union contents depend on the negotiated protocol. -@@ -764,6 +765,7 @@ typedef struct gnutls_group_entry_st { - const unsigned *q_bits; - gnutls_ecc_curve_t curve; - gnutls_pk_algorithm_t pk; -+ gnutls_pk_algorithm_t pk2; - unsigned tls_id; /* The RFC4492 namedCurve ID or TLS 1.3 group ID */ - } gnutls_group_entry_st; - -diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in -index 6b87610c44..790406e4df 100644 ---- a/lib/includes/gnutls/gnutls.h.in -+++ b/lib/includes/gnutls/gnutls.h.in -@@ -908,7 +908,12 @@ typedef enum { - GNUTLS_PK_ECDH_X448 = 11, - GNUTLS_PK_EDDSA_ED448 = 12, - GNUTLS_PK_RSA_OAEP = 13, -- GNUTLS_PK_MAX = GNUTLS_PK_RSA_OAEP -+ GNUTLS_PK_MAX = GNUTLS_PK_RSA_OAEP, -+ -+ /* Experimental algorithms */ -+ GNUTLS_PK_EXP_MIN = 256, -+ GNUTLS_PK_EXP_KYBER768 = GNUTLS_PK_EXP_MIN, -+ GNUTLS_PK_EXP_MAX = GNUTLS_PK_EXP_KYBER768 - } gnutls_pk_algorithm_t; - - const char *gnutls_pk_algorithm_get_name(gnutls_pk_algorithm_t algorithm); -@@ -1136,6 +1141,11 @@ typedef enum { - GNUTLS_GROUP_FFDHE8192, - GNUTLS_GROUP_FFDHE6144, - GNUTLS_GROUP_MAX = GNUTLS_GROUP_FFDHE6144, -+ -+ /* Experimental algorithms */ -+ GNUTLS_GROUP_EXP_MIN = 512, -+ GNUTLS_GROUP_EXP_X25519_KYBER768 = GNUTLS_GROUP_EXP_MIN, -+ GNUTLS_GROUP_EXP_MAX = GNUTLS_GROUP_EXP_X25519_KYBER768 - } gnutls_group_t; - - /* macros to allow specifying a specific curve in gnutls_privkey_generate() -diff --git a/lib/nettle/Makefile.am b/lib/nettle/Makefile.am -index b855c8c193..0f21823cb4 100644 ---- a/lib/nettle/Makefile.am -+++ b/lib/nettle/Makefile.am -@@ -36,6 +36,10 @@ if ENABLE_MINITASN1 - AM_CPPFLAGS += -I$(srcdir)/../minitasn1 - endif - -+if ENABLE_DLOPEN -+AM_CPPFLAGS += $(LIBOQS_CFLAGS) -DGNUTLS_OQS_ENABLE_DLOPEN=1 -+endif -+ - noinst_LTLIBRARIES = libcrypto.la - - libcrypto_la_SOURCES = pk.c mpi.c mac.c cipher.c init.c \ -diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c -index b317b790d7..4155a540ed 100644 ---- a/lib/nettle/pk.c -+++ b/lib/nettle/pk.c -@@ -70,6 +70,9 @@ - #include "gnettle.h" - #include "fips.h" - #include "dh.h" -+#ifdef HAVE_LIBOQS -+#include "dlwrap/oqs.h" -+#endif - - static inline const struct ecc_curve *get_supported_nist_curve(int curve); - static inline const struct ecc_curve *get_supported_gost_curve(int curve); -@@ -687,6 +690,111 @@ cleanup: - return ret; - } - -+static int _wrap_nettle_pk_encaps(gnutls_pk_algorithm_t algo, -+ gnutls_datum_t *ciphertext, -+ gnutls_datum_t *shared_secret, -+ const gnutls_datum_t *pub) -+{ -+ int ret; -+ -+ switch (algo) { -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: { -+ OQS_KEM *kem = NULL; -+ OQS_STATUS rc; -+ -+ kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); -+ if (kem == NULL) -+ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ -+ ciphertext->data = gnutls_malloc(kem->length_ciphertext); -+ if (ciphertext->data == NULL) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ goto cleanup; -+ } -+ ciphertext->size = kem->length_ciphertext; -+ -+ shared_secret->data = gnutls_malloc(kem->length_shared_secret); -+ if (shared_secret->data == NULL) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ goto cleanup; -+ } -+ shared_secret->size = kem->length_shared_secret; -+ -+ rc = GNUTLS_OQS_FUNC(OQS_KEM_encaps)( -+ kem, ciphertext->data, shared_secret->data, pub->data); -+ if (rc != OQS_SUCCESS) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); -+ goto cleanup; -+ } -+ -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = 0; -+ } break; -+#endif -+ default: -+ ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_ALGORITHM); -+ goto cleanup; -+ } -+ -+cleanup: -+ if (ret < 0) { -+ gnutls_free(ciphertext->data); -+ gnutls_free(shared_secret->data); -+ } -+ return ret; -+} -+ -+static int _wrap_nettle_pk_decaps(gnutls_pk_algorithm_t algo, -+ gnutls_datum_t *shared_secret, -+ const gnutls_datum_t *ciphertext, -+ const gnutls_datum_t *priv) -+{ -+ int ret; -+ -+ switch (algo) { -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: { -+ OQS_KEM *kem = NULL; -+ OQS_STATUS rc; -+ -+ kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); -+ if (kem == NULL) -+ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ -+ shared_secret->data = gnutls_malloc(kem->length_shared_secret); -+ if (shared_secret->data == NULL) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ goto cleanup; -+ } -+ shared_secret->size = kem->length_shared_secret; -+ -+ rc = GNUTLS_OQS_FUNC(OQS_KEM_decaps)( -+ kem, shared_secret->data, ciphertext->data, priv->data); -+ if (rc != OQS_SUCCESS) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); -+ goto cleanup; -+ } -+ -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = 0; -+ } break; -+#endif -+ default: -+ ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_ALGORITHM); -+ goto cleanup; -+ } -+cleanup: -+ if (ret < 0) -+ gnutls_free(shared_secret->data); -+ return ret; -+} -+ - /* This wraps nettle_rsa_encrypt so it returns ciphertext as a byte - * array instead of a mpz_t value. Returns 1 on success; 0 otherwise. - */ -@@ -2234,6 +2342,9 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk) - case GNUTLS_PK_RSA_PSS: - case GNUTLS_PK_RSA_OAEP: - case GNUTLS_PK_EDDSA_ED25519: -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: -+#endif - #if ENABLE_GOST - case GNUTLS_PK_GOST_01: - case GNUTLS_PK_GOST_12_256: -@@ -2875,6 +2986,9 @@ static int pct_test(gnutls_pk_algorithm_t algo, - } - case GNUTLS_PK_ECDH_X25519: - case GNUTLS_PK_ECDH_X448: -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: -+#endif - ret = 0; - goto cleanup; - default: -@@ -3605,6 +3719,49 @@ wrap_nettle_pk_generate_keys(gnutls_pk_algorithm_t algo, - goto cleanup; - break; - } -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: { -+ OQS_KEM *kem = NULL; -+ OQS_STATUS rc; -+ -+ not_approved = true; -+ -+ kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); -+ if (kem == NULL) { -+ ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ goto cleanup; -+ } -+ -+ params->raw_priv.size = kem->length_secret_key; -+ params->raw_priv.data = gnutls_malloc(params->raw_priv.size); -+ if (params->raw_priv.data == NULL) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ goto cleanup; -+ } -+ -+ params->raw_pub.size = kem->length_public_key; -+ params->raw_pub.data = gnutls_malloc(params->raw_pub.size); -+ if (params->raw_pub.data == NULL) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -+ goto cleanup; -+ } -+ -+ rc = GNUTLS_OQS_FUNC(OQS_KEM_keypair)(kem, params->raw_pub.data, -+ params->raw_priv.data); -+ if (rc != OQS_SUCCESS) { -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ ret = gnutls_assert_val(GNUTLS_E_ILLEGAL_PARAMETER); -+ goto cleanup; -+ } -+ -+ GNUTLS_OQS_FUNC(OQS_KEM_free)(kem); -+ -+ ret = 0; -+ break; -+ } -+#endif - default: - gnutls_assert(); - return GNUTLS_E_INVALID_REQUEST; -@@ -3858,6 +4015,11 @@ static int wrap_nettle_pk_verify_priv_params(gnutls_pk_algorithm_t algo, - ret = 0; - break; - } -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: -+ ret = 0; -+ break; -+#endif - #if ENABLE_GOST - case GNUTLS_PK_GOST_01: - case GNUTLS_PK_GOST_12_256: -@@ -4307,6 +4469,8 @@ gnutls_crypto_pk_st _gnutls_pk_ops = { - .generate_keys = wrap_nettle_pk_generate_keys, - .pk_fixup_private_params = wrap_nettle_pk_fixup, - .derive = _wrap_nettle_pk_derive, -+ .encaps = _wrap_nettle_pk_encaps, -+ .decaps = _wrap_nettle_pk_decaps, - .curve_exists = _wrap_nettle_pk_curve_exists, - .pk_exists = _wrap_nettle_pk_exists, - .sign_exists = _wrap_nettle_pk_sign_exists -diff --git a/lib/pk.h b/lib/pk.h -index 20fe314f94..eca4e02d73 100644 ---- a/lib/pk.h -+++ b/lib/pk.h -@@ -46,6 +46,10 @@ extern gnutls_crypto_pk_st _gnutls_pk_ops; - _gnutls_pk_ops.derive(algo, out, pub, priv, nonce, 0) - #define _gnutls_pk_derive_tls13(algo, out, pub, priv) \ - _gnutls_pk_ops.derive(algo, out, pub, priv, NULL, PK_DERIVE_TLS13) -+#define _gnutls_pk_encaps(algo, ciphertext, shared_secret, pub) \ -+ _gnutls_pk_ops.encaps(algo, ciphertext, shared_secret, pub) -+#define _gnutls_pk_decaps(algo, shared_secret, ciphertext, priv) \ -+ _gnutls_pk_ops.decaps(algo, shared_secret, ciphertext, priv) - #define _gnutls_pk_generate_keys(algo, bits, params, temporal) \ - _gnutls_pk_ops.generate_keys(algo, bits, params, temporal) - #define _gnutls_pk_generate_params(algo, bits, priv) \ -diff --git a/lib/state.c b/lib/state.c -index ec514c0cd2..f2c74d97d0 100644 ---- a/lib/state.c -+++ b/lib/state.c -@@ -459,6 +459,7 @@ static void deinit_keys(gnutls_session_t session) - gnutls_pk_params_release(&session->key.kshare.ecdhx_params); - gnutls_pk_params_release(&session->key.kshare.ecdh_params); - gnutls_pk_params_release(&session->key.kshare.dh_params); -+ gnutls_pk_params_release(&session->key.kshare.kem_params); - - if (!vers->tls13_sem && session->key.binders[0].prf == NULL) { - gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params); -diff --git a/tests/Makefile.am b/tests/Makefile.am -index c674835c1f..ca76736d2e 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -600,6 +600,10 @@ ctests += win32-certopenstore - - endif - -+if ENABLE_LIBOQS -+dist_check_SCRIPTS += pqc-hybrid-kx.sh -+endif -+ - cpptests = - if ENABLE_CXX - if HAVE_CMOCKA -diff --git a/tests/pqc-hybrid-kx.sh b/tests/pqc-hybrid-kx.sh -new file mode 100644 -index 0000000000..b9302b43b1 ---- /dev/null -+++ b/tests/pqc-hybrid-kx.sh -@@ -0,0 +1,54 @@ -+#!/bin/sh -+ -+# Copyright (C) 2022 Red Hat, Inc. -+# -+# Author: Daiki Ueno -+# -+# This file is part of GnuTLS. -+# -+# GnuTLS is free software; you can redistribute it and/or modify it -+# under the terms of the GNU General Public License as published by the -+# Free Software Foundation; either version 3 of the License, or (at -+# your option) any later version. -+# -+# GnuTLS is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with GnuTLS. If not, see . -+ -+: ${srcdir=.} -+: ${SERV=../src/gnutls-serv${EXEEXT}} -+: ${CLI=../src/gnutls-cli${EXEEXT}} -+ -+if ! test -x "${SERV}"; then -+ exit 77 -+fi -+ -+if ! test -x "${CLI}"; then -+ exit 77 -+fi -+ -+. "${srcdir}/scripts/common.sh" -+testdir=`create_testdir pqc-hybrid-kx` -+ -+KEY="$srcdir/../doc/credentials/x509/key-ed25519.pem" -+CERT="$srcdir/../doc/credentials/x509/cert-ed25519.pem" -+CACERT="$srcdir/../doc/credentials/x509/ca.pem" -+ -+eval "${GETPORT}" -+launch_server --echo --priority NORMAL:-GROUP-ALL:+GROUP-X25519-KYBER768 --x509keyfile="$KEY" --x509certfile="$CERT" -+PID=$! -+wait_server ${PID} -+ -+${VALGRIND} "${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-GROUP-ALL:+GROUP-X25519-KYBER768 --x509cafile="$CACERT" --logfile="$testdir/cli.log" -Date: Tue, 23 Jul 2024 11:25:18 +0900 -Subject: [PATCH 1/3] dlwrap: use different macro for library soname in - generated code - -As GnuTLS opt in for manual initialization of dlopen'ed libraries, -config.h shouldn't define the SONAME macro used in the generated code. - -Signed-off-by: Daiki Ueno ---- - devel/generate-dlwrap.sh | 18 +++++++++++++----- - lib/dlwrap/brotlidec.c | 17 +++++++++-------- - lib/dlwrap/brotlienc.c | 17 +++++++++-------- - lib/dlwrap/oqs.c | 17 +++++++++-------- - lib/dlwrap/zlib.c | 17 +++++++++-------- - lib/dlwrap/zstd.c | 17 +++++++++-------- - 6 files changed, 58 insertions(+), 45 deletions(-) - -diff --git a/devel/generate-dlwrap.sh b/devel/generate-dlwrap.sh -index 3e253d9228..0394655bbf 100755 ---- a/devel/generate-dlwrap.sh -+++ b/devel/generate-dlwrap.sh -@@ -21,20 +21,28 @@ DST="$srcdir/lib/$DLWRAP" - - echo "Generating $DST/zlib.h" - --"$DLWRAP" --input /usr/include/zlib.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/z.syms" --license-file "$SRC/z.license" --soname Z_LIBRARY_SONAME --prefix gnutls_zlib --header-guard GNUTLS_LIB_DLWRAP_ZLIB_H_ --include "" -+"$DLWRAP" --input /usr/include/zlib.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/z.syms" --license-file "$SRC/z.license" --soname Z_LIBRARY_SONAME_UNUSED --prefix gnutls_zlib --header-guard GNUTLS_LIB_DLWRAP_ZLIB_H_ --include "" - - echo "Generating $DST/zstd.h" - --"$DLWRAP" --input /usr/include/zstd.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/zstd.syms" --license-file "$SRC/zstd.license" --soname ZSTD_LIBRARY_SONAME --prefix gnutls_zstd --header-guard GNUTLS_LIB_DLWRAP_ZSTD_H_ --include "" -+"$DLWRAP" --input /usr/include/zstd.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/zstd.syms" --license-file "$SRC/zstd.license" --soname ZSTD_LIBRARY_SONAME_UNUSED --prefix gnutls_zstd --header-guard GNUTLS_LIB_DLWRAP_ZSTD_H_ --include "" - - echo "Generating $DST/brotlienc.h" - --"$DLWRAP" --input /usr/include/brotli/encode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlienc.syms" --license-file "$SRC/brotli.license" --soname BROTLIENC_LIBRARY_SONAME --prefix gnutls_brotlienc --loader-basename brotlienc --header-guard GNUTLS_LIB_DLWRAP_BROTLIENC_H_ --include "" -+"$DLWRAP" --input /usr/include/brotli/encode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlienc.syms" --license-file "$SRC/brotli.license" --soname BROTLIENC_LIBRARY_SONAME_UNUSED --prefix gnutls_brotlienc --loader-basename brotlienc --header-guard GNUTLS_LIB_DLWRAP_BROTLIENC_H_ --include "" - - echo "Generating $DST/brotlidec.h" - --"$DLWRAP" --input /usr/include/brotli/decode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlidec.syms" --license-file "$SRC/brotli.license" --soname BROTLIDEC_LIBRARY_SONAME --prefix gnutls_brotlidec --loader-basename brotlidec --header-guard GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ --include "" -+"$DLWRAP" --input /usr/include/brotli/decode.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/brotlidec.syms" --license-file "$SRC/brotli.license" --soname BROTLIDEC_LIBRARY_SONAME_UNUSED --prefix gnutls_brotlidec --loader-basename brotlidec --header-guard GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ --include "" - - echo "Generating $DST/oqs.h" - --"$DLWRAP" --input /usr/include/oqs/oqs.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/oqs.syms" --license "SPDX-License-Identifier: MIT" --soname OQS_LIBRARY_SONAME --prefix gnutls_oqs --header-guard GNUTLS_LIB_DLWRAP_OQS_H_ --include "" -+"$DLWRAP" --input /usr/include/oqs/oqs.h -o "$DST" --clang-resource-dir $(clang -print-resource-dir) --symbol-file "$SRC/oqs.syms" --license "SPDX-License-Identifier: MIT" --soname OQS_LIBRARY_SONAME_UNUSED --prefix gnutls_oqs --header-guard GNUTLS_LIB_DLWRAP_OQS_H_ --include "" -+ -+sed -i '/^#include /i\ -+/* Local modification: remove this once liboqs 0.10.2 is released */\ -+#include "config.h"\ -+#if !HAVE_DECL_OQS_SHA3_SET_CALLBACKS\ -+#include "liboqs/backport/sha3_ops.h"\ -+#endif\ -+' "$DST/oqs.h" -diff --git a/lib/dlwrap/brotlidec.c b/lib/dlwrap/brotlidec.c -index 45c9b4b259..15cee63bd6 100644 ---- a/lib/dlwrap/brotlidec.c -+++ b/lib/dlwrap/brotlidec.c -@@ -18,16 +18,16 @@ - #include - #include - --/* If BROTLIDEC_LIBRARY_SONAME is defined, dlopen handle can be automatically -+/* If BROTLIDEC_LIBRARY_SONAME_UNUSED is defined, dlopen handle can be automatically - * set; otherwise, the caller needs to call - * gnutls_brotlidec_ensure_library with soname determined at run time. - */ --#ifdef BROTLIDEC_LIBRARY_SONAME -+#ifdef BROTLIDEC_LIBRARY_SONAME_UNUSED - - static void - ensure_library (void) - { -- if (gnutls_brotlidec_ensure_library (BROTLIDEC_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ if (gnutls_brotlidec_ensure_library (BROTLIDEC_LIBRARY_SONAME_UNUSED, RTLD_LAZY | RTLD_LOCAL) < 0) - abort (); - } - -@@ -47,11 +47,11 @@ static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; - - #endif /* !GNUTLS_BROTLIDEC_ENABLE_PTHREAD */ - --#else /* BROTLIDEC_LIBRARY_SONAME */ -+#else /* BROTLIDEC_LIBRARY_SONAME_UNUSED */ - - #define ENSURE_LIBRARY do {} while (0) - --#endif /* !BROTLIDEC_LIBRARY_SONAME */ -+#endif /* !BROTLIDEC_LIBRARY_SONAME_UNUSED */ - - static void *gnutls_brotlidec_dlhandle; - -@@ -147,7 +147,10 @@ void - gnutls_brotlidec_unload_library (void) - { - if (gnutls_brotlidec_dlhandle) -- dlclose (gnutls_brotlidec_dlhandle); -+ { -+ dlclose (gnutls_brotlidec_dlhandle); -+ gnutls_brotlidec_dlhandle = NULL; -+ } - - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" -@@ -160,8 +163,6 @@ gnutls_brotlidec_unload_library (void) - #undef FUNC - - #pragma GCC diagnostic pop -- --#undef RESET_SYMBOL - } - - #else /* GNUTLS_BROTLIDEC_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/brotlienc.c b/lib/dlwrap/brotlienc.c -index 9dd8ff37c6..1deff747e2 100644 ---- a/lib/dlwrap/brotlienc.c -+++ b/lib/dlwrap/brotlienc.c -@@ -18,16 +18,16 @@ - #include - #include - --/* If BROTLIENC_LIBRARY_SONAME is defined, dlopen handle can be automatically -+/* If BROTLIENC_LIBRARY_SONAME_UNUSED is defined, dlopen handle can be automatically - * set; otherwise, the caller needs to call - * gnutls_brotlienc_ensure_library with soname determined at run time. - */ --#ifdef BROTLIENC_LIBRARY_SONAME -+#ifdef BROTLIENC_LIBRARY_SONAME_UNUSED - - static void - ensure_library (void) - { -- if (gnutls_brotlienc_ensure_library (BROTLIENC_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ if (gnutls_brotlienc_ensure_library (BROTLIENC_LIBRARY_SONAME_UNUSED, RTLD_LAZY | RTLD_LOCAL) < 0) - abort (); - } - -@@ -47,11 +47,11 @@ static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; - - #endif /* !GNUTLS_BROTLIENC_ENABLE_PTHREAD */ - --#else /* BROTLIENC_LIBRARY_SONAME */ -+#else /* BROTLIENC_LIBRARY_SONAME_UNUSED */ - - #define ENSURE_LIBRARY do {} while (0) - --#endif /* !BROTLIENC_LIBRARY_SONAME */ -+#endif /* !BROTLIENC_LIBRARY_SONAME_UNUSED */ - - static void *gnutls_brotlienc_dlhandle; - -@@ -147,7 +147,10 @@ void - gnutls_brotlienc_unload_library (void) - { - if (gnutls_brotlienc_dlhandle) -- dlclose (gnutls_brotlienc_dlhandle); -+ { -+ dlclose (gnutls_brotlienc_dlhandle); -+ gnutls_brotlienc_dlhandle = NULL; -+ } - - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" -@@ -160,8 +163,6 @@ gnutls_brotlienc_unload_library (void) - #undef FUNC - - #pragma GCC diagnostic pop -- --#undef RESET_SYMBOL - } - - #else /* GNUTLS_BROTLIENC_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/oqs.c b/lib/dlwrap/oqs.c -index d7fcc9c80c..c05f883127 100644 ---- a/lib/dlwrap/oqs.c -+++ b/lib/dlwrap/oqs.c -@@ -18,16 +18,16 @@ - #include - #include - --/* If OQS_LIBRARY_SONAME is defined, dlopen handle can be automatically -+/* If OQS_LIBRARY_SONAME_UNUSED is defined, dlopen handle can be automatically - * set; otherwise, the caller needs to call - * gnutls_oqs_ensure_library with soname determined at run time. - */ --#ifdef OQS_LIBRARY_SONAME -+#ifdef OQS_LIBRARY_SONAME_UNUSED - - static void - ensure_library (void) - { -- if (gnutls_oqs_ensure_library (OQS_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ if (gnutls_oqs_ensure_library (OQS_LIBRARY_SONAME_UNUSED, RTLD_LAZY | RTLD_LOCAL) < 0) - abort (); - } - -@@ -47,11 +47,11 @@ static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; - - #endif /* !GNUTLS_OQS_ENABLE_PTHREAD */ - --#else /* OQS_LIBRARY_SONAME */ -+#else /* OQS_LIBRARY_SONAME_UNUSED */ - - #define ENSURE_LIBRARY do {} while (0) - --#endif /* !OQS_LIBRARY_SONAME */ -+#endif /* !OQS_LIBRARY_SONAME_UNUSED */ - - static void *gnutls_oqs_dlhandle; - -@@ -147,7 +147,10 @@ void - gnutls_oqs_unload_library (void) - { - if (gnutls_oqs_dlhandle) -- dlclose (gnutls_oqs_dlhandle); -+ { -+ dlclose (gnutls_oqs_dlhandle); -+ gnutls_oqs_dlhandle = NULL; -+ } - - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" -@@ -160,8 +163,6 @@ gnutls_oqs_unload_library (void) - #undef FUNC - - #pragma GCC diagnostic pop -- --#undef RESET_SYMBOL - } - - #else /* GNUTLS_OQS_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/zlib.c b/lib/dlwrap/zlib.c -index 455485c63f..878070c0a4 100644 ---- a/lib/dlwrap/zlib.c -+++ b/lib/dlwrap/zlib.c -@@ -18,16 +18,16 @@ - #include - #include - --/* If Z_LIBRARY_SONAME is defined, dlopen handle can be automatically -+/* If Z_LIBRARY_SONAME_UNUSED is defined, dlopen handle can be automatically - * set; otherwise, the caller needs to call - * gnutls_zlib_ensure_library with soname determined at run time. - */ --#ifdef Z_LIBRARY_SONAME -+#ifdef Z_LIBRARY_SONAME_UNUSED - - static void - ensure_library (void) - { -- if (gnutls_zlib_ensure_library (Z_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ if (gnutls_zlib_ensure_library (Z_LIBRARY_SONAME_UNUSED, RTLD_LAZY | RTLD_LOCAL) < 0) - abort (); - } - -@@ -47,11 +47,11 @@ static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; - - #endif /* !GNUTLS_ZLIB_ENABLE_PTHREAD */ - --#else /* Z_LIBRARY_SONAME */ -+#else /* Z_LIBRARY_SONAME_UNUSED */ - - #define ENSURE_LIBRARY do {} while (0) - --#endif /* !Z_LIBRARY_SONAME */ -+#endif /* !Z_LIBRARY_SONAME_UNUSED */ - - static void *gnutls_zlib_dlhandle; - -@@ -147,7 +147,10 @@ void - gnutls_zlib_unload_library (void) - { - if (gnutls_zlib_dlhandle) -- dlclose (gnutls_zlib_dlhandle); -+ { -+ dlclose (gnutls_zlib_dlhandle); -+ gnutls_zlib_dlhandle = NULL; -+ } - - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" -@@ -160,8 +163,6 @@ gnutls_zlib_unload_library (void) - #undef FUNC - - #pragma GCC diagnostic pop -- --#undef RESET_SYMBOL - } - - #else /* GNUTLS_ZLIB_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/zstd.c b/lib/dlwrap/zstd.c -index 2ea7252975..532c80b610 100644 ---- a/lib/dlwrap/zstd.c -+++ b/lib/dlwrap/zstd.c -@@ -18,16 +18,16 @@ - #include - #include - --/* If ZSTD_LIBRARY_SONAME is defined, dlopen handle can be automatically -+/* If ZSTD_LIBRARY_SONAME_UNUSED is defined, dlopen handle can be automatically - * set; otherwise, the caller needs to call - * gnutls_zstd_ensure_library with soname determined at run time. - */ --#ifdef ZSTD_LIBRARY_SONAME -+#ifdef ZSTD_LIBRARY_SONAME_UNUSED - - static void - ensure_library (void) - { -- if (gnutls_zstd_ensure_library (ZSTD_LIBRARY_SONAME, RTLD_LAZY | RTLD_LOCAL) < 0) -+ if (gnutls_zstd_ensure_library (ZSTD_LIBRARY_SONAME_UNUSED, RTLD_LAZY | RTLD_LOCAL) < 0) - abort (); - } - -@@ -47,11 +47,11 @@ static pthread_once_t dlopen_once = PTHREAD_ONCE_INIT; - - #endif /* !GNUTLS_ZSTD_ENABLE_PTHREAD */ - --#else /* ZSTD_LIBRARY_SONAME */ -+#else /* ZSTD_LIBRARY_SONAME_UNUSED */ - - #define ENSURE_LIBRARY do {} while (0) - --#endif /* !ZSTD_LIBRARY_SONAME */ -+#endif /* !ZSTD_LIBRARY_SONAME_UNUSED */ - - static void *gnutls_zstd_dlhandle; - -@@ -147,7 +147,10 @@ void - gnutls_zstd_unload_library (void) - { - if (gnutls_zstd_dlhandle) -- dlclose (gnutls_zstd_dlhandle); -+ { -+ dlclose (gnutls_zstd_dlhandle); -+ gnutls_zstd_dlhandle = NULL; -+ } - - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" -@@ -160,8 +163,6 @@ gnutls_zstd_unload_library (void) - #undef FUNC - - #pragma GCC diagnostic pop -- --#undef RESET_SYMBOL - } - - #else /* GNUTLS_ZSTD_ENABLE_DLOPEN */ --- -2.45.2 - - -From ec65c64e6c904d5a408e2afb31ecacc2b52ed7dc Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 23 Jul 2024 15:12:11 +0900 -Subject: [PATCH 2/3] liboqs: manually load liboqs.so at startup - -Signed-off-by: Daiki Ueno ---- - lib/global.c | 6 +++++- - lib/liboqs/liboqs.c | 21 ++++++++++++++++++++- - lib/liboqs/liboqs.h | 2 +- - 3 files changed, 26 insertions(+), 3 deletions(-) - -diff --git a/lib/global.c b/lib/global.c -index ae2f7f54dc..4aaf79a768 100644 ---- a/lib/global.c -+++ b/lib/global.c -@@ -330,7 +330,11 @@ static int _gnutls_global_init(unsigned constructor) - } - - #ifdef HAVE_LIBOQS -- _gnutls_liboqs_init(); -+ ret = _gnutls_liboqs_init(); -+ if (ret < 0) { -+ gnutls_assert(); -+ goto out; -+ } - #endif - - #ifndef _WIN32 -diff --git a/lib/liboqs/liboqs.c b/lib/liboqs/liboqs.c -index 88f2369719..c5531d4796 100644 ---- a/lib/liboqs/liboqs.c -+++ b/lib/liboqs/liboqs.c -@@ -22,15 +22,33 @@ - - #include "liboqs/liboqs.h" - -+#ifdef _WIN32 -+#define RTLD_NOW 0 -+#define RTLD_GLOBAL 0 -+#else -+#include -+#endif -+ -+#ifndef OQS_LIBRARY_SONAME -+#define OQS_LIBRARY_SONAME "none" -+#endif -+ -+#include "errors.h" -+ - #include "dlwrap/oqs.h" - #include "liboqs/rand.h" - #include "liboqs/sha3.h" - --void _gnutls_liboqs_init(void) -+int _gnutls_liboqs_init(void) - { -+ if (gnutls_oqs_ensure_library(OQS_LIBRARY_SONAME, -+ RTLD_NOW | RTLD_GLOBAL) < 0) -+ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ - _gnutls_liboqs_sha3_init(); - GNUTLS_OQS_FUNC(OQS_init)(); - _gnutls_liboqs_rand_init(); -+ return 0; - } - - void _gnutls_liboqs_deinit(void) -@@ -38,4 +56,5 @@ void _gnutls_liboqs_deinit(void) - _gnutls_liboqs_rand_deinit(); - _gnutls_liboqs_sha3_deinit(); - GNUTLS_OQS_FUNC(OQS_destroy)(); -+ gnutls_oqs_unload_library(); - } -diff --git a/lib/liboqs/liboqs.h b/lib/liboqs/liboqs.h -index b6c1659212..50206fa77c 100644 ---- a/lib/liboqs/liboqs.h -+++ b/lib/liboqs/liboqs.h -@@ -21,7 +21,7 @@ - #ifndef GNUTLS_LIB_LIBOQS_LIBOQS_H - #define GNUTLS_LIB_LIBOQS_LIBOQS_H - --void _gnutls_liboqs_init(void); -+int _gnutls_liboqs_init(void); - void _gnutls_liboqs_deinit(void); - - #endif /* GNUTLS_LIB_LIBOQS_LIBOQS_H */ --- -2.45.2 - - -From ecc41197f2233494d066114e2747b17b24d24543 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 23 Jul 2024 09:50:04 +0900 -Subject: [PATCH 3/3] tests: pqc-hybrid-kx: use key and certificate in - distribution - -The Ed25519 key and certificate in doc/credentials/x509/ are currently -not included in the distribution. Use the ECDSA ones in the test to -make the test work. - -Signed-off-by: Daiki Ueno ---- - tests/pqc-hybrid-kx.sh | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/tests/pqc-hybrid-kx.sh b/tests/pqc-hybrid-kx.sh -index b9302b43b1..b587587bd2 100644 ---- a/tests/pqc-hybrid-kx.sh -+++ b/tests/pqc-hybrid-kx.sh -@@ -34,8 +34,8 @@ fi - . "${srcdir}/scripts/common.sh" - testdir=`create_testdir pqc-hybrid-kx` - --KEY="$srcdir/../doc/credentials/x509/key-ed25519.pem" --CERT="$srcdir/../doc/credentials/x509/cert-ed25519.pem" -+KEY="$srcdir/../doc/credentials/x509/key-ecc.pem" -+CERT="$srcdir/../doc/credentials/x509/cert-ecc.pem" - CACERT="$srcdir/../doc/credentials/x509/ca.pem" - - eval "${GETPORT}" -@@ -43,12 +43,12 @@ launch_server --echo --priority NORMAL:-GROUP-ALL:+GROUP-X25519-KYBER768 --x509k - PID=$! - wait_server ${PID} - --${VALGRIND} "${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-GROUP-ALL:+GROUP-X25519-KYBER768 --x509cafile="$CACERT" --logfile="$testdir/cli.log" -Date: Tue, 23 Jul 2024 20:48:26 +0900 -Subject: [PATCH] liboqs: defer loading of liboqs at run-time - -Instead of loading liboqs at startup, this defers it until the liboqs -functions are actually used. - -Signed-off-by: Daiki Ueno ---- - lib/dlwrap/brotlidec.c | 24 ++++++++++++++++++---- - lib/dlwrap/brotlidec.h | 7 +++++++ - lib/dlwrap/brotlienc.c | 24 ++++++++++++++++++---- - lib/dlwrap/brotlienc.h | 7 +++++++ - lib/dlwrap/oqs.c | 24 ++++++++++++++++++---- - lib/dlwrap/oqs.h | 7 +++++++ - lib/dlwrap/zlib.c | 24 ++++++++++++++++++---- - lib/dlwrap/zlib.h | 7 +++++++ - lib/dlwrap/zstd.c | 24 ++++++++++++++++++---- - lib/dlwrap/zstd.h | 7 +++++++ - lib/global.c | 8 -------- - lib/liboqs/liboqs.c | 46 +++++++++++++++++++++++++++++++++++------- - lib/liboqs/liboqs.h | 2 +- - lib/nettle/pk.c | 33 ++++++++++++++++++++++++------ - 14 files changed, 202 insertions(+), 42 deletions(-) - -diff --git a/lib/dlwrap/brotlidec.c b/lib/dlwrap/brotlidec.c -index 15cee63bd6..7e4546a8e7 100644 ---- a/lib/dlwrap/brotlidec.c -+++ b/lib/dlwrap/brotlidec.c -@@ -128,10 +128,13 @@ gnutls_brotlidec_ensure_library (const char *soname, int flags) - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" - --#define FUNC(ret, name, args, cargs) \ -- err = ENSURE_SYMBOL(name); \ -- if (err < 0) \ -- return err; -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ { \ -+ gnutls_brotlidec_dlhandle = NULL; \ -+ return err; \ -+ } - #define VOID_FUNC FUNC - #include "brotlidecfuncs.h" - #undef VOID_FUNC -@@ -165,6 +168,12 @@ gnutls_brotlidec_unload_library (void) - #pragma GCC diagnostic pop - } - -+unsigned -+gnutls_brotlidec_is_usable (void) -+{ -+ return gnutls_brotlidec_dlhandle != NULL; -+} -+ - #else /* GNUTLS_BROTLIDEC_ENABLE_DLOPEN */ - - int -@@ -180,4 +189,11 @@ gnutls_brotlidec_unload_library (void) - { - } - -+unsigned -+gnutls_brotlidec_is_usable (void) -+{ -+ /* The library is linked at build time, thus always usable */ -+ return 1; -+} -+ - #endif /* !GNUTLS_BROTLIDEC_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/brotlidec.h b/lib/dlwrap/brotlidec.h -index 31397f24cf..f7d97eed35 100644 ---- a/lib/dlwrap/brotlidec.h -+++ b/lib/dlwrap/brotlidec.h -@@ -44,4 +44,11 @@ int gnutls_brotlidec_ensure_library (const char *soname, int flags); - */ - void gnutls_brotlidec_unload_library (void); - -+/* Return 1 if the library is loaded and usable. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+unsigned gnutls_brotlidec_is_usable (void); -+ - #endif /* GNUTLS_LIB_DLWRAP_BROTLIDEC_H_ */ -diff --git a/lib/dlwrap/brotlienc.c b/lib/dlwrap/brotlienc.c -index 1deff747e2..fae13ed313 100644 ---- a/lib/dlwrap/brotlienc.c -+++ b/lib/dlwrap/brotlienc.c -@@ -128,10 +128,13 @@ gnutls_brotlienc_ensure_library (const char *soname, int flags) - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" - --#define FUNC(ret, name, args, cargs) \ -- err = ENSURE_SYMBOL(name); \ -- if (err < 0) \ -- return err; -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ { \ -+ gnutls_brotlienc_dlhandle = NULL; \ -+ return err; \ -+ } - #define VOID_FUNC FUNC - #include "brotliencfuncs.h" - #undef VOID_FUNC -@@ -165,6 +168,12 @@ gnutls_brotlienc_unload_library (void) - #pragma GCC diagnostic pop - } - -+unsigned -+gnutls_brotlienc_is_usable (void) -+{ -+ return gnutls_brotlienc_dlhandle != NULL; -+} -+ - #else /* GNUTLS_BROTLIENC_ENABLE_DLOPEN */ - - int -@@ -180,4 +189,11 @@ gnutls_brotlienc_unload_library (void) - { - } - -+unsigned -+gnutls_brotlienc_is_usable (void) -+{ -+ /* The library is linked at build time, thus always usable */ -+ return 1; -+} -+ - #endif /* !GNUTLS_BROTLIENC_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/brotlienc.h b/lib/dlwrap/brotlienc.h -index ed1af45e04..4dfbf3b838 100644 ---- a/lib/dlwrap/brotlienc.h -+++ b/lib/dlwrap/brotlienc.h -@@ -44,4 +44,11 @@ int gnutls_brotlienc_ensure_library (const char *soname, int flags); - */ - void gnutls_brotlienc_unload_library (void); - -+/* Return 1 if the library is loaded and usable. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+unsigned gnutls_brotlienc_is_usable (void); -+ - #endif /* GNUTLS_LIB_DLWRAP_BROTLIENC_H_ */ -diff --git a/lib/dlwrap/oqs.c b/lib/dlwrap/oqs.c -index c05f883127..f9ae269faa 100644 ---- a/lib/dlwrap/oqs.c -+++ b/lib/dlwrap/oqs.c -@@ -128,10 +128,13 @@ gnutls_oqs_ensure_library (const char *soname, int flags) - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" - --#define FUNC(ret, name, args, cargs) \ -- err = ENSURE_SYMBOL(name); \ -- if (err < 0) \ -- return err; -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ { \ -+ gnutls_oqs_dlhandle = NULL; \ -+ return err; \ -+ } - #define VOID_FUNC FUNC - #include "oqsfuncs.h" - #undef VOID_FUNC -@@ -165,6 +168,12 @@ gnutls_oqs_unload_library (void) - #pragma GCC diagnostic pop - } - -+unsigned -+gnutls_oqs_is_usable (void) -+{ -+ return gnutls_oqs_dlhandle != NULL; -+} -+ - #else /* GNUTLS_OQS_ENABLE_DLOPEN */ - - int -@@ -180,4 +189,11 @@ gnutls_oqs_unload_library (void) - { - } - -+unsigned -+gnutls_oqs_is_usable (void) -+{ -+ /* The library is linked at build time, thus always usable */ -+ return 1; -+} -+ - #endif /* !GNUTLS_OQS_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/oqs.h b/lib/dlwrap/oqs.h -index 6a1d8e0766..1cf5d015a5 100644 ---- a/lib/dlwrap/oqs.h -+++ b/lib/dlwrap/oqs.h -@@ -50,4 +50,11 @@ int gnutls_oqs_ensure_library (const char *soname, int flags); - */ - void gnutls_oqs_unload_library (void); - -+/* Return 1 if the library is loaded and usable. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+unsigned gnutls_oqs_is_usable (void); -+ - #endif /* GNUTLS_LIB_DLWRAP_OQS_H_ */ -diff --git a/lib/dlwrap/zlib.c b/lib/dlwrap/zlib.c -index 878070c0a4..19851513a9 100644 ---- a/lib/dlwrap/zlib.c -+++ b/lib/dlwrap/zlib.c -@@ -128,10 +128,13 @@ gnutls_zlib_ensure_library (const char *soname, int flags) - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" - --#define FUNC(ret, name, args, cargs) \ -- err = ENSURE_SYMBOL(name); \ -- if (err < 0) \ -- return err; -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ { \ -+ gnutls_zlib_dlhandle = NULL; \ -+ return err; \ -+ } - #define VOID_FUNC FUNC - #include "zlibfuncs.h" - #undef VOID_FUNC -@@ -165,6 +168,12 @@ gnutls_zlib_unload_library (void) - #pragma GCC diagnostic pop - } - -+unsigned -+gnutls_zlib_is_usable (void) -+{ -+ return gnutls_zlib_dlhandle != NULL; -+} -+ - #else /* GNUTLS_ZLIB_ENABLE_DLOPEN */ - - int -@@ -180,4 +189,11 @@ gnutls_zlib_unload_library (void) - { - } - -+unsigned -+gnutls_zlib_is_usable (void) -+{ -+ /* The library is linked at build time, thus always usable */ -+ return 1; -+} -+ - #endif /* !GNUTLS_ZLIB_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/zlib.h b/lib/dlwrap/zlib.h -index a9666d27f5..0d7113febf 100644 ---- a/lib/dlwrap/zlib.h -+++ b/lib/dlwrap/zlib.h -@@ -44,4 +44,11 @@ int gnutls_zlib_ensure_library (const char *soname, int flags); - */ - void gnutls_zlib_unload_library (void); - -+/* Return 1 if the library is loaded and usable. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+unsigned gnutls_zlib_is_usable (void); -+ - #endif /* GNUTLS_LIB_DLWRAP_ZLIB_H_ */ -diff --git a/lib/dlwrap/zstd.c b/lib/dlwrap/zstd.c -index 532c80b610..bd5153e464 100644 ---- a/lib/dlwrap/zstd.c -+++ b/lib/dlwrap/zstd.c -@@ -128,10 +128,13 @@ gnutls_zstd_ensure_library (const char *soname, int flags) - #pragma GCC diagnostic push - #pragma GCC diagnostic ignored "-Wunused-macros" - --#define FUNC(ret, name, args, cargs) \ -- err = ENSURE_SYMBOL(name); \ -- if (err < 0) \ -- return err; -+#define FUNC(ret, name, args, cargs) \ -+ err = ENSURE_SYMBOL(name); \ -+ if (err < 0) \ -+ { \ -+ gnutls_zstd_dlhandle = NULL; \ -+ return err; \ -+ } - #define VOID_FUNC FUNC - #include "zstdfuncs.h" - #undef VOID_FUNC -@@ -165,6 +168,12 @@ gnutls_zstd_unload_library (void) - #pragma GCC diagnostic pop - } - -+unsigned -+gnutls_zstd_is_usable (void) -+{ -+ return gnutls_zstd_dlhandle != NULL; -+} -+ - #else /* GNUTLS_ZSTD_ENABLE_DLOPEN */ - - int -@@ -180,4 +189,11 @@ gnutls_zstd_unload_library (void) - { - } - -+unsigned -+gnutls_zstd_is_usable (void) -+{ -+ /* The library is linked at build time, thus always usable */ -+ return 1; -+} -+ - #endif /* !GNUTLS_ZSTD_ENABLE_DLOPEN */ -diff --git a/lib/dlwrap/zstd.h b/lib/dlwrap/zstd.h -index 80ac2fbd46..4a68a45e37 100644 ---- a/lib/dlwrap/zstd.h -+++ b/lib/dlwrap/zstd.h -@@ -44,4 +44,11 @@ int gnutls_zstd_ensure_library (const char *soname, int flags); - */ - void gnutls_zstd_unload_library (void); - -+/* Return 1 if the library is loaded and usable. -+ * -+ * Note that this function is NOT thread-safe; when calling it from -+ * multi-threaded programs, protect it with a locking mechanism. -+ */ -+unsigned gnutls_zstd_is_usable (void); -+ - #endif /* GNUTLS_LIB_DLWRAP_ZSTD_H_ */ -diff --git a/lib/global.c b/lib/global.c -index 4aaf79a768..42d90ee9d5 100644 ---- a/lib/global.c -+++ b/lib/global.c -@@ -329,14 +329,6 @@ static int _gnutls_global_init(unsigned constructor) - goto out; - } - --#ifdef HAVE_LIBOQS -- ret = _gnutls_liboqs_init(); -- if (ret < 0) { -- gnutls_assert(); -- goto out; -- } --#endif -- - #ifndef _WIN32 - ret = _gnutls_register_fork_handler(); - if (ret < 0) { -diff --git a/lib/liboqs/liboqs.c b/lib/liboqs/liboqs.c -index c5531d4796..3c0df56644 100644 ---- a/lib/liboqs/liboqs.c -+++ b/lib/liboqs/liboqs.c -@@ -34,27 +34,59 @@ - #endif - - #include "errors.h" -+#include "locks.h" - - #include "dlwrap/oqs.h" - #include "liboqs/rand.h" - #include "liboqs/sha3.h" - --int _gnutls_liboqs_init(void) -+/* We can't use GNUTLS_ONCE here, as it wouldn't allow manual unloading */ -+GNUTLS_STATIC_MUTEX(liboqs_init_mutex); -+static int _liboqs_init = 0; -+ -+int _gnutls_liboqs_ensure(void) - { -+ int ret; -+ -+ if (_liboqs_init) -+ return GNUTLS_E_SUCCESS; -+ -+ ret = gnutls_static_mutex_lock(&liboqs_init_mutex); -+ if (unlikely(ret < 0)) -+ return gnutls_assert_val(ret); -+ - if (gnutls_oqs_ensure_library(OQS_LIBRARY_SONAME, -- RTLD_NOW | RTLD_GLOBAL) < 0) -- return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ RTLD_NOW | RTLD_GLOBAL) < 0) { -+ _gnutls_debug_log( -+ "liboqs: unable to initialize liboqs functions\n"); -+ ret = gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); -+ goto out; -+ } - - _gnutls_liboqs_sha3_init(); - GNUTLS_OQS_FUNC(OQS_init)(); - _gnutls_liboqs_rand_init(); -- return 0; -+ -+ _liboqs_init = 1; -+ ret = GNUTLS_E_SUCCESS; -+ -+out: -+ (void)gnutls_static_mutex_unlock(&liboqs_init_mutex); -+ -+ return ret; - } - -+/* This is not thread-safe: call this function only from -+ * gnutls_global_deinit, which has a proper protection. -+ */ - void _gnutls_liboqs_deinit(void) - { -- _gnutls_liboqs_rand_deinit(); -- _gnutls_liboqs_sha3_deinit(); -- GNUTLS_OQS_FUNC(OQS_destroy)(); -+ if (_liboqs_init) { -+ _gnutls_liboqs_rand_deinit(); -+ _gnutls_liboqs_sha3_deinit(); -+ GNUTLS_OQS_FUNC(OQS_destroy)(); -+ } -+ - gnutls_oqs_unload_library(); -+ _liboqs_init = 0; - } -diff --git a/lib/liboqs/liboqs.h b/lib/liboqs/liboqs.h -index 50206fa77c..3717454275 100644 ---- a/lib/liboqs/liboqs.h -+++ b/lib/liboqs/liboqs.h -@@ -21,7 +21,7 @@ - #ifndef GNUTLS_LIB_LIBOQS_LIBOQS_H - #define GNUTLS_LIB_LIBOQS_LIBOQS_H - --int _gnutls_liboqs_init(void); -+int _gnutls_liboqs_ensure(void); - void _gnutls_liboqs_deinit(void); - - #endif /* GNUTLS_LIB_LIBOQS_LIBOQS_H */ -diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c -index 4155a540ed..79f7988d50 100644 ---- a/lib/nettle/pk.c -+++ b/lib/nettle/pk.c -@@ -72,6 +72,7 @@ - #include "dh.h" - #ifdef HAVE_LIBOQS - #include "dlwrap/oqs.h" -+#include "liboqs/liboqs.h" - #endif - - static inline const struct ecc_curve *get_supported_nist_curve(int curve); -@@ -703,6 +704,9 @@ static int _wrap_nettle_pk_encaps(gnutls_pk_algorithm_t algo, - OQS_KEM *kem = NULL; - OQS_STATUS rc; - -+ if (_gnutls_liboqs_ensure() < 0) -+ return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); -+ - kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); - if (kem == NULL) - return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -@@ -761,6 +765,9 @@ static int _wrap_nettle_pk_decaps(gnutls_pk_algorithm_t algo, - OQS_KEM *kem = NULL; - OQS_STATUS rc; - -+ if (_gnutls_liboqs_ensure() < 0) -+ return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); -+ - kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); - if (kem == NULL) - return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); -@@ -2342,9 +2349,6 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk) - case GNUTLS_PK_RSA_PSS: - case GNUTLS_PK_RSA_OAEP: - case GNUTLS_PK_EDDSA_ED25519: --#ifdef HAVE_LIBOQS -- case GNUTLS_PK_EXP_KYBER768: --#endif - #if ENABLE_GOST - case GNUTLS_PK_GOST_01: - case GNUTLS_PK_GOST_12_256: -@@ -2353,6 +2357,10 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk) - case GNUTLS_PK_ECDH_X448: - case GNUTLS_PK_EDDSA_ED448: - return 1; -+#ifdef HAVE_LIBOQS -+ case GNUTLS_PK_EXP_KYBER768: -+ return _gnutls_liboqs_ensure() == 0; -+#endif - default: - return 0; - } -@@ -2986,11 +2994,15 @@ static int pct_test(gnutls_pk_algorithm_t algo, - } - case GNUTLS_PK_ECDH_X25519: - case GNUTLS_PK_ECDH_X448: -+ break; - #ifdef HAVE_LIBOQS - case GNUTLS_PK_EXP_KYBER768: -+ if (_gnutls_liboqs_ensure() < 0) { -+ ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); -+ goto cleanup; -+ } - #endif -- ret = 0; -- goto cleanup; -+ break; - default: - ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - goto cleanup; -@@ -3724,6 +3736,13 @@ wrap_nettle_pk_generate_keys(gnutls_pk_algorithm_t algo, - OQS_KEM *kem = NULL; - OQS_STATUS rc; - -+#ifdef HAVE_LIBOQS -+ if (_gnutls_liboqs_ensure() < 0) { -+ ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); -+ goto cleanup; -+ } -+#endif -+ - not_approved = true; - - kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); -@@ -4017,7 +4036,9 @@ static int wrap_nettle_pk_verify_priv_params(gnutls_pk_algorithm_t algo, - } - #ifdef HAVE_LIBOQS - case GNUTLS_PK_EXP_KYBER768: -- ret = 0; -+ ret = _gnutls_liboqs_ensure(); -+ if (ret < 0) -+ ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - break; - #endif - #if ENABLE_GOST --- -2.45.2 - -From dfac4bb0d96507a409e3c3434c04bd8f79ac479f Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Mon, 29 Jul 2024 08:40:34 +0900 -Subject: [PATCH 1/2] liboqs: check whether Kyber768 is compiled in - -In the default build configuration of liboqs 0.10.1, Kyber768 is -disabled. This adds a guard against it and skip tests if not -available. - -Signed-off-by: Daiki Ueno ---- - devel/dlwrap/oqs.syms | 1 + - lib/dlwrap/oqsfuncs.h | 1 + - lib/nettle/pk.c | 27 ++++++++++++++++++--------- - tests/pqc-hybrid-kx.sh | 4 ++++ - 4 files changed, 24 insertions(+), 9 deletions(-) - -diff --git a/devel/dlwrap/oqs.syms b/devel/dlwrap/oqs.syms -index 8f067b2dd3..413f887598 100644 ---- a/devel/dlwrap/oqs.syms -+++ b/devel/dlwrap/oqs.syms -@@ -1,6 +1,7 @@ - OQS_SHA3_set_callbacks - OQS_init - OQS_destroy -+OQS_KEM_alg_is_enabled - OQS_KEM_new - OQS_KEM_encaps - OQS_KEM_decaps -diff --git a/lib/dlwrap/oqsfuncs.h b/lib/dlwrap/oqsfuncs.h -index 95c1b083dc..4aa0ba4ab4 100644 ---- a/lib/dlwrap/oqsfuncs.h -+++ b/lib/dlwrap/oqsfuncs.h -@@ -7,6 +7,7 @@ VOID_FUNC(void, OQS_init, (void), ()) - VOID_FUNC(void, OQS_destroy, (void), ()) - VOID_FUNC(void, OQS_SHA3_set_callbacks, (struct OQS_SHA3_callbacks *new_callbacks), (new_callbacks)) - VOID_FUNC(void, OQS_randombytes_custom_algorithm, (void (*algorithm_ptr)(uint8_t *, size_t)), (algorithm_ptr)) -+FUNC(int, OQS_KEM_alg_is_enabled, (const char *method_name), (method_name)) - FUNC(OQS_KEM *, OQS_KEM_new, (const char *method_name), (method_name)) - FUNC(OQS_STATUS, OQS_KEM_keypair, (const OQS_KEM *kem, uint8_t *public_key, uint8_t *secret_key), (kem, public_key, secret_key)) - FUNC(OQS_STATUS, OQS_KEM_encaps, (const OQS_KEM *kem, uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key), (kem, ciphertext, shared_secret, public_key)) -diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c -index eb8c44459d..8a987ed121 100644 ---- a/lib/nettle/pk.c -+++ b/lib/nettle/pk.c -@@ -704,7 +704,9 @@ static int _wrap_nettle_pk_encaps(gnutls_pk_algorithm_t algo, - OQS_KEM *kem = NULL; - OQS_STATUS rc; - -- if (_gnutls_liboqs_ensure() < 0) -+ if (_gnutls_liboqs_ensure() < 0 || -+ !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)( -+ OQS_KEM_alg_kyber_768)) - return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - - kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); -@@ -765,7 +767,9 @@ static int _wrap_nettle_pk_decaps(gnutls_pk_algorithm_t algo, - OQS_KEM *kem = NULL; - OQS_STATUS rc; - -- if (_gnutls_liboqs_ensure() < 0) -+ if (_gnutls_liboqs_ensure() < 0 || -+ !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)( -+ OQS_KEM_alg_kyber_768)) - return gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - - kem = GNUTLS_OQS_FUNC(OQS_KEM_new)(OQS_KEM_alg_kyber_768); -@@ -2359,7 +2363,9 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk) - return 1; - #ifdef HAVE_LIBOQS - case GNUTLS_PK_EXP_KYBER768: -- return _gnutls_liboqs_ensure() == 0; -+ return _gnutls_liboqs_ensure() == 0 && -+ GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)( -+ OQS_KEM_alg_kyber_768); - #endif - default: - return 0; -@@ -2997,7 +3003,9 @@ static int pct_test(gnutls_pk_algorithm_t algo, - break; - #ifdef HAVE_LIBOQS - case GNUTLS_PK_EXP_KYBER768: -- if (_gnutls_liboqs_ensure() < 0) { -+ if (_gnutls_liboqs_ensure() < 0 || -+ !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)( -+ OQS_KEM_alg_kyber_768)) { - ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - goto cleanup; - } -@@ -3736,12 +3744,12 @@ wrap_nettle_pk_generate_keys(gnutls_pk_algorithm_t algo, - OQS_KEM *kem = NULL; - OQS_STATUS rc; - --#ifdef HAVE_LIBOQS -- if (_gnutls_liboqs_ensure() < 0) { -+ if (_gnutls_liboqs_ensure() < 0 || -+ !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)( -+ OQS_KEM_alg_kyber_768)) { - ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - goto cleanup; - } --#endif - - not_approved = true; - -@@ -4038,8 +4046,9 @@ static int wrap_nettle_pk_verify_priv_params(gnutls_pk_algorithm_t algo, - } - #ifdef HAVE_LIBOQS - case GNUTLS_PK_EXP_KYBER768: -- ret = _gnutls_liboqs_ensure(); -- if (ret < 0) -+ if (_gnutls_liboqs_ensure() < 0 || -+ !GNUTLS_OQS_FUNC(OQS_KEM_alg_is_enabled)( -+ OQS_KEM_alg_kyber_768)) - ret = gnutls_assert_val(GNUTLS_E_UNKNOWN_PK_ALGORITHM); - break; - #endif -diff --git a/tests/pqc-hybrid-kx.sh b/tests/pqc-hybrid-kx.sh -index b587587bd2..6d47105fa0 100644 ---- a/tests/pqc-hybrid-kx.sh -+++ b/tests/pqc-hybrid-kx.sh -@@ -31,6 +31,10 @@ if ! test -x "${CLI}"; then - exit 77 - fi - -+if ! "${CLI}" --list | grep '^Public Key Systems: .*Kyber768.*' >/dev/null; then -+ exit 77 -+fi -+ - . "${srcdir}/scripts/common.sh" - testdir=`create_testdir pqc-hybrid-kx` - --- -2.45.2 - diff --git a/gnutls-3.8.6-nettle-rsa-oaep.patch b/gnutls-3.8.6-nettle-rsa-oaep.patch deleted file mode 100644 index d8f0b4b..0000000 --- a/gnutls-3.8.6-nettle-rsa-oaep.patch +++ /dev/null @@ -1,27 +0,0 @@ -From a9800309197fe5aef913944b2fc77164946f0689 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 23 Jul 2024 16:04:56 +0900 -Subject: [PATCH] build: link against libhogweed when checking - nettle_rsa_oaep_* - -Signed-off-by: Daiki Ueno ---- - configure.ac | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index fb0aefe1f4..8b55808bd7 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -795,7 +795,7 @@ AM_CONDITIONAL([NEED_SIV_GCM], [test "$ac_cv_func_nettle_siv_gcm_encrypt_message - - # Check for RSA-OAEP - save_LIBS=$LIBS --LIBS="$LIBS $NETTLE_LIBS" -+LIBS="$LIBS $HOGWEED_LIBS $NETTLE_LIBS $GMP_LIBS" - AC_CHECK_FUNCS(nettle_rsa_oaep_sha256_encrypt) - LIBS=$save_LIBS - AM_CONDITIONAL([NEED_RSA_OAEP], [test "$ac_cv_func_nettle_rsa_oaep_sha256_encrypt" != yes]) --- -2.45.2 - diff --git a/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch b/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch deleted file mode 100644 index d93dd28..0000000 --- a/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch +++ /dev/null @@ -1,29 +0,0 @@ -From a36b73a21e4b5b6e051b23192a645dea34c9d6af Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 5 Nov 2024 14:45:46 +0900 -Subject: [PATCH] tests: skip CHACHA20-POLY1305 in TLS 1.2 when KTLS is enabled - -Signed-off-by: Daiki Ueno ---- - tests/gnutls_ktls.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c -index 90d3e9af91..d5ac4efecc 100644 ---- a/tests/gnutls_ktls.c -+++ b/tests/gnutls_ktls.c -@@ -347,9 +347,11 @@ void doit(void) - { - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM"); -+#if 0 - if (!gnutls_fips140_mode_enabled()) { - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305"); - } -+#endif - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); - if (!gnutls_fips140_mode_enabled()) { --- -2.47.0 - diff --git a/gnutls-3.8.9-ktls-kernel-check.patch b/gnutls-3.8.9-ktls-kernel-check.patch deleted file mode 100644 index 0299beb..0000000 --- a/gnutls-3.8.9-ktls-kernel-check.patch +++ /dev/null @@ -1,1310 +0,0 @@ -From 633bea37176f3fe16dd431ccb35112aa970c7db1 Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Tue, 11 Feb 2025 12:45:44 +0100 -Subject: [PATCH 1/7] kTLS: keyupdate_test improvements - -- ktls_utils.h has helper funtion to create standard sockets required - for ktls support testing. -- key_update test for kTLS is now a flavourt of the tls13/key_update - test instead of being standalone(broadens the testing cases). -- gnutls_ktls.c now uses the aformentioned ktls_utils.h - -Signed-off-by: Frantisek Krenzelok ---- - tests/Makefile.am | 16 +- - tests/gnutls_ktls.c | 60 ++----- - tests/ktls_keyupdate.c | 368 --------------------------------------- - tests/ktls_utils.h | 94 ++++++++++ - tests/tls13/key_update.c | 115 +++++++++++- - 5 files changed, 228 insertions(+), 425 deletions(-) - delete mode 100644 tests/ktls_keyupdate.c - create mode 100644 tests/ktls_utils.h - -diff --git a/tests/Makefile.am b/tests/Makefile.am -index 72926e9da4..9990ee21cc 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -517,12 +517,6 @@ if ENABLE_TPM2 - dist_check_SCRIPTS += tpm2.sh - endif - --if ENABLE_KTLS --indirect_tests += gnutls_ktls --dist_check_SCRIPTS += ktls.sh --indirect_tests += ktls_keyupdate --dist_check_SCRIPTS += ktls_keyupdate.sh --endif - - if !WINDOWS - -@@ -530,6 +524,16 @@ if !WINDOWS - # List of tests not available/functional under windows - # - -+if ENABLE_KTLS -+indirect_tests += gnutls_ktls -+dist_check_SCRIPTS += ktls.sh -+ -+indirect_tests += ktls_keyupdate -+ktls_keyupdate_SOURCES = tls13/key_update.c -+ktls_keyupdate_CFLAGS = -DUSE_KTLS -+dist_check_SCRIPTS += ktls_keyupdate.sh -+endif -+ - dist_check_SCRIPTS += dtls/dtls.sh dtls/dtls-resume.sh #dtls/dtls-nb - - indirect_tests += dtls-stress -diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c -index 90d3e9af91..ca576d42aa 100644 ---- a/tests/gnutls_ktls.c -+++ b/tests/gnutls_ktls.c -@@ -31,6 +31,7 @@ int main(void) - - #include "cert-common.h" - #include "utils.h" -+#include "ktls_utils.h" - - static void server_log_func(int level, const char *str) - { -@@ -94,7 +95,8 @@ static void client(int fd, const char *prio) - } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); - - if (ret == 0) { -- success("client: Peer has closed the TLS connection\n"); -+ if (debug) -+ success("client: Peer has closed the TLS connection\n"); - goto end; - } else if (ret < 0) { - fail("client: Error: %s\n", gnutls_strerror(ret)); -@@ -116,7 +118,8 @@ static void client(int fd, const char *prio) - } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); - - if (ret == 0) { -- success("client: Peer has closed the TLS connection\n"); -+ if (debug) -+ success("client: Peer has closed the TLS connection\n"); - goto end; - } else if (ret < 0) { - fail("client: Error: %s\n", gnutls_strerror(ret)); -@@ -277,35 +280,16 @@ static void ch_handler(int sig) - static void run(const char *prio) - { - int ret; -- struct sockaddr_in saddr; -- socklen_t addrlen; -- int listener; -- int fd; -+ int client_fd, server_fd; - - success("running ktls test with %s\n", prio); - - signal(SIGCHLD, ch_handler); - signal(SIGPIPE, SIG_IGN); - -- listener = socket(AF_INET, SOCK_STREAM, 0); -- if (listener == -1) { -- fail("error in listener(): %s\n", strerror(errno)); -- } -- -- memset(&saddr, 0, sizeof(saddr)); -- saddr.sin_family = AF_INET; -- saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); -- saddr.sin_port = 0; -- -- ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); -- if (ret == -1) { -- fail("error in bind(): %s\n", strerror(errno)); -- } -- -- addrlen = sizeof(saddr); -- ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); -- if (ret == -1) { -- fail("error in getsockname(): %s\n", strerror(errno)); -+ if ((ret = create_socket_pair(&client_fd, &server_fd))) { -+ fail("Error in socket creation: %d\n", ret); -+ exit(1); - } - - child = fork(); -@@ -315,30 +299,20 @@ static void run(const char *prio) - } - - if (child) { -- int status; - /* parent */ -- ret = listen(listener, 1); -- if (ret == -1) { -- fail("error in listen(): %s\n", strerror(errno)); -- } -+ int status; -+ close(client_fd); - -- fd = accept(listener, NULL, NULL); -- if (fd == -1) { -- fail("error in accept(): %s\n", strerror(errno)); -- } -- server(fd, prio); -+ server(server_fd, prio); - - wait(&status); - check_wait_status(status); - } else { -- fd = socket(AF_INET, SOCK_STREAM, 0); -- if (fd == -1) { -- fail("error in socket(): %s\n", strerror(errno)); -- exit(1); -- } -- usleep(1000000); -- connect(fd, (struct sockaddr *)&saddr, addrlen); -- client(fd, prio); -+ close(server_fd); -+ sleep(1); -+ -+ client(client_fd, prio); -+ - exit(0); - } - } -diff --git a/tests/ktls_keyupdate.c b/tests/ktls_keyupdate.c -deleted file mode 100644 -index b439b7df21..0000000000 ---- a/tests/ktls_keyupdate.c -+++ /dev/null -@@ -1,368 +0,0 @@ --// Copyright (C) 2022 Red Hat, Inc. --// --// Author: Frantisek Krenzelok --// --// This file is part of GnuTLS. --// --// GnuTLS is free software; you can redistribute it and/or modify it --// under the terms of the GNU General Public License as published by the --// Free Software Foundation; either version 3 of the License, or (at --// your option) any later version. --// --// GnuTLS is distributed in the hope that it will be useful, but --// WITHOUT ANY WARRANTY; without even the implied warranty of --// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU --// General Public License for more details. --// --// You should have received a copy of the GNU General Public License --// along with GnuTLS. If not, see . -- --#ifdef HAVE_CONFIG_H --#include "config.h" --#endif -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#include "cert-common.h" --#include "utils.h" -- --#if defined(_WIN32) -- --int main(void) --{ -- exit(77); --} -- --#else -- --#define MAX_BUF 1024 --#define MSG "Hello world!" -- --#define HANDSHAKE(session, name, ret) \ -- { \ -- do { \ -- ret = gnutls_handshake(session); \ -- } while (ret < 0 && gnutls_error_is_fatal(ret) == 0); \ -- if (ret < 0) { \ -- fail("%s: Handshake failed\n", name); \ -- goto end; \ -- } \ -- } -- --#define SEND_MSG(session, name, ret) \ -- { \ -- do { \ -- ret = gnutls_record_send(session, MSG, \ -- strlen(MSG) + 1); \ -- } while (ret == GNUTLS_E_AGAIN || \ -- ret == GNUTLS_E_INTERRUPTED); \ -- if (ret < 0) { \ -- fail("%s: data sending has failed (%s)\n", name, \ -- gnutls_strerror(ret)); \ -- goto end; \ -- } \ -- } -- --#define RECV_MSG(session, name, buffer, buffer_len, ret) \ -- { \ -- memset(buffer, 0, sizeof(buffer)); \ -- do { \ -- ret = gnutls_record_recv(session, buffer, \ -- sizeof(buffer)); \ -- } while (ret == GNUTLS_E_AGAIN || \ -- ret == GNUTLS_E_INTERRUPTED); \ -- if (ret == 0) { \ -- success("%s: Peer has closed the TLS connection\n", \ -- name); \ -- goto end; \ -- } else if (ret < 0) { \ -- fail("%s: Error -> %s\n", name, gnutls_strerror(ret)); \ -- goto end; \ -- } \ -- if (strncmp(buffer, MSG, ret)) { \ -- fail("%s: Message doesn't match\n", name); \ -- goto end; \ -- } \ -- } -- --#define KEY_UPDATE(session, name, peer_req, ret) \ -- { \ -- do { \ -- ret = gnutls_session_key_update(session, peer_req); \ -- } while (ret == GNUTLS_E_AGAIN || \ -- ret == GNUTLS_E_INTERRUPTED); \ -- if (ret < 0) { \ -- fail("%s: key update has failed (%s)\n", name, \ -- gnutls_strerror(ret)); \ -- goto end; \ -- } \ -- } -- --#define CHECK_KTLS_ENABLED(session, ret) \ -- { \ -- ret = gnutls_transport_is_ktls_enabled(session); \ -- if (!(ret & GNUTLS_KTLS_RECV)) { \ -- fail("client: KTLS was not properly initialized\n"); \ -- goto end; \ -- } \ -- } -- --static void server_log_func(int level, const char *str) --{ -- fprintf(stderr, "server|<%d>| %s", level, str); --} -- --static void client_log_func(int level, const char *str) --{ -- fprintf(stderr, "client|<%d>| %s", level, str); --} -- --static void client(int fd, const char *prio, int pipe) --{ -- const char *name = "client"; -- int ret; -- char foo; -- char buffer[MAX_BUF + 1]; -- gnutls_certificate_credentials_t x509_cred; -- gnutls_session_t session; -- -- global_init(); -- -- if (debug) { -- gnutls_global_set_log_function(client_log_func); -- gnutls_global_set_log_level(7); -- } -- -- gnutls_certificate_allocate_credentials(&x509_cred); -- -- gnutls_init(&session, GNUTLS_CLIENT); -- gnutls_handshake_set_timeout(session, 0); -- -- assert(gnutls_priority_set_direct(session, prio, NULL) >= 0); -- -- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); -- -- gnutls_transport_set_int(session, fd); -- -- HANDSHAKE(session, name, ret); -- -- CHECK_KTLS_ENABLED(session, ret) -- // Test 0: Try sending/receiving data -- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) -- SEND_MSG(session, name, ret) -- CHECK_KTLS_ENABLED(session, ret) -- // Test 1: Servers does key update -- read(pipe, &foo, 1); -- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) -- SEND_MSG(session, name, ret) -- CHECK_KTLS_ENABLED(session, ret) -- // Test 2: Does key update witch request -- read(pipe, &foo, 1); -- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) -- SEND_MSG(session, name, ret) -- CHECK_KTLS_ENABLED(session, ret) -- ret = gnutls_bye(session, GNUTLS_SHUT_RDWR); -- if (ret < 0) { -- fail("client: error in closing session: %s\n", -- gnutls_strerror(ret)); -- } -- -- ret = 0; --end: -- -- close(fd); -- -- gnutls_deinit(session); -- -- gnutls_certificate_free_credentials(x509_cred); -- -- gnutls_global_deinit(); -- -- if (ret != 0) -- exit(1); --} -- --pid_t child; --static void terminate(void) --{ -- assert(child); -- kill(child, SIGTERM); -- exit(1); --} -- --static void server(int fd, const char *prio, int pipe) --{ -- const char *name = "server"; -- int ret; -- char bar = 0; -- char buffer[MAX_BUF + 1]; -- gnutls_certificate_credentials_t x509_cred; -- gnutls_session_t session; -- -- global_init(); -- -- if (debug) { -- gnutls_global_set_log_function(server_log_func); -- gnutls_global_set_log_level(7); -- } -- -- gnutls_certificate_allocate_credentials(&x509_cred); -- ret = gnutls_certificate_set_x509_key_mem( -- x509_cred, &server_cert, &server_key, GNUTLS_X509_FMT_PEM); -- if (ret < 0) -- exit(1); -- -- gnutls_init(&session, GNUTLS_SERVER); -- gnutls_handshake_set_timeout(session, 0); -- -- assert(gnutls_priority_set_direct(session, prio, NULL) >= 0); -- -- gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, x509_cred); -- -- gnutls_transport_set_int(session, fd); -- -- HANDSHAKE(session, name, ret) -- CHECK_KTLS_ENABLED(session, ret) -- success("Test 0: sending/receiving data\n"); -- SEND_MSG(session, name, ret) -- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) -- CHECK_KTLS_ENABLED(session, ret) -- success("Test 1: server key update without request\n"); -- KEY_UPDATE(session, name, 0, ret) -- write(pipe, &bar, 1); -- SEND_MSG(session, name, ret) -- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) -- CHECK_KTLS_ENABLED(session, ret) -- success("Test 2: server key update with request\n"); -- KEY_UPDATE(session, name, GNUTLS_KU_PEER, ret) -- write(pipe, &bar, 1); -- SEND_MSG(session, name, ret) -- RECV_MSG(session, name, buffer, MAX_BUF + 1, ret) -- CHECK_KTLS_ENABLED(session, ret) -- ret = gnutls_bye(session, GNUTLS_SHUT_RDWR); -- if (ret < 0) { -- fail("server: error in closing session: %s\n", -- gnutls_strerror(ret)); -- } -- -- ret = 0; --end: -- close(fd); -- gnutls_deinit(session); -- -- gnutls_certificate_free_credentials(x509_cred); -- -- gnutls_global_deinit(); -- -- if (ret) { -- terminate(); -- } -- -- if (debug) -- success("server: finished\n"); --} -- --static void ch_handler(int sig) --{ -- return; --} -- --static void run(const char *prio) --{ -- int ret; -- struct sockaddr_in saddr; -- socklen_t addrlen; -- int listener; -- int fd; -- -- int sync_pipe[2]; //used for synchronization -- pipe(sync_pipe); -- -- success("running ktls test with %s\n", prio); -- -- signal(SIGCHLD, ch_handler); -- signal(SIGPIPE, SIG_IGN); -- -- listener = socket(AF_INET, SOCK_STREAM, 0); -- if (listener == -1) { -- fail("error in listener(): %s\n", strerror(errno)); -- } -- -- memset(&saddr, 0, sizeof(saddr)); -- saddr.sin_family = AF_INET; -- saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); -- saddr.sin_port = 0; -- -- ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); -- if (ret == -1) { -- fail("error in bind(): %s\n", strerror(errno)); -- } -- -- addrlen = sizeof(saddr); -- ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); -- if (ret == -1) { -- fail("error in getsockname(): %s\n", strerror(errno)); -- } -- -- child = fork(); -- if (child < 0) { -- fail("error in fork(): %s\n", strerror(errno)); -- exit(1); -- } -- -- if (child) { -- int status; -- /* parent */ -- ret = listen(listener, 1); -- if (ret == -1) { -- fail("error in listen(): %s\n", strerror(errno)); -- } -- -- fd = accept(listener, NULL, NULL); -- if (fd == -1) { -- fail("error in accept(): %s\n", strerror(errno)); -- } -- -- close(sync_pipe[0]); -- server(fd, prio, sync_pipe[1]); -- -- wait(&status); -- check_wait_status(status); -- } else { -- fd = socket(AF_INET, SOCK_STREAM, 0); -- if (fd == -1) { -- fail("error in socket(): %s\n", strerror(errno)); -- exit(1); -- } -- -- usleep(1000000); -- connect(fd, (struct sockaddr *)&saddr, addrlen); -- -- close(sync_pipe[1]); -- client(fd, prio, sync_pipe[0]); -- exit(0); -- } --} -- --void doit(void) --{ -- run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); -- run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); --} -- --#endif /* _WIN32 */ -diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h -new file mode 100644 -index 0000000000..231618d615 ---- /dev/null -+++ b/tests/ktls_utils.h -@@ -0,0 +1,94 @@ -+#ifndef GNUTLS_TESTS_KTLS_UTILS_H -+#define GNUTLS_TESTS_KTLS_UTILS_H -+ -+#include -+#include -+ -+#include -+ -+#include -+#include -+ -+/* Sets the NONBLOCK flag on the socket(fd) */ -+inline static int set_nonblocking(int fd) -+{ -+ int flags = fcntl(fd, F_GETFL, 0); -+ if (flags == -1) { -+ return 1; -+ } -+ -+ if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) { -+ return 2; -+ } -+ -+ return 0; -+} -+ -+/* Creates a pair of TCP connected sockets */ -+static int create_socket_pair(int *client_fd, int *server_fd) -+{ -+ int ret; -+ struct sockaddr_in saddr; -+ socklen_t addrlen; -+ int listener; -+ -+ listener = socket(AF_INET, SOCK_STREAM, 0); -+ if (listener == -1) { -+ fail("error in listener(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ int opt = 0; -+ setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); -+ -+ memset(&saddr, 0, sizeof(saddr)); -+ saddr.sin_family = AF_INET; -+ saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); -+ saddr.sin_port = 0; -+ -+ ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr)); -+ if (ret == -1) { -+ fail("error in bind(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ addrlen = sizeof(saddr); -+ ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen); -+ if (ret == -1) { -+ fail("error in getsockname(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ ret = listen(listener, 1); -+ if (ret == -1) { -+ fail("error in listen(): %s\n", strerror(errno)); -+ close(listener); -+ return 1; -+ } -+ -+ *client_fd = socket(AF_INET, SOCK_STREAM, 0); -+ if (*client_fd < 0) { -+ fail("error in socket(): %s\n", strerror(errno)); -+ return 1; -+ } -+ -+ ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen); -+ if (ret < 0) { -+ fail("error in connect(): %s\n", strerror(errno)); -+ close(listener); -+ close(*client_fd); -+ return 1; -+ } -+ -+ *server_fd = accept(listener, NULL, NULL); -+ if (*server_fd < 0) { -+ fail("error in accept(): %s\n", strerror(errno)); -+ close(listener); -+ close(*client_fd); -+ return 1; -+ } -+ -+ return 0; -+} -+ -+#endif //GNUTLS_TESTS_KTLS_UTILS_H -diff --git a/tests/tls13/key_update.c b/tests/tls13/key_update.c -index 19bea7b9ac..9c72ee14ab 100644 ---- a/tests/tls13/key_update.c -+++ b/tests/tls13/key_update.c -@@ -47,6 +47,67 @@ static void tls_log_func(int level, const char *str) - #define MSG \ - "Hello TLS, and hi and how are you and more data here... and more... and even more and even more more data..." - -+#ifdef USE_KTLS -+/* For ktls flavour of the test, the test needs to be run with the kTLS enabled -+ * option in the GnuTLS configuration file, in the case of the GnuTLS testing, -+ * the shell script `tests/ktls_keyupdate.sh` does just that. -+ */ -+ -+#include "ktls_utils.h" -+ -+#define RUN(s, n) \ -+ { \ -+ int ret; \ -+ int cfd, sfd; \ -+ if ((ret = create_sockets(&cfd, &sfd))) { \ -+ fail("kTLS: %s\n", errors[ret]); \ -+ exit(1); \ -+ } \ -+ run(s, n, cfd, sfd); \ -+ close(cfd); \ -+ close(sfd); \ -+ } -+ -+/* We could check specificaly but given how the setting of new keys work, let's -+ * check if something had gone sideways on both the receive and sending sockets. -+ */ -+#define CHECK_KTLS_ENABLED(session) \ -+ switch (gnutls_transport_is_ktls_enabled(session)) { \ -+ case GNUTLS_KTLS_RECV: \ -+ fail("kTLS: Only recv support is initiated\n"); \ -+ break; \ -+ case GNUTLS_KTLS_SEND: \ -+ fail("kTLS: Only send support is initiated\n"); \ -+ break; \ -+ case GNUTLS_KTLS_DUPLEX: \ -+ break; \ -+ default: \ -+ fail("kTLS: dissabled\n"); \ -+ } -+ -+/* ktls needs to use real sockets */ -+char *errors[] = { "", "Failed to create the socket pair", -+ "Failed to set the socket non-blocking" }; -+ -+inline static int create_sockets(int *cfd, int *sfd) -+{ -+ int ret = create_socket_pair(cfd, sfd); -+ if (ret) -+ return 1; -+ -+ if (set_nonblocking(*cfd) || set_nonblocking(*sfd)) -+ return 2; -+ -+ return 0; -+} -+ -+#else /* non-kTLS */ -+ -+#define RUN(s, n) run(s, n, -1, -1) -+#define CHECK_KTLS_ENABLED(session) /* No-op */ -+ -+#endif /* non-kTLS */ -+ - static unsigned key_update_msg_inc = 0; - static unsigned key_update_msg_out = 0; - -@@ -68,7 +129,7 @@ static int hsk_callback(gnutls_session_t session, unsigned int htype, - return 0; - } - --static void run(const char *name, unsigned test) -+static void run(const char *name, unsigned test, int cfd, int sfd) - { - /* Server stuff. */ - gnutls_certificate_credentials_t ccred; -@@ -100,9 +161,14 @@ static void run(const char *name, unsigned test) - exit(1); - - gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE, scred); -+#ifdef USE_KTLS -+ /* for kTLS you can't use custom push/pull functions */ -+ gnutls_transport_set_int(server, sfd); -+#else - gnutls_transport_set_push_function(server, server_push); - gnutls_transport_set_pull_function(server, server_pull); - gnutls_transport_set_ptr(server, server); -+#endif - - /* Init client */ - assert(gnutls_certificate_allocate_credentials(&ccred) >= 0); -@@ -118,14 +184,23 @@ static void run(const char *name, unsigned test) - if (ret < 0) - exit(1); - -+#ifdef USE_KTLS -+ /* for kTLS you can't use custom push/pull functions */ -+ gnutls_transport_set_int(client, cfd); -+#else - gnutls_transport_set_push_function(client, client_push); - gnutls_transport_set_pull_function(client, client_pull); - gnutls_transport_set_ptr(client, client); -+#endif - - HANDSHAKE(client, server); - if (debug) - success("Handshake established\n"); - -+ /* check kTLS initialization (both send and recv should be supported)*/ -+ CHECK_KTLS_ENABLED(client); -+ CHECK_KTLS_ENABLED(server); -+ - switch (test) { - case 0: - case 1: -@@ -134,10 +209,14 @@ static void run(const char *name, unsigned test) - ret = gnutls_session_key_update(client, 0); - } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED); - -+ CHECK_KTLS_ENABLED(client); -+ CHECK_KTLS_ENABLED(server); -+ - /* server receives the client key update and sends data */ - TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); - TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); - EMPTY_BUF(server, client, buffer, MAX_BUF); -+ - if (test != 0) - break; - sec_sleep(2); -@@ -151,10 +230,14 @@ static void run(const char *name, unsigned test) - if (ret < 0) - fail("error in key update: %s\n", gnutls_strerror(ret)); - -+ CHECK_KTLS_ENABLED(server); -+ CHECK_KTLS_ENABLED(client); -+ - /* client receives the key update and sends data */ - TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); - TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); - EMPTY_BUF(server, client, buffer, MAX_BUF); -+ - if (test != 0) - break; - sec_sleep(2); -@@ -167,10 +250,14 @@ static void run(const char *name, unsigned test) - if (ret < 0) - fail("error in key update: %s\n", gnutls_strerror(ret)); - -+ CHECK_KTLS_ENABLED(client); -+ CHECK_KTLS_ENABLED(server); -+ - /* server receives the client key update and sends data */ - TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); - TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); - EMPTY_BUF(server, client, buffer, MAX_BUF); -+ - if (test != 0) - break; - sec_sleep(2); -@@ -183,6 +270,9 @@ static void run(const char *name, unsigned test) - if (ret < 0) - fail("error in key update: %s\n", gnutls_strerror(ret)); - -+ CHECK_KTLS_ENABLED(server); -+ CHECK_KTLS_ENABLED(client); -+ - TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); - TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); - EMPTY_BUF(server, client, buffer, MAX_BUF); -@@ -210,6 +300,9 @@ static void run(const char *name, unsigned test) - /* client receives key update */ - EMPTY_BUF(server, client, buffer, MAX_BUF); - -+ CHECK_KTLS_ENABLED(server); -+ CHECK_KTLS_ENABLED(client); -+ - /* client uncorks and sends key update */ - do { - ret = gnutls_record_uncork(client, GNUTLS_RECORD_WAIT); -@@ -217,6 +310,9 @@ static void run(const char *name, unsigned test) - if (ret < 0) - fail("cannot send: %s\n", gnutls_strerror(ret)); - -+ CHECK_KTLS_ENABLED(server); -+ CHECK_KTLS_ENABLED(client); -+ - EMPTY_BUF(server, client, buffer, MAX_BUF); - - sec_sleep(2); -@@ -238,6 +334,9 @@ static void run(const char *name, unsigned test) - if (ret < 0) - fail("error in key update: %s\n", gnutls_strerror(ret)); - -+ CHECK_KTLS_ENABLED(server); -+ CHECK_KTLS_ENABLED(client); -+ - /* server receives the client key update and sends data */ - TRANSFER(client, server, MSG, strlen(MSG), buffer, MAX_BUF); - TRANSFER(server, client, MSG, strlen(MSG), buffer, MAX_BUF); -@@ -263,11 +362,11 @@ static void run(const char *name, unsigned test) - - void doit(void) - { -- run("single", 1); -- run("single", 2); -- run("single", 3); -- run("single", 4); -- run("single", 5); -- run("single", 6); -- run("all", 0); /* all one after each other */ -+ RUN("single", 1); -+ RUN("single", 2); -+ RUN("single", 3); -+ RUN("single", 4); -+ RUN("single", 5); -+ RUN("single", 6); -+ RUN("all", 0); /* all one after each other */ - } --- -GitLab - - -From 247640a84f6aa7dddf6e2380d7189542b5483a4a Mon Sep 17 00:00:00 2001 -From: Frantisek Krenzelok -Date: Tue, 11 Feb 2025 13:35:43 +0100 -Subject: [PATCH 2/7] kTLS: add new keyupdate error return on recv - -kTLS now returns -EKEYEXPIRED when the socket's keys aren't updated after -receiving a keyupdate (this is very unlikely). Currently when this -happens the ktls recv funtion returns GNUTLS_E_AGAIN and the receive -function is called again and again. - -Signed-off-by: Frantisek Krenzelok ---- - lib/system/ktls.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 432c70c5a2..cb29c5a763 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -59,6 +59,7 @@ gnutls_transport_is_ktls_enabled(gnutls_session_t session) - { - if (unlikely(!session->internals.initial_negotiation_completed)) { - _gnutls_debug_log("Initial negotiation is not yet complete\n"); -+ gnutls_assert(); - return 0; - } - -@@ -82,7 +83,9 @@ void _gnutls_ktls_enable(gnutls_session_t session) - } - } else { - _gnutls_record_log( -- "Unable to set TCP_ULP for read socket: %d\n", errno); -+ "kTLS: Unable to set TCP_ULP for read socket: %d\n", -+ errno); -+ gnutls_assert(); - } - - if (sockin != sockout) { -@@ -91,8 +94,9 @@ void _gnutls_ktls_enable(gnutls_session_t session) - session->internals.ktls_enabled |= GNUTLS_KTLS_SEND; - } else { - _gnutls_record_log( -- "Unable to set TCP_ULP for write socket: %d\n", -+ "kTLS: Unable to set TCP_ULP for write socket: %d\n", - errno); -+ gnutls_assert(); - } - } - #endif -@@ -1064,6 +1068,13 @@ int _gnutls_ktls_recv_control_msg(gnutls_session_t session, - default: - return GNUTLS_E_PULL_ERROR; - } -+ } else if (unlikely(ret == -EKEYEXPIRED)) { -+ /* This will be received until a keyupdate is performed on the -+ scoket. */ -+ _gnutls_debug_log("kTLS: socket(recv) has not yet received " -+ "updated keys\n"); -+ gnutls_assert(); -+ return GNUTLS_E_AGAIN; - } - - /* connection closed */ --- -GitLab - - -From 1cf5e7d5748e0a2312b55e9c4bcf252a34765919 Mon Sep 17 00:00:00 2001 -From: Krenzelok Frantisek -Date: Mon, 17 Feb 2025 23:08:57 +0100 -Subject: [PATCH 4/7] kTLS: add rekey kernel version check (Linux) - -Signed-off-by: Krenzelok Frantisek ---- - lib/system/ktls.c | 8 ++++++++ - tests/ktls.sh | 17 ++++++++--------- - tests/ktls_keyupdate.sh | 18 ++++++++++++++---- - tests/scripts/common.sh | 26 ++++++++++++++++++++++++++ - 4 files changed, 56 insertions(+), 13 deletions(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index cb29c5a763..66ab24ec7a 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -507,6 +507,14 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, - return GNUTLS_E_UNIMPLEMENTED_FEATURE; - } - -+ if (major < 6 || (major == 6 && minor < 14)) { -+ _gnutls_debug_log("Linux kernel version %lu.%lu doesn't yet " -+ "support kTLS keyupdate, this will result in " -+ "invalidation of the current session after a " -+ "key-update is performed\n", -+ major, minor); -+ } -+ - /* check whether or not cipher suite supports ktls - */ - switch (cipher) { -diff --git a/tests/ktls.sh b/tests/ktls.sh -index a15d6116d9..ca9ead8df0 100644 ---- a/tests/ktls.sh -+++ b/tests/ktls.sh -@@ -25,19 +25,18 @@ - - case "$host_os" in - FreeBSD) -- if ! sysctl -n kern.ipc.tls.enable | grep 1 > /dev/null; then -- exit 77 -+ if ! sysctl -n kern.ipc.tls.enable | grep 1 > /dev/null; then -+ exit 77 - fi -+ -+ kernel_version_check 13 0 || exit 77 - ;; - Linux) -- if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then -- exit 77 -+ if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then -+ exit 77 - fi -- case "$(uname -r)" in -- 4.* | 5.[0-9].* | 5.10.*) -- exit 77 -- ;; -- esac -+ -+ kernel_version_check 5 10 || exit 77 - ;; - esac - -diff --git a/tests/ktls_keyupdate.sh b/tests/ktls_keyupdate.sh -index ae12a2f102..54706d8d94 100755 ---- a/tests/ktls_keyupdate.sh -+++ b/tests/ktls_keyupdate.sh -@@ -19,13 +19,23 @@ - # You should have received a copy of the GNU General Public License - # along with GnuTLS. If not, see . - --: ${builddir=.} -+: ${builddir=.} ${host_os=`uname`} - - . "$srcdir/scripts/common.sh" - --if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then -- exit 77 --fi -+case "$host_os" in -+ FreeBSD) -+ # key update is not yet supported on FreeBSD -+ exit 77 -+ ;; -+ Linux) -+ if ! grep '^tls ' /proc/modules 2>&1 /dev/null; then -+ exit 77 -+ fi -+ -+ kernel_version_check 6 14 || exit 77 -+ ;; -+esac - - testdir=`create_testdir ktls_keyupdate` - -diff --git a/tests/scripts/common.sh b/tests/scripts/common.sh -index 47355cf025..c5f91b62c4 100644 ---- a/tests/scripts/common.sh -+++ b/tests/scripts/common.sh -@@ -267,3 +267,29 @@ check_if_equal() { - diff -b -B "$1" "$2" - return $? - } -+ -+# works for FreeBSD and Linux -+# $1: the major version to check against -+# $2: the minor version to check against -+kernel_version_check() { -+ local required_major=$1 -+ local required_minor=$2 -+ -+ kernel_version=$(uname -r | sed -E 's/^([0-9]+\.[0-9]+).*/\1/' 2>/dev/null) -+ kernel_major=$(echo $kernel_version | cut -d. -f1 2>/dev/null) -+ kernel_minor=$(echo $kernel_version | cut -d. -f2 2>/dev/null) -+ -+ if ! [[ "$kernel_major" =~ ^[0-9]+$ ]] || ! [[ "$kernel_minor" =~ ^[0-9]+$ ]]; then -+ return 1 -+ fi -+ -+ if [ "$kernel_major" -lt "$required_major" ]; then -+ return 1 -+ fi -+ -+ if [ "$kernel_major" -eq "$required_major" ] && [ "$kernel_minor" -lt "$required_minor" ]; then -+ return 1 -+ fi -+ -+ return 0 -+} --- -GitLab - - -From 82fac5267fd74196c29e8a8b3e47e17d6ec4c20b Mon Sep 17 00:00:00 2001 -From: Krenzelok Frantisek -Date: Tue, 11 Mar 2025 11:37:33 +0100 -Subject: [PATCH 5/7] kTLS: improve alert messages - -Signed-off-by: Krenzelok Frantisek ---- - lib/system/ktls.c | 38 +++++++++++++++++++++++++++++++++++++- - 1 file changed, 37 insertions(+), 1 deletion(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 66ab24ec7a..2983888d37 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -1122,8 +1122,44 @@ int _gnutls_ktls_recv_int(gnutls_session_t session, content_type_t type, - GNUTLS_E_UNIMPLEMENTED_FEATURE); - break; - case GNUTLS_ALERT: -+ if (ret < 2) { -+ return gnutls_assert_val( -+ GNUTLS_E_UNEXPECTED_PACKET); -+ } -+ -+ uint8_t level = ((uint8_t *)data)[0]; -+ uint8_t desc = ((uint8_t *)data)[1]; -+ -+ _gnutls_record_log( -+ "REC[%p]: Alert[%d|%d] - %s - was received\n", -+ session, level, desc, -+ gnutls_alert_get_name((int)desc)); -+ -+ session->internals.last_alert = desc; -+ -+ /* if close notify is received and -+ * the alert is not fatal -+ */ -+ if (desc == GNUTLS_A_CLOSE_NOTIFY && -+ level != GNUTLS_AL_FATAL) { -+ /* If we have been expecting for an alert do -+ */ -+ session->internals.read_eof = 1; -+ return 0; -+ } -+ /* if the alert is FATAL or WARNING -+ * return the appropriate message -+ */ -+ gnutls_assert(); -+ if (level == GNUTLS_AL_FATAL) { -+ session->internals.resumable = false; -+ session->internals.invalid_connection = 1; -+ return gnutls_assert_val( -+ GNUTLS_E_FATAL_ALERT_RECEIVED); -+ } -+ -+ ret = GNUTLS_E_WARNING_ALERT_RECEIVED; - session_invalidate(session); -- ret = 0; - break; - case GNUTLS_HANDSHAKE: - ret = gnutls_handshake_write( --- -GitLab - - -From 93d1fe12e52a382bd024b0db51482f0c7272bb2a Mon Sep 17 00:00:00 2001 -From: Krenzelok Frantisek -Date: Tue, 11 Mar 2025 11:38:47 +0100 -Subject: [PATCH 6/7] kTLS: fix gnutls-cli-debug - test - -Signed-off-by: Krenzelok Frantisek ---- - src/cli-debug.c | 6 ++++++ - src/tests.c | 4 +++- - tests/gnutls-cli-debug.sh | 11 ++++++----- - 3 files changed, 15 insertions(+), 6 deletions(-) - -diff --git a/src/cli-debug.c b/src/cli-debug.c -index ad8e525e30..b140cd3bc4 100644 ---- a/src/cli-debug.c -+++ b/src/cli-debug.c -@@ -67,6 +67,11 @@ static void tls_log_func(int level, const char *str) - fprintf(stderr, "|<%d>| %s", level, str); - } - -+static void tls_audit_log_func(gnutls_session_t session, const char *str) -+{ -+ fprintf(stderr, "|<%p>| %s", session, str); -+} -+ - typedef test_code_t (*TEST_FUNC)(gnutls_session_t); - - typedef struct { -@@ -277,6 +282,7 @@ int main(int argc, char **argv) - } - - gnutls_global_set_log_function(tls_log_func); -+ gnutls_global_set_audit_log_function(tls_audit_log_func); - gnutls_global_set_log_level(debug); - - /* get server name */ -diff --git a/src/tests.c b/src/tests.c -index 6544d1e2e0..2c06c8d669 100644 ---- a/src/tests.c -+++ b/src/tests.c -@@ -1770,7 +1770,9 @@ static test_code_t test_do_handshake_and_send_record(gnutls_session_t session) - return ret; - - gnutls_record_send(session, snd_buf, sizeof(snd_buf) - 1); -- ret = gnutls_record_recv(session, buf, sizeof(buf) - 1); -+ do { -+ ret = gnutls_record_recv(session, buf, sizeof(buf) - 1); -+ } while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN); - if (ret < 0) - return TEST_FAILED; - -diff --git a/tests/gnutls-cli-debug.sh b/tests/gnutls-cli-debug.sh -index c09e676c6a..82f4d4d111 100755 ---- a/tests/gnutls-cli-debug.sh -+++ b/tests/gnutls-cli-debug.sh -@@ -26,6 +26,7 @@ - : ${TIMEOUT=timeout} - OUTFILE=cli-debug.$$.tmp - TMPFILE=config.$$.tmp -+LOGFILE="$(basename "$0" .sh).log" - unset RETCODE - - if ! test -x "${SERV}"; then -@@ -71,7 +72,7 @@ PID=$! - wait_server ${PID} - - "$TIMEOUT" 1800 \ --"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" -+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" - - kill ${PID} - wait -@@ -118,7 +119,7 @@ PID=$! - wait_server ${PID} - - "$TIMEOUT" 1800 \ --"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" -+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" - - kill ${PID} - wait -@@ -160,7 +161,7 @@ PID=$! - wait_server ${PID} - - "$TIMEOUT" 1800 \ --"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" -+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" - - kill ${PID} - wait -@@ -186,7 +187,7 @@ _EOF_ - - GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" \ - "$TIMEOUT" 1800 \ --"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" -+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" - - kill ${PID} - wait -@@ -209,7 +210,7 @@ if test "${ENABLE_GOST}" = "1" && test "${GNUTLS_FORCE_FIPS_MODE}" != 1 ; then - wait_server ${PID} - - "$TIMEOUT" 1800 \ -- "${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!" -+ "${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>$LOGFILE || fail ${PID} "gnutls-cli-debug run should have succeeded!" - - kill ${PID} - wait --- -GitLab - - -From eaa6912f6ee6bd8ff5f1175bbd7ccedd0526695e Mon Sep 17 00:00:00 2001 -From: Krenzelok Frantisek -Date: Mon, 17 Mar 2025 12:41:24 +0100 -Subject: [PATCH 7/7] tests: add enviromental variable - -Signed-off-by: Krenzelok Frantisek ---- - tests/Makefile.am | 2 +- - tests/ktls.sh | 4 ++-- - tests/ktls_keyupdate.sh | 4 ++-- - 3 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/tests/Makefile.am b/tests/Makefile.am -index 9990ee21cc..b39a97bac3 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -21,7 +21,7 @@ - - SUBDIRS = . cert-tests slow - --TESTS_ENVIRONMENT = -+TESTS_ENVIRONMENT = HOST_OS=$$(uname) - - if WINDOWS - SUBDIRS += windows -diff --git a/tests/ktls.sh b/tests/ktls.sh -index ca9ead8df0..c2847be833 100644 ---- a/tests/ktls.sh -+++ b/tests/ktls.sh -@@ -19,11 +19,11 @@ - # You should have received a copy of the GNU General Public License - # along with GnuTLS. If not, see . - --: ${builddir=.} ${host_os=`uname`} -+: ${builddir=.} - - . "$srcdir/scripts/common.sh" - --case "$host_os" in -+case "$HOST_OS" in - FreeBSD) - if ! sysctl -n kern.ipc.tls.enable | grep 1 > /dev/null; then - exit 77 -diff --git a/tests/ktls_keyupdate.sh b/tests/ktls_keyupdate.sh -index 54706d8d94..54526727e3 100755 ---- a/tests/ktls_keyupdate.sh -+++ b/tests/ktls_keyupdate.sh -@@ -19,11 +19,11 @@ - # You should have received a copy of the GNU General Public License - # along with GnuTLS. If not, see . - --: ${builddir=.} ${host_os=`uname`} -+: ${builddir=.} - - . "$srcdir/scripts/common.sh" - --case "$host_os" in -+case "$HOST_OS" in - FreeBSD) - # key update is not yet supported on FreeBSD - exit 77 --- -GitLab - diff --git a/gnutls.spec b/gnutls.spec index c705e2d..dddb863 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,94 +1,34 @@ -%define srpmhash() %{lua: -local files = rpm.expand("%_specdir/gnutls.spec") -for i, p in ipairs(patches) do - files = files.." "..p -end -for i, p in ipairs(sources) do - files = files.." "..p -end -local sha256sum = assert(io.popen("cat "..files.."| sha256sum")) -local hash = sha256sum:read("*a") -sha256sum:close() -print(string.sub(hash, 0, 16)) -} - -Version: 3.8.11 -Release: %{?autorelease}%{!?autorelease:1%{?dist}} -Patch: gnutls-3.2.7-rpath.patch - -# follow https://gitlab.com/gnutls/gnutls/-/issues/1443 -Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch - -%bcond_without bootstrap +# This spec file has been automatically updated +Version: 3.6.15 +Release: 1%{?dist} +Patch1: gnutls-3.6.7-no-now-guile.patch +Patch2: gnutls-3.2.7-rpath.patch +Patch3: gnutls-3.6.15-gnulib-perror-tests.patch %bcond_without dane +%if 0%{?rhel} +%bcond_with guile %bcond_without fips -%bcond_with tpm12 -%bcond_without tpm2 -%if 0%{?rhel} >= 9 -%bcond_with gost %else -%bcond_without gost +%bcond_without guile +%bcond_without fips %endif -%bcond_without certificate_compression -%bcond_without leancrypto -%bcond_without crypto_auditing -%bcond_without tests - -%if 0%{?fedora} && 0%{?fedora} < 38 -%bcond_without srp -%else -%bcond_with srp -%endif - -%if 0%{?fedora} -%bcond_without mingw -%else -%bcond_with mingw -%endif - -%if 0%{?rhel} >= 9 && %{with fips} -%bcond_without bundled_gmp -%else -%bcond_with bundled_gmp -%endif - - -%define fips_requires() %{lua: -local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'"))) -local v = f:read("*all") -f:close() -print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n") -} Summary: A TLS protocol implementation Name: gnutls # The libraries are LGPLv2.1+, utilities are GPLv3+ -License: GPL-3.0-or-later AND LGPL-2.1-or-later +License: GPLv3+ and LGPLv2+ BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel -BuildRequires: readline-devel, libtasn1-devel >= 4.3 -%if %{with certificate_compression} -BuildRequires: zlib-devel, brotli-devel, libzstd-devel -%endif -%if %{with bootstrap} -BuildRequires: automake, autoconf, gperf, libtool, texinfo -%endif -BuildRequires: nettle-devel >= 3.10.1 -%if %{with leancrypto} -BuildRequires: meson -%endif -%if %{with tpm12} +BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 +BuildRequires: libtool, automake, autoconf, texinfo +BuildRequires: autogen-libopts-devel >= 5.18 autogen +BuildRequires: nettle-devel >= 3.5.1 BuildRequires: trousers-devel >= 0.3.11.2 -%endif -%if %{with tpm2} -BuildRequires: tpm2-tss-devel >= 3.0.3 -%endif BuildRequires: libidn2-devel BuildRequires: libunistring-devel -BuildRequires: net-tools, softhsm, gcc, gcc-c++ +BuildRequires: gperf, net-tools, datefudge, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 -BuildRequires: git-core -%if %{with crypto_auditing} -BuildRequires: systemtap-sdt-devel +%if %{with fips} +BuildRequires: fipscheck %endif # for a sanity check on cert loading @@ -96,54 +36,19 @@ BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 -# always bump when a nettle release is packaged -Requires: nettle >= 3.10.1 -%if %{with tpm12} +Requires: nettle >= 3.4.1 Recommends: trousers >= 0.3.11.2 -%endif %if %{with dane} BuildRequires: unbound-devel unbound-libs %endif -BuildRequires: make gtk-doc - -%if %{with mingw} -BuildRequires: mingw32-cpp -BuildRequires: mingw32-filesystem >= 95 -BuildRequires: mingw32-gcc -BuildRequires: mingw32-gcc-c++ -BuildRequires: mingw32-libtasn1 >= 4.3 -BuildRequires: mingw32-readline -BuildRequires: mingw32-zlib -BuildRequires: mingw32-nettle >= 3.6 -BuildRequires: mingw64-cpp -BuildRequires: mingw64-filesystem >= 95 -BuildRequires: mingw64-gcc -BuildRequires: mingw64-gcc-c++ -BuildRequires: mingw64-libtasn1 >= 4.3 -BuildRequires: mingw64-readline -BuildRequires: mingw64-zlib -BuildRequires: mingw64-nettle >= 3.6 +%if %{with guile} +BuildRequires: guile22-devel %endif - URL: http://www.gnutls.org/ -%define short_version %(echo %{version} | grep -m1 -o "[0-9]*\.[0-9]*" | head -1) -Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz -Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig -Source2: https://gnutls.org/gnutls-release-keyring.gpg - -%if %{with bundled_gmp} -Provides: bundled(gmp) = 6.2.1 -Source100: gmp-6.2.1.tar.xz -# Taken from the main gmp package -Source101: gmp-6.2.1-intel-cet.patch -Source102: gmp-6.2.1-c23.patch -%endif - -%if %{with leancrypto} -Provides: bundled(leancrypto) = 1.6.0 -Source300: leancrypto-1.6.0.tar.gz -%endif +Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz +Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig +Source2: gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -162,7 +67,7 @@ Requires: %{name}-dane%{?_isa} = %{version}-%{release} Requires: pkgconfig %package utils -License: GPL-3.0-or-later +License: GPLv3+ Summary: Command line tools for TLS protocol Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with dane} @@ -175,14 +80,11 @@ Summary: A DANE protocol implementation for GnuTLS Requires: %{name}%{?_isa} = %{version}-%{release} %endif -%if %{with fips} -%package fips -Summary: Virtual package to install packages required to use %{name} under FIPS mode +%if %{with guile} +%package guile +Summary: Guile bindings for the GNUTLS library Requires: %{name}%{?_isa} = %{version}-%{release} -%{fips_requires nettle} -%if !%{with bundled_gmp} -%{fips_requires gmp} -%endif +Requires: guile22 %endif %description @@ -228,150 +130,44 @@ This package contains library that implements the DANE protocol for verifying TLS certificates through DNSSEC. %endif -%if %{with fips} -%description fips +%if %{with guile} +%description guile GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and -other required structures. -This package does not contain any file, but installs required packages -to use GnuTLS under FIPS mode. -%endif - -%if %{with mingw} -%package -n mingw32-%{name} -Summary: MinGW GnuTLS TLS/SSL encryption library -Requires: pkgconfig -Requires: mingw32-libtasn1 >= 4.3 -BuildArch: noarch - -%description -n mingw32-gnutls -GnuTLS TLS/SSL encryption library. This library is cross-compiled -for MinGW. - -%package -n mingw64-%{name} -Summary: MinGW GnuTLS TLS/SSL encryption library -Requires: pkgconfig -Requires: mingw64-libtasn1 >= 4.3 -BuildArch: noarch - -%description -n mingw64-gnutls -GnuTLS TLS/SSL encryption library. This library is cross-compiled -for MinGW. - -%{?mingw_debug_package} +other required structures. +This package contains Guile bindings for the library. %endif %prep -%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' +gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} -%autosetup -p1 -S git - -%if %{with bundled_gmp} -mkdir -p bundled_gmp -pushd bundled_gmp -tar --strip-components=1 -xf %{SOURCE100} -patch -p1 < %{SOURCE101} -patch -p1 < %{SOURCE102} -popd -%endif - -%build -%define _lto_cflags %{nil} - -%if %{with leancrypto} -mkdir -p bundled_leancrypto -pushd bundled_leancrypto -tar --strip-components=1 -xf %{SOURCE300} -popd -%endif - -%if %{with bundled_gmp} -pushd bundled_gmp -autoreconf -ifv -%configure --disable-cxx --disable-shared --enable-fat --with-pic -%make_build -popd - -export GMP_CFLAGS="-I$PWD/bundled_gmp" -export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a" -%endif - -%if %{with leancrypto} -pushd bundled_leancrypto -%set_build_flags -meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ - -Ddefault_library=static \ - -Dascon=disabled -Dascon_keccak=disabled \ - -Dbike_5=disabled -Dbike_3=disabled -Dbike_1=disabled \ - -Dkyber_x25519=disabled -Ddilithium_ed25519=disabled \ - -Dx509_parser=disabled -Dx509_generator=disabled \ - -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ - -Dsha2-256=disabled \ - -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ - -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ - -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ - -Dhash_crypt=disabled \ - -Dhmac=disabled -Dhkdf=disabled \ - -Dkdf_ctr=disabled -Dkdf_fb=disabled -Dkdf_dpi=disabled \ - -Dpbkdf2=disabled \ - -Dkmac_drng=disabled -Dcshake_drng=disabled \ - -Dhotp=disabled -Dtotp=disabled \ - -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \ - -Daes_kw=disabled -Dapps=disabled \ - -Ddisable-asm=true \ - _build -# the reason for -Ddisable-asm=true being bz2416812 -# revert once the root cause is fixed -meson compile -C _build -meson install -C _build - -popd - -export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install" - -export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include" -export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a" -%endif - -%if %{with bootstrap} -autoreconf -fi -%endif +%autosetup -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h +rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h echo "SYSTEM=NORMAL" >> tests/system.prio +# Note that we explicitly enable SHA1, as SHA1 deprecation is handled +# via the crypto policies + +%build CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes" export CCASFLAGS -%if %{with fips} -eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release) -export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name" -%endif +# These should be checked by m4/guile.m4 instead of configure.ac +# taking into account of _guile_suffix +guile_snarf=%{_bindir}/guile-snarf2.2 +export guile_snarf +GUILD=%{_bindir}/guild2.2 +export GUILD -mkdir native_build -pushd native_build - -%global _configure ../configure -%configure \ +%configure --with-libtasn1-prefix=%{_prefix} \ %if %{with fips} --enable-fips140-mode \ - --with-fips140-module-name="$FIPS_MODULE_NAME" \ - --with-fips140-module-version=%{version}-%{srpmhash} \ -%endif -%if %{with gost} - --enable-gost \ -%else - --disable-gost \ -%endif -%if %{with srp} - --enable-srp-authentication \ -%endif -%ifarch %{ix86} - --disable-year2038 \ %endif --enable-sha1-support \ --disable-static \ @@ -379,154 +175,71 @@ pushd native_build --disable-non-suiteb-curves \ --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \ --with-default-trust-store-pkcs11="pkcs11:" \ -%if %{with tpm12} --with-trousers-lib=%{_libdir}/libtspi.so.1 \ -%else - --without-tpm \ -%endif -%if %{with tpm2} - --with-tpm2 \ -%else - --without-tpm2 \ -%endif - --enable-ktls \ --htmldir=%{_docdir}/manual \ +%if %{with guile} + --enable-guile \ + --with-guile-extension-dir=%{_libdir}/guile/2.2 \ +%else + --disable-guile \ +%endif %if %{with dane} --with-unbound-root-key-file=/var/lib/unbound/root.key \ - --enable-libdane \ + --enable-dane \ %else - --disable-libdane \ -%endif -%if %{with certificate_compression} - --with-zlib --with-brotli --with-zstd \ -%else - --without-zlib --without-brotli --without-zstd \ -%endif -%if %{with leancrypto} - --with-leancrypto \ -%else - --without-leancrypto \ -%endif -%if %{with crypto_auditing} - --enable-crypto-auditing \ -%else - --disable-crypto-auditing \ + --disable-dane \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" -%make_build -%if %{with leancrypto} -sed -i '/^Requires.private:/s/leancrypto[ ,]*//g' lib/gnutls.pc -%endif -popd - -%if %{with mingw} -# MinGW does not support CCASFLAGS -export CCASFLAGS="" -%mingw_configure \ -%if %{with srp} - --enable-srp-authentication \ -%endif - --enable-sha1-support \ - --disable-static \ - --disable-openssl-compatibility \ - --disable-non-suiteb-curves \ - --disable-libdane \ - --disable-rpath \ - --disable-nls \ - --disable-cxx \ - --enable-shared \ - --without-tpm \ - --with-included-unistring \ - --disable-doc \ - --with-default-priority-string="@SYSTEM" \ - --without-p11-kit -%mingw_make %{?_smp_mflags} -%endif - -%install -%make_install -C native_build -pushd native_build -make -C doc install-html DESTDIR=$RPM_BUILD_ROOT -rm -f $RPM_BUILD_ROOT%{_infodir}/dir -rm -f $RPM_BUILD_ROOT%{_libdir}/*.la -%if %{without dane} -rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc -%endif - -%if %{with fips} -# doing it twice should be a no-op the second time, -# and this way we avoid redefining it and missing a future change -%global __debug_package 1 -%{__spec_install_post} -fname=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.*` -./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac" -sed -i "s^$RPM_BUILD_ROOT/usr^^" "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac" -ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac" -%endif +make %{?_smp_mflags} V=1 %if %{with fips} %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ + fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \ + file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \ %{nil} %endif -%find_lang gnutls -popd - -%if %{with mingw} -%mingw_make_install - -# Remove .la files -rm -f $RPM_BUILD_ROOT%{mingw32_libdir}/*.la -rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/*.la - -# The .def files aren't interesting for other binaries -rm -f $RPM_BUILD_ROOT%{mingw32_bindir}/*.def -rm -f $RPM_BUILD_ROOT%{mingw64_bindir}/*.def - -# Remove info and man pages which duplicate stuff in Fedora already. -rm -rf $RPM_BUILD_ROOT%{mingw32_infodir} -rm -rf $RPM_BUILD_ROOT%{mingw32_mandir} -rm -rf $RPM_BUILD_ROOT%{mingw32_docdir}/gnutls - -rm -rf $RPM_BUILD_ROOT%{mingw64_infodir} -rm -rf $RPM_BUILD_ROOT%{mingw64_mandir} -rm -rf $RPM_BUILD_ROOT%{mingw64_docdir}/gnutls - -# Remove test libraries -rm -f $RPM_BUILD_ROOT%{mingw32_libdir}/crypt32.dll* -rm -f $RPM_BUILD_ROOT%{mingw32_libdir}/ncrypt.dll* -rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/crypt32.dll* -rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll* - -%mingw_debug_install_post +%install +make install DESTDIR=$RPM_BUILD_ROOT +make -C doc install-html DESTDIR=$RPM_BUILD_ROOT +rm -f $RPM_BUILD_ROOT%{_infodir}/dir +rm -f $RPM_BUILD_ROOT%{_libdir}/*.la +rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a +rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la +rm -f $RPM_BUILD_ROOT%{_libdir}/gnutls/libpkcs11mock1.* +%if %{without dane} +rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %endif +%find_lang gnutls + %check -%if %{with tests} -pushd native_build -make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null || { cat tests/test-suite.log tests/cert-tests/test-suite.log tests/slow/test-suite.log src/gl/tests/test-suite.log; exit 1; } -popd -%endif +make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null -%files -f native_build/gnutls.lang +%files -f gnutls.lang +%defattr(-,root,root,-) %{_libdir}/libgnutls.so.30* %if %{with fips} %{_libdir}/.libgnutls.so.30*.hmac %endif %doc README.md AUTHORS NEWS THANKS -%license COPYING COPYING.LESSERv2 +%license LICENSE doc/COPYING doc/COPYING.LESSER %files c++ %{_libdir}/libgnutlsxx.so.* %files devel +%defattr(-,root,root,-) %{_includedir}/* %{_libdir}/libgnutls*.so +%if %{with fips} +%{_libdir}/.libgnutls.so.*.hmac +%endif %{_libdir}/pkgconfig/*.pc %{_mandir}/man3/* @@ -535,16 +248,13 @@ popd %{_docdir}/manual/* %files utils +%defattr(-,root,root,-) %{_bindir}/certtool -%if %{with tpm12} %{_bindir}/tpmtool -%endif %{_bindir}/ocsptool %{_bindir}/psktool %{_bindir}/p11tool -%if %{with srp} %{_bindir}/srptool -%endif %if %{with dane} %{_bindir}/danetool %endif @@ -554,50 +264,765 @@ popd %if %{with dane} %files dane +%defattr(-,root,root,-) %{_libdir}/libgnutls-dane.so.* %endif -%if %{with fips} -%files fips -%endif - -%if %{with mingw} -%files -n mingw32-%{name} -%license COPYING COPYING.LESSERv2 -%{mingw32_bindir}/certtool.exe -%{mingw32_bindir}/gnutls-cli-debug.exe -%{mingw32_bindir}/gnutls-cli.exe -%{mingw32_bindir}/gnutls-serv.exe -%{mingw32_bindir}/libgnutls-30.dll -%{mingw32_bindir}/ocsptool.exe -#%%{mingw32_bindir}/p11tool.exe -%{mingw32_bindir}/psktool.exe -%if %{with srp} -%{mingw32_bindir}/srptool.exe -%endif -%{mingw32_libdir}/libgnutls.dll.a -%{mingw32_libdir}/libgnutls-30.def -%{mingw32_libdir}/pkgconfig/gnutls.pc -%{mingw32_includedir}/gnutls/ - -%files -n mingw64-%{name} -%license COPYING COPYING.LESSERv2 -%{mingw64_bindir}/certtool.exe -%{mingw64_bindir}/gnutls-cli-debug.exe -%{mingw64_bindir}/gnutls-cli.exe -%{mingw64_bindir}/gnutls-serv.exe -%{mingw64_bindir}/libgnutls-30.dll -%{mingw64_bindir}/ocsptool.exe -#%%{mingw64_bindir}/p11tool.exe -%{mingw64_bindir}/psktool.exe -%if %{with srp} -%{mingw64_bindir}/srptool.exe -%endif -%{mingw64_libdir}/libgnutls.dll.a -%{mingw64_libdir}/libgnutls-30.def -%{mingw64_libdir}/pkgconfig/gnutls.pc -%{mingw64_includedir}/gnutls/ +%if %{with guile} +%files guile +%defattr(-,root,root,-) +%{_libdir}/guile/2.2/guile-gnutls*.so* +%{_libdir}/guile/2.2/site-ccache/gnutls.go +%{_libdir}/guile/2.2/site-ccache/gnutls/extra.go +%{_datadir}/guile/site/2.2/gnutls.scm +%{_datadir}/guile/site/2.2/gnutls/extra.scm %endif %changelog -%autochangelog +* Fri Sep 4 2020 Daiki Ueno - 3.6.15-1 +- Update to upstream 3.6.15 release + +* Tue Jun 09 2020 Anderson Sasaki - 3.6.14-2 +- Fix memory leak when serializing iovec_t (#1845083) +- Fix automatic libraries sonames detection (#1845806) + +* Thu Jun 4 2020 Daiki Ueno - 3.6.14-1 +- Update to upstream 3.6.14 release + +* Sun May 31 2020 Daiki Ueno - 3.6.13-6 +- Update gnutls-3.6.13-superseding-chain.patch + +* Sun May 31 2020 Daiki Ueno - 3.6.13-5 +- Fix cert chain validation behavior if the last cert has expired (#1842178) + +* Mon May 25 2020 Anderson Sasaki - 3.6.13-4 +- Add option to gnutls-cli to wait for resumption under TLS 1.3 + +* Tue May 19 2020 Anderson Sasaki - 3.6.13-3 +- Disable RSA blinding during FIPS self-tests + +* Wed May 13 2020 Anderson Sasaki - 3.6.13-2 +- Bump linked libraries soname to fix FIPS selftests (#1835265) + +* Tue Mar 31 2020 Daiki Ueno - 3.6.13-1 +- Update to upstream 3.6.13 release + +* Thu Mar 26 2020 Anderson Sasaki - 3.6.12-2 +- Fix FIPS POST (#1813384) +- Fix gnutls-serv --echo to not exit when a message is received (#1816583) + +* Sun Feb 02 2020 Nikos Mavrogiannopoulos - 3.6.12-1 +- Update to upstream 3.6.12 release + +* Tue Jan 28 2020 Fedora Release Engineering - 3.6.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Dec 02 2019 Nikos Mavrogiannopoulos - 3.6.11-1 +- Update to upstream 3.6.11 release + +* Sun Sep 29 2019 Nikos Mavrogiannopoulos - 3.6.10-1 +- Update to upstream 3.6.10 release + +* Fri Jul 26 2019 Nikos Mavrogiannopoulos - 3.6.9-1 +- Update to upstream 3.6.9 release + +* Thu Jul 25 2019 Fedora Release Engineering - 3.6.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Jul 15 2019 Nikos Mavrogiannopoulos - 3.6.8-2 +- Rebuilt with guile-2.2 + +* Tue May 28 2019 Nikos Mavrogiannopoulos - 3.6.8-1 +- Update to upstream 3.6.8 release + +* Wed Mar 27 2019 Anderson Toshiyuki Sasaki - 3.6.7-1 +- Update to upstream 3.6.7 release +- Fixed CVE-2019-3836 (#1693214) +- Fixed CVE-2019-3829 (#1693210) + +* Fri Feb 1 2019 Nikos Mavrogiannopoulos - 3.6.6-1 +- Update to upstream 3.6.6 release + +* Thu Jan 31 2019 Fedora Release Engineering - 3.6.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jan 11 2019 Anderson Toshiyuki Sasaki - 3.6.5-2 +- Added explicit Requires for nettle >= 3.4.1 + +* Tue Dec 11 2018 Anderson Toshiyuki Sasaki - 3.6.5-1 +- Update to upstream 3.6.5 release + +* Mon Oct 29 2018 James Antill - 3.6.4-5 +- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc. + +* Wed Oct 17 2018 Nikos Mavrogiannopoulos - 3.6.4-4 +- Fix issue with rehandshake affecting glib-networking (#1634736) + +* Tue Oct 16 2018 Tomáš Mráz - 3.6.4-3 +- Add missing annobin notes for assembler sources + +* Tue Oct 09 2018 Petr Menšík - 3.6.4-2 +- Rebuilt for unbound 1.8 + +* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 +- Updated to upstream 3.6.4 release +- Added support for the latest version of the TLS1.3 protocol +- Enabled SHA1 support as SHA1 deprecation is handled via the + fedora crypto policies. + +* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 +- Fixed gnutls-cli input reading +- Ensure that we do not cause issues with version rollback detection + and TLS1.3. + +* Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 +- Fixed ECDSA public key import (#1612803) + +* Thu Jul 26 2018 Nikos Mavrogiannopoulos - 3.6.3-2 +- Backported regression fixes from 3.6.2 + +* Mon Jul 16 2018 Nikos Mavrogiannopoulos - 3.6.3-1 +- Update to upstream 3.6.3 release + +* Fri Jul 13 2018 Fedora Release Engineering - 3.6.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Jun 13 2018 Nikos Mavrogiannopoulos - 3.6.2-4 +- Enable FIPS140-2 mode in Fedora + +* Wed Jun 06 2018 Nikos Mavrogiannopoulos - 3.6.2-3 +- Update to upstream 3.6.2 release + +* Fri May 25 2018 David Abdurachmanov - 3.6.2-2 +- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep + +* Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.6.2-1 +- Update to upstream 3.6.2 release + +* Wed Feb 07 2018 Fedora Release Engineering - 3.6.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Fri Feb 2 2018 Nikos Mavrogiannopoulos - 3.6.1-4 +- Rebuilt to address incompatibility with new nettle + +* Thu Nov 30 2017 Nikos Mavrogiannopoulos - 3.6.1-3 +- Corrected regression from 3.6.1-2 which prevented the loading of + arbitrary p11-kit modules (#1507402) + +* Mon Nov 6 2017 Nikos Mavrogiannopoulos - 3.6.1-2 +- Prevent the loading of all PKCS#11 modules on certificate verification + but only restrict to p11-kit trust module (#1507402) + +* Sat Oct 21 2017 Nikos Mavrogiannopoulos - 3.6.1-1 +- Update to upstream 3.6.1 release + +* Mon Aug 21 2017 Nikos Mavrogiannopoulos - 3.6.0-1 +- Update to upstream 3.6.0 release + +* Wed Aug 02 2017 Fedora Release Engineering - 3.5.14-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 3.5.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Tue Jul 04 2017 Nikos Mavrogiannopoulos - 3.5.14-1 +- Update to upstream 3.5.14 release + +* Wed Jun 07 2017 Nikos Mavrogiannopoulos - 3.5.13-1 +- Update to upstream 3.5.13 release + +* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-2 +- Fix issue with p11-kit-trust arch dependency + +* Thu May 11 2017 Nikos Mavrogiannopoulos - 3.5.12-1 +- Update to upstream 3.5.12 release + +* Fri Apr 07 2017 Nikos Mavrogiannopoulos - 3.5.11-1 +- Update to upstream 3.5.11 release + +* Mon Mar 06 2017 Nikos Mavrogiannopoulos - 3.5.10-1 +- Update to upstream 3.5.10 release + +* Wed Feb 15 2017 Nikos Mavrogiannopoulos - 3.5.9-2 +- Work around missing pkg-config file (#1422256) + +* Tue Feb 14 2017 Nikos Mavrogiannopoulos - 3.5.9-1 +- Update to upstream 3.5.9 release + +* Fri Feb 10 2017 Fedora Release Engineering - 3.5.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Sat Feb 4 2017 Nikos Mavrogiannopoulos 3.5.8-2 +- Added patch fix initialization issue in gnutls_pkcs11_obj_list_import_url4 + +* Mon Jan 9 2017 Nikos Mavrogiannopoulos 3.5.8-1 +- New upstream release + +* Tue Dec 13 2016 Nikos Mavrogiannopoulos 3.5.7-3 +- Fix PKCS#8 file loading (#1404084) + +* Thu Dec 8 2016 Nikos Mavrogiannopoulos 3.5.7-1 +- New upstream release + +* Fri Nov 4 2016 Nikos Mavrogiannopoulos 3.5.6-1 +- New upstream release + +* Tue Oct 11 2016 walters@redhat.com - 3.5.5-2 +- Apply patch to fix compatibility with ostree (#1383708) + +* Mon Oct 10 2016 Nikos Mavrogiannopoulos 3.5.5-1 +- New upstream release + +* Thu Sep 8 2016 Nikos Mavrogiannopoulos 3.5.4-1 +- New upstream release + +* Mon Aug 29 2016 Nikos Mavrogiannopoulos 3.5.3-2 +- Work around #1371082 for x86 +- Fixed issue with DTLS sliding window implementation (#1370881) + +* Tue Aug 9 2016 Nikos Mavrogiannopoulos 3.5.3-1 +- New upstream release + +* Wed Jul 6 2016 Nikos Mavrogiannopoulos 3.5.2-1 +- New upstream release + +* Wed Jun 15 2016 Nikos Mavrogiannopoulos 3.5.1-1 +- New upstream release + +* Tue Jun 7 2016 Nikos Mavrogiannopoulos 3.4.13-1 +- New upstream release (#1343258) +- Addresses issue with setuid programs introduced in 3.4.12 (#1343342) + +* Fri May 20 2016 Nikos Mavrogiannopoulos 3.4.12-1 +- New upstream release + +* Mon Apr 11 2016 Nikos Mavrogiannopoulos 3.4.11-1 +- New upstream release + +* Fri Mar 4 2016 Nikos Mavrogiannopoulos 3.4.10-1 +- New upstream release (#1314576) + +* Wed Feb 3 2016 Nikos Mavrogiannopoulos 3.4.9-1 +- Fix broken key usage flags introduced in 3.4.8 (#1303355) + +* Mon Jan 11 2016 Nikos Mavrogiannopoulos 3.4.8-1 +- New upstream release (#1297079) + +* Mon Nov 23 2015 Nikos Mavrogiannopoulos 3.4.7-1 +- New upstream release (#1284300) +- Documentation updates (#1282864) +- Adds interface to set unique IDs in certificates (#1281343) +- Allow arbitrary key sizes with ARCFOUR (#1284401) + +* Wed Oct 21 2015 Nikos Mavrogiannopoulos 3.4.6-1 +- New upstream release (#1273672) +- Enhances p11tool to write CKA_ISSUER and CKA_SERIAL_NUMBER (#1272178) + +* Tue Oct 20 2015 Adam Williamson - 3.4.5-2 +- fix interaction with Chrome 45+ (master secret extension) (#1273102) + +* Mon Sep 14 2015 Nikos Mavrogiannopoulos 3.4.5-1 +- New upstream release (#1252192) +- Eliminates hard limits on CRL parsing of certtool. + +* Mon Aug 10 2015 Nikos Mavrogiannopoulos 3.4.4-1 +- new upstream release +- no longer requires trousers patch +- fixes issue in gnutls_x509_privkey_import (#1250020) + +* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-2 +- Don't link against trousers but rather dlopen() it when available. + That avoids a dependency on openssl by the main library. + +* Mon Jul 13 2015 Nikos Mavrogiannopoulos 3.4.3-1 +- new upstream release + +* Thu Jul 02 2015 Adam Jackson 3.4.2-3 +- Only disable -z now for the guile modules + +* Thu Jun 18 2015 Nikos Mavrogiannopoulos 3.4.2-2 +- rename the symbol version for internal symbols to avoid clashes + with 3.3.x. + +* Wed Jun 17 2015 Nikos Mavrogiannopoulos 3.4.2-1 +- new upstream release + +* Tue May 5 2015 Nikos Mavrogiannopoulos 3.4.1-2 +- Provide missing GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA definition + +* Mon May 4 2015 Nikos Mavrogiannopoulos 3.4.1-1 +- new upstream release + +* Sat May 02 2015 Kalev Lember - 3.3.14-2 +- Rebuilt for GCC 5 C++11 ABI change + +* Mon Mar 30 2015 Nikos Mavrogiannopoulos 3.3.14-1 +- new upstream release +- improved BER decoding of PKCS #12 structures (#1131461) + +* Fri Mar 6 2015 Nikos Mavrogiannopoulos 3.3.13-3 +- Build with hardened flags +- Removed -Wl,--no-add-needed linker flag + +* Fri Feb 27 2015 Till Maas - 3.3.13-2 +- Do not build with hardened flags + +* Thu Feb 26 2015 Nikos Mavrogiannopoulos 3.3.13-1 +- new upstream release + +* Sat Feb 21 2015 Till Maas - 3.3.12-3 +- Make build verbose +- Use %%license + +* Sat Feb 21 2015 Till Maas - 3.3.12-2 +- Rebuilt for Fedora 23 Change + https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code + +* Mon Jan 19 2015 Nikos Mavrogiannopoulos 3.3.12-1 +- new upstream release + +* Mon Jan 5 2015 Nikos Mavrogiannopoulos 3.3.11-2 +- enabled guile bindings (#1177847) + +* Thu Dec 11 2014 Nikos Mavrogiannopoulos 3.3.11-1 +- new upstream release + +* Mon Nov 10 2014 Nikos Mavrogiannopoulos 3.3.10-1 +- new upstream release + +* Thu Oct 23 2014 Nikos Mavrogiannopoulos 3.3.9-2 +- applied fix for issue in get-issuer (#1155901) + +* Mon Oct 13 2014 Nikos Mavrogiannopoulos 3.3.9-1 +- new upstream release + +* Fri Sep 19 2014 Nikos Mavrogiannopoulos 3.3.8-2 +- strip rpath from library + +* Thu Sep 18 2014 Nikos Mavrogiannopoulos 3.3.8-1 +- new upstream release + +* Mon Aug 25 2014 Nikos Mavrogiannopoulos 3.3.7-1 +- new upstream release + +* Sat Aug 16 2014 Fedora Release Engineering - 3.3.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Wed Jul 23 2014 Nikos Mavrogiannopoulos 3.3.6-1 +- new upstream release + +* Tue Jul 01 2014 Nikos Mavrogiannopoulos 3.3.5-2 +- Added work-around for s390 builds with gcc 4.9 (#1102324) + +* Mon Jun 30 2014 Nikos Mavrogiannopoulos 3.3.5-1 +- new upstream release + +* Tue Jun 17 2014 Nikos Mavrogiannopoulos 3.3.4-3 +- explicitly depend on p11-kit-trust + +* Sat Jun 07 2014 Fedora Release Engineering - 3.3.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Mon Jun 02 2014 Nikos Mavrogiannopoulos 3.3.4-1 +- new upstream release + +* Fri May 30 2014 Nikos Mavrogiannopoulos 3.3.3-1 +- new upstream release + +* Wed May 21 2014 Nikos Mavrogiannopoulos 3.3.2-2 +- Require crypto-policies + +* Fri May 09 2014 Nikos Mavrogiannopoulos 3.3.2-1 +- new upstream release + +* Mon May 05 2014 Nikos Mavrogiannopoulos 3.3.1-4 +- Replaced /etc/crypto-profiles/apps with /etc/crypto-policies/back-ends. +- Added support for "very weak" profile. + +* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-2 +- gnutls_global_deinit() will not do anything if the previous + initialization has failed (#1091053) + +* Mon Apr 28 2014 Nikos Mavrogiannopoulos 3.3.1-1 +- new upstream release + +* Mon Apr 14 2014 Nikos Mavrogiannopoulos 3.3.0-1 +- new upstream release + +* Tue Apr 08 2014 Nikos Mavrogiannopoulos 3.2.13-1 +- new upstream release + +* Wed Mar 05 2014 Nikos Mavrogiannopoulos 3.2.12.1-1 +- new upstream release + +* Mon Mar 03 2014 Nikos Mavrogiannopoulos 3.2.12-1 +- new upstream release + +* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-2 +- use p11-kit trust store for certificate verification + +* Mon Feb 03 2014 Nikos Mavrogiannopoulos 3.2.10-1 +- new upstream release + +* Tue Jan 14 2014 Tomáš Mráz 3.2.8-2 +- build the crywrap tool + +* Mon Dec 23 2013 Nikos Mavrogiannopoulos 3.2.8-1 +- new upstream release + +* Wed Dec 4 2013 Nikos Mavrogiannopoulos 3.2.7-2 +- Use the correct root key for unbound /var/lib/unbound/root.key (#1012494) +- Pull asm fixes from upstream (#973210) + +* Mon Nov 25 2013 Nikos Mavrogiannopoulos 3.2.7-1 +- new upstream release +- added dependency to autogen-libopts-devel to use the system's + libopts library +- added dependency to trousers-devel to enable TPM support + +* Mon Nov 4 2013 Tomáš Mráz 3.1.16-1 +- new upstream release +- fixes CVE-2013-4466 off-by-one in dane_query_tlsa() + +* Fri Oct 25 2013 Tomáš Mráz 3.1.15-1 +- new upstream release +- fixes CVE-2013-4466 buffer overflow in handling DANE entries + +* Wed Oct 16 2013 Tomáš Mráz 3.1.13-3 +- enable ECC NIST Suite B curves + +* Sat Aug 03 2013 Fedora Release Engineering - 3.1.13-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Mon Jul 15 2013 Tomáš Mráz 3.1.13-1 +- new upstream release + +* Mon May 13 2013 Tomáš Mráz 3.1.11-1 +- new upstream release + +* Mon Mar 25 2013 Tomas Mraz 3.1.10-1 +- new upstream release +- license of the library is back to LGPLv2.1+ + +* Fri Mar 15 2013 Tomas Mraz 3.1.9-1 +- new upstream release + +* Thu Mar 7 2013 Tomas Mraz 3.1.8-3 +- drop the temporary old library + +* Tue Feb 26 2013 Tomas Mraz 3.1.8-2 +- don't send ECC algos as supported (#913797) + +* Thu Feb 21 2013 Tomas Mraz 3.1.8-1 +- new upstream version + +* Wed Feb 6 2013 Tomas Mraz 3.1.7-1 +- new upstream version, requires rebuild of dependencies +- this release temporarily includes old compatibility .so + +* Tue Feb 5 2013 Tomas Mraz 2.12.22-2 +- rebuilt with new libtasn1 +- make guile bindings optional - breaks i686 build and there is + no dependent package + +* Tue Jan 8 2013 Tomas Mraz 2.12.22-1 +- new upstream version + +* Wed Nov 28 2012 Tomas Mraz 2.12.21-2 +- use RSA bit sizes supported by libgcrypt in FIPS mode for security + levels (#879643) + +* Fri Nov 9 2012 Tomas Mraz 2.12.21-1 +- new upstream version + +* Thu Nov 1 2012 Tomas Mraz 2.12.20-4 +- negotiate only FIPS approved algorithms in the FIPS mode (#871826) + +* Wed Aug 8 2012 Tomas Mraz 2.12.20-3 +- fix the gnutls-cli-debug manpage - patch by Peter Schiffer + +* Thu Jul 19 2012 Fedora Release Engineering - 2.12.20-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Mon Jun 18 2012 Tomas Mraz 2.12.20-1 +- new upstream version + +* Fri May 18 2012 Tomas Mraz 2.12.19-1 +- new upstream version + +* Thu Mar 29 2012 Tomas Mraz 2.12.18-1 +- new upstream version + +* Thu Mar 8 2012 Tomas Mraz 2.12.17-1 +- new upstream version +- fix leaks in key generation (#796302) + +* Fri Feb 03 2012 Kevin Fenzi - 2.12.14-3 +- Disable largefile on arm arch. (#787287) + +* Fri Jan 13 2012 Fedora Release Engineering - 2.12.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Nov 8 2011 Tomas Mraz 2.12.14-1 +- new upstream version + +* Mon Oct 24 2011 Tomas Mraz 2.12.12-1 +- new upstream version + +* Thu Sep 29 2011 Tomas Mraz 2.12.11-1 +- new upstream version + +* Fri Aug 26 2011 Tomas Mraz 2.12.9-1 +- new upstream version + +* Tue Aug 16 2011 Tomas Mraz 2.12.8-1 +- new upstream version + +* Mon Jul 25 2011 Tomas Mraz 2.12.7-2 +- fix problem when using new libgcrypt +- split libgnutlsxx to a subpackage (#455146) +- drop libgnutls-openssl (#460310) + +* Tue Jun 21 2011 Tomas Mraz 2.12.7-1 +- new upstream version + +* Mon May 9 2011 Tomas Mraz 2.12.4-1 +- new upstream version + +* Tue Apr 26 2011 Tomas Mraz 2.12.3-1 +- new upstream version + +* Mon Apr 18 2011 Tomas Mraz 2.12.2-1 +- new upstream version + +* Thu Mar 3 2011 Tomas Mraz 2.10.5-1 +- new upstream version + +* Tue Feb 08 2011 Fedora Release Engineering - 2.10.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Wed Dec 8 2010 Tomas Mraz 2.10.4-1 +- new upstream version + +* Thu Dec 2 2010 Tomas Mraz 2.10.3-2 +- fix buffer overflow in gnutls-serv (#659259) + +* Fri Nov 19 2010 Tomas Mraz 2.10.3-1 +- new upstream version + +* Thu Sep 30 2010 Tomas Mraz 2.10.2-1 +- new upstream version + +* Wed Sep 29 2010 jkeating - 2.10.1-4 +- Rebuilt for gcc bug 634757 + +* Thu Sep 23 2010 Tomas Mraz 2.10.1-3 +- more patching for internal errors regression (#629858) + patch by Vivek Dasmohapatra + +* Tue Sep 21 2010 Tomas Mraz 2.10.1-2 +- backported patch from upstream git hopefully fixing internal errors + (#629858) + +* Wed Aug 4 2010 Tomas Mraz 2.10.1-1 +- new upstream version + +* Wed Jun 2 2010 Tomas Mraz 2.8.6-2 +- add support for safe renegotiation CVE-2009-3555 (#533125) + +* Wed May 12 2010 Tomas Mraz 2.8.6-1 +- upgrade to a new upstream version + +* Mon Feb 15 2010 Rex Dieter 2.8.5-4 +- FTBFS gnutls-2.8.5-3.fc13: ImplicitDSOLinking (#564624) + +* Thu Jan 28 2010 Tomas Mraz 2.8.5-3 +- drop superfluous rpath from binaries +- do not call autoreconf during build +- specify the license on utils subpackage + +* Mon Jan 18 2010 Tomas Mraz 2.8.5-2 +- do not create static libraries (#556052) + +* Mon Nov 2 2009 Tomas Mraz 2.8.5-1 +- upgrade to a new upstream version + +* Wed Sep 23 2009 Tomas Mraz 2.8.4-1 +- upgrade to a new upstream version + +* Fri Aug 14 2009 Tomas Mraz 2.8.3-1 +- upgrade to a new upstream version + +* Fri Jul 24 2009 Fedora Release Engineering - 2.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Wed Jun 10 2009 Tomas Mraz 2.8.1-1 +- upgrade to a new upstream version + +* Wed Jun 3 2009 Tomas Mraz 2.8.0-1 +- upgrade to a new upstream version + +* Mon May 4 2009 Tomas Mraz 2.6.6-1 +- upgrade to a new upstream version - security fixes + +* Tue Apr 14 2009 Tomas Mraz 2.6.5-1 +- upgrade to a new upstream version, minor bugfixes only + +* Fri Mar 6 2009 Tomas Mraz 2.6.4-1 +- upgrade to a new upstream version + +* Tue Feb 24 2009 Fedora Release Engineering - 2.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Mon Dec 15 2008 Tomas Mraz 2.6.3-1 +- upgrade to a new upstream version + +* Thu Dec 4 2008 Tomas Mraz 2.6.2-1 +- upgrade to a new upstream version + +* Tue Nov 11 2008 Tomas Mraz 2.4.2-3 +- fix chain verification issue CVE-2008-4989 (#470079) + +* Thu Sep 25 2008 Tomas Mraz 2.4.2-2 +- add guile subpackage (#463735) +- force new libtool through autoreconf to drop unnecessary rpaths + +* Tue Sep 23 2008 Tomas Mraz 2.4.2-1 +- new upstream version + +* Tue Jul 1 2008 Tomas Mraz 2.4.1-1 +- new upstream version +- correct the license tag +- explicit --with-included-opencdk not needed +- use external lzo library, internal not included anymore + +* Tue Jun 24 2008 Tomas Mraz 2.4.0-1 +- upgrade to latest upstream + +* Tue May 20 2008 Tomas Mraz 2.0.4-3 +- fix three security issues in gnutls handshake - GNUTLS-SA-2008-1 + (#447461, #447462, #447463) + +* Mon Feb 4 2008 Joe Orton 2.0.4-2 +- use system libtasn1 + +* Tue Dec 4 2007 Tomas Mraz 2.0.4-1 +- upgrade to latest upstream + +* Tue Aug 21 2007 Tomas Mraz 1.6.3-2 +- license tag fix + +* Wed Jun 6 2007 Tomas Mraz 1.6.3-1 +- upgrade to latest upstream (#232445) + +* Tue Apr 10 2007 Tomas Mraz 1.4.5-2 +- properly require install-info (patch by Ville Skyttä) +- standard buildroot and use dist tag +- add COPYING and README to doc + +* Wed Feb 7 2007 Tomas Mraz 1.4.5-1 +- new upstream version +- drop libtermcap-devel from buildrequires + +* Thu Sep 14 2006 Tomas Mraz 1.4.1-2 +- detect forged signatures - CVE-2006-4790 (#206411), patch + from upstream + +* Tue Jul 18 2006 Tomas Mraz - 1.4.1-1 +- upgrade to new upstream version, only minor changes + +* Wed Jul 12 2006 Jesse Keating - 1.4.0-1.1 +- rebuild + +* Wed Jun 14 2006 Tomas Mraz - 1.4.0-1 +- upgrade to new upstream version (#192070), rebuild + of dependent packages required + +* Tue May 16 2006 Tomas Mraz - 1.2.10-2 +- added missing buildrequires + +* Mon Feb 13 2006 Tomas Mraz - 1.2.10-1 +- updated to new version (fixes CVE-2006-0645) + +* Fri Feb 10 2006 Jesse Keating - 1.2.9-3.2 +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Jesse Keating - 1.2.9-3.1 +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Tue Jan 3 2006 Jesse Keating 1.2.9-3 +- rebuilt + +* Fri Dec 9 2005 Tomas Mraz 1.2.9-2 +- replaced *-config scripts with calls to pkg-config to + solve multilib conflicts + +* Wed Nov 23 2005 Tomas Mraz 1.2.9-1 +- upgrade to newest upstream +- removed .la files (#172635) + +* Sun Aug 7 2005 Tomas Mraz 1.2.6-1 +- upgrade to newest upstream (rebuild of dependencies necessary) + +* Mon Jul 4 2005 Tomas Mraz 1.0.25-2 +- split the command line tools to utils subpackage + +* Sat Apr 30 2005 Tomas Mraz 1.0.25-1 +- new upstream version fixes potential DOS attack + +* Sat Apr 23 2005 Tomas Mraz 1.0.24-2 +- readd the version script dropped by upstream + +* Fri Apr 22 2005 Tomas Mraz 1.0.24-1 +- update to the latest upstream version on the 1.0 branch + +* Wed Mar 2 2005 Warren Togami 1.0.20-6 +- gcc4 rebuild + +* Tue Jan 4 2005 Ivana Varekova 1.0.20-5 +- add gnutls Requires zlib-devel (#144069) + +* Mon Nov 08 2004 Colin Walters 1.0.20-4 +- Make gnutls-devel Require libgcrypt-devel + +* Tue Sep 21 2004 Jeff Johnson 1.0.20-3 +- rebuild with release++, otherwise unchanged. + +* Tue Sep 7 2004 Jeff Johnson 1.0.20-2 +- patent tainted SRP code removed. + +* Sun Sep 5 2004 Jeff Johnson 1.0.20-1 +- update to 1.0.20. +- add --with-included-opencdk --with-included-libtasn1 +- add --with-included-libcfg --with-included-lzo +- add --disable-srp-authentication. +- do "make check" after build. + +* Fri Mar 21 2003 Jeff Johnson 0.9.2-1 +- upgrade to 0.9.2 + +* Tue Jun 25 2002 Jeff Johnson 0.4.4-1 +- update to 0.4.4. + +* Fri Jun 21 2002 Tim Powers +- automated rebuild + +* Sat May 25 2002 Jeff Johnson 0.4.3-1 +- update to 0.4.3. + +* Tue May 21 2002 Jeff Johnson 0.4.2-1 +- update to 0.4.2. +- change license to LGPL. +- include splint annotations patch. + +* Tue Apr 2 2002 Nalin Dahyabhai 0.4.0-1 +- update to 0.4.0 + +* Thu Jan 17 2002 Nalin Dahyabhai 0.3.2-1 +- update to 0.3.2 + +* Thu Jan 10 2002 Nalin Dahyabhai 0.3.0-1 +- add a URL + +* Thu Dec 20 2001 Nalin Dahyabhai +- initial package diff --git a/hobble-gnutls b/hobble-gnutls index dd914a5..0989b6c 100755 --- a/hobble-gnutls +++ b/hobble-gnutls @@ -6,3 +6,10 @@ if [ "$1" = "-e" ] ; then else CMD="rm -f" fi + +# SRP +for f in auth/srp_sb64.c auth/srp_passwd.c auth/srp_rsa.c \ + srp.c auth/srp.c ext/srp.c ; do + eval "$CMD lib/$f" +done + diff --git a/plans/fips-smoke.fmf b/plans/fips-smoke.fmf deleted file mode 100644 index 4fda866..0000000 --- a/plans/fips-smoke.fmf +++ /dev/null @@ -1,4 +0,0 @@ -summary: Runs FIPS library integrity checks. -name: fips-smoke -execute: - script: if [[ $(GNUTLS_DEBUG_LEVEL=99 GNUTLS_FORCE_FIPS_MODE=1 certtool 2>&1 | grep "Error") ]]; then exit 1; else exit 0; fi; diff --git a/plans/nss-2way.fmf b/plans/nss-2way.fmf deleted file mode 100644 index 4c6cc65..0000000 --- a/plans/nss-2way.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Upstreamed gnutls-openssl interop-2way tests -contact: Stanislav Zidek -discover: - # upstreamed tests (public) - - name: interop-nss-2way - how: fmf - url: https://gitlab.com/redhat-crypto/tests/interop.git - filter: 'tag: interop-gnutls & tag: interop-nss & tag: interop-2way' -execute: - how: tmt diff --git a/plans/openssl-2way.fmf b/plans/openssl-2way.fmf deleted file mode 100644 index 6187882..0000000 --- a/plans/openssl-2way.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Upstreamed gnutls-openssl interop-2way tests -contact: Stanislav Zidek -discover: - # upstreamed tests (public) - - name: interop-openssl-2way - how: fmf - url: https://gitlab.com/redhat-crypto/tests/interop.git - filter: 'tag: interop-gnutls & tag: interop-openssl & tag: interop-2way' -execute: - how: tmt diff --git a/plans/short-interop-tests.fmf b/plans/short-interop-tests.fmf deleted file mode 100644 index 4db38e8..0000000 --- a/plans/short-interop-tests.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Upstreamed gnutls interop tests - short tests which do not need to run in parallel -contact: Stanislav Zidek -discover: - # upstreamed tests (public) - - name: interop-gnutls-short - how: fmf - url: https://gitlab.com/redhat-crypto/tests/interop.git - filter: 'tag: interop-gnutls & tag: -interop-slow' -execute: - how: tmt diff --git a/sources b/sources index c383c9e..b005a4a 100644 --- a/sources +++ b/sources @@ -1,5 +1,3 @@ -SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386 -SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d -SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a -SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100 +SHA512 (gnutls-3.6.15.tar.xz) = f757d1532198f44bcad7b73856ce6a05bab43f6fb77fcc81c59607f146202f73023d0796d3e1e7471709cf792c8ee7d436e19407e0601bc0bda2f21512b3b01c +SHA512 (gnutls-3.6.15.tar.xz.sig) = a6dbb6093fefddce4c76ce0015d1e0ff7bb712985007c5c6bd5ed6a8cd7529ab250bcbc98b70beeb9dc1b43dcfc65495c77b9abb43e690f24eb7bf0042af1f68 +SHA512 (gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg) = a74b92826fd0e5388c9f6d9231959e38b26aeef83138648fab66df951d8e1a4db5302b569d08515d4d6443e5e4f6c466f98319f330c820790260d22a9b9f7173