Update to 3.6.7

- Fixed CVE-2019-3836 (#1693214)
- Fixed CVE-2019-3829 (#1693210)

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

.gitignore

@@ -98,3 +98,12 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
 /gnutls-3.6.3.tar.xz.sig
 /gnutls-3.6.3.tar.xz
+/gnutls-3.6.4.tar.xz
+/gnutls-3.6.4.tar.xz.sig
+/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
+/gnutls-3.6.5.tar.xz.sig
+/gnutls-3.6.5.tar.xz
+/gnutls-3.6.6.tar.xz
+/gnutls-3.6.6.tar.xz.sig
+/gnutls-3.6.7.tar.xz
+/gnutls-3.6.7.tar.xz.sig

gnutls-3.4.2-no-now-guile.patch

@@ -1,12 +0,0 @@
-diff -up gnutls-3.4.2/guile/src/Makefile.in.jx gnutls-3.4.2/guile/src/Makefile.in
---- gnutls-3.4.2/guile/src/Makefile.in.jx	2015-06-16 12:23:31.000000000 -0400
-+++ gnutls-3.4.2/guile/src/Makefile.in	2015-07-02 14:01:19.415060204 -0400
-@@ -1316,7 +1316,7 @@ guileextension_LTLIBRARIES = guile-gnutl
- # Use '-module' to build a "dlopenable module", in Libtool terms.
- # Use '-undefined' to placate Libtool on Windows; see
- # <http://lists.gnutls.org/pipermail/gnutls-devel/2014-December/007294.html>.
--guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined
-+guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy
- 
- # Linking against GnuTLS.
- GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la

gnutls-3.6.3-backport-upstream-fixes.patch

@@ -1,55 +0,0 @@
-diff --git a/lib/cert-cred.c b/lib/cert-cred.c
-index d3777e51f..2150e903f 100644
---- a/lib/cert-cred.c
-+++ b/lib/cert-cred.c
-@@ -387,6 +387,13 @@ static int call_legacy_cert_cb1(gnutls_session_t session,
- 	if (ret < 0)
- 		return gnutls_assert_val(ret);
- 
-+	if (st2.ncerts == 0) {
-+		*pcert_length = 0;
-+		*ocsp_length = 0;
-+		*privkey = NULL;
-+		return 0;
-+	}
-+
- 	if (st2.cert_type != GNUTLS_CRT_X509) {
- 		gnutls_assert();
- 		ret = GNUTLS_E_INVALID_REQUEST;
-@@ -503,7 +510,10 @@ void gnutls_certificate_set_retrieve_function
-      gnutls_certificate_retrieve_function * func)
- {
- 	cred->legacy_cert_cb1 = func;
--	cred->get_cert_callback3 = call_legacy_cert_cb1;
-+	if (!func)
-+		cred->get_cert_callback3 = NULL;
-+	else
-+		cred->get_cert_callback3 = call_legacy_cert_cb1;
- }
- 
- static int call_legacy_cert_cb2(gnutls_session_t session,
-@@ -578,7 +588,10 @@ void gnutls_certificate_set_retrieve_function2
-      gnutls_certificate_retrieve_function2 * func) 
- {
- 	cred->legacy_cert_cb2 = func;
--	cred->get_cert_callback3 = call_legacy_cert_cb2;
-+	if (!func)
-+		cred->get_cert_callback3 = NULL;
-+	else
-+		cred->get_cert_callback3 = call_legacy_cert_cb2;
- }
- 
- /**
-diff --git a/lib/hello_ext.c b/lib/hello_ext.c
-index a3027130a..f72afe77f 100644
---- a/lib/hello_ext.c
-+++ b/lib/hello_ext.c
-@@ -208,7 +208,7 @@ int hello_ext_parse(void *_ctx, unsigned tls_id, const uint8_t *data, unsigned d
- 
- 	if (tls_id == PRE_SHARED_KEY_TLS_ID) {
- 		ctx->seen_pre_shared_key = 1;
--	} else if (ctx->seen_pre_shared_key) {
-+	} else if (ctx->seen_pre_shared_key && session->security_parameters.entity == GNUTLS_SERVER) {
- 		/* the pre-shared key extension must always be the last one,
- 		 * draft-ietf-tls-tls13-28: 4.2.11 */
- 		return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

gnutls-3.6.3-fix-ecdsa.patch

@@ -1,27 +0,0 @@
-diff --git a/lib/pubkey.c b/lib/pubkey.c
-index 162ceaa4a..8fc42b95a 100644
---- a/lib/pubkey.c
-+++ b/lib/pubkey.c
-@@ -1072,7 +1072,6 @@ gnutls_pubkey_import(gnutls_pubkey_t key,
- 	int result = 0, need_free = 0;
- 	gnutls_datum_t _data;
- 	ASN1_TYPE spk;
--	gnutls_ecc_curve_t curve;
- 
- 	if (key == NULL) {
- 		gnutls_assert();
-@@ -1119,14 +1118,7 @@ gnutls_pubkey_import(gnutls_pubkey_t key,
- 		goto cleanup;
- 	}
- 
--	/* this has already been called by get_asn_mpis() thus it cannot
--	 * fail.
--	 */
--	key->params.algo = _gnutls_x509_get_pk_algorithm(spk, "", &curve, NULL);
--
--	key->params.curve = curve;
- 	key->bits = pubkey_to_bits(&key->params);
--
- 	result = 0;
- 
-       cleanup:

gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch

@@ -1,30 +0,0 @@
-diff --git a/tests/priority-init2.c b/tests/priority-init2.c
-index 850a6d9..d6b7659 100644
---- a/tests/priority-init2.c
-+++ b/tests/priority-init2.c
-@@ -91,8 +91,8 @@ static void start(struct test_st *test)
- 		if (test->exp_err == ret) {
- 			if (ep-test->add_prio != test->err_pos) {
- 				fprintf(stderr, "diff: %d\n", (int)(ep-test->add_prio));
--				fail("error expected error on different position[%d]: %s\n",
--					test->err_pos, test->add_prio);
-+//				fail("error expected error on different position[%d]: %s\n",
-+//					test->err_pos, test->add_prio);
- 			}
- 			goto cleanup;
- 		}
-diff --git a/tests/set-default-prio.c b/tests/set-default-prio.c
-index 48e8bf1..16235f8 100644
---- a/tests/set-default-prio.c
-+++ b/tests/set-default-prio.c
-@@ -90,8 +90,8 @@ static void start(struct test_st *test)
- 		if (test->exp_err == ret) {
- 			if (ep-test->add_prio != test->err_pos) {
- 				fprintf(stderr, "diff: %d\n", (int)(ep-test->add_prio));
--				fail("error expected error on different position[%d]: %s\n",
--					test->err_pos, test->add_prio);
-+//				fail("error expected error on different position[%d]: %s\n",
-+//					test->err_pos, test->add_prio);
- 			}
- 			goto cleanup;
- 		}

gnutls-3.6.7-no-now-guile.patch

@@ -0,0 +1,11 @@
+--- a/guile/src/Makefile.in	2019-03-27 11:51:55.984398001 +0100
++++ b/guile/src/Makefile.in	2019-03-27 11:52:27.259626076 +0100
+@@ -1472,7 +1472,7 @@
+ # Use '-module' to build a "dlopenable module", in Libtool terms.
+ # Use '-undefined' to placate Libtool on Windows; see
+ # <https://lists.gnutls.org/pipermail/gnutls-devel/2014-December/007294.html>.
+-guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined
++guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy
+ 
+ # Linking against GnuTLS.
+ GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la

gnutls.spec

@@ -1,11 +1,8 @@
 # This spec file has been automatically updated
-Version:	3.6.3
-Release: 3%{?dist}
+Version:	3.6.7
+Release: 1%{?dist}
 Patch1:	gnutls-3.2.7-rpath.patch
-Patch2:	gnutls-3.4.2-no-now-guile.patch
-Patch3:	gnutls-3.6.3-skip-new-priority-funcs-err-pos.patch
-Patch4: gnutls-3.6.3-backport-upstream-fixes.patch
-Patch5: gnutls-3.6.3-fix-ecdsa.patch
+Patch2:	gnutls-3.6.7-no-now-guile.patch
 %bcond_without dane
 %if 0%{?rhel}
 %bcond_with guile
@@ -19,12 +16,11 @@ Summary: A TLS protocol implementation
 Name: gnutls
 # The libraries are LGPLv2.1+, utilities are GPLv3+
 License: GPLv3+ and LGPLv2+
-Group: System Environment/Libraries
 BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel
 BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3
 BuildRequires: libtool, automake, autoconf, texinfo
 BuildRequires: autogen-libopts-devel >= 5.18 autogen
-BuildRequires: nettle-devel >= 3.1.1
+BuildRequires: nettle-devel >= 3.4.1
 BuildRequires: trousers-devel >= 0.3.11.2
 BuildRequires: libidn2-devel
 BuildRequires: libunistring-devel
@@ -39,6 +35,7 @@ BuildRequires: p11-kit-trust, ca-certificates
 Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
+Requires: nettle >= 3.4.1
 Recommends: trousers >= 0.3.11.2
 
 %if %{with dane}
@@ -48,8 +45,8 @@ BuildRequires: unbound-devel unbound-libs
 BuildRequires: guile-devel
 %endif
 URL: http://www.gnutls.org/
-Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz
-Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig
+Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz
+Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig
 Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
 
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
@@ -61,20 +58,16 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
 
 %package devel
 Summary: Development files for the %{name} package
-Group: Development/Libraries
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: %{name}-c++%{?_isa} = %{version}-%{release}
 %if %{with dane}
 Requires: %{name}-dane%{?_isa} = %{version}-%{release}
 %endif
 Requires: pkgconfig
-Requires(post): /sbin/install-info
-Requires(preun): /sbin/install-info
 
 %package utils
 License: GPLv3+
 Summary: Command line tools for TLS protocol
-Group: Applications/System
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %if %{with dane}
 Requires: %{name}-dane%{?_isa} = %{version}-%{release}
@@ -89,7 +82,6 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
 %if %{with guile}
 %package guile
 Summary: Guile bindings for the GNUTLS library
-Group: Development/Libraries
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: guile
 %endif
@@ -150,12 +142,8 @@ This package contains Guile bindings for the library.
 %prep
 gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 
-%setup -q
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
+%autosetup -p1
+autoreconf
 
 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure
 rm -f lib/minitasn1/*.c lib/minitasn1/*.h
@@ -163,16 +151,17 @@ rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/
 
 echo "SYSTEM=NORMAL" >> tests/system.prio
 
+# Note that we explicitly enable SHA1, as SHA1 deprecation is handled
+# via the crypto policies
+
 %build
+CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes"
+export CCASFLAGS
 %configure --with-libtasn1-prefix=%{_prefix} \
-%if (0%{?fedora} <= 28)
-	   --enable-ssl3-support \
-%else
-	   --enable-tls13-support \
-%endif
 %if %{with fips}
            --enable-fips140-mode \
 %endif
+	   --enable-sha1-support \
            --disable-static \
            --disable-openssl-compatibility \
            --disable-non-suiteb-curves \
@@ -223,36 +212,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
 %check
 make check %{?_smp_mflags}
 
-%post -p /sbin/ldconfig
-
-%postun -p /sbin/ldconfig
-
-%post c++ -p /sbin/ldconfig
-
-%postun c++ -p /sbin/ldconfig
-
-%post devel
-if [ -f %{_infodir}/gnutls.info.gz ]; then
-    /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
-fi
-
-%preun devel
-if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then
-   /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
-fi
-
-%if %{with dane}
-%post dane -p /sbin/ldconfig
-
-%postun dane -p /sbin/ldconfig
-%endif
-
-%if %{with guile}
-%post guile -p /sbin/ldconfig
-
-%postun guile -p /sbin/ldconfig
-%endif
-
 %files -f gnutls.lang
 %defattr(-,root,root,-)
 %{_libdir}/libgnutls.so.30*
@@ -311,6 +270,43 @@ fi
 %endif
 
 %changelog
+* Wed Mar 27 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.7-1
+- Update to upstream 3.6.7 release
+- Fixed CVE-2019-3836 (#1693214)
+- Fixed CVE-2019-3829 (#1693210)
+
+* Fri Feb  1 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.6-1
+- Update to upstream 3.6.6 release
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.5-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jan 11 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-2
+- Add explicit Requires for nettle >= 3.4.1
+
+* Wed Dec 12 2018 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-1
+- Update to upstream 3.6.5 release
+
+* Fri Oct 19 2018 Petr Menšík <pemensik@redhat.com> - 3.6.4-4
+- Rebuild for unbound 1.8 again
+
+* Wed Oct 17 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-3
+- Fix issue with rehandshake affecting glib-networking (#1634736)
+
+* Tue Oct 09 2018 Petr Menšík <pemensik@redhat.com> - 3.6.4-2
+- Rebuilt for unbound 1.8
+
+* Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-1
+- Updated to upstream 3.6.4 release
+- Added support for the latest version of the TLS1.3 protocol
+- Enabled SHA1 support as SHA1 deprecation is handled via the
+  fedora crypto policies.
+
+* Thu Aug 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4
+- Fixed gnutls-cli input reading
+- Ensure that we do not cause issues with version rollback detection
+  and TLS1.3.
+
 * Tue Aug 07 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-3
 - Fixed ECDSA public key import (#1612803)
 

sources

@@ -1,3 +1,3 @@
+SHA512 (gnutls-3.6.7.tar.xz) = ae9b8996eb9b7269d28213f0aca3a4a17890ba8d47e3dc3b8e754ab8e2b4251e9412aaaa161a8bf56167f04cc169b4cada46f55a7bde92b955eb36cd717a99f3
+SHA512 (gnutls-3.6.7.tar.xz.sig) = fd397cab1f658053d52cdd214a9d816262993b572cd4b623f3e276fd6759e2e620bd3f27d5a749a2b066173c6c39fcc357225d3136996b99e2f88d268aef5baf
 SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad
-SHA512 (gnutls-3.6.3.tar.xz.sig) = 5377352aa239a4458b0ac6aaada438dce0336b989c4f65949fec3e469531dfb2397bb36dbe69dbc6f479f6944999937ebb4a5cb40e806d0bd4062c5647aa397b
-SHA512 (gnutls-3.6.3.tar.xz) = 6238502464d229a9777e3076f4c745d16deaada83c9da756ecdcd370947576e0446bda3a7f85d5a099b745bbf8c0134ebdf6632e4b26d61daf170792fb4f5abe