CVS commit: pkgsrc/security/gnutls

["Leonardo Taccari" <leot%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   leot
Date:           Sun Dec  9 20:12:41 UTC 2018

Modified Files:
        pkgsrc/security/gnutls: Makefile PLIST buildlink3.mk distinfo

Log Message:
gnutls: Update security/gnutls to 3.6.5

pkgsrc changes:
- Remove comments regarding bash and tests (bash was added
  unconditionally due REPLACE_BASH usages)

Changes:
3.6.5
-----
** libgnutls: Provide the option of transparent re-handshake/reauthentication
   when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571).
** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127)
** libgnutls: The priority functions will ignore and not enable TLS1.3 if
   requested with legacy TLS versions enabled but not TLS1.2. That is because
   if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled)
   servers which do not support TLS1.3 will negotiate TLS1.2 which will be
   rejected by the client as disabled (#621).
** libgnutls: Change RSA decryption to use a new side-channel silent function.
   This addresses a security issue where memory access patterns as well as timing
   on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher
   attacks. Side-channel resistant code is slower due to the need to mask
   access and timings. When used in TLS the new functions cause RSA based
   handshakes to be between 13% and 28% slower on average (Numbers are indicative,
   the tests where performed on a relatively modern Intel CPU, results vary
   depending on the CPU and architecture used). This change makes nettle 3.4.1
   the minimum requirement of gnutls (#630). [CVSS: medium]
** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword
   in the priority string. It is only accepted as legacy option and is ignored.
** libgnutls: Added support for EdDSA under PKCS#11 (#417)
** libgnutls: Added support for AES-CFB8 cipher (#357)
** libgnutls: Added support for AES-CMAC MAC (#351)
** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers
   have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D
   S-BOXes). They are fixed now.
** libgnutls: Added support for GOST key unmasking and unwrapped GOST private
   keys parsing, as specified in R 50.1.112-2016.
** gnutls-serv: It applies the default settings when no --priority option is given,
   using gnutls_set_default_priority().
** p11tool: Fix initialization of security officer's PIN with the --initialize-so-pin
   option (#561)
** certtool: Add parameter --no-text that prevents certtool from outputting
   text before PEM-encoded private key, public key, certificate, CRL or CSR.

** API and ABI modifications:
GNUTLS_AUTO_REAUTH: Added
GNUTLS_CIPHER_AES_128_CFB8: Added
GNUTLS_CIPHER_AES_192_CFB8: Added
GNUTLS_CIPHER_AES_256_CFB8: Added
GNUTLS_MAC_AES_CMAC_128: Added
GNUTLS_MAC_AES_CMAC_256: Added
gnutls_record_get_max_early_data_size: Added
gnutls_record_send_early_data: Added
gnutls_record_recv_early_data: Added
gnutls_db_check_entry_expire_time: Added
gnutls_anti_replay_set_add_function: Added
gnutls_anti_replay_init: Added
gnutls_anti_replay_deinit: Added
gnutls_anti_replay_set_window: Added
gnutls_anti_replay_enable: Added
gnutls_privkey_decrypt_data2: Added


To generate a diff of this commit:
cvs rdiff -u -r1.191 -r1.192 pkgsrc/security/gnutls/Makefile
cvs rdiff -u -r1.61 -r1.62 pkgsrc/security/gnutls/PLIST
cvs rdiff -u -r1.33 -r1.34 pkgsrc/security/gnutls/buildlink3.mk
cvs rdiff -u -r1.131 -r1.132 pkgsrc/security/gnutls/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/gnutls/Makefile
diff -u pkgsrc/security/gnutls/Makefile:1.191 pkgsrc/security/gnutls/Makefile:1.192
--- pkgsrc/security/gnutls/Makefile:1.191       Fri Nov  9 18:03:45 2018
+++ pkgsrc/security/gnutls/Makefile     Sun Dec  9 20:12:41 2018
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.191 2018/11/09 18:03:45 nia Exp $
+# $NetBSD: Makefile,v 1.192 2018/12/09 20:12:41 leot Exp $
 
-DISTNAME=      gnutls-3.6.4
+DISTNAME=      gnutls-3.6.5
 CATEGORIES=    security devel
 MASTER_SITES=  ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/
 EXTRACT_SUFX=  .tar.xz
@@ -28,13 +28,7 @@ CONFIGURE_ARGS+=             --enable-local-libopts
 CONFIGURE_ARGS.SunOS+=         --disable-hardware-acceleration
 CONFIGURE_ARGS.FreeBSD+=       ac_cv_type_max_align_t=yes
 
-# as of 3.5.8, 0 test failures
 TEST_TARGET=           check
-# without the USE_TOOLS line below, the fastopen.sh test fails
-# but when this line is added, the tool path for bash is embedded
-# in to the binaries, so only enable this for testing and
-# disable before commit
-#USE_TOOLS+=           bash
 
 INFO_FILES=            yes
 
@@ -85,7 +79,7 @@ CHECK_BUILTIN.zlib:=yes
 #.include "../../lang/guile20/buildlink3.mk"
 BUILDLINK_API_DEPENDS.libtasn1+=       libtasn1>=4.9
 .include "../../security/libtasn1/buildlink3.mk"
-BUILDLINK_API_DEPENDS.nettle+=         nettle>=3.1
+BUILDLINK_API_DEPENDS.nettle+=         nettle>=3.4.1
 .include "../../security/nettle/buildlink3.mk"
 BUILDLINK_API_DEPENDS.p11-kit+=        p11-kit>=0.23.1
 .include "../../security/p11-kit/buildlink3.mk"

Index: pkgsrc/security/gnutls/PLIST
diff -u pkgsrc/security/gnutls/PLIST:1.61 pkgsrc/security/gnutls/PLIST:1.62
--- pkgsrc/security/gnutls/PLIST:1.61   Fri Nov  9 18:03:45 2018
+++ pkgsrc/security/gnutls/PLIST        Sun Dec  9 20:12:41 2018
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.61 2018/11/09 18:03:45 nia Exp $
+@comment $NetBSD: PLIST,v 1.62 2018/12/09 20:12:41 leot Exp $
 bin/certtool
 bin/gnutls-cli
 bin/gnutls-cli-debug
@@ -86,6 +86,12 @@ man/man3/gnutls_anon_set_params_function
 man/man3/gnutls_anon_set_server_dh_params.3
 man/man3/gnutls_anon_set_server_known_dh_params.3
 man/man3/gnutls_anon_set_server_params_function.3
+man/man3/gnutls_anti_replay_deinit.3
+man/man3/gnutls_anti_replay_enable.3
+man/man3/gnutls_anti_replay_init.3
+man/man3/gnutls_anti_replay_set_add_function.3
+man/man3/gnutls_anti_replay_set_ptr.3
+man/man3/gnutls_anti_replay_set_window.3
 man/man3/gnutls_auth_client_get_type.3
 man/man3/gnutls_auth_get_type.3
 man/man3/gnutls_auth_server_get_type.3
@@ -188,6 +194,7 @@ man/man3/gnutls_crypto_register_cipher.3
 man/man3/gnutls_crypto_register_digest.3
 man/man3/gnutls_crypto_register_mac.3
 man/man3/gnutls_db_check_entry.3
+man/man3/gnutls_db_check_entry_expire_time.3
 man/man3/gnutls_db_check_entry_time.3
 man/man3/gnutls_db_get_default_cache_expiration.3
 man/man3/gnutls_db_get_ptr.3
@@ -532,6 +539,7 @@ man/man3/gnutls_priority_set_direct.3
 man/man3/gnutls_priority_sign_list.3
 man/man3/gnutls_priority_string_list.3
 man/man3/gnutls_privkey_decrypt_data.3
+man/man3/gnutls_privkey_decrypt_data2.3
 man/man3/gnutls_privkey_deinit.3
 man/man3/gnutls_privkey_export_dsa_raw.3
 man/man3/gnutls_privkey_export_dsa_raw2.3
@@ -649,14 +657,17 @@ man/man3/gnutls_record_disable_padding.3
 man/man3/gnutls_record_discard_queued.3
 man/man3/gnutls_record_get_direction.3
 man/man3/gnutls_record_get_discarded.3
+man/man3/gnutls_record_get_max_early_data_size.3
 man/man3/gnutls_record_get_max_size.3
 man/man3/gnutls_record_get_state.3
 man/man3/gnutls_record_overhead_size.3
 man/man3/gnutls_record_recv.3
+man/man3/gnutls_record_recv_early_data.3
 man/man3/gnutls_record_recv_packet.3
 man/man3/gnutls_record_recv_seq.3
 man/man3/gnutls_record_send.3
 man/man3/gnutls_record_send2.3
+man/man3/gnutls_record_send_early_data.3
 man/man3/gnutls_record_send_range.3
 man/man3/gnutls_record_set_max_early_data_size.3
 man/man3/gnutls_record_set_max_size.3

Index: pkgsrc/security/gnutls/buildlink3.mk
diff -u pkgsrc/security/gnutls/buildlink3.mk:1.33 pkgsrc/security/gnutls/buildlink3.mk:1.34
--- pkgsrc/security/gnutls/buildlink3.mk:1.33   Thu Apr 19 22:12:25 2018
+++ pkgsrc/security/gnutls/buildlink3.mk        Sun Dec  9 20:12:41 2018
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.33 2018/04/19 22:12:25 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.34 2018/12/09 20:12:41 leot Exp $
 
 BUILDLINK_TREE+=       gnutls
 
@@ -14,6 +14,7 @@ BUILDLINK_PKGSRCDIR.gnutls?=  ../../secur
 .include "../../devel/libcfg+/buildlink3.mk"
 .include "../../devel/zlib/buildlink3.mk"
 .include "../../security/libtasn1/buildlink3.mk"
+BUILDLINK_API_DEPENDS.nettle+=         nettle>=3.4.1
 .include "../../security/nettle/buildlink3.mk"
 .include "../../security/p11-kit/buildlink3.mk"
 .include "../../textproc/libunistring/buildlink3.mk"

Index: pkgsrc/security/gnutls/distinfo
diff -u pkgsrc/security/gnutls/distinfo:1.131 pkgsrc/security/gnutls/distinfo:1.132
--- pkgsrc/security/gnutls/distinfo:1.131       Fri Nov  9 18:03:45 2018
+++ pkgsrc/security/gnutls/distinfo     Sun Dec  9 20:12:41 2018
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.131 2018/11/09 18:03:45 nia Exp $
+$NetBSD: distinfo,v 1.132 2018/12/09 20:12:41 leot Exp $
 
-SHA1 (gnutls-3.6.4.tar.xz) = cb3e25d477a8821b05ba8e0596093ddb64c3f702
-RMD160 (gnutls-3.6.4.tar.xz) = fee56aaf3ecb6e7e7e18c804592dadac555ec517
-SHA512 (gnutls-3.6.4.tar.xz) = f39ac09b48ebf230653cbf82b29ded39a1403313067135495b23f428b35783f9ef073993157d1f284678abedd19e2cf1fd01af843001b88320ca17b346b219ab
-Size (gnutls-3.6.4.tar.xz) = 8076364 bytes
+SHA1 (gnutls-3.6.5.tar.xz) = 749fcaba23f63b523ec2ad262caeca6f1e62fc6f
+RMD160 (gnutls-3.6.5.tar.xz) = a7194f821deb3b1cd9efa7be8382bf893e317a8e
+SHA512 (gnutls-3.6.5.tar.xz) = 127f053ce45c63cd745fa5a654a2d8e4fbc322f5e17dcc3740fb2e7b376dd18dad59318d66e6e93e37d6a179fca4b35cf2ae62d13be5645cd2d06badd79d4dce
+Size (gnutls-3.6.5.tar.xz) = 8192888 bytes
 SHA1 (patch-lib_Makefile.in) = c9a6bbe6238ccd9de41c708012e36b202d2a86e7
 SHA1 (patch-lib_accelerated_x86_x86-common.c) = eaf3c473b1ca83c5b15be26f8c06a82d7961420c
 SHA1 (patch-src_libopts_autoopts_options.h) = 9202c55314fe8764ac82c95bbfabfa1b031e9ba4