Accepting request 181378 from Base:System
- Disable all ECC algorithms. - gnutls-32bit.patch: upstream patch to make test work with 32bit time_t. - gnutls-implement-trust-store-dir.diff currently not yet forward ported. - Updated to GnuTLS 3.2.1 ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. - Updated to GnuTLS 3.2.0 ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). - Updated to GnuTLS 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't OBS-URL: https://build.opensuse.org/request/show/181378 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gnutls?expand=0&rev=58
This commit is contained in:
parent
be42c61130
commit
aa7b9ea5b8
@ -1,20 +1,8 @@
|
||||
Index: gnutls-3.0.20/configure.ac
|
||||
Index: gnutls-3.2.1/aclocal.m4
|
||||
===================================================================
|
||||
--- gnutls-3.0.20.orig/configure.ac 2012-07-01 21:50:17.000000000 +0200
|
||||
+++ gnutls-3.0.20/configure.ac 2012-07-01 21:50:17.977499968 +0200
|
||||
@@ -37,6 +37,7 @@ dnl Checks for programs.
|
||||
AC_PROG_CC
|
||||
AM_PROG_AS
|
||||
AC_PROG_CXX
|
||||
+AM_PROG_AR
|
||||
gl_EARLY
|
||||
|
||||
# For includes/gnutls/gnutls.h.in.
|
||||
Index: gnutls-3.0.20/aclocal.m4
|
||||
===================================================================
|
||||
--- gnutls-3.0.20.orig/aclocal.m4 2012-06-05 19:10:14.000000000 +0200
|
||||
+++ gnutls-3.0.20/aclocal.m4 2012-07-01 21:53:42.821893323 +0200
|
||||
@@ -529,7 +529,7 @@ AM_MISSING_PROG(AUTOHEADER, autoheader)
|
||||
--- gnutls-3.2.1.orig/aclocal.m4
|
||||
+++ gnutls-3.2.1/aclocal.m4
|
||||
@@ -517,7 +517,7 @@ AM_MISSING_PROG(AUTOHEADER, autoheader)
|
||||
AM_MISSING_PROG(MAKEINFO, makeinfo)
|
||||
AC_REQUIRE([AM_PROG_INSTALL_SH])dnl
|
||||
AC_REQUIRE([AM_PROG_INSTALL_STRIP])dnl
|
||||
@ -23,7 +11,7 @@ Index: gnutls-3.0.20/aclocal.m4
|
||||
# We need awk for the "check" target. The system "awk" is bad on
|
||||
# some platforms.
|
||||
AC_REQUIRE([AC_PROG_AWK])dnl
|
||||
@@ -773,10 +773,10 @@ fi
|
||||
@@ -761,10 +761,10 @@ fi
|
||||
|
||||
# serial 1
|
||||
|
||||
@ -36,11 +24,11 @@ Index: gnutls-3.0.20/aclocal.m4
|
||||
[AC_PREREQ([2.60])dnl
|
||||
AC_REQUIRE([AC_PROG_MKDIR_P])dnl
|
||||
dnl Automake 1.8 to 1.9.6 used to define mkdir_p. We now use MKDIR_P,
|
||||
Index: gnutls-3.0.20/gl/m4/gnulib-common.m4
|
||||
Index: gnutls-3.2.1/gl/m4/gnulib-common.m4
|
||||
===================================================================
|
||||
--- gnutls-3.0.20.orig/gl/m4/gnulib-common.m4 2012-06-05 19:07:51.000000000 +0200
|
||||
+++ gnutls-3.0.20/gl/m4/gnulib-common.m4 2012-07-01 21:53:42.821893323 +0200
|
||||
@@ -301,7 +301,7 @@ m4_ifdef([AC_PROG_MKDIR_P], [
|
||||
--- gnutls-3.2.1.orig/gl/m4/gnulib-common.m4
|
||||
+++ gnutls-3.2.1/gl/m4/gnulib-common.m4
|
||||
@@ -303,7 +303,7 @@ m4_ifdef([AC_PROG_MKDIR_P], [
|
||||
AC_SUBST([MKDIR_P])])], [
|
||||
dnl For autoconf < 2.60: Backport of AC_PROG_MKDIR_P.
|
||||
AC_DEFUN_ONCE([AC_PROG_MKDIR_P],
|
||||
@ -48,11 +36,11 @@ Index: gnutls-3.0.20/gl/m4/gnulib-common.m4
|
||||
+ [AC_REQUIRE([AC_PROG_MKDIR_P])dnl defined by automake
|
||||
MKDIR_P='$(mkdir_p)'
|
||||
AC_SUBST([MKDIR_P])])])
|
||||
|
||||
Index: gnutls-3.0.20/m4/po.m4
|
||||
])
|
||||
Index: gnutls-3.2.1/m4/po.m4
|
||||
===================================================================
|
||||
--- gnutls-3.0.20.orig/m4/po.m4 2011-11-08 22:07:12.000000000 +0100
|
||||
+++ gnutls-3.0.20/m4/po.m4 2012-07-01 21:53:42.822893277 +0200
|
||||
--- gnutls-3.2.1.orig/m4/po.m4
|
||||
+++ gnutls-3.2.1/m4/po.m4
|
||||
@@ -24,7 +24,7 @@ AC_DEFUN([AM_PO_SUBDIRS],
|
||||
[
|
||||
AC_REQUIRE([AC_PROG_MAKE_SET])dnl
|
||||
|
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:9ba12ae7a3eb122f1d5ee897ed910abd5a1a84b84dc0333ef977f0b1692d1993
|
||||
size 4636572
|
711
gnutls-3.2.1-noecc.patch
Normal file
711
gnutls-3.2.1-noecc.patch
Normal file
@ -0,0 +1,711 @@
|
||||
Index: gnutls-3.2.1/lib/algorithms/kx.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/algorithms/kx.c
|
||||
+++ gnutls-3.2.1/lib/algorithms/kx.c
|
||||
@@ -28,9 +28,11 @@
|
||||
|
||||
extern mod_auth_st rsa_auth_struct;
|
||||
extern mod_auth_st dhe_rsa_auth_struct;
|
||||
+#ifdef ENABLE_ECC
|
||||
extern mod_auth_st ecdhe_rsa_auth_struct;
|
||||
extern mod_auth_st ecdhe_psk_auth_struct;
|
||||
extern mod_auth_st ecdhe_ecdsa_auth_struct;
|
||||
+#endif
|
||||
extern mod_auth_st dhe_dss_auth_struct;
|
||||
extern mod_auth_st anon_auth_struct;
|
||||
extern mod_auth_st anon_ecdh_auth_struct;
|
||||
@@ -57,8 +59,10 @@ static const gnutls_cred_map cred_mappin
|
||||
{GNUTLS_KX_ANON_DH, GNUTLS_CRD_ANON, GNUTLS_CRD_ANON},
|
||||
{GNUTLS_KX_ANON_ECDH, GNUTLS_CRD_ANON, GNUTLS_CRD_ANON},
|
||||
{GNUTLS_KX_RSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
|
||||
+#ifdef ENABLE_ECC
|
||||
{GNUTLS_KX_ECDHE_RSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
|
||||
{GNUTLS_KX_ECDHE_ECDSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
|
||||
+#endif
|
||||
{GNUTLS_KX_DHE_DSS, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
|
||||
{GNUTLS_KX_DHE_RSA, GNUTLS_CRD_CERTIFICATE, GNUTLS_CRD_CERTIFICATE},
|
||||
{GNUTLS_KX_PSK, GNUTLS_CRD_PSK, GNUTLS_CRD_PSK},
|
||||
@@ -98,7 +102,7 @@ static const gnutls_kx_algo_entry _gnutl
|
||||
{"DHE-RSA", GNUTLS_KX_DHE_RSA, &dhe_rsa_auth_struct, 1},
|
||||
{"DHE-DSS", GNUTLS_KX_DHE_DSS, &dhe_dss_auth_struct, 1},
|
||||
#endif
|
||||
-#ifdef ENABLE_ECDHE
|
||||
+#if defined(ENABLE_ECDHE) && defined(ENABLE_ECC)
|
||||
{"ECDHE-RSA", GNUTLS_KX_ECDHE_RSA, &ecdhe_rsa_auth_struct, 0},
|
||||
{"ECDHE-ECDSA", GNUTLS_KX_ECDHE_ECDSA, &ecdhe_ecdsa_auth_struct, 0},
|
||||
#endif
|
||||
@@ -113,7 +117,7 @@ static const gnutls_kx_algo_entry _gnutl
|
||||
{"DHE-PSK", GNUTLS_KX_DHE_PSK, &dhe_psk_auth_struct,
|
||||
1 /* needs DHE params */},
|
||||
# endif
|
||||
-# ifdef ENABLE_ECDHE
|
||||
+# if defined(ENABLE_ECDHE) && defined(ENABLE_ECC)
|
||||
{"ECDHE-PSK", GNUTLS_KX_ECDHE_PSK, &ecdhe_psk_auth_struct, 0},
|
||||
# endif
|
||||
#endif
|
||||
Index: gnutls-3.2.1/lib/algorithms/publickey.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/algorithms/publickey.c
|
||||
+++ gnutls-3.2.1/lib/algorithms/publickey.c
|
||||
@@ -49,8 +49,10 @@ static const gnutls_pk_map pk_mappings[]
|
||||
{GNUTLS_KX_RSA, GNUTLS_PK_RSA, CIPHER_ENCRYPT},
|
||||
{GNUTLS_KX_DHE_RSA, GNUTLS_PK_RSA, CIPHER_SIGN},
|
||||
{GNUTLS_KX_SRP_RSA, GNUTLS_PK_RSA, CIPHER_SIGN},
|
||||
+#ifdef ENABLE_ECC
|
||||
{GNUTLS_KX_ECDHE_RSA, GNUTLS_PK_RSA, CIPHER_SIGN},
|
||||
{GNUTLS_KX_ECDHE_ECDSA, GNUTLS_PK_EC, CIPHER_SIGN},
|
||||
+#endif
|
||||
{GNUTLS_KX_DHE_DSS, GNUTLS_PK_DSA, CIPHER_SIGN},
|
||||
{GNUTLS_KX_SRP_DSS, GNUTLS_PK_DSA, CIPHER_SIGN},
|
||||
{0, 0, 0}
|
||||
@@ -96,7 +98,9 @@ static const gnutls_pk_entry pk_algorith
|
||||
{"DSA", PK_DSA_OID, GNUTLS_PK_DSA},
|
||||
{"GOST R 34.10-2001", PK_GOST_R3410_2001_OID, GNUTLS_PK_UNKNOWN},
|
||||
{"GOST R 34.10-94", PK_GOST_R3410_94_OID, GNUTLS_PK_UNKNOWN},
|
||||
+#ifdef ENABLE_ECC
|
||||
{"EC", "1.2.840.10045.2.1", GNUTLS_PK_EC},
|
||||
+#endif
|
||||
{0, 0, 0}
|
||||
};
|
||||
|
||||
Index: gnutls-3.2.1/lib/algorithms/sign.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/algorithms/sign.c
|
||||
+++ gnutls-3.2.1/lib/algorithms/sign.c
|
||||
@@ -43,6 +43,14 @@ typedef struct gnutls_sign_entry gnutls_
|
||||
#define TLS_SIGN_AID_UNKNOWN {255, 255}
|
||||
static const sign_algorithm_st unknown_tls_aid = TLS_SIGN_AID_UNKNOWN;
|
||||
|
||||
+#ifndef ENABLE_ECC
|
||||
+#define GNUTLS_SIGN_ECDSA_SHA1 0
|
||||
+#define GNUTLS_SIGN_ECDSA_SHA224 0
|
||||
+#define GNUTLS_SIGN_ECDSA_SHA256 0
|
||||
+#define GNUTLS_SIGN_ECDSA_SHA384 0
|
||||
+#define GNUTLS_SIGN_ECDSA_SHA512 0
|
||||
+#endif
|
||||
+
|
||||
static const gnutls_sign_entry sign_algorithms[] = {
|
||||
{"RSA-SHA1", SIG_RSA_SHA1_OID, GNUTLS_SIGN_RSA_SHA1, GNUTLS_PK_RSA,
|
||||
GNUTLS_DIG_SHA1, {2, 1}},
|
||||
Index: gnutls-3.2.1/lib/auth/cert.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/auth/cert.c
|
||||
+++ gnutls-3.2.1/lib/auth/cert.c
|
||||
@@ -63,7 +63,11 @@ static gnutls_privkey_t alloc_and_load_p
|
||||
key, int deinit);
|
||||
#endif
|
||||
|
||||
+#ifdef ENABLE_ECC
|
||||
#define MAX_CLIENT_SIGN_ALGOS 3
|
||||
+#else
|
||||
+#define MAX_CLIENT_SIGN_ALGOS 2
|
||||
+#endif
|
||||
#define CERTTYPE_SIZE (MAX_CLIENT_SIGN_ALGOS+1)
|
||||
typedef enum CertificateSigType
|
||||
{ RSA_SIGN = 1, DSA_SIGN = 2, ECDSA_SIGN = 64
|
||||
@@ -1438,8 +1442,10 @@ _gnutls_check_supported_sign_algo (Certi
|
||||
return GNUTLS_PK_RSA;
|
||||
case DSA_SIGN:
|
||||
return GNUTLS_PK_DSA;
|
||||
+#ifdef ENABLE_ECC
|
||||
case ECDSA_SIGN:
|
||||
return GNUTLS_PK_EC;
|
||||
+#endif
|
||||
}
|
||||
|
||||
return -1;
|
||||
@@ -1726,7 +1732,9 @@ _gnutls_gen_cert_server_cert_req (gnutls
|
||||
tmp_data[0] = CERTTYPE_SIZE - 1;
|
||||
tmp_data[1] = RSA_SIGN;
|
||||
tmp_data[2] = DSA_SIGN;
|
||||
+#ifdef ENABLE_ECC
|
||||
tmp_data[3] = ECDSA_SIGN; /* only these for now */
|
||||
+#endif
|
||||
|
||||
ret = _gnutls_buffer_append_data (data, tmp_data, CERTTYPE_SIZE);
|
||||
if (ret < 0)
|
||||
Index: gnutls-3.2.1/lib/auth/dhe_psk.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/auth/dhe_psk.c
|
||||
+++ gnutls-3.2.1/lib/auth/dhe_psk.c
|
||||
@@ -92,6 +92,7 @@ const mod_auth_st ecdhe_psk_auth_struct
|
||||
};
|
||||
#endif
|
||||
|
||||
+#ifdef ENABLE_ECDHE
|
||||
static int
|
||||
gen_ecdhe_psk_client_kx (gnutls_session_t session, gnutls_buffer_st* data)
|
||||
{
|
||||
@@ -135,6 +136,7 @@ cleanup:
|
||||
|
||||
return ret;
|
||||
}
|
||||
+#endif
|
||||
|
||||
static int
|
||||
gen_dhe_psk_client_kx (gnutls_session_t session, gnutls_buffer_st* data)
|
||||
@@ -230,6 +232,7 @@ gen_dhe_psk_server_kx (gnutls_session_t
|
||||
return ret;
|
||||
}
|
||||
|
||||
+#ifdef ENABLE_ECDHE
|
||||
static int
|
||||
gen_ecdhe_psk_server_kx (gnutls_session_t session, gnutls_buffer_st* data)
|
||||
{
|
||||
@@ -254,7 +257,7 @@ gen_ecdhe_psk_server_kx (gnutls_session_
|
||||
|
||||
return ret;
|
||||
}
|
||||
-
|
||||
+#endif
|
||||
|
||||
static int
|
||||
proc_dhe_psk_client_kx (gnutls_session_t session, uint8_t * data,
|
||||
@@ -335,6 +338,7 @@ proc_dhe_psk_client_kx (gnutls_session_t
|
||||
|
||||
}
|
||||
|
||||
+#ifdef ENABLE_ECDHE
|
||||
static int
|
||||
proc_ecdhe_psk_client_kx (gnutls_session_t session, uint8_t * data,
|
||||
size_t _data_size)
|
||||
@@ -399,6 +403,7 @@ proc_ecdhe_psk_client_kx (gnutls_session
|
||||
|
||||
return ret;
|
||||
}
|
||||
+#endif
|
||||
|
||||
static int
|
||||
proc_dhe_psk_server_kx (gnutls_session_t session, uint8_t * data,
|
||||
@@ -432,6 +437,7 @@ proc_dhe_psk_server_kx (gnutls_session_t
|
||||
return 0;
|
||||
}
|
||||
|
||||
+#ifdef ENABLE_ECDHE
|
||||
static int
|
||||
proc_ecdhe_psk_server_kx (gnutls_session_t session, uint8_t * data,
|
||||
size_t _data_size)
|
||||
@@ -463,5 +469,6 @@ proc_ecdhe_psk_server_kx (gnutls_session
|
||||
|
||||
return 0;
|
||||
}
|
||||
+#endif
|
||||
|
||||
#endif /* ENABLE_PSK */
|
||||
Index: gnutls-3.2.1/lib/ext/ecc.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/ext/ecc.c
|
||||
+++ gnutls-3.2.1/lib/ext/ecc.c
|
||||
@@ -35,6 +35,7 @@
|
||||
/* Maps record size to numbers according to the
|
||||
* extensions draft.
|
||||
*/
|
||||
+#ifdef ENABLE_ECC
|
||||
|
||||
static int _gnutls_supported_ecc_recv_params (gnutls_session_t session,
|
||||
const uint8_t * data,
|
||||
@@ -269,3 +270,5 @@ _gnutls_session_supports_ecc_curve (gnut
|
||||
|
||||
return GNUTLS_E_ECC_UNSUPPORTED_CURVE;
|
||||
}
|
||||
+
|
||||
+#endif
|
||||
Index: gnutls-3.2.1/lib/gnutls_extensions.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/gnutls_extensions.c
|
||||
+++ gnutls-3.2.1/lib/gnutls_extensions.c
|
||||
@@ -351,6 +351,7 @@ _gnutls_ext_init (void)
|
||||
if (ret != GNUTLS_E_SUCCESS)
|
||||
return ret;
|
||||
|
||||
+#ifdef ENABLE_ECC
|
||||
ret = _gnutls_ext_register (&ext_mod_supported_ecc);
|
||||
if (ret != GNUTLS_E_SUCCESS)
|
||||
return ret;
|
||||
@@ -358,6 +359,7 @@ _gnutls_ext_init (void)
|
||||
ret = _gnutls_ext_register (&ext_mod_supported_ecc_pf);
|
||||
if (ret != GNUTLS_E_SUCCESS)
|
||||
return ret;
|
||||
+#endif
|
||||
|
||||
ret = _gnutls_ext_register (&ext_mod_sig);
|
||||
if (ret != GNUTLS_E_SUCCESS)
|
||||
Index: gnutls-3.2.1/lib/gnutls_priority.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/gnutls_priority.c
|
||||
+++ gnutls-3.2.1/lib/gnutls_priority.c
|
||||
@@ -245,35 +245,45 @@ gnutls_certificate_type_set_priority (gn
|
||||
}
|
||||
|
||||
static const int supported_ecc_normal[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_ECC_CURVE_SECP192R1,
|
||||
GNUTLS_ECC_CURVE_SECP224R1,
|
||||
GNUTLS_ECC_CURVE_SECP256R1,
|
||||
GNUTLS_ECC_CURVE_SECP384R1,
|
||||
GNUTLS_ECC_CURVE_SECP521R1,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int supported_ecc_secure128[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_ECC_CURVE_SECP256R1,
|
||||
GNUTLS_ECC_CURVE_SECP384R1,
|
||||
GNUTLS_ECC_CURVE_SECP521R1,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int supported_ecc_suiteb128[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_ECC_CURVE_SECP256R1,
|
||||
GNUTLS_ECC_CURVE_SECP384R1,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int supported_ecc_suiteb192[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_ECC_CURVE_SECP384R1,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int supported_ecc_secure192[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_ECC_CURVE_SECP384R1,
|
||||
GNUTLS_ECC_CURVE_SECP521R1,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
@@ -458,51 +468,75 @@ static const int comp_priority[] = {
|
||||
static const int sign_priority_default[] = {
|
||||
GNUTLS_SIGN_RSA_SHA256,
|
||||
GNUTLS_SIGN_DSA_SHA256,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA256,
|
||||
+#endif
|
||||
|
||||
GNUTLS_SIGN_RSA_SHA384,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA384,
|
||||
+#endif
|
||||
|
||||
GNUTLS_SIGN_RSA_SHA512,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA512,
|
||||
+#endif
|
||||
|
||||
GNUTLS_SIGN_RSA_SHA224,
|
||||
GNUTLS_SIGN_DSA_SHA224,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA224,
|
||||
+#endif
|
||||
|
||||
GNUTLS_SIGN_RSA_SHA1,
|
||||
GNUTLS_SIGN_DSA_SHA1,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA1,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int sign_priority_suiteb128[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA256,
|
||||
GNUTLS_SIGN_ECDSA_SHA384,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int sign_priority_suiteb192[] = {
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA384,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int sign_priority_secure128[] = {
|
||||
GNUTLS_SIGN_RSA_SHA256,
|
||||
GNUTLS_SIGN_DSA_SHA256,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA256,
|
||||
+#endif
|
||||
GNUTLS_SIGN_RSA_SHA384,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA384,
|
||||
+#endif
|
||||
GNUTLS_SIGN_RSA_SHA512,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA512,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
static const int sign_priority_secure192[] = {
|
||||
GNUTLS_SIGN_RSA_SHA384,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA384,
|
||||
+#endif
|
||||
GNUTLS_SIGN_RSA_SHA512,
|
||||
+#ifdef ENABLE_ECC
|
||||
GNUTLS_SIGN_ECDSA_SHA512,
|
||||
+#endif
|
||||
0
|
||||
};
|
||||
|
||||
Index: gnutls-3.2.1/lib/nettle/pk.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/nettle/pk.c
|
||||
+++ gnutls-3.2.1/lib/nettle/pk.c
|
||||
@@ -146,6 +146,7 @@ static int _wrap_nettle_pk_derive(gnutls
|
||||
|
||||
switch (algo)
|
||||
{
|
||||
+#ifdef ENABLE_ECC
|
||||
case GNUTLS_PK_EC:
|
||||
{
|
||||
struct ecc_scalar ecc_priv;
|
||||
@@ -186,6 +187,7 @@ ecc_cleanup:
|
||||
if (ret < 0) goto cleanup;
|
||||
break;
|
||||
}
|
||||
+#endif
|
||||
default:
|
||||
gnutls_assert ();
|
||||
ret = GNUTLS_E_INTERNAL_ERROR;
|
||||
@@ -330,6 +332,7 @@ _wrap_nettle_pk_sign (gnutls_pk_algorith
|
||||
|
||||
switch (algo)
|
||||
{
|
||||
+#ifdef ENABLE_ECC
|
||||
case GNUTLS_PK_EC: /* we do ECDSA */
|
||||
{
|
||||
struct ecc_scalar priv;
|
||||
@@ -369,6 +372,7 @@ _wrap_nettle_pk_sign (gnutls_pk_algorith
|
||||
}
|
||||
break;
|
||||
}
|
||||
+#endif
|
||||
case GNUTLS_PK_DSA:
|
||||
{
|
||||
struct dsa_public_key pub;
|
||||
@@ -470,6 +474,7 @@ _wrap_nettle_pk_verify (gnutls_pk_algori
|
||||
|
||||
switch (algo)
|
||||
{
|
||||
+#ifdef ENABLE_ECC
|
||||
case GNUTLS_PK_EC: /* ECDSA */
|
||||
{
|
||||
struct ecc_point pub;
|
||||
@@ -511,6 +516,7 @@ _wrap_nettle_pk_verify (gnutls_pk_algori
|
||||
ecc_point_clear( &pub);
|
||||
break;
|
||||
}
|
||||
+#endif
|
||||
case GNUTLS_PK_DSA:
|
||||
{
|
||||
struct dsa_public_key pub;
|
||||
@@ -717,6 +723,7 @@ rsa_fail:
|
||||
|
||||
break;
|
||||
}
|
||||
+#ifdef ENABLE_ECC
|
||||
case GNUTLS_PK_EC:
|
||||
{
|
||||
struct ecc_scalar key;
|
||||
@@ -757,6 +764,7 @@ ecc_cleanup:
|
||||
|
||||
break;
|
||||
}
|
||||
+#endif
|
||||
default:
|
||||
gnutls_assert ();
|
||||
return GNUTLS_E_INVALID_REQUEST;
|
||||
@@ -873,6 +881,7 @@ dsa_cleanup:
|
||||
}
|
||||
|
||||
break;
|
||||
+#ifdef ENABLE_ECC
|
||||
case GNUTLS_PK_EC:
|
||||
{
|
||||
struct ecc_point r, pub;
|
||||
@@ -934,6 +943,7 @@ ecc_cleanup:
|
||||
ecc_point_clear(&pub);
|
||||
}
|
||||
break;
|
||||
+#endif
|
||||
default:
|
||||
ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
|
||||
}
|
||||
Index: gnutls-3.2.1/tests/cert-tests/dane
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/cert-tests/dane
|
||||
+++ gnutls-3.2.1/tests/cert-tests/dane
|
||||
@@ -22,6 +22,8 @@
|
||||
|
||||
set -e
|
||||
|
||||
+exit 77
|
||||
+
|
||||
srcdir=${srcdir:-.}
|
||||
DANETOOL=${DANETOOL:-../../src/danetool$EXEEXT}
|
||||
|
||||
Index: gnutls-3.2.1/tests/dtls/dtls-nb
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/dtls/dtls-nb
|
||||
+++ gnutls-3.2.1/tests/dtls/dtls-nb
|
||||
@@ -22,9 +22,7 @@
|
||||
|
||||
set -e
|
||||
|
||||
-if test "${WINDIR}" != "";then
|
||||
- exit 77
|
||||
-fi
|
||||
+exit 77
|
||||
|
||||
./dtls-stress -nb -shello 021 -sfinished 01 -cfinished 012 SKeyExchange CKeyExchange CFinished
|
||||
./dtls-stress -nb -shello 012 -sfinished 10 -cfinished 210 SHello SKeyExchange SHelloDone
|
||||
Index: gnutls-3.2.1/tests/dtls/dtls
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/dtls/dtls
|
||||
+++ gnutls-3.2.1/tests/dtls/dtls
|
||||
@@ -22,9 +22,7 @@
|
||||
|
||||
set -e
|
||||
|
||||
-if test "${WINDIR}" != "";then
|
||||
- exit 77
|
||||
-fi
|
||||
+exit 77
|
||||
|
||||
./dtls-stress -shello 021 -sfinished 01 -cfinished 012 SKeyExchange CKeyExchange CFinished
|
||||
./dtls-stress -shello 012 -sfinished 10 -cfinished 210 SHello SKeyExchange SHelloDone
|
||||
Index: gnutls-3.2.1/tests/ecdsa/ecdsa
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/ecdsa/ecdsa
|
||||
+++ gnutls-3.2.1/tests/ecdsa/ecdsa
|
||||
@@ -22,6 +22,8 @@
|
||||
|
||||
#set -e
|
||||
|
||||
+exit 77
|
||||
+
|
||||
srcdir=${srcdir:-.}
|
||||
CERTTOOL=${CERTTOOL:-../../src/certtool$EXEEXT}
|
||||
|
||||
Index: gnutls-3.2.1/tests/mini-dtls-heartbeat.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-dtls-heartbeat.c
|
||||
+++ gnutls-3.2.1/tests/mini-dtls-heartbeat.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32) || !defined(ENABLE_HEARTBEAT)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_HEARTBEAT) || !defined(ENABLE_ECC)
|
||||
|
||||
int
|
||||
main ()
|
||||
Index: gnutls-3.2.1/tests/mini-dtls-record.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-dtls-record.c
|
||||
+++ gnutls-3.2.1/tests/mini-dtls-record.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int
|
||||
main ()
|
||||
Index: gnutls-3.2.1/tests/mini-dtls-rehandshake.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-dtls-rehandshake.c
|
||||
+++ gnutls-3.2.1/tests/mini-dtls-rehandshake.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/mini-dtls-srtp.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-dtls-srtp.c
|
||||
+++ gnutls-3.2.1/tests/mini-dtls-srtp.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32) || !defined(ENABLE_DTLS_SRTP)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_DTLS_SRTP) || !defined(ENABLE_ECC)
|
||||
|
||||
int
|
||||
main (int argc, char** argv)
|
||||
Index: gnutls-3.2.1/tests/mini-handshake-timeout.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-handshake-timeout.c
|
||||
+++ gnutls-3.2.1/tests/mini-handshake-timeout.c
|
||||
@@ -28,7 +28,7 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int main()
|
||||
{
|
||||
@@ -142,7 +142,11 @@ initialize_tls_session (gnutls_session_t
|
||||
/* avoid calling all the priority functions, since the defaults
|
||||
* are adequate.
|
||||
*/
|
||||
- gnutls_priority_set_direct (*session, "NORMAL:+ANON-ECDH", NULL);
|
||||
+#ifdef ENABLE_ECC
|
||||
+ gnutls_priority_set_direct (session, "NORMAL:+ANON-ECDH", NULL);
|
||||
+#else
|
||||
+ gnutls_priority_set_direct (session, "NORMAL:+ANON-DH", NULL);
|
||||
+#endif
|
||||
}
|
||||
|
||||
static void
|
||||
Index: gnutls-3.2.1/tests/mini-loss-time.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-loss-time.c
|
||||
+++ gnutls-3.2.1/tests/mini-loss-time.c
|
||||
@@ -28,7 +28,7 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/mini-record.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-record.c
|
||||
+++ gnutls-3.2.1/tests/mini-record.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/mini-record-range.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-record-range.c
|
||||
+++ gnutls-3.2.1/tests/mini-record-range.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/mini-xssl.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-xssl.c
|
||||
+++ gnutls-3.2.1/tests/mini-xssl.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECC)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/pkcs12_simple.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/pkcs12_simple.c
|
||||
+++ gnutls-3.2.1/tests/pkcs12_simple.c
|
||||
@@ -50,6 +50,10 @@ doit (void)
|
||||
gnutls_x509_privkey_t pkey;
|
||||
int ret;
|
||||
|
||||
+#ifndef ENABLE_ECC
|
||||
+ exit(77);
|
||||
+#endif
|
||||
+
|
||||
ret = global_init ();
|
||||
if (ret < 0)
|
||||
fail ("global_init failed %d\n", ret);
|
||||
Index: gnutls-3.2.1/tests/slow/keygen.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/slow/keygen.c
|
||||
+++ gnutls-3.2.1/tests/slow/keygen.c
|
||||
@@ -65,6 +65,11 @@ doit (void)
|
||||
if (algorithm == GNUTLS_PK_DH)
|
||||
continue;
|
||||
|
||||
+#ifndef ENABLE_ECC
|
||||
+ if (algorithm == GNUTLS_PK_EC)
|
||||
+ continue;
|
||||
+#endif
|
||||
+
|
||||
ret = gnutls_x509_privkey_init (&pkey);
|
||||
if (ret < 0)
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/srp/mini-srp.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/srp/mini-srp.c
|
||||
+++ gnutls-3.2.1/tests/srp/mini-srp.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_SRP)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/lib/auth/ecdhe.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/lib/auth/ecdhe.c
|
||||
+++ gnutls-3.2.1/lib/auth/ecdhe.c
|
||||
@@ -50,7 +50,7 @@ static int
|
||||
proc_ecdhe_client_kx (gnutls_session_t session,
|
||||
uint8_t * data, size_t _data_size);
|
||||
|
||||
-#if defined(ENABLE_ECDHE)
|
||||
+#if defined(ENABLE_ECDHE) && defined(ENABLE_ECC)
|
||||
const mod_auth_st ecdhe_ecdsa_auth_struct = {
|
||||
"ECDHE_ECDSA",
|
||||
_gnutls_gen_cert_server_crt,
|
||||
Index: gnutls-3.2.1/tests/mini-dtls-hello-verify.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-dtls-hello-verify.c
|
||||
+++ gnutls-3.2.1/tests/mini-dtls-hello-verify.c
|
||||
@@ -27,7 +27,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ECDH)
|
||||
|
||||
int main()
|
||||
{
|
||||
Index: gnutls-3.2.1/tests/mini-alpn.c
|
||||
===================================================================
|
||||
--- gnutls-3.2.1.orig/tests/mini-alpn.c
|
||||
+++ gnutls-3.2.1/tests/mini-alpn.c
|
||||
@@ -25,7 +25,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
-#if defined(_WIN32) || !defined(ENABLE_ALPN)
|
||||
+#if defined(_WIN32) || !defined(ENABLE_ALPN) || !defined(ENABLE_ECDH)
|
||||
|
||||
int
|
||||
main (int argc, char** argv)
|
3
gnutls-3.2.1.tar.xz
Normal file
3
gnutls-3.2.1.tar.xz
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:abfa8165947837ada2363355ada25d913f48e6bb261f0a67f20d2fb6079e22fe
|
||||
size 5127332
|
BIN
gnutls-3.2.1.tar.xz.sig
Normal file
BIN
gnutls-3.2.1.tar.xz.sig
Normal file
Binary file not shown.
35
gnutls-32bit.patch
Normal file
35
gnutls-32bit.patch
Normal file
@ -0,0 +1,35 @@
|
||||
From b12040aeab5fbaf02677571db1d8bf1995bd5ee0 Mon Sep 17 00:00:00 2001
|
||||
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
|
||||
Date: Sun, 2 Jun 2013 12:10:06 +0200
|
||||
Subject: [PATCH] Avoid comparing the expiration date to prevent false positive error in 32-bit systems.
|
||||
|
||||
---
|
||||
tests/cert-tests/pem-decoding | 6 ++++--
|
||||
1 files changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/tests/cert-tests/pem-decoding b/tests/cert-tests/pem-decoding
|
||||
index fe769ec..f8c6372 100755
|
||||
--- a/tests/cert-tests/pem-decoding
|
||||
+++ b/tests/cert-tests/pem-decoding
|
||||
@@ -61,7 +61,9 @@ if test "$rc" != "0"; then
|
||||
exit $rc
|
||||
fi
|
||||
|
||||
-diff $srcdir/complex-cert.pem tmp-pem.pem
|
||||
+cat $srcdir/complex-cert.pem |grep -v "Not After:" >tmp1
|
||||
+cat $srcdir/tmp-pem.pem |grep -v "Not After:" >tmp2
|
||||
+diff tmp1 tmp2
|
||||
rc=$?
|
||||
|
||||
if test "$rc" != "0"; then
|
||||
@@ -69,6 +71,6 @@ if test "$rc" != "0"; then
|
||||
exit $rc
|
||||
fi
|
||||
|
||||
-rm -f tmp-pem.pem
|
||||
+rm -f tmp-pem.pem tmp1 tmp2
|
||||
|
||||
exit 0
|
||||
--
|
||||
1.7.1
|
||||
|
@ -1,33 +1,34 @@
|
||||
From a6cef9220ae251e3b8f8d663c5fa7f888e3176d8 Mon Sep 17 00:00:00 2001
|
||||
From: Ludwig Nussel <ludwig.nussel@suse.de>
|
||||
Date: Tue, 8 May 2012 15:47:02 +0200
|
||||
Subject: [PATCH gnutls] implement trust store dir
|
||||
|
||||
(since updated as some parts were introduced upstream)
|
||||
|
||||
---
|
||||
configure.ac | 18 ++++++++++++-
|
||||
lib/gnutls_x509.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
|
||||
2 files changed, 90 insertions(+), 2 deletions(-)
|
||||
|
||||
Index: configure.ac
|
||||
Index: gnutls-3.2.1/configure.ac
|
||||
===================================================================
|
||||
--- configure.ac.orig 2012-11-08 23:05:32.000000000 +0000
|
||||
+++ configure.ac 2012-11-16 23:18:51.000000000 +0000
|
||||
@@ -301,9 +301,11 @@ AC_ARG_WITH([default-crl-file],
|
||||
--- gnutls-3.2.1.orig/configure.ac
|
||||
+++ gnutls-3.2.1/configure.ac
|
||||
@@ -398,6 +398,25 @@ if test "$with_default_trust_store_file"
|
||||
with_default_trust_store_file=""
|
||||
fi
|
||||
|
||||
+AC_ARG_WITH([default-trust-store-dir],
|
||||
+ [AS_HELP_STRING([--with-default-trust-store-dir=DIRECTORY],
|
||||
+ [use the given directory as default trust store])], with_default_trust_store_dir="$withval",
|
||||
+ [if test "$build" = "$host" ; then
|
||||
+ for i in \
|
||||
+ /etc/ssl/certs/
|
||||
+ do
|
||||
+ if test -e $i ; then
|
||||
+ with_default_trust_store_dir="$i"
|
||||
+ break
|
||||
+ fi
|
||||
+ done
|
||||
+ fi]
|
||||
+)
|
||||
+
|
||||
+if test "$with_default_trust_store_dir" = "no";then
|
||||
+ with_default_trust_store_dir=""
|
||||
+fi
|
||||
+
|
||||
AC_ARG_WITH([default-crl-file],
|
||||
[AS_HELP_STRING([--with-default-crl-file=FILE],
|
||||
[use the given CRL file as default])])
|
||||
|
||||
-if test "x$with_default_trust_store_pkcs11" = x -a "x$with_default_trust_store_file" = x; then
|
||||
+if test "x$with_default_trust_store_pkcs11" = x -a "x$with_default_trust_store_file" = x \
|
||||
+ -a "x$with_default_trust_store_dir" = x; then
|
||||
# auto detect http://lists.gnu.org/archive/html/help-gnutls/2012-05/msg00004.html
|
||||
for i in \
|
||||
+ /etc/ssl/certs \
|
||||
/etc/ssl/certs/ca-certificates.crt \
|
||||
/etc/pki/tls/cert.pem \
|
||||
/usr/local/share/certs/ca-root-nss.crt \
|
||||
@@ -321,6 +323,11 @@ if test "x$with_default_trust_store_file
|
||||
@@ -407,6 +426,11 @@ if test "x$with_default_trust_store_file
|
||||
["$with_default_trust_store_file"], [use the given file default trust store])
|
||||
fi
|
||||
|
||||
@ -39,117 +40,115 @@ Index: configure.ac
|
||||
if test "x$with_default_crl_file" != x; then
|
||||
AC_DEFINE_UNQUOTED([DEFAULT_CRL_FILE],
|
||||
["$with_default_crl_file"], [use the given CRL file])
|
||||
@@ -562,6 +569,7 @@ if features are disabled)
|
||||
@@ -683,6 +707,7 @@ AC_MSG_NOTICE([System files:
|
||||
|
||||
Trust store pkcs: $with_default_trust_store_pkcs11
|
||||
Trust store file: $with_default_trust_store_file
|
||||
+ Trust store dir: $with_default_trust_store_dir
|
||||
CRL file: $with_default_crl_file
|
||||
Trust store pkcs: $with_default_trust_store_pkcs11
|
||||
Trust store file: $with_default_trust_store_file
|
||||
+ Trust store dir: $with_default_trust_store_dir
|
||||
CRL file: $with_default_crl_file
|
||||
DNSSEC root key file: $unbound_root_key_file
|
||||
])
|
||||
|
||||
Index: lib/gnutls_x509.c
|
||||
Index: gnutls-3.2.1/lib/system.c
|
||||
===================================================================
|
||||
--- lib/gnutls_x509.c.orig 2012-09-22 01:01:26.000000000 +0100
|
||||
+++ lib/gnutls_x509.c 2012-11-16 23:16:31.000000000 +0000
|
||||
@@ -36,6 +36,7 @@
|
||||
#include <gnutls_pk.h>
|
||||
#include <gnutls_str.h>
|
||||
#include <debug.h>
|
||||
+#include <dirent.h>
|
||||
#include <x509_b64.h>
|
||||
#include <gnutls_x509.h>
|
||||
#include "x509/common.h"
|
||||
@@ -1694,6 +1695,72 @@ set_x509_system_trust_file (gnutls_certi
|
||||
--- gnutls-3.2.1.orig/lib/system.c
|
||||
+++ gnutls-3.2.1/lib/system.c
|
||||
@@ -385,7 +385,45 @@ const char *home_dir = getenv ("HOME");
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
|
||||
+#ifdef DEFAULT_TRUST_STORE_DIR
|
||||
+static int
|
||||
+_gnutls_certificate_set_x509_system_trust_dir (gnutls_certificate_credentials_t cred)
|
||||
-#if defined(DEFAULT_TRUST_STORE_FILE) || (defined(DEFAULT_TRUST_STORE_PKCS11) && defined(ENABLE_PKCS11))
|
||||
+/* Used by both Android code and by Linux TRUST_STORE_DIR /etc/ssl/certs code */
|
||||
+#if defined(DEFAULT_TRUST_STORE_DIR) || defined(ANDROID) || defined(__ANDROID__)
|
||||
+# include <dirent.h>
|
||||
+# include <unistd.h>
|
||||
+static int load_dir_certs(const char* dirname, gnutls_x509_trust_list_t list,
|
||||
+ unsigned int tl_flags, unsigned int tl_vflags, unsigned type)
|
||||
+{
|
||||
+ DIR* dir;
|
||||
+ struct dirent* buf, *de;
|
||||
+ int ret, r = 0;
|
||||
+ gnutls_datum_t cas;
|
||||
+ size_t size;
|
||||
+ char cafile[PATH_MAX];
|
||||
+DIR * dirp;
|
||||
+struct dirent *d;
|
||||
+int ret;
|
||||
+int r = 0;
|
||||
+char path[GNUTLS_PATH_MAX];
|
||||
+
|
||||
+ dir = opendir(DEFAULT_TRUST_STORE_DIR);
|
||||
+ if (dir == NULL)
|
||||
+ dirp = opendir(dirname);
|
||||
+ if (dirp != NULL)
|
||||
+ {
|
||||
+ gnutls_assert ();
|
||||
+ return GNUTLS_E_FILE_ERROR;
|
||||
+ do
|
||||
+ {
|
||||
+ d = readdir(dirp);
|
||||
+ if (d != NULL && d->d_type == DT_REG)
|
||||
+ {
|
||||
+ snprintf(path, sizeof(path), "%s/%s", dirname, d->d_name);
|
||||
+
|
||||
+ ret = gnutls_x509_trust_list_add_trust_file(list, path, NULL, type, tl_flags, tl_vflags);
|
||||
+ if (ret >= 0)
|
||||
+ r += ret;
|
||||
+ }
|
||||
+ }
|
||||
+ while(d != NULL);
|
||||
+ closedir(dirp);
|
||||
+ }
|
||||
+
|
||||
+ buf = alloca(offsetof(struct dirent, d_name) + pathconf(DEFAULT_TRUST_STORE_DIR, _PC_NAME_MAX) + 1);
|
||||
+
|
||||
+ while (1)
|
||||
+ {
|
||||
+ if (readdir_r(dir, buf, &de))
|
||||
+ {
|
||||
+ gnutls_assert();
|
||||
+ break;
|
||||
+ }
|
||||
+ if (de == NULL)
|
||||
+ {
|
||||
+ break;
|
||||
+ }
|
||||
+ if (strlen(de->d_name) < 4 || strcmp(de->d_name+strlen(de->d_name)-4, ".pem"))
|
||||
+ {
|
||||
+ continue;
|
||||
+ }
|
||||
+
|
||||
+ strcpy(cafile, DEFAULT_TRUST_STORE_DIR "/");
|
||||
+ strncat(cafile, de->d_name, sizeof(cafile)-strlen(cafile)-1);
|
||||
+ cas.data = (void*)read_binary_file (cafile, &size);
|
||||
+ if (cas.data == NULL)
|
||||
+ {
|
||||
+ gnutls_assert ();
|
||||
+ continue;
|
||||
+ }
|
||||
+
|
||||
+ cas.size = size;
|
||||
+
|
||||
+ ret = gnutls_certificate_set_x509_trust_mem(cred, &cas, GNUTLS_X509_FMT_PEM);
|
||||
+
|
||||
+ free (cas.data);
|
||||
+
|
||||
+ if (ret < 0)
|
||||
+ {
|
||||
+ gnutls_assert ();
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ r += ret;
|
||||
+ }
|
||||
+ }
|
||||
+ closedir(dir);
|
||||
+
|
||||
+
|
||||
+ return r;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
/**
|
||||
* gnutls_certificate_set_x509_system_trust:
|
||||
* @cred: is a #gnutls_certificate_credentials_t structure.
|
||||
@@ -1712,7 +1779,7 @@ set_x509_system_trust_file (gnutls_certi
|
||||
+
|
||||
+#if defined(DEFAULT_TRUST_STORE_FILE) || (defined(DEFAULT_TRUST_STORE_PKCS11) && defined(ENABLE_PKCS11)) || defined(DEFAULT_TRUST_STORE_DIR)
|
||||
+
|
||||
static
|
||||
int
|
||||
gnutls_certificate_set_x509_system_trust (gnutls_certificate_credentials_t cred)
|
||||
{
|
||||
-#if !defined(_WIN32) && !defined(DEFAULT_TRUST_STORE_PKCS11) && !defined(DEFAULT_TRUST_STORE_FILE)
|
||||
+#if !defined(_WIN32) && !defined(DEFAULT_TRUST_STORE_PKCS11) && !defined(DEFAULT_TRUST_STORE_FILE) && !defined(DEFAULT_TRUST_STORE_DIR)
|
||||
int r = GNUTLS_E_UNIMPLEMENTED_FEATURE;
|
||||
#else
|
||||
int ret, r = 0;
|
||||
@@ -1730,6 +1797,11 @@ gnutls_certificate_set_x509_system_trust
|
||||
add_system_trust(gnutls_x509_trust_list_t list,
|
||||
@@ -413,6 +451,12 @@ add_system_trust(gnutls_x509_trust_list_
|
||||
r += ret;
|
||||
#endif
|
||||
# endif
|
||||
|
||||
+#ifdef DEFAULT_TRUST_STORE_DIR
|
||||
+ ret = _gnutls_certificate_set_x509_system_trust_dir(cred);
|
||||
+# ifdef DEFAULT_TRUST_STORE_DIR
|
||||
+ ret = load_dir_certs(DEFAULT_TRUST_STORE_DIR, list, tl_flags, tl_vflags, GNUTLS_X509_FMT_PEM);
|
||||
+ if (ret > 0)
|
||||
+ r += ret;
|
||||
+#endif
|
||||
+# endif
|
||||
+
|
||||
return r;
|
||||
}
|
||||
|
||||
#elif defined(_WIN32)
|
||||
@@ -466,39 +510,6 @@ int add_system_trust(gnutls_x509_trust_l
|
||||
return r;
|
||||
}
|
||||
#elif defined(ANDROID) || defined(__ANDROID__)
|
||||
-# include <dirent.h>
|
||||
-# include <unistd.h>
|
||||
-static int load_dir_certs(const char* dirname, gnutls_x509_trust_list_t list,
|
||||
- unsigned int tl_flags, unsigned int tl_vflags, unsigned type)
|
||||
-{
|
||||
-DIR * dirp;
|
||||
-struct dirent *d;
|
||||
-int ret;
|
||||
-int r = 0;
|
||||
-char path[GNUTLS_PATH_MAX];
|
||||
-
|
||||
- dirp = opendir(dirname);
|
||||
- if (dirp != NULL)
|
||||
- {
|
||||
- do
|
||||
- {
|
||||
- d = readdir(dirp);
|
||||
- if (d != NULL && d->d_type == DT_REG)
|
||||
- {
|
||||
- snprintf(path, sizeof(path), "%s/%s", dirname, d->d_name);
|
||||
-
|
||||
- ret = gnutls_x509_trust_list_add_trust_file(list, path, NULL, type, tl_flags, tl_vflags);
|
||||
- if (ret >= 0)
|
||||
- r += ret;
|
||||
- }
|
||||
- }
|
||||
- while(d != NULL);
|
||||
- closedir(dirp);
|
||||
- }
|
||||
-
|
||||
- return r;
|
||||
-}
|
||||
-
|
||||
static int load_revoked_certs(gnutls_x509_trust_list_t list, unsigned type)
|
||||
{
|
||||
DIR * dirp;
|
||||
|
279
gnutls.changes
279
gnutls.changes
@ -1,3 +1,282 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Jun 27 13:44:12 UTC 2013 - meissner@suse.com
|
||||
|
||||
- Disable all ECC algorithms.
|
||||
|
||||
- gnutls-32bit.patch: upstream patch to make test
|
||||
work with 32bit time_t.
|
||||
|
||||
- gnutls-implement-trust-store-dir.diff
|
||||
|
||||
currently not yet forward ported.
|
||||
|
||||
- Updated to GnuTLS 3.2.1
|
||||
** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain
|
||||
openssl versions.
|
||||
** libgnutls: Fixes in interrupted function resumption. Report
|
||||
and patch by Tim Kosse.
|
||||
** libgnutls: Corrected issue when receiving client hello verify
|
||||
requests in DTLS.
|
||||
** libgnutls: Fixes in DTLS record overhead size calculations.
|
||||
** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by
|
||||
Mann Ern Kang.
|
||||
- Updated to GnuTLS 3.2.0
|
||||
** libgnutls: Use nettle's elliptic curve implementation.
|
||||
** libgnutls: Added Salsa20 cipher
|
||||
** libgnutls: Added UMAC-96 and UMAC-128
|
||||
** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96.
|
||||
As they are not standardized they are defined using private ciphersuite numbers.
|
||||
** libgnutls: Added support for DTLS 1.2.
|
||||
** libgnutls: Added support for the Application Layer Protocol
|
||||
Negotiation (ALPN) extension.
|
||||
** libgnutls: Removed support for the RSA-EXPORT ciphersuites.
|
||||
** libgnutls: Avoid linking to librt (that also avoids unnecessary
|
||||
linking to pthreads if p11-kit isn't used).
|
||||
|
||||
- Updated to GnuTLS 3.1.10 (released 2013-03-22)
|
||||
** certtool: When generating PKCS #12 files use by default the
|
||||
ARCFOUR (RC4) cipher to be compatible with devices that don't
|
||||
support AES with PKCS #12.
|
||||
** libgnutls: Load CA certificates in android 4.x systems.
|
||||
** libgnutls: Optimized CA certificate loading.
|
||||
** libgnutls: Private keys are overwritten on deinitialization.
|
||||
** libgnutls: PKCS #11 slots are scanned only when needed, not
|
||||
on initialization. This speeds up gnutls initialization when smart
|
||||
cards are present.
|
||||
** libgnutls: Corrected issue in the (deprecated) external key
|
||||
signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen.
|
||||
** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by
|
||||
Joke de Buhr.
|
||||
** libgnutls-dane: Updated DANE verification options.
|
||||
** configure: Trust store file must be explicitly set or unset when
|
||||
cross compiling.
|
||||
- Updated to GnuTLS 3.1.9 (released 2013-02-27)
|
||||
** certtool: Option --to-p12 will now ask for a password to generate
|
||||
a PKCS #12 file from an encrypted key file. Reported by Yan Fiz.
|
||||
** libgnutls: Corrected issue in gnutls_pubkey_verify_data().
|
||||
** libgnutls: Corrected parsing issue in XMPP within a subject
|
||||
alternative name. Reported by James Cloos.
|
||||
** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11
|
||||
modules, and not only the ones loaded via p11-kit.
|
||||
** libgnutls: Added function to check whether the private key is
|
||||
still available (inserted).
|
||||
** libgnutls: Try to detect fork even during nonce generation.
|
||||
|
||||
- Updated to GnuTLS 3.1.8 (released 2013-02-10)
|
||||
** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return
|
||||
GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation
|
||||
with encrypted keys. Reported by Yan Fiz.
|
||||
** libgnutls: The minimum DH bits accepted by priorities NORMAL and
|
||||
PERFORMANCE was set to previous defaults 727 bits. Reported by Diego
|
||||
Elio Petteno.
|
||||
** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash()
|
||||
to operate with long keys. Reported by Erik A Jensen.
|
||||
|
||||
- Updated to GnuTLS 3.1.7 (released 2013-02-04)
|
||||
** certtool: Added option "dn" which allows to directly set the DN
|
||||
in a template from an RFC4514 string.
|
||||
** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters.
|
||||
** libgnutls-xssl: Added a new library to simplify GnuTLS usage.
|
||||
** libgnutls-dane: Added function to specify a DLV file.
|
||||
** libgnutls: Heartbeat code was made optional.
|
||||
** libgnutls: Fixes in server side of DTLS-0.9.
|
||||
** libgnutls: DN variable 'T' was expanded to 'title'.
|
||||
** libgnutls: Fixes in record padding parsing to prevent a timing attack.
|
||||
Issue reported by Kenny Paterson and Nadhem Alfardan.
|
||||
** libgnutls: Added functions to directly set the DN in a certificate
|
||||
or request from an RFC4514 string.
|
||||
** libgnutls: Optimizations in the random generator. The re-seeding of
|
||||
it is now explicitly done on every session deinit.
|
||||
** libgnutls: Simplified the DTLS sliding window implementation.
|
||||
** libgnutls: The minimum DH bits accepted by a client are now set
|
||||
by the specified priority string. The current values correspond to the
|
||||
previous defaults (727 bits), except for the SECURE128 and SECURE192
|
||||
strings which increase the minimum to 1248 and 1776 respectively.
|
||||
** libgnutls: Added the gnutls_record_cork() and uncork API to enable
|
||||
buffering in sending application data.
|
||||
** libgnutls: Removed default random padding, and added a length-hiding interface
|
||||
instead. Both the server and the client must support this extension. Whether
|
||||
length-hiding can be used on a given session can be checked using
|
||||
gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti.
|
||||
** libgnutls: Added the experimental %NEW_PADDING priority string. It enables
|
||||
a new padding mechanism in TLS allowing arbitrary padding in TLS records
|
||||
in all ciphersuites, which makes length-hiding more efficient and solves
|
||||
the issues with timing attacks on CBC ciphersuites.
|
||||
** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD
|
||||
ciphers (i.e., AES-GCM). Reported by William McGovern.
|
||||
|
||||
- Updated to GnuTLS 3.1.6 (released 2013-01-02)
|
||||
** libgnutls: Fixed record padding parsing issue. Reported by Kenny
|
||||
Patterson and Nadhem Alfardan.
|
||||
** libgnutls: Several updates in the ASN.1 string handling subsystem.
|
||||
** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero
|
||||
policy qualifiers.
|
||||
** libgnutls: Ignore heartbeat messages when received out-of-order,
|
||||
instead of issuing an error.
|
||||
** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported
|
||||
by Kikuchi Masashi.
|
||||
** libgnutls: TPM support is disabled by default because GPL programs
|
||||
cannot link with it. Use --with-tpm to enable it.
|
||||
** libgnutls-guile: Fixed parallel compilation issue.
|
||||
** gnutls-cli: It will try to connect to all possible returned addresses
|
||||
before failing.
|
||||
|
||||
- Updated to GnuTLS 3.1.5 (released 2012-11-24)
|
||||
** libgnutls: Added functions to parse the certificates policies
|
||||
extension.
|
||||
** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished
|
||||
Name by translating it to UTF-8 (works on windows or systems with
|
||||
iconv).
|
||||
** libgnutls: Added PKCS #11 key generation function that returns the
|
||||
public key on generation.
|
||||
** libgnutls: Corrected bug in priority string parsing, that mostly
|
||||
affected combined levels. Patch by Tim Kosse.
|
||||
** certtool: The --pubkey-info option can be combined with the
|
||||
--load-privkey or --load-request to print the corresponding public keys.
|
||||
** certtool: It is able to set certificate policies via a template.
|
||||
** certtool: Added --hex-numbers option which prints big numbers in
|
||||
an easier to parse format.
|
||||
** p11tool: After key generation, outputs the public key (useful in
|
||||
tokens that do not store the public key).
|
||||
** danetool: It is being built even without libgnutls-dane (the
|
||||
--check functionality is disabled though).
|
||||
|
||||
- Updated to GnuTLS 3.1.4 (released 2012-11-10)
|
||||
** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on
|
||||
the available revocation data validity.
|
||||
** libgnutls: Added gnutls_certificate_verification_status_print(),
|
||||
a function to print the verification status code in human readable text.
|
||||
** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS.
|
||||
** libgnutls: Simplified certificate verification by adding
|
||||
gnutls_certificate_verify_peers3().
|
||||
** libgnutls: Added support for extension to establish keys for SRTP.
|
||||
Contributed by Martin Storsjo.
|
||||
** libgnutls: The X.509 verification functions check the key
|
||||
usage bits and pathlen constraints and on failure output
|
||||
GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE.
|
||||
** libgnutls: gnutls_x509_crl_verify() includes the time checks.
|
||||
** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN
|
||||
and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default.
|
||||
** libgnutls: Always tolerate key usage violation errors from the side
|
||||
of the peer, but also notify via an audit message.
|
||||
** gnutls-cli: Added --local-dns option.
|
||||
** danetool: Corrected bug that prevented loading PEM files.
|
||||
** danetool: Added --check option to allow querying and verifying
|
||||
a site's DANE data.
|
||||
** libgnutls-dane: Added pkg-config file for the library.
|
||||
|
||||
- Updated to GnuTLS 3.1.3 (released 2012-10-12)
|
||||
** libgnutls: Added support for the OCSP Certificate Status
|
||||
extension.
|
||||
** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP
|
||||
certificate status extension in verification.
|
||||
** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl().
|
||||
** libgnutls: Increased maximum password length in the PKCS #12
|
||||
functions.
|
||||
** libgnutls: Fixed the receipt of session tickets during session resumption.
|
||||
Reported by danblack at http://savannah.gnu.org/support/?108146
|
||||
** libgnutls: Added functions to export structures in an allocated buffer.
|
||||
** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP
|
||||
response corresponds to the given certificate.
|
||||
** libgnutls: In client side gnutls_init() enables the session ticket and
|
||||
OCSP certificate status request extensions by default. The flag
|
||||
GNUTLS_NO_EXTENSIONS can be used to prevent that.
|
||||
** libgnutls: Several updates in the OpenPGP code. The generating code
|
||||
is fully RFC6091 compliant and RFC5081 support is only supported in client
|
||||
mode.
|
||||
** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC
|
||||
certificate verification.
|
||||
** gnutls-cli: Added --dane option to enable DANE certificate verification.
|
||||
** danetool: Added tool to generate DANE TLSA Resource Records (RR).
|
||||
|
||||
- Updated to GnuTLS 3.1.2 (released 2012-09-26)
|
||||
** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust()
|
||||
and gnutls_x509_trust_list_add_trust_mem() that prevented the loading
|
||||
of certificates in the windows platform.
|
||||
** libgnutls: Corrected bug in OpenPGP subpacket encoding.
|
||||
** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk.
|
||||
(the work was done during Google Summer of Code).
|
||||
** libgnutls: Added X.509 certificate verification flag
|
||||
GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification
|
||||
of unsorted certificate chains and is enabled by default for
|
||||
TLS certificate verification (if gnutls_certificate_set_verify_flags()
|
||||
does not override it).
|
||||
** libgnutls: Prints warning on certificates that contain keys of
|
||||
an insecure level. If the %COMPAT priority flag is not specified
|
||||
the TLS connection fails.
|
||||
** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode
|
||||
if interrupted during the retrasmition of handshake data.
|
||||
** libgnutls: Better mingw32 support (patch by LRN).
|
||||
** libgnutls: The %COMPAT keyword, if specified, will tolerate
|
||||
key usage violation errors (they are far too common to ignore).
|
||||
** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(),
|
||||
which provides a tool to counter compression-related attacks where
|
||||
parts of the data are controlled by the attacker _and_ are placed in
|
||||
separate records (use with care - do not use compression if not sure).
|
||||
** libgnutls: Depends on libtasn1 2.14 or later.
|
||||
** certtool: Prints the number of bits of the public key algorithm
|
||||
parameter in a private key.
|
||||
|
||||
- Updated to GnuTLS 3.1.1 (released 2012-09-02)
|
||||
** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link.
|
||||
** certtool: Changes in password handling of certtool.
|
||||
Ask password when required and only if the '--password' option is not
|
||||
given. If the '--password' option is given during key generation then
|
||||
assume the PKCS #8 file format, instead of ignoring the password.
|
||||
** tpmtool: No longer asks for key password in registered keys.
|
||||
** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin.
|
||||
wmNAF is now used for point multiplication and other optimizations.
|
||||
(the major part of the work was done during Google Summer of Code).
|
||||
** libgnutls: The default pull_timeout_function only uses select
|
||||
instead of a combination of select() and recv() to prevent issues
|
||||
when used in stream sockets in some systems.
|
||||
** libgnutls: Be tolerant in ECDSA signature violations (e.g. using
|
||||
SHA256 with a SECP384 curve instead of SHA-384), to interoperate with
|
||||
openssl.
|
||||
** libgnutls: Fixed DSA and ECDSA signature generation in smart
|
||||
cards. Thanks to Andreas Schwier from cardcontact.de for providing
|
||||
me with ECDSA capable smart cards.
|
||||
|
||||
- Updated to GnuTLS 3.1.0 (released 2012-08-15)
|
||||
** libgnutls: Added direct support for TPM as a cryptographic module
|
||||
in gnutls/tpm.h. TPM keys can be used in functions accepting files
|
||||
using URLs of the following types:
|
||||
tpmkey:file=/path/to/file
|
||||
tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user
|
||||
|
||||
** libgnutls: Priority string level keywords can be combined.
|
||||
For example the string "SECURE256:+SUITEB128" is now allowed.
|
||||
** libgnutls: requires libnettle 2.5.
|
||||
** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5)
|
||||
for encryption and signatures.
|
||||
** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between
|
||||
generic errors and signature verification errors in the verification
|
||||
functions.
|
||||
** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function
|
||||
to simplify parsing in most PKCS #12 use cases.
|
||||
** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds
|
||||
the whole certificate chain (if any) to the credentials structure, instead
|
||||
of only the end-user certificate.
|
||||
** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse()
|
||||
and gnutls_x509_privkey_import_pkcs8(), return consistently
|
||||
GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no
|
||||
password was provided.
|
||||
** libgnutls: Added gnutls_handshake_set_timeout() a function that
|
||||
allows to set the maximum time spent in a handshake.
|
||||
** libgnutlsxx: Added session::set_transport_vec_push_function. Patch
|
||||
by Alexandre Bique.
|
||||
** tpmtool: Added. It is a tool to generate private keys in the TPM.
|
||||
** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx
|
||||
and --benchmark-tls-ciphers
|
||||
** certtool: generated PKCS #12 structures may hold more than one
|
||||
private key. Patch by Lucas Fisher.
|
||||
** certtool: Added option --null-password to generate/decrypt keys
|
||||
that use a NULL password (in schemas that distinguish between NULL
|
||||
an empty passwords).
|
||||
** minitasn1: Upgraded to libtasn1 version 2.13.
|
||||
|
||||
- Library is now LGPL-2.1+, extras and tools are still GPL-3.0
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Apr 26 08:07:12 UTC 2013 - mmeister@suse.com
|
||||
|
||||
|
1300
gnutls.keyring
Normal file
1300
gnutls.keyring
Normal file
File diff suppressed because it is too large
Load Diff
45
gnutls.spec
45
gnutls.spec
@ -21,25 +21,38 @@
|
||||
%define gnutls_ossl_sover 27
|
||||
|
||||
Name: gnutls
|
||||
Version: 3.0.28
|
||||
Version: 3.2.1
|
||||
Release: 0
|
||||
Summary: The GNU Transport Layer Security Library
|
||||
License: LGPL-3.0+ and GPL-3.0+
|
||||
License: LGPL-2.1+ and GPL-3.0+
|
||||
Group: Productivity/Networking/Security
|
||||
Url: http://www.gnutls.org/
|
||||
Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.0/%{name}-%{version}.tar.xz
|
||||
Source1: baselibs.conf
|
||||
# suse specific, add support for certificate directories -- lnussel
|
||||
Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.2/%{name}-%{version}.tar.xz
|
||||
# signature is checked by source services.
|
||||
Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.2/%{name}-%{version}.tar.xz.sig
|
||||
Source2: %name.keyring
|
||||
Source3: baselibs.conf
|
||||
# suse specific, add support for certificate directories -- lnussel/meissner
|
||||
Patch1: gnutls-implement-trust-store-dir.diff
|
||||
|
||||
Patch2: automake-1.12.patch
|
||||
# PATCH-FIX-OPENSUSE gnutls-3.0.26-skip-test-fwrite.patch andreas.stieger@gmx.de -- skip a failing test
|
||||
Patch3: gnutls-3.0.26-skip-test-fwrite.patch
|
||||
|
||||
# https://gitorious.org/gnutls/gnutls/commit/b12040aeab5fbaf02677571db1d8bf1995bd5ee0?format=patch
|
||||
# PATCH-UPSTREAM gnutls-32bit.patch meissner@suse.de -- avoid dates after 2037 with 32bit time_t
|
||||
Patch4: gnutls-32bit.patch
|
||||
|
||||
# Disable elliptic curves for reasons. - meissner&cfarrell
|
||||
Patch5: gnutls-3.2.1-noecc.patch
|
||||
|
||||
BuildRequires: automake
|
||||
BuildRequires: gcc-c++
|
||||
BuildRequires: libidn-devel
|
||||
BuildRequires: libnettle-devel >= 2.2
|
||||
BuildRequires: libnettle-devel >= 2.7
|
||||
BuildRequires: libtasn1-devel >= 2.14
|
||||
BuildRequires: libtool
|
||||
BuildRequires: valgrind
|
||||
%if %suse_version >= 1230
|
||||
BuildRequires: makeinfo
|
||||
%endif
|
||||
@ -60,7 +73,7 @@ implements the proposed standards of the IETF's TLS working group.
|
||||
|
||||
%package -n libgnutls%{gnutls_sover}
|
||||
Summary: The GNU Transport Layer Security Library
|
||||
License: LGPL-3.0+
|
||||
License: LGPL-2.1+
|
||||
Group: Productivity/Networking/Security
|
||||
|
||||
%description -n libgnutls%{gnutls_sover}
|
||||
@ -70,7 +83,7 @@ implements the proposed standards of the IETF's TLS working group.
|
||||
|
||||
%package -n libgnutlsxx%{gnutlsxx_sover}
|
||||
Summary: The GNU Transport Layer Security Library
|
||||
License: LGPL-3.0+
|
||||
License: LGPL-2.1+
|
||||
Group: Productivity/Networking/Security
|
||||
|
||||
%description -n libgnutlsxx%{gnutlsxx_sover}
|
||||
@ -92,7 +105,7 @@ implements the proposed standards of the IETF's TLS working group.
|
||||
|
||||
%package -n libgnutls-devel
|
||||
Summary: Development package for gnutls
|
||||
License: LGPL-3.0+
|
||||
License: LGPL-2.1+
|
||||
Group: Development/Libraries/C and C++
|
||||
PreReq: %install_info_prereq
|
||||
Requires: glibc-devel
|
||||
@ -104,7 +117,7 @@ Files needed for software development using gnutls.
|
||||
|
||||
%package -n libgnutlsxx-devel
|
||||
Summary: Development package for gnutls
|
||||
License: LGPL-3.0+
|
||||
License: LGPL-2.1+
|
||||
Group: Development/Libraries/C and C++
|
||||
PreReq: %install_info_prereq
|
||||
Requires: libgnutls-devel = %{version}
|
||||
@ -128,19 +141,22 @@ Files needed for software development using gnutls.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch1
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3
|
||||
echo %{_includedir}/%{name}/abstract.h
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
|
||||
%build
|
||||
autoreconf -if
|
||||
# echde explicitly disabled - meissner&cfarrell
|
||||
%configure \
|
||||
--disable-static \
|
||||
--with-pic \
|
||||
--disable-rpath \
|
||||
--disable-silent-rules \
|
||||
--with-default-trust-store-dir=/etc/ssl/certs \
|
||||
--disable-ecdhe \
|
||||
--with-sysroot=/%{?_sysroot}
|
||||
%__make %{?_smp_mflags}
|
||||
|
||||
@ -200,11 +216,13 @@ rm -rf %{buildroot}
|
||||
%{_bindir}/psktool
|
||||
%{_bindir}/p11tool
|
||||
%{_bindir}/srptool
|
||||
%{_bindir}/danetool
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%files -n libgnutls%{gnutls_sover}
|
||||
%defattr(-,root,root)
|
||||
%{_libdir}/libgnutls.so.%{gnutls_sover}*
|
||||
%{_libdir}/libgnutls-xssl.so.*
|
||||
|
||||
%files -n libgnutls-openssl%{gnutls_ossl_sover}
|
||||
%defattr(-,root,root)
|
||||
@ -227,7 +245,10 @@ rm -rf %{buildroot}
|
||||
%{_includedir}/%{name}/pkcs11.h
|
||||
%{_includedir}/%{name}/pkcs12.h
|
||||
%{_includedir}/%{name}/x509.h
|
||||
%{_includedir}/%{name}/tpm.h
|
||||
%{_includedir}/%{name}/xssl.h
|
||||
%{_libdir}/libgnutls.so
|
||||
%{_libdir}/libgnutls-xssl.so
|
||||
%{_libdir}/pkgconfig/gnutls.pc
|
||||
%{_mandir}/man3/*
|
||||
%{_infodir}/*.*
|
||||
|
Loading…
Reference in New Issue
Block a user