rpm/gnutls
SHA256
1
0
Fork 0
forked from pool/gnutls
Code Pull Requests Activity
gnutls/disable-psk-file-test.patch

108 lines
5.7 KiB
Diff
Raw Normal View History

Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
Index: gnutls-3.6.6/tests/Makefile.in
Accepting request 662795 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.5 ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). OBS-URL: https://build.opensuse.org/request/show/662795 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
2019-01-04 13:39:42 +00:00
===================================================================
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
--- gnutls-3.6.6.orig/tests/Makefile.in 2019-01-25 08:26:36.000000000 +0100
+++ gnutls-3.6.6/tests/Makefile.in 2019-02-04 09:02:38.627539105 +0100
@@ -480,7 +480,7 @@ am__EXEEXT_12 = tls13/supported_versions
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
pkcs7-gen$(EXEEXT) dtls-etm$(EXEEXT) \
x509sign-verify-rsa$(EXEEXT) x509sign-verify-ecdsa$(EXEEXT) \
x509sign-verify-gost$(EXEEXT) mini-alignment$(EXEEXT) \
- oids$(EXEEXT) atfork$(EXEEXT) prf$(EXEEXT) psk-file$(EXEEXT) \
+ oids$(EXEEXT) atfork$(EXEEXT) prf$(EXEEXT) \
Accepting request 662795 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.5 ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). OBS-URL: https://build.opensuse.org/request/show/662795 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
2019-01-04 13:39:42 +00:00
priority-init2$(EXEEXT) post-client-hello-change-prio$(EXEEXT) \
status-request$(EXEEXT) status-request-ok$(EXEEXT) \
status-request-missing$(EXEEXT) sign-verify-ext$(EXEEXT) \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -1652,8 +1652,6 @@ privkey_verify_broken_OBJECTS = privkey-
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
privkey_verify_broken_LDADD = $(LDADD)
privkey_verify_broken_DEPENDENCIES = $(COMMON_GNUTLS_LDADD) \
libutils.la $(am__DEPENDENCIES_2)
-psk_file_SOURCES = psk-file.c
-psk_file_OBJECTS = psk-file.$(OBJEXT)
psk_file_LDADD = $(LDADD)
psk_file_DEPENDENCIES = $(COMMON_GNUTLS_LDADD) libutils.la \
$(am__DEPENDENCIES_2)
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -2841,7 +2839,7 @@ am__depfiles_remade = ./$(DEPDIR)/alerts
Accepting request 662795 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.5 ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). OBS-URL: https://build.opensuse.org/request/show/662795 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
2019-01-04 13:39:42 +00:00
./$(DEPDIR)/priorities.Po ./$(DEPDIR)/priority-init2.Po \
./$(DEPDIR)/priority-mix.Po ./$(DEPDIR)/priority-set.Po \
./$(DEPDIR)/priority-set2.Po ./$(DEPDIR)/privkey-keygen.Po \
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
- ./$(DEPDIR)/privkey-verify-broken.Po ./$(DEPDIR)/psk-file.Po \
+ ./$(DEPDIR)/privkey-verify-broken.Po \
./$(DEPDIR)/pskself.Po ./$(DEPDIR)/pubkey-import-export.Po \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
./$(DEPDIR)/random-art.Po ./$(DEPDIR)/rawpk-api.Po \
./$(DEPDIR)/record-pad.Po ./$(DEPDIR)/record-retvals.Po \
@@ -3153,7 +3151,7 @@ SOURCES = $(libpkcs11mock1_la_SOURCES) $
Accepting request 662795 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.5 ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). OBS-URL: https://build.opensuse.org/request/show/662795 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
2019-01-04 13:39:42 +00:00
post-client-hello-change-prio.c prf.c priorities.c \
priorities-groups.c priority-init2.c priority-mix.c \
priority-set.c priority-set2.c privkey-keygen.c \
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
- privkey-verify-broken.c psk-file.c pskself.c \
+ privkey-verify-broken.c pskself.c \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
pubkey-import-export.c random-art.c rawpk-api.c record-pad.c \
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
record-retvals.c record-sizes.c record-sizes-range.c \
record-timeouts.c recv-data-before-handshake.c \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -3323,7 +3321,7 @@ DIST_SOURCES = $(am__libpkcs11mock1_la_S
Accepting request 662795 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.5 ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). OBS-URL: https://build.opensuse.org/request/show/662795 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
2019-01-04 13:39:42 +00:00
post-client-hello-change-prio.c prf.c priorities.c \
priorities-groups.c priority-init2.c priority-mix.c \
priority-set.c priority-set2.c privkey-keygen.c \
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
- privkey-verify-broken.c psk-file.c pskself.c \
+ privkey-verify-broken.c pskself.c \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
pubkey-import-export.c random-art.c rawpk-api.c record-pad.c \
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
record-retvals.c record-sizes.c record-sizes-range.c \
record-timeouts.c recv-data-before-handshake.c \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -4915,7 +4913,7 @@ ctests = tls13/supported_versions tls13/
Accepting request 662795 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.5 ** libgnutls: Provide the option of transparent re-handshake/reauthentication when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571). ** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127) ** libgnutls: The priority functions will ignore and not enable TLS1.3 if requested with legacy TLS versions enabled but not TLS1.2. That is because if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled) servers which do not support TLS1.3 will negotiate TLS1.2 which will be rejected by the client as disabled (#621). ** libgnutls: Change RSA decryption to use a new side-channel silent function. This addresses a security issue where memory access patterns as well as timing on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher attacks. Side-channel resistant code is slower due to the need to mask access and timings. When used in TLS the new functions cause RSA based handshakes to be between 13% and 28% slower on average (Numbers are indicative, the tests where performed on a relatively modern Intel CPU, results vary depending on the CPU and architecture used). This change makes nettle 3.4.1 the minimum requirement of gnutls (#630). [CVSS: medium] ** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword in the priority string. It is only accepted as legacy option and is ignored. ** libgnutls: Added support for EdDSA under PKCS#11 (#417) ** libgnutls: Added support for AES-CFB8 cipher (#357) ** libgnutls: Added support for AES-CMAC MAC (#351) ** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D S-BOXes). They are fixed now. ** libgnutls: Added support for GOST key unmasking and unwrapped GOST private keys parsing, as specified in R 50.1.112-2016. ** gnutls-serv: It applies the default settings when no --priority option is given, using gnutls_set_default_priority(). OBS-URL: https://build.opensuse.org/request/show/662795 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
2019-01-04 13:39:42 +00:00
gnutls_ocsp_resp_list_import2 server-sign-md5-rep \
privkey-keygen mini-tls-nonblock no-signal pkcs7-gen dtls-etm \
x509sign-verify-rsa x509sign-verify-ecdsa x509sign-verify-gost \
- mini-alignment oids atfork prf psk-file priority-init2 \
+ mini-alignment oids atfork prf priority-init2 \
post-client-hello-change-prio status-request status-request-ok \
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
status-request-missing sign-verify-ext fallback-scsv \
pkcs8-key-decode urls dtls-rehandshake-cert key-usage-rsa \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -6099,10 +6097,6 @@ privkey-verify-broken$(EXEEXT): $(privke
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
@rm -f privkey-verify-broken$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(privkey_verify_broken_OBJECTS) $(privkey_verify_broken_LDADD) $(LIBS)
-psk-file$(EXEEXT): $(psk_file_OBJECTS) $(psk_file_DEPENDENCIES) $(EXTRA_psk_file_DEPENDENCIES)
- @rm -f psk-file$(EXEEXT)
- $(AM_V_CCLD)$(LINK) $(psk_file_OBJECTS) $(psk_file_LDADD) $(LIBS)
-
pskself$(EXEEXT): $(pskself_OBJECTS) $(pskself_DEPENDENCIES) $(EXTRA_pskself_DEPENDENCIES)
@rm -f pskself$(EXEEXT)
$(AM_V_CCLD)$(LINK) $(pskself_OBJECTS) $(pskself_LDADD) $(LIBS)
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -7133,7 +7127,6 @@ distclean-compile:
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/priority-set2.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/privkey-keygen.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/privkey-verify-broken.Po@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/psk-file.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pskself.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pubkey-import-export.Po@am__quote@ # am--include-marker
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/random-art.Po@am__quote@ # am--include-marker
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -9258,13 +9251,6 @@ prf.log: prf$(EXEEXT)
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
--log-file $$b.log --trs-file $$b.trs \
$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
"$$tst" $(AM_TESTS_FD_REDIRECT)
-psk-file.log: psk-file$(EXEEXT)
- @p='psk-file$(EXEEXT)'; \
- b='psk-file'; \
- $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
- --log-file $$b.log --trs-file $$b.trs \
- $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
- "$$tst" $(AM_TESTS_FD_REDIRECT)
priority-init2.log: priority-init2$(EXEEXT)
@p='priority-init2$(EXEEXT)'; \
b='priority-init2'; \
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -11316,7 +11302,6 @@ distclean: distclean-recursive
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
-rm -f ./$(DEPDIR)/priority-set2.Po
-rm -f ./$(DEPDIR)/privkey-keygen.Po
-rm -f ./$(DEPDIR)/privkey-verify-broken.Po
- -rm -f ./$(DEPDIR)/psk-file.Po
-rm -f ./$(DEPDIR)/pskself.Po
-rm -f ./$(DEPDIR)/pubkey-import-export.Po
-rm -f ./$(DEPDIR)/random-art.Po
Accepting request 671127 from home:vitezslav_cizek:branches:security:tls - Update to 3.6.6 ** libgnutls: gnutls_pubkey_import_ecc_raw() was fixed to set the number bits on the public key (#640). ** libgnutls: Added support for raw public-key authentication as defined in RFC7250. Raw public-keys can be negotiated by enabling the corresponding certificate types via the priority strings. The raw public-key mechanism must be explicitly enabled via the GNUTLS_ENABLE_RAWPK init flag (#26, #280). ** libgnutls: When on server or client side we are sending no extensions we do not set an empty extensions field but we rather remove that field competely. This solves a regression since 3.5.x and improves compatibility of the server side with certain clients. ** libgnutls: We no longer mark RSA keys in PKCS#11 tokens as RSA-PSS capable if the CKA_SIGN is not set (#667). ** libgnutls: The priority string option %NO_EXTENSIONS was improved to completely disable extensions at all cases, while providing a functional session. This also implies that when specified, TLS1.3 is disabled. ** libgnutls: GNUTLS_X509_NO_WELL_DEFINED_EXPIRATION was marked as deprecated. The previous definition was non-functional (#609). - drop no longer needed gnutls-enbale-guile-2.2.patch - refresh disable-psk-file-test.patch OBS-URL: https://build.opensuse.org/request/show/671127 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=17
2019-02-04 15:36:51 +00:00
@@ -11766,7 +11751,6 @@ maintainer-clean: maintainer-clean-recur
Accepting request 642092 from home:vitezslav_cizek:branches:security:tls - Temporarily disable failing psk-file test (race condition) * add disable-psk-file-test.patch - Version update to 3.6.4 (bsc#1111757): OBS-URL: https://build.opensuse.org/request/show/642092 OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=12
2018-10-15 17:34:04 +00:00
-rm -f ./$(DEPDIR)/priority-set2.Po
-rm -f ./$(DEPDIR)/privkey-keygen.Po
-rm -f ./$(DEPDIR)/privkey-verify-broken.Po
- -rm -f ./$(DEPDIR)/psk-file.Po
-rm -f ./$(DEPDIR)/pskself.Po
-rm -f ./$(DEPDIR)/pubkey-import-export.Po
-rm -f ./$(DEPDIR)/random-art.Po
Copy Permalink