diff --git a/gnutls-3.8.5.tar.xz b/gnutls-3.8.5.tar.xz deleted file mode 100644 index 4dab5d4..0000000 --- a/gnutls-3.8.5.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:66269a2cfe0e1c2dabec87bdbbd8ab656f396edd9a40dd006978e003cfa52bfc -size 6491504 diff --git a/gnutls-3.8.5.tar.xz.sig b/gnutls-3.8.5.tar.xz.sig deleted file mode 100644 index ad2c423..0000000 Binary files a/gnutls-3.8.5.tar.xz.sig and /dev/null differ diff --git a/gnutls-3.8.6.tar.xz b/gnutls-3.8.6.tar.xz new file mode 100644 index 0000000..5d151c1 --- /dev/null +++ b/gnutls-3.8.6.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2e1588aae53cb32d43937f1f4eca28febd9c0c7aa1734fc5dd61a7e81e0ebcdd +size 6517476 diff --git a/gnutls-3.8.6.tar.xz.sig b/gnutls-3.8.6.tar.xz.sig new file mode 100644 index 0000000..6ce9f29 Binary files /dev/null and b/gnutls-3.8.6.tar.xz.sig differ diff --git a/gnutls-FIPS-140-3-references.patch b/gnutls-FIPS-140-3-references.patch index b511319..addb659 100644 --- a/gnutls-FIPS-140-3-references.patch +++ b/gnutls-FIPS-140-3-references.patch @@ -1,7 +1,7 @@ -Index: gnutls-3.8.5/configure.ac +Index: gnutls-3.8.6/configure.ac =================================================================== ---- gnutls-3.8.5.orig/configure.ac -+++ gnutls-3.8.5/configure.ac +--- gnutls-3.8.6.orig/configure.ac ++++ gnutls-3.8.6/configure.ac @@ -623,19 +623,19 @@ LT_INIT([disable-static,win32-dll,shared AC_LIB_HAVE_LINKFLAGS(dl,, [#include ], [dladdr (0, 0);]) @@ -25,10 +25,10 @@ Index: gnutls-3.8.5/configure.ac AC_ARG_WITH(fips140-module-name, AS_HELP_STRING([--with-fips140-module-name], [specify the FIPS140 module name]), -Index: gnutls-3.8.5/doc/cha-gtls-app.texi +Index: gnutls-3.8.6/doc/cha-gtls-app.texi =================================================================== ---- gnutls-3.8.5.orig/doc/cha-gtls-app.texi -+++ gnutls-3.8.5/doc/cha-gtls-app.texi +--- gnutls-3.8.6.orig/doc/cha-gtls-app.texi ++++ gnutls-3.8.6/doc/cha-gtls-app.texi @@ -222,7 +222,7 @@ CPU. The currently available options are @end itemize @@ -38,10 +38,10 @@ Index: gnutls-3.8.5/doc/cha-gtls-app.texi if set to one it will force the FIPS mode enablement. @end multitable -Index: gnutls-3.8.5/doc/cha-internals.texi +Index: gnutls-3.8.6/doc/cha-internals.texi =================================================================== ---- gnutls-3.8.5.orig/doc/cha-internals.texi -+++ gnutls-3.8.5/doc/cha-internals.texi +--- gnutls-3.8.6.orig/doc/cha-internals.texi ++++ gnutls-3.8.6/doc/cha-internals.texi @@ -14,7 +14,7 @@ happens inside the black box. * TLS Hello Extension Handling:: * Cryptographic Backend:: @@ -162,11 +162,11 @@ Index: gnutls-3.8.5/doc/cha-internals.texi operation. It can be attached to the current execution thread with @funcref{gnutls_fips140_push_context} and its internal state will be updated until it is detached with -Index: gnutls-3.8.5/doc/enums.texi +Index: gnutls-3.8.6/doc/enums.texi =================================================================== ---- gnutls-3.8.5.orig/doc/enums.texi -+++ gnutls-3.8.5/doc/enums.texi -@@ -1190,7 +1190,7 @@ application traffic secret is installed +--- gnutls-3.8.6.orig/doc/enums.texi ++++ gnutls-3.8.6/doc/enums.texi +@@ -1192,7 +1192,7 @@ application traffic secret is installed @c gnutls_fips_mode_t @table @code @item GNUTLS_@-FIPS140_@-DISABLED @@ -175,7 +175,7 @@ Index: gnutls-3.8.5/doc/enums.texi @item GNUTLS_@-FIPS140_@-STRICT The default mode; all forbidden operations will cause an operation failure via error code. -@@ -1198,8 +1198,8 @@ operation failure via error code. +@@ -1200,8 +1200,8 @@ operation failure via error code. A transient state during library initialization. That state cannot be set or seen by applications. @item GNUTLS_@-FIPS140_@-LAX @@ -186,10 +186,10 @@ Index: gnutls-3.8.5/doc/enums.texi application is aware of the followed security policy, and needs to utilize disallowed operations for other reasons (e.g., compatibility). @item GNUTLS_@-FIPS140_@-LOG -Index: gnutls-3.8.5/doc/functions/gnutls_fips140_set_mode +Index: gnutls-3.8.6/doc/functions/gnutls_fips140_set_mode =================================================================== ---- gnutls-3.8.5.orig/doc/functions/gnutls_fips140_set_mode -+++ gnutls-3.8.5/doc/functions/gnutls_fips140_set_mode +--- gnutls-3.8.6.orig/doc/functions/gnutls_fips140_set_mode ++++ gnutls-3.8.6/doc/functions/gnutls_fips140_set_mode @@ -3,7 +3,7 @@ @@ -215,10 +215,10 @@ Index: gnutls-3.8.5/doc/functions/gnutls_fips140_set_mode values for @code{mode} or to @code{GNUTLS_FIPS140_SELFTESTS} mode, the library switches to @code{GNUTLS_FIPS140_STRICT} mode. -Index: gnutls-3.8.5/doc/gnutls.html +Index: gnutls-3.8.6/doc/gnutls.html =================================================================== ---- gnutls-3.8.5.orig/doc/gnutls.html -+++ gnutls-3.8.5/doc/gnutls.html +--- gnutls-3.8.6.orig/doc/gnutls.html ++++ gnutls-3.8.6/doc/gnutls.html @@ -485,7 +485,7 @@ Documentation License”.
  • 11.4 TLS Extension Handling
  • 11.5 Cryptographic Backend
    • @@ -228,7 +228,7 @@ Index: gnutls-3.8.5/doc/gnutls.html
  • Appendix A Upgrading from previous versions
  • Appendix B Support -@@ -9045,7 +9045,7 @@ CPU. The currently available options are +@@ -9046,7 +9046,7 @@ CPU. The currently available options are
  • 0x200000: Enable VIA PHE
  • 0x400000: Enable VIA PHE SHA512
    • @@ -237,7 +237,7 @@ Index: gnutls-3.8.5/doc/gnutls.html if set to one it will force the FIPS mode enablement. -@@ -18477,7 +18477,7 @@ None: +@@ -18481,7 +18481,7 @@ None: --inline-commands-prefix=str Change the default delimiter for inline commands --provider=file Specify the PKCS #11 provider library - file must pre-exist @@ -246,7 +246,7 @@ Index: gnutls-3.8.5/doc/gnutls.html --list-config Reports the configuration of the library --logfile=str Redirect informational messages to a specific file --keymatexport=str Label used for exporting keying material -@@ -19499,7 +19499,7 @@ happens inside the black box. +@@ -19503,7 +19503,7 @@ happens inside the black box.
  • TLS Extension Handling
  • Cryptographic Backend
  • Random Number Generators
    • @@ -255,7 +255,7 @@ Index: gnutls-3.8.5/doc/gnutls.html
    -@@ -20028,7 +20028,7 @@ For more information see

    @@ -264,7 +264,7 @@ Index: gnutls-3.8.5/doc/gnutls.html

    11.6 Random Number Generators

    -@@ -20036,7 +20036,7 @@ Next:     GnuTLS provides two random generators. The default, and the AES-DRBG random generator which is only used when the library is compiled with support for @@ -273,7 +273,7 @@ Index: gnutls-3.8.5/doc/gnutls.html

    The default generator - inner workings

    -@@ -20173,22 +20173,22 @@ on the above paragraph, all levels are i +@@ -20177,22 +20177,22 @@ on the above paragraph, all levels are i

    Previous: , Up: Internal Architecture of GnuTLS   [Contents][Index]

    @@ -302,7 +302,7 @@ Index: gnutls-3.8.5/doc/gnutls.html as follows.

    @@ -318,7 +318,7 @@ Index: gnutls-3.8.5/doc/gnutls.html
  • Any cryptographic operation will be refused if any of the self-tests failed
    • -@@ -20211,7 +20211,7 @@ modified as follows. +@@ -20215,7 +20215,7 @@ modified as follows. environment variable GNUTLS_SKIP_FIPS_INTEGRITY_CHECKS will disable the library integrity tests on startup, and the variable GNUTLS_FORCE_FIPS_MODE can be set to force a value from @@ -327,7 +327,7 @@ Index: gnutls-3.8.5/doc/gnutls.html mode, while ’0’ will disable it.

    The integrity checks for the dependent libraries and GnuTLS are performed -@@ -20219,13 +20219,13 @@ using ’.hmac’ files which ar +@@ -20223,13 +20223,13 @@ using ’.hmac’ files which ar key for the operations can be provided on compile-time with the configure option ’–with-fips140-key’. The MAC algorithm used is HMAC-SHA256.

    @@ -344,7 +344,7 @@ Index: gnutls-3.8.5/doc/gnutls.html the application can relax these requirements via gnutls_fips140_set_mode which can switch to alternative modes as in Figure 11.5.

    -@@ -20234,7 +20234,7 @@ which can switch to alternative modes as +@@ -20238,7 +20238,7 @@ which can switch to alternative modes as
    GNUTLS_FIPS140_DISABLED
    @@ -353,7 +353,7 @@ Index: gnutls-3.8.5/doc/gnutls.html

    GNUTLS_FIPS140_STRICT

    The default mode; all forbidden operations will cause an -@@ -20245,8 +20245,8 @@ operation failure via error code. +@@ -20249,8 +20249,8 @@ operation failure via error code. cannot be set or seen by applications.

    GNUTLS_FIPS140_LAX
    @@ -364,7 +364,7 @@ Index: gnutls-3.8.5/doc/gnutls.html application is aware of the followed security policy, and needs to utilize disallowed operations for other reasons (e.g., compatibility).

    -@@ -20258,7 +20258,7 @@ to a message to the audit callback funct +@@ -20262,7 +20262,7 @@ to a message to the audit callback funct

    Figure 11.5: The gnutls_fips_mode_t enumeration.

    The intention of this API is to be used by applications which may run in @@ -373,7 +373,7 @@ Index: gnutls-3.8.5/doc/gnutls.html e.g., for non-security related purposes. In these cases applications should wrap the non-compliant code within blocks like the following.

    -@@ -20287,9 +20287,9 @@ if (gnutls_fips140_mode_enabled()) +@@ -20291,9 +20291,9 @@ if (gnutls_fips140_mode_enabled())

    The reason of the GNUTLS_FIPS140_SET_MODE_THREAD flag in the previous calls is to localize the change in the mode. Note also, that such a block has no effect when the library is not operating @@ -385,7 +385,7 @@ Index: gnutls-3.8.5/doc/gnutls.html 

    gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
    -@@ -20312,7 +20312,7 @@ performed within a given context. +@@ -20316,7 +20316,7 @@ performed within a given context.
    int gnutls_fips140_pop_context ( void)
    @@ -394,7 +394,7 @@ Index: gnutls-3.8.5/doc/gnutls.html operation. It can be attached to the current execution thread with gnutls_fips140_push_context and its internal state will be updated until it is detached with -@@ -20685,8 +20685,8 @@ Previous: @@ -405,7 +405,7 @@ Index: gnutls-3.8.5/doc/gnutls.html

    -@@ -24602,7 +24602,7 @@ unusable. This function is not thread-s +@@ -24607,7 +24607,7 @@ unusable. This function is not thread-s

    gnutls_fips140_set_mode

    Function: void gnutls_fips140_set_mode (gnutls_fips_mode_t mode, unsigned flags)
    @@ -414,7 +414,7 @@ Index: gnutls-3.8.5/doc/gnutls.html

    flags: should be zero or GNUTLS_FIPS140_SET_MODE_THREAD

    -@@ -24611,13 +24611,13 @@ unusable. This function is not thread-s +@@ -24616,13 +24616,13 @@ unusable. This function is not thread-s behavior with no flags after threads are created is undefined.

    When the flag GNUTLS_FIPS140_SET_MODE_THREAD is specified @@ -430,7 +430,7 @@ Index: gnutls-3.8.5/doc/gnutls.html values for mode or to GNUTLS_FIPS140_SELFTESTS mode, the library switches to GNUTLS_FIPS140_STRICT mode.

    -@@ -46996,7 +46996,7 @@ Next: gnutls_fingerprint: Core TLS API gnutls_fips140_context_deinit: Core TLS API gnutls_fips140_context_init: Core TLS API @@ -439,11 +439,11 @@ Index: gnutls-3.8.5/doc/gnutls.html gnutls_fips140_get_operation_state: Core TLS API gnutls_fips140_mode_enabled: Core TLS API gnutls_fips140_pop_context: Core TLS API -Index: gnutls-3.8.5/doc/gnutls.info-3 +Index: gnutls-3.8.6/doc/gnutls.info-3 =================================================================== ---- gnutls-3.8.5.orig/doc/gnutls.info-3 -+++ gnutls-3.8.5/doc/gnutls.info-3 -@@ -2262,7 +2262,7 @@ to ‘more’. Both will exit with a st +--- gnutls-3.8.6.orig/doc/gnutls.info-3 ++++ gnutls-3.8.6/doc/gnutls.info-3 +@@ -2264,7 +2264,7 @@ to ‘more’. Both will exit with a st --inline-commands-prefix=str Change the default delimiter for inline commands --provider=file Specify the PKCS #11 provider library - file must pre-exist @@ -452,7 +452,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3 --list-config Reports the configuration of the library --logfile=str Redirect informational messages to a specific file --keymatexport=str Label used for exporting keying material -@@ -3415,7 +3415,7 @@ to know what happens inside the black bo +@@ -3417,7 +3417,7 @@ to know what happens inside the black bo * TLS Hello Extension Handling:: * Cryptographic Backend:: * Random Number Generators-internals:: @@ -461,7 +461,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3  File: gnutls.info, Node: The TLS Protocol, Next: TLS Handshake Protocol, Up: Internal architecture of GnuTLS -@@ -3947,7 +3947,7 @@ and abstract key types::. +@@ -3949,7 +3949,7 @@ and abstract key types::. kernel implementation of ‘/dev/crypto’.  @@ -470,7 +470,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3 11.6 Random Number Generators ============================= -@@ -3957,7 +3957,7 @@ About the generators +@@ -3959,7 +3959,7 @@ About the generators GnuTLS provides two random generators. The default, and the AES-DRBG random generator which is only used when the library is compiled with @@ -479,7 +479,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3 The default generator - inner workings -------------------------------------- -@@ -4189,7 +4189,7 @@ in *note Figure 11.5: gnutls_fips_mode_t +@@ -4191,7 +4191,7 @@ in *note Figure 11.5: gnutls_fips_mode_t Figure 11.5: The ‘gnutls_fips_mode_t’ enumeration. The intention of this API is to be used by applications which may run in @@ -488,7 +488,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3 set, e.g., for non-security related purposes. In these cases applications should wrap the non-compliant code within blocks like the following. -@@ -4213,10 +4213,10 @@ are macros to simplify the following seq +@@ -4215,10 +4215,10 @@ are macros to simplify the following seq The reason of the ‘GNUTLS_FIPS140_SET_MODE_THREAD’ flag in the previous calls is to localize the change in the mode. Note also, that such a @@ -501,7 +501,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3 gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0); Service indicator -@@ -4698,8 +4698,8 @@ There are certifications from national o +@@ -4700,8 +4700,8 @@ There are certifications from national o practices, such as unit testing and reliance on well known crypto primitives. @@ -512,7 +512,7 @@ Index: gnutls-3.8.5/doc/gnutls.info-3  File: gnutls.info, Node: Error codes, Next: Supported ciphersuites, Prev: Support, Up: Top -@@ -9169,7 +9169,7 @@ gnutls_fips140_set_mode +@@ -9172,7 +9172,7 @@ gnutls_fips140_set_mode -- Function: void gnutls_fips140_set_mode (gnutls_fips_mode_t MODE, unsigned FLAGS) @@ -521,10 +521,10 @@ Index: gnutls-3.8.5/doc/gnutls.info-3 FLAGS: should be zero or ‘GNUTLS_FIPS140_SET_MODE_THREAD’ -Index: gnutls-3.8.5/doc/invoke-gnutls-cli.texi +Index: gnutls-3.8.6/doc/invoke-gnutls-cli.texi =================================================================== ---- gnutls-3.8.5.orig/doc/invoke-gnutls-cli.texi -+++ gnutls-3.8.5/doc/invoke-gnutls-cli.texi +--- gnutls-3.8.6.orig/doc/invoke-gnutls-cli.texi ++++ gnutls-3.8.6/doc/invoke-gnutls-cli.texi @@ -102,7 +102,7 @@ None: --inline-commands-prefix=str Change the default delimiter for inline commands --provider=file Specify the PKCS #11 provider library @@ -534,10 +534,10 @@ Index: gnutls-3.8.5/doc/invoke-gnutls-cli.texi --list-config Reports the configuration of the library --logfile=str Redirect informational messages to a specific file --keymatexport=str Label used for exporting keying material -Index: gnutls-3.8.5/doc/manpages/gnutls-cli.1 +Index: gnutls-3.8.6/doc/manpages/gnutls-cli.1 =================================================================== ---- gnutls-3.8.5.orig/doc/manpages/gnutls-cli.1 -+++ gnutls-3.8.5/doc/manpages/gnutls-cli.1 +--- gnutls-3.8.6.orig/doc/manpages/gnutls-cli.1 ++++ gnutls-3.8.6/doc/manpages/gnutls-cli.1 @@ -398,7 +398,7 @@ Specify the PKCS #11 provider library. This will override the default options in /etc/gnutls/pkcs11.conf .TP @@ -547,10 +547,10 @@ Index: gnutls-3.8.5/doc/manpages/gnutls-cli.1 .sp .TP .NOP \f\*[B-Font]\-\-list\-config\f[] -Index: gnutls-3.8.5/doc/reference/html/gnutls-gnutls.html +Index: gnutls-3.8.6/doc/reference/html/gnutls-gnutls.html =================================================================== ---- gnutls-3.8.5.orig/doc/reference/html/gnutls-gnutls.html -+++ gnutls-3.8.5/doc/reference/html/gnutls-gnutls.html +--- gnutls-3.8.6.orig/doc/reference/html/gnutls-gnutls.html ++++ gnutls-3.8.6/doc/reference/html/gnutls-gnutls.html @@ -20870,12 +20870,12 @@ gnutls_fips140_set_mode (  -@@ -25915,7 +25915,7 @@ encryption

    +@@ -25920,7 +25920,7 @@ encryption

    enum gnutls_fips_mode_t

    @@ -584,7 +584,7 @@ Index: gnutls-3.8.5/doc/reference/html/gnutls-gnutls.html

    Members

    -@@ -25928,7 +25928,7 @@ encryption

    +@@ -25933,7 +25933,7 @@ encryption

    -@@ -25951,8 +25951,8 @@ operation failure via error code.

    +@@ -25956,8 +25956,8 @@ operation failure via error code.

    -@@ -27592,4 +27592,4 @@ This is used by
    Generated by GTK-Doc V1.33.1 - \ No newline at end of file + -Index: gnutls-3.8.5/lib/fips.c +Index: gnutls-3.8.6/lib/fips.c =================================================================== ---- gnutls-3.8.5.orig/lib/fips.c -+++ gnutls-3.8.5/lib/fips.c +--- gnutls-3.8.6.orig/lib/fips.c ++++ gnutls-3.8.6/lib/fips.c @@ -121,7 +121,7 @@ unsigned _gnutls_fips_mode_enabled(void) } @@ -633,7 +633,7 @@ Index: gnutls-3.8.5/lib/fips.c ret = GNUTLS_FIPS140_SELFTESTS; goto exit; } -@@ -712,7 +712,7 @@ unsigned gnutls_fips140_mode_enabled(voi +@@ -722,7 +722,7 @@ unsigned gnutls_fips140_mode_enabled(voi /** * gnutls_fips140_set_mode: @@ -642,7 +642,7 @@ Index: gnutls-3.8.5/lib/fips.c * @flags: should be zero or %GNUTLS_FIPS140_SET_MODE_THREAD * * That function is not thread-safe when changing the mode with no flags -@@ -720,13 +720,13 @@ unsigned gnutls_fips140_mode_enabled(voi +@@ -730,13 +730,13 @@ unsigned gnutls_fips140_mode_enabled(voi * behavior with no flags after threads are created is undefined. * * When the flag %GNUTLS_FIPS140_SET_MODE_THREAD is specified @@ -658,7 +658,7 @@ Index: gnutls-3.8.5/lib/fips.c * values for @mode or to %GNUTLS_FIPS140_SELFTESTS mode, the library * switches to %GNUTLS_FIPS140_STRICT mode. * -@@ -738,10 +738,10 @@ void gnutls_fips140_set_mode(gnutls_fips +@@ -748,10 +748,10 @@ void gnutls_fips140_set_mode(gnutls_fips gnutls_fips_mode_t prev = _gnutls_fips_mode_enabled(); if (prev == GNUTLS_FIPS140_DISABLED || prev == GNUTLS_FIPS140_SELFTESTS) { @@ -671,7 +671,7 @@ Index: gnutls-3.8.5/lib/fips.c return; } -@@ -754,7 +754,7 @@ void gnutls_fips140_set_mode(gnutls_fips +@@ -764,7 +764,7 @@ void gnutls_fips140_set_mode(gnutls_fips case GNUTLS_FIPS140_SELFTESTS: _gnutls_audit_log( NULL, @@ -680,7 +680,7 @@ Index: gnutls-3.8.5/lib/fips.c mode = GNUTLS_FIPS140_STRICT; break; default: -@@ -930,7 +930,7 @@ void _gnutls_switch_fips_state(gnutls_fi +@@ -940,7 +940,7 @@ void _gnutls_switch_fips_state(gnutls_fi } if (!_tfips_context) { @@ -689,7 +689,7 @@ Index: gnutls-3.8.5/lib/fips.c return; } -@@ -944,7 +944,7 @@ void _gnutls_switch_fips_state(gnutls_fi +@@ -954,7 +954,7 @@ void _gnutls_switch_fips_state(gnutls_fi if (mode != GNUTLS_FIPS140_LAX) { _gnutls_audit_log( NULL, @@ -698,7 +698,7 @@ Index: gnutls-3.8.5/lib/fips.c operation_state_to_string(state)); } _tfips_context->state = state; -@@ -955,7 +955,7 @@ void _gnutls_switch_fips_state(gnutls_fi +@@ -965,7 +965,7 @@ void _gnutls_switch_fips_state(gnutls_fi if (mode != GNUTLS_FIPS140_LAX) { _gnutls_audit_log( NULL, @@ -707,7 +707,7 @@ Index: gnutls-3.8.5/lib/fips.c operation_state_to_string(state)); } _tfips_context->state = state; -@@ -967,7 +967,7 @@ void _gnutls_switch_fips_state(gnutls_fi +@@ -977,7 +977,7 @@ void _gnutls_switch_fips_state(gnutls_fi if (mode != GNUTLS_FIPS140_LAX) { _gnutls_audit_log( NULL, @@ -716,7 +716,7 @@ Index: gnutls-3.8.5/lib/fips.c operation_state_to_string( _tfips_context->state), operation_state_to_string(state)); -@@ -1029,7 +1029,7 @@ int gnutls_fips140_run_self_tests(void) +@@ -1039,7 +1039,7 @@ int gnutls_fips140_run_self_tests(void) ret < 0) { _gnutls_switch_lib_state(LIB_STATE_ERROR); _gnutls_audit_log(NULL, @@ -725,7 +725,7 @@ Index: gnutls-3.8.5/lib/fips.c } else { /* Restore the previous library state */ _gnutls_switch_lib_state(prev_lib_state); -@@ -1041,7 +1041,7 @@ int gnutls_fips140_run_self_tests(void) +@@ -1051,7 +1051,7 @@ int gnutls_fips140_run_self_tests(void) if (gnutls_fips140_pop_context() < 0) { _gnutls_switch_lib_state(LIB_STATE_ERROR); _gnutls_audit_log( @@ -734,11 +734,11 @@ Index: gnutls-3.8.5/lib/fips.c } gnutls_fips140_context_deinit(fips_context); } -Index: gnutls-3.8.5/lib/fips.h +Index: gnutls-3.8.6/lib/fips.h =================================================================== ---- gnutls-3.8.5.orig/lib/fips.h -+++ gnutls-3.8.5/lib/fips.h -@@ -160,7 +160,7 @@ is_cipher_algo_allowed_in_fips(gnutls_ci +--- gnutls-3.8.6.orig/lib/fips.h ++++ gnutls-3.8.6/lib/fips.h +@@ -163,7 +163,7 @@ is_cipher_algo_allowed_in_fips(gnutls_ci } #ifdef ENABLE_FIPS140 @@ -747,7 +747,7 @@ Index: gnutls-3.8.5/lib/fips.h * and return an error if necessary or ignore */ #define FIPS_RULE(condition, ret_error, ...) \ { \ -@@ -170,10 +170,10 @@ is_cipher_algo_allowed_in_fips(gnutls_ci +@@ -173,10 +173,10 @@ is_cipher_algo_allowed_in_fips(gnutls_ci if (_mode == GNUTLS_FIPS140_LOG) { \ _gnutls_audit_log( \ NULL, \ @@ -760,7 +760,7 @@ Index: gnutls-3.8.5/lib/fips.h return ret_error; \ } \ } \ -@@ -188,7 +188,7 @@ inline static bool is_mac_algo_allowed(g +@@ -191,7 +191,7 @@ inline static bool is_mac_algo_allowed(g switch (mode) { case GNUTLS_FIPS140_LOG: _gnutls_audit_log(NULL, @@ -769,7 +769,7 @@ Index: gnutls-3.8.5/lib/fips.h gnutls_mac_get_name(algo)); FALLTHROUGH; case GNUTLS_FIPS140_DISABLED: -@@ -210,7 +210,7 @@ inline static bool is_cipher_algo_allowe +@@ -213,7 +213,7 @@ inline static bool is_cipher_algo_allowe switch (mode) { case GNUTLS_FIPS140_LOG: _gnutls_audit_log(NULL, @@ -778,10 +778,10 @@ Index: gnutls-3.8.5/lib/fips.h gnutls_cipher_get_name(algo)); FALLTHROUGH; case GNUTLS_FIPS140_DISABLED: -Index: gnutls-3.8.5/lib/global.c +Index: gnutls-3.8.6/lib/global.c =================================================================== ---- gnutls-3.8.5.orig/lib/global.c -+++ gnutls-3.8.5/lib/global.c +--- gnutls-3.8.6.orig/lib/global.c ++++ gnutls-3.8.6/lib/global.c @@ -338,12 +338,12 @@ static int _gnutls_global_init(unsigned #ifdef ENABLE_FIPS140 @@ -815,11 +815,11 @@ Index: gnutls-3.8.5/lib/global.c if (res != 2) { gnutls_assert(); goto out; -Index: gnutls-3.8.5/lib/includes/gnutls/gnutls.h.in +Index: gnutls-3.8.6/lib/includes/gnutls/gnutls.h.in =================================================================== ---- gnutls-3.8.5.orig/lib/includes/gnutls/gnutls.h.in -+++ gnutls-3.8.5/lib/includes/gnutls/gnutls.h.in -@@ -3201,16 +3201,16 @@ typedef int (*gnutls_alert_read_func)(gn +--- gnutls-3.8.6.orig/lib/includes/gnutls/gnutls.h.in ++++ gnutls-3.8.6/lib/includes/gnutls/gnutls.h.in +@@ -3203,16 +3203,16 @@ typedef int (*gnutls_alert_read_func)(gn void gnutls_alert_set_read_function(gnutls_session_t session, gnutls_alert_read_func func); @@ -840,7 +840,7 @@ Index: gnutls-3.8.5/lib/includes/gnutls/gnutls.h.in * application is aware of the followed security policy, and needs * to utilize disallowed operations for other reasons (e.g., compatibility). * @GNUTLS_FIPS140_LOG: Similarly to %GNUTLS_FIPS140_LAX, it allows forbidden operations; any use of them results -@@ -3218,7 +3218,7 @@ unsigned gnutls_fips140_mode_enabled(voi +@@ -3220,7 +3220,7 @@ unsigned gnutls_fips140_mode_enabled(voi * @GNUTLS_FIPS140_SELFTESTS: A transient state during library initialization. That state * cannot be set or seen by applications. * @@ -849,10 +849,10 @@ Index: gnutls-3.8.5/lib/includes/gnutls/gnutls.h.in */ typedef enum gnutls_fips_mode_t { GNUTLS_FIPS140_DISABLED = 0, -Index: gnutls-3.8.5/src/cli.c +Index: gnutls-3.8.6/src/cli.c =================================================================== ---- gnutls-3.8.5.orig/src/cli.c -+++ gnutls-3.8.5/src/cli.c +--- gnutls-3.8.6.orig/src/cli.c ++++ gnutls-3.8.6/src/cli.c @@ -1635,10 +1635,10 @@ static void cmd_parser(int argc, char ** if (HAVE_OPT(FIPS140_MODE)) { @@ -866,10 +866,10 @@ Index: gnutls-3.8.5/src/cli.c exit(1); } -Index: gnutls-3.8.5/src/gnutls-cli-options.c +Index: gnutls-3.8.6/src/gnutls-cli-options.c =================================================================== ---- gnutls-3.8.5.orig/src/gnutls-cli-options.c -+++ gnutls-3.8.5/src/gnutls-cli-options.c +--- gnutls-3.8.6.orig/src/gnutls-cli-options.c ++++ gnutls-3.8.6/src/gnutls-cli-options.c @@ -810,7 +810,7 @@ usage (FILE *out, int status) " --inline-commands-prefix=str Change the default delimiter for inline commands\n" " --provider=file Specify the PKCS #11 provider library\n" @@ -879,10 +879,10 @@ Index: gnutls-3.8.5/src/gnutls-cli-options.c " --list-config Reports the configuration of the library\n" " --logfile=str Redirect informational messages to a specific file\n" " --keymatexport=str Label used for exporting keying material\n" -Index: gnutls-3.8.5/tests/cert-tests/gost.sh +Index: gnutls-3.8.6/tests/cert-tests/gost.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/gost.sh -+++ gnutls-3.8.5/tests/cert-tests/gost.sh +--- gnutls-3.8.6.orig/tests/cert-tests/gost.sh ++++ gnutls-3.8.6/tests/cert-tests/gost.sh @@ -38,7 +38,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -892,10 +892,10 @@ Index: gnutls-3.8.5/tests/cert-tests/gost.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs12-corner-cases.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs12-corner-cases.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs12-corner-cases.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs12-corner-cases.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs12-corner-cases.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs12-corner-cases.sh @@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -905,10 +905,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs12-corner-cases.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs12-encode.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs12-encode.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs12-encode.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs12-encode.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs12-encode.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs12-encode.sh @@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -918,10 +918,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs12-encode.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs12-gost.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs12-gost.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs12-gost.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs12-gost.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs12-gost.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs12-gost.sh @@ -29,7 +29,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -931,10 +931,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs12-gost.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs12.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs12.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs12.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs12.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs12.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs12.sh @@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -944,10 +944,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs12.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs8-decode.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs8-decode.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs8-decode.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs8-decode.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs8-decode.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs8-decode.sh @@ -29,7 +29,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -957,10 +957,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs8-decode.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs8-eddsa.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs8-eddsa.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs8-eddsa.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs8-eddsa.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs8-eddsa.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs8-eddsa.sh @@ -29,7 +29,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -970,10 +970,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs8-eddsa.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs8-gost.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs8-gost.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs8-gost.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs8-gost.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs8-gost.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs8-gost.sh @@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -983,10 +983,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs8-gost.sh exit 77 fi -Index: gnutls-3.8.5/tests/cert-tests/pkcs8.sh +Index: gnutls-3.8.6/tests/cert-tests/pkcs8.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cert-tests/pkcs8.sh -+++ gnutls-3.8.5/tests/cert-tests/pkcs8.sh +--- gnutls-3.8.6.orig/tests/cert-tests/pkcs8.sh ++++ gnutls-3.8.6/tests/cert-tests/pkcs8.sh @@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then fi @@ -996,10 +996,10 @@ Index: gnutls-3.8.5/tests/cert-tests/pkcs8.sh exit 77 fi -Index: gnutls-3.8.5/tests/cipher-listings.sh +Index: gnutls-3.8.6/tests/cipher-listings.sh =================================================================== ---- gnutls-3.8.5.orig/tests/cipher-listings.sh -+++ gnutls-3.8.5/tests/cipher-listings.sh +--- gnutls-3.8.6.orig/tests/cipher-listings.sh ++++ gnutls-3.8.6/tests/cipher-listings.sh @@ -63,7 +63,7 @@ check() ${CLI} --fips140-mode @@ -1009,10 +1009,10 @@ Index: gnutls-3.8.5/tests/cipher-listings.sh exit 77 fi -Index: gnutls-3.8.5/tests/testpkcs11.sh +Index: gnutls-3.8.6/tests/testpkcs11.sh =================================================================== ---- gnutls-3.8.5.orig/tests/testpkcs11.sh -+++ gnutls-3.8.5/tests/testpkcs11.sh +--- gnutls-3.8.6.orig/tests/testpkcs11.sh ++++ gnutls-3.8.6/tests/testpkcs11.sh @@ -26,7 +26,7 @@ RETCODE=0 @@ -1022,10 +1022,10 @@ Index: gnutls-3.8.5/tests/testpkcs11.sh exit 77 fi -Index: gnutls-3.8.5/doc/enums/gnutls_fips_mode_t +Index: gnutls-3.8.6/doc/enums/gnutls_fips_mode_t =================================================================== ---- gnutls-3.8.5.orig/doc/enums/gnutls_fips_mode_t -+++ gnutls-3.8.5/doc/enums/gnutls_fips_mode_t +--- gnutls-3.8.6.orig/doc/enums/gnutls_fips_mode_t ++++ gnutls-3.8.6/doc/enums/gnutls_fips_mode_t @@ -3,7 +3,7 @@ @c gnutls_fips_mode_t @table @code @@ -1046,10 +1046,10 @@ Index: gnutls-3.8.5/doc/enums/gnutls_fips_mode_t application is aware of the followed security policy, and needs to utilize disallowed operations for other reasons (e.g., compatibility). @item GNUTLS_@-FIPS140_@-LOG -Index: gnutls-3.8.5/doc/gnutls-api.texi +Index: gnutls-3.8.6/doc/gnutls-api.texi =================================================================== ---- gnutls-3.8.5.orig/doc/gnutls-api.texi -+++ gnutls-3.8.5/doc/gnutls-api.texi +--- gnutls-3.8.6.orig/doc/gnutls-api.texi ++++ gnutls-3.8.6/doc/gnutls-api.texi @@ -3275,7 +3275,7 @@ unusable. This function is not thread-s @subheading gnutls_fips140_set_mode @anchor{gnutls_fips140_set_mode} @@ -1075,10 +1075,10 @@ Index: gnutls-3.8.5/doc/gnutls-api.texi values for @code{mode} or to @code{GNUTLS_FIPS140_SELFTESTS} mode, the library switches to @code{GNUTLS_FIPS140_STRICT} mode. -Index: gnutls-3.8.5/lib/ext/session_ticket.c +Index: gnutls-3.8.6/lib/ext/session_ticket.c =================================================================== ---- gnutls-3.8.5.orig/lib/ext/session_ticket.c -+++ gnutls-3.8.5/lib/ext/session_ticket.c +--- gnutls-3.8.6.orig/lib/ext/session_ticket.c ++++ gnutls-3.8.6/lib/ext/session_ticket.c @@ -517,7 +517,7 @@ int gnutls_session_ticket_key_generate(g { if (_gnutls_fips_mode_enabled()) { @@ -1088,11 +1088,11 @@ Index: gnutls-3.8.5/lib/ext/session_ticket.c * some limits on allowed key size, thus it is not * used. These limits do not affect this function as * it does not generate a "key" but rather key material -Index: gnutls-3.8.5/lib/libgnutls.map +Index: gnutls-3.8.6/lib/libgnutls.map =================================================================== ---- gnutls-3.8.5.orig/lib/libgnutls.map -+++ gnutls-3.8.5/lib/libgnutls.map -@@ -1450,7 +1450,7 @@ GNUTLS_FIPS140_3_4 { +--- gnutls-3.8.6.orig/lib/libgnutls.map ++++ gnutls-3.8.6/lib/libgnutls.map +@@ -1459,7 +1459,7 @@ GNUTLS_FIPS140_3_4 { gnutls_hkdf_self_test; gnutls_pbkdf2_self_test; gnutls_tlsprf_self_test; @@ -1101,11 +1101,11 @@ Index: gnutls-3.8.5/lib/libgnutls.map drbg_aes_reseed; drbg_aes_init; drbg_aes_generate; -Index: gnutls-3.8.5/lib/nettle/mac.c +Index: gnutls-3.8.6/lib/nettle/mac.c =================================================================== ---- gnutls-3.8.5.orig/lib/nettle/mac.c -+++ gnutls-3.8.5/lib/nettle/mac.c -@@ -264,7 +264,7 @@ static void _wrap_gmac_digest(void *_ctx +--- gnutls-3.8.6.orig/lib/nettle/mac.c ++++ gnutls-3.8.6/lib/nettle/mac.c +@@ -270,7 +270,7 @@ static void _wrap_gmac_digest(void *_ctx static int _mac_ctx_init(gnutls_mac_algorithm_t algo, struct nettle_mac_ctx *ctx) { @@ -1114,7 +1114,7 @@ Index: gnutls-3.8.5/lib/nettle/mac.c * gnutls_hash_init() and gnutls_hmac_init() */ ctx->set_nonce = NULL; -@@ -650,7 +650,7 @@ static void _md5_sha1_digest(void *_ctx, +@@ -663,7 +663,7 @@ static void _md5_sha1_init(void *_ctx) static int _ctx_init(gnutls_digest_algorithm_t algo, struct nettle_hash_ctx *ctx) { @@ -1123,10 +1123,10 @@ Index: gnutls-3.8.5/lib/nettle/mac.c * gnutls_hash_init() and gnutls_hmac_init() */ switch (algo) { case GNUTLS_DIG_MD5: -Index: gnutls-3.8.5/config.h.in +Index: gnutls-3.8.6/config.h.in =================================================================== ---- gnutls-3.8.5.orig/config.h.in -+++ gnutls-3.8.5/config.h.in +--- gnutls-3.8.6.orig/config.h.in ++++ gnutls-3.8.6/config.h.in @@ -82,7 +82,7 @@ /* enable DHE */ #undef ENABLE_ECDHE @@ -1145,11 +1145,11 @@ Index: gnutls-3.8.5/config.h.in #undef FIPS_KEY /* The FIPS140 module name */ -Index: gnutls-3.8.5/configure +Index: gnutls-3.8.6/configure =================================================================== ---- gnutls-3.8.5.orig/configure -+++ gnutls-3.8.5/configure -@@ -3832,7 +3832,7 @@ Optional Features: +--- gnutls-3.8.6.orig/configure ++++ gnutls-3.8.6/configure +@@ -3834,7 +3834,7 @@ Optional Features: --enable-fast-install[=PKGS] optimize for fast installation [default=yes] --disable-libtool-lock avoid locking (might break parallel builds) @@ -1158,10 +1158,10 @@ Index: gnutls-3.8.5/configure --enable-strict-x509 enable stricter sanity checks for x509 certificates --disable-non-suiteb-curves disable curves not in SuiteB -Index: gnutls-3.8.5/doc/cha-support.texi +Index: gnutls-3.8.6/doc/cha-support.texi =================================================================== ---- gnutls-3.8.5.orig/doc/cha-support.texi -+++ gnutls-3.8.5/doc/cha-support.texi +--- gnutls-3.8.6.orig/doc/cha-support.texi ++++ gnutls-3.8.6/doc/cha-support.texi @@ -134,5 +134,5 @@ There are certifications from national o to an auditor that the crypto component follows some best practices, such as unit testing and reliance on well known crypto primitives. @@ -1170,23 +1170,23 @@ Index: gnutls-3.8.5/doc/cha-support.texi -See @ref{FIPS140-2 mode} for more information. +GnuTLS has support for the FIPS 140-3 certification under Red Hat Enterprise Linux. +See @ref{FIPS140-3 mode} for more information. -Index: gnutls-3.8.5/doc/gnutls.info +Index: gnutls-3.8.6/doc/gnutls.info =================================================================== ---- gnutls-3.8.5.orig/doc/gnutls.info -+++ gnutls-3.8.5/doc/gnutls.info -@@ -620,7 +620,7 @@ Ref: fig-crypto-layers745475 - Ref: Cryptographic Backend-Footnote-1748787 - Ref: Cryptographic Backend-Footnote-2748872 - Node: Random Number Generators-internals748984 --Node: FIPS140-2 mode756454 -+Node: FIPS140-3 mode756454 - Ref: gnutls_fips_mode_t759152 - Node: Upgrading from previous versions762821 - Node: Support777063 -Index: gnutls-3.8.5/src/gnutls-cli-options.json +--- gnutls-3.8.6.orig/doc/gnutls.info ++++ gnutls-3.8.6/doc/gnutls.info +@@ -620,7 +620,7 @@ Ref: fig-crypto-layers745654 + Ref: Cryptographic Backend-Footnote-1748966 + Ref: Cryptographic Backend-Footnote-2749051 + Node: Random Number Generators-internals749163 +-Node: FIPS140-2 mode756633 ++Node: FIPS140-3 mode756633 + Ref: gnutls_fips_mode_t759331 + Node: Upgrading from previous versions763000 + Node: Support777242 +Index: gnutls-3.8.6/src/gnutls-cli-options.json =================================================================== ---- gnutls-3.8.5.orig/src/gnutls-cli-options.json -+++ gnutls-3.8.5/src/gnutls-cli-options.json +--- gnutls-3.8.6.orig/src/gnutls-cli-options.json ++++ gnutls-3.8.6/src/gnutls-cli-options.json @@ -384,7 +384,7 @@ }, { @@ -1196,10 +1196,10 @@ Index: gnutls-3.8.5/src/gnutls-cli-options.json }, { "long-option": "list-config", -Index: gnutls-3.8.5/tests/pkcs11-tool.sh +Index: gnutls-3.8.6/tests/pkcs11-tool.sh =================================================================== ---- gnutls-3.8.5.orig/tests/pkcs11-tool.sh -+++ gnutls-3.8.5/tests/pkcs11-tool.sh +--- gnutls-3.8.6.orig/tests/pkcs11-tool.sh ++++ gnutls-3.8.6/tests/pkcs11-tool.sh @@ -30,7 +30,7 @@ set -x : ${DIFF=diff} @@ -1209,10 +1209,10 @@ Index: gnutls-3.8.5/tests/pkcs11-tool.sh exit 77 fi -Index: gnutls-3.8.5/doc/manpages/gnutls_fips140_set_mode.3 +Index: gnutls-3.8.6/doc/manpages/gnutls_fips140_set_mode.3 =================================================================== ---- gnutls-3.8.5.orig/doc/manpages/gnutls_fips140_set_mode.3 -+++ gnutls-3.8.5/doc/manpages/gnutls_fips140_set_mode.3 +--- gnutls-3.8.6.orig/doc/manpages/gnutls_fips140_set_mode.3 ++++ gnutls-3.8.6/doc/manpages/gnutls_fips140_set_mode.3 @@ -8,7 +8,7 @@ gnutls_fips140_set_mode \- API function .BI "void gnutls_fips140_set_mode(gnutls_fips_mode_t " mode ", unsigned " flags ");" .SH ARGUMENTS diff --git a/gnutls-FIPS-jitterentropy.patch b/gnutls-FIPS-jitterentropy.patch index bdd00ba..1fc0770 100644 --- a/gnutls-FIPS-jitterentropy.patch +++ b/gnutls-FIPS-jitterentropy.patch @@ -1,7 +1,7 @@ -Index: gnutls-3.8.1/lib/nettle/sysrng-linux.c +Index: gnutls-3.8.6/lib/nettle/sysrng-linux.c =================================================================== ---- gnutls-3.8.1.orig/lib/nettle/sysrng-linux.c -+++ gnutls-3.8.1/lib/nettle/sysrng-linux.c +--- gnutls-3.8.6.orig/lib/nettle/sysrng-linux.c ++++ gnutls-3.8.6/lib/nettle/sysrng-linux.c @@ -49,6 +49,15 @@ get_entropy_func _rnd_get_system_entropy = NULL; @@ -158,11 +158,11 @@ Index: gnutls-3.8.1/lib/nettle/sysrng-linux.c +#endif return; } -Index: gnutls-3.8.1/lib/nettle/Makefile.in +Index: gnutls-3.8.6/lib/nettle/Makefile.in =================================================================== ---- gnutls-3.8.1.orig/lib/nettle/Makefile.in -+++ gnutls-3.8.1/lib/nettle/Makefile.in -@@ -402,7 +402,7 @@ am__v_CC_1 = +--- gnutls-3.8.6.orig/lib/nettle/Makefile.in ++++ gnutls-3.8.6/lib/nettle/Makefile.in +@@ -497,7 +497,7 @@ am__v_CC_1 = CCLD = $(CC) LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ @@ -171,10 +171,10 @@ Index: gnutls-3.8.1/lib/nettle/Makefile.in AM_V_CCLD = $(am__v_CCLD_@AM_V@) am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) am__v_CCLD_0 = @echo " CCLD " $@; -Index: gnutls-3.8.1/lib/nettle/Makefile.am +Index: gnutls-3.8.6/lib/nettle/Makefile.am =================================================================== ---- gnutls-3.8.1.orig/lib/nettle/Makefile.am -+++ gnutls-3.8.1/lib/nettle/Makefile.am +--- gnutls-3.8.6.orig/lib/nettle/Makefile.am ++++ gnutls-3.8.6/lib/nettle/Makefile.am @@ -20,7 +20,7 @@ include $(top_srcdir)/lib/common.mk @@ -184,10 +184,10 @@ Index: gnutls-3.8.1/lib/nettle/Makefile.am AM_CPPFLAGS = \ -I$(srcdir)/int \ -Index: gnutls-3.8.1/lib/nettle/rnd-fips.c +Index: gnutls-3.8.6/lib/nettle/rnd-fips.c =================================================================== ---- gnutls-3.8.1.orig/lib/nettle/rnd-fips.c -+++ gnutls-3.8.1/lib/nettle/rnd-fips.c +--- gnutls-3.8.6.orig/lib/nettle/rnd-fips.c ++++ gnutls-3.8.6/lib/nettle/rnd-fips.c @@ -129,6 +129,10 @@ static int drbg_init(struct fips_ctx *fc uint8_t buffer[DRBG_AES_SEED_SIZE]; int ret; @@ -210,16 +210,16 @@ Index: gnutls-3.8.1/lib/nettle/rnd-fips.c ret = get_entropy(fctx, buffer, sizeof(buffer)); if (ret < 0) { _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR); -Index: gnutls-3.8.1/tests/Makefile.am +Index: gnutls-3.8.6/tests/Makefile.am =================================================================== ---- gnutls-3.8.1.orig/tests/Makefile.am -+++ gnutls-3.8.1/tests/Makefile.am -@@ -208,7 +208,7 @@ ctests += mini-record-2 simple gnutls_hm +--- gnutls-3.8.6.orig/tests/Makefile.am ++++ gnutls-3.8.6/tests/Makefile.am +@@ -209,7 +209,7 @@ ctests += mini-record-2 simple gnutls_hm dtls12-cert-key-exchange dtls10-cert-key-exchange x509-cert-callback-legacy \ keylog-env ssl2-hello tlsfeature-ext dtls-rehandshake-cert-2 dtls-session-ticket-lost \ tlsfeature-crt dtls-rehandshake-cert-3 resume-with-false-start \ -- set_x509_key_file_ocsp client-fastopen rng-sigint srp rng-pthread \ -+ set_x509_key_file_ocsp client-fastopen srp rng-pthread \ +- set_x509_key_file_ocsp client-fastopen rng-sigint srp \ ++ set_x509_key_file_ocsp client-fastopen srp \ safe-renegotiation/srn0 safe-renegotiation/srn1 safe-renegotiation/srn2 \ safe-renegotiation/srn3 safe-renegotiation/srn4 safe-renegotiation/srn5 \ rsa-illegal-import set_x509_ocsp_multi_invalid set_key set_x509_key_file_ocsp_multi2 \ diff --git a/gnutls.changes b/gnutls.changes index 0162c52..d4efaeb 100644 --- a/gnutls.changes +++ b/gnutls.changes @@ -1,3 +1,22 @@ +------------------------------------------------------------------- +Thu Jul 25 08:51:56 UTC 2024 - Pedro Monreal + +- Update to 3.8.6: + * libgnutls: PBMAC1 is now supported as a MAC mechanism for PKCS#12 + To be compliant with FIPS 140-3, PKCS#12 files with MAC based on + PBKDF2 (PBMAC1) is now supported, according to the specification + proposed in draft-ietf-lamps-pkcs12-pbmac1. + * libgnutls: SHA3 extendable output functions (XOF) are now supported + SHA3 XOF, SHAKE128 and SHAKE256, are now usable through a new + public API gnutls_hash_squeeze. + * API and ABI modifications: + - gnutls_pkcs12_generate_mac3: New function + - gnutls_pkcs12_flags_t: New enum + - gnutls_hash_squeeze: New function + * Rebase patches: + - gnutls-FIPS-140-3-references.patch + - gnutls-FIPS-jitterentropy.patch + ------------------------------------------------------------------- Fri Apr 5 07:28:14 UTC 2024 - Pedro Monreal diff --git a/gnutls.spec b/gnutls.spec index f579a5b..a99c19b 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -40,7 +40,7 @@ %endif %bcond_with tpm Name: gnutls -Version: 3.8.5 +Version: 3.8.6 Release: 0 Summary: The GNU Transport Layer Security Library License: GPL-3.0-or-later AND LGPL-2.1-or-later

    GNUTLS_FIPS140_DISABLED

    		 @@ -593,7 +593,7 @@ Index: gnutls-3.8.5/doc/reference/html/gnutls-gnutls.html  

    GNUTLS_FIPS140_LAX

    		 @@ -604,17 +604,17 @@ Index: gnutls-3.8.5/doc/reference/html/gnutls-gnutls.html application is aware of the followed security policy, and needs to utilize disallowed operations for other reasons (e.g., compatibility).