forked from pool/gnutls
6e5080fb38
- Update to 3.6.5
** libgnutls: Provide the option of transparent re-handshake/reauthentication
when the GNUTLS_AUTO_REAUTH flag is specified in gnutls_init() (#571).
** libgnutls: Added support for TLS 1.3 zero round-trip (0-RTT) mode (#127)
** libgnutls: The priority functions will ignore and not enable TLS1.3 if
requested with legacy TLS versions enabled but not TLS1.2. That is because
if such a priority string is used in the client side (e.g., TLS1.3+TLS1.0 enabled)
servers which do not support TLS1.3 will negotiate TLS1.2 which will be
rejected by the client as disabled (#621).
** libgnutls: Change RSA decryption to use a new side-channel silent function.
This addresses a security issue where memory access patterns as well as timing
on the underlying Nettle rsa-decrypt function could lead to new Bleichenbacher
attacks. Side-channel resistant code is slower due to the need to mask
access and timings. When used in TLS the new functions cause RSA based
handshakes to be between 13% and 28% slower on average (Numbers are indicative,
the tests where performed on a relatively modern Intel CPU, results vary
depending on the CPU and architecture used). This change makes nettle 3.4.1
the minimum requirement of gnutls (#630). [CVSS: medium]
** libgnutls: gnutls_priority_init() and friends, allow the CTYPE-OPENPGP keyword
in the priority string. It is only accepted as legacy option and is ignored.
** libgnutls: Added support for EdDSA under PKCS#11 (#417)
** libgnutls: Added support for AES-CFB8 cipher (#357)
** libgnutls: Added support for AES-CMAC MAC (#351)
** libgnutls: In two previous versions GNUTLS_CIPHER_GOST28147_CPB/CPC/CPD_CFB ciphers
have incorrectly used CryptoPro-A S-BOX instead of proper (CryptoPro-B/-C/-D
S-BOXes). They are fixed now.
** libgnutls: Added support for GOST key unmasking and unwrapped GOST private
keys parsing, as specified in R 50.1.112-2016.
** gnutls-serv: It applies the default settings when no --priority option is given,
using gnutls_set_default_priority().
OBS-URL: https://build.opensuse.org/request/show/662795
OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=16
36 lines
1.6 KiB
Diff
36 lines
1.6 KiB
Diff
Index: gnutls-3.6.5/tests/Makefile.am
|
|
===================================================================
|
|
--- gnutls-3.6.5.orig/tests/Makefile.am 2019-01-04 14:11:28.196622546 +0100
|
|
+++ gnutls-3.6.5/tests/Makefile.am 2019-01-04 14:11:29.080627637 +0100
|
|
@@ -445,7 +445,7 @@ if !WINDOWS
|
|
# List of tests not available/functional under windows
|
|
#
|
|
|
|
-dist_check_SCRIPTS += dtls/dtls dtls/dtls-resume #dtls/dtls-nb
|
|
+dist_check_SCRIPTS += dtls/dtls #dtls/dtls-resume #dtls/dtls-nb
|
|
|
|
indirect_tests += dtls-stress
|
|
|
|
Index: gnutls-3.6.5/tests/Makefile.in
|
|
===================================================================
|
|
--- gnutls-3.6.5.orig/tests/Makefile.in 2019-01-04 14:11:28.200622568 +0100
|
|
+++ gnutls-3.6.5/tests/Makefile.in 2019-01-04 14:11:44.352715599 +0100
|
|
@@ -164,7 +164,7 @@ host_triplet = @host@
|
|
#
|
|
# List of tests not available/functional under windows
|
|
#
|
|
-@WINDOWS_FALSE@am__append_13 = dtls/dtls dtls/dtls-resume fastopen.sh \
|
|
+@WINDOWS_FALSE@am__append_13 = dtls/dtls fastopen.sh \
|
|
@WINDOWS_FALSE@ pkgconfig.sh starttls.sh starttls-ftp.sh \
|
|
@WINDOWS_FALSE@ starttls-smtp.sh starttls-lmtp.sh \
|
|
@WINDOWS_FALSE@ starttls-pop3.sh starttls-nntp.sh \
|
|
@@ -2663,7 +2663,7 @@ x509sign_verify_rsa_DEPENDENCIES = $(COM
|
|
$(am__DEPENDENCIES_2)
|
|
am__dist_check_SCRIPTS_DIST = rfc2253-escape-test \
|
|
rsa-md5-collision/rsa-md5-collision.sh systemkey.sh dtls/dtls \
|
|
- dtls/dtls-resume fastopen.sh pkgconfig.sh starttls.sh \
|
|
+ fastopen.sh pkgconfig.sh starttls.sh \
|
|
starttls-ftp.sh starttls-smtp.sh starttls-lmtp.sh \
|
|
starttls-pop3.sh starttls-nntp.sh starttls-sieve.sh \
|
|
ocsp-tests/ocsp-tls-connection \
|