diff --git a/.gitignore b/.gitignore index 2d69faa..4979f33 100644 --- a/.gitignore +++ b/.gitignore @@ -70,3 +70,4 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.5.5-hobbled.tar.xz /gnutls-3.5.6-hobbled.tar.xz /gnutls-3.5.7-hobbled.tar.xz +/gnutls-3.5.8-hobbled.tar.xz diff --git a/gnutls-3.5.1-default-policy.patch b/gnutls-3.5.1-default-policy.patch deleted file mode 100644 index 4a3dabb..0000000 --- a/gnutls-3.5.1-default-policy.patch +++ /dev/null @@ -1,31 +0,0 @@ -diff --git a/lib/priority.c b/lib/priority.c -index 767312c..0657940 100644 ---- a/lib/priority.c -+++ b/lib/priority.c -@@ -1215,6 +1215,7 @@ gnutls_priority_init(gnutls_priority_t * priority_cache, - bulk_rmadd_func *bulk_fn; - bulk_rmadd_func *bulk_given_fn; - const cipher_entry_st *centry; -+ unsigned dset; - - if (err_pos) - *err_pos = priorities; -@@ -1232,10 +1233,16 @@ gnutls_priority_init(gnutls_priority_t * priority_cache, - (*priority_cache)->sr = SR_PARTIAL; - (*priority_cache)->min_record_version = 1; - -- if (priorities == NULL) -- priorities = "NORMAL"; -+ if (priorities == NULL) { -+ priorities = "@SYSTEM"; -+ dset = 1; -+ } - - darg = _gnutls_resolve_priorities(priorities); -+ if (darg == NULL && dset == 1) { -+ priorities = "NORMAL"; -+ darg = _gnutls_resolve_priorities(priorities); -+ } - if (darg == NULL) { - gnutls_assert(); - goto error; diff --git a/gnutls-3.5.7-load-pkcs8-keys.patch b/gnutls-3.5.7-load-pkcs8-keys.patch deleted file mode 100644 index e065415..0000000 --- a/gnutls-3.5.7-load-pkcs8-keys.patch +++ /dev/null @@ -1,159 +0,0 @@ -diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c -index 74bb466..0094a83 100644 ---- a/lib/x509/privkey_pkcs8.c -+++ b/lib/x509/privkey_pkcs8.c -@@ -711,6 +711,7 @@ static int pkcs8_key_decrypt(const gnutls_datum_t * raw_key, - &kdf_params, &enc_params, &tmp); - if (result < 0) { - gnutls_assert(); -+ result = GNUTLS_E_DECRYPTION_FAILED; - goto error; - } - -diff --git a/tests/Makefile.am b/tests/Makefile.am -index af82633..b279cdc 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -116,7 +116,7 @@ ctests = mini-record-2 simple gc set_pkcs12_cred certder certuniqueid \ - multi-alerts naked-alerts pkcs7-cat-parse set_known_dh_params_x509 \ - set_known_dh_params_anon set_known_dh_params_psk session-tickets-ok \ - session-tickets-missing set_x509_key_file_legacy status-request-ext \ -- rng-no-onload dtls1-2-mtu-check crl_apis -+ rng-no-onload dtls1-2-mtu-check crl_apis pkcs8-key-decode-encrypted - - if HAVE_SECCOMP_TESTS - ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp -diff --git a/tests/pkcs8-key-decode-encrypted.c b/tests/pkcs8-key-decode-encrypted.c -new file mode 100644 -index 0000000..48ab9b6 ---- /dev/null -+++ b/tests/pkcs8-key-decode-encrypted.c -@@ -0,0 +1,75 @@ -+/* -+ * Copyright (C) 2015 Red Hat, Inc. -+ * -+ * Author: Daniel Berrange -+ * -+ * This file is part of GnuTLS. -+ * -+ * GnuTLS is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 3 of the License, or -+ * (at your option) any later version. -+ * -+ * GnuTLS is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with GnuTLS; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+ -+#include "utils.h" -+ -+#define PRIVATE_KEY \ -+ "-----BEGIN ENCRYPTED PRIVATE KEY-----\n" \ -+ "MIHeMEkGCSqGSIb3DQEFDTA8MBsGCSqGSIb3DQEFDDAOBAiebBrnqPv4owICCAAw\n" \ -+ "HQYJYIZIAWUDBAEqBBBykFR6i1My/DYFBYrz1lmABIGQ3XGpp3+v/ENC1S+X7Ay6\n" \ -+ "JoquYKuMw6yUmWoGFvPIPA9UWqMve2Uj4l2l96Sywd6iNFP63ow6pIq4wUP6REuY\n" \ -+ "ZhCgoAOQomeFqhAhkw6QJCygp5vw2rh9OZ5tiP/Ko6IDTA2rSas91nepHpQOb247\n" \ -+ "zta5XzXb5TRkBsVU8tAPADP+wS/vBCS05ne1wmhdD6c6\n" \ -+ "-----END ENCRYPTED PRIVATE KEY-----\n" -+ -+ -+static int test_decode(void) -+{ -+ gnutls_x509_privkey_t key; -+ const gnutls_datum_t data = { -+ (unsigned char *)PRIVATE_KEY, -+ strlen(PRIVATE_KEY) -+ }; -+ int err; -+ -+ if ((err = gnutls_x509_privkey_init(&key)) < 0) { -+ fail("Failed to init key %s\n", gnutls_strerror(err)); -+ } -+ -+ err = gnutls_x509_privkey_import_pkcs8(key, &data, -+ GNUTLS_X509_FMT_PEM, "", 0); -+ if (err != GNUTLS_E_DECRYPTION_FAILED) { -+ fail("Unexpected error code: %s/%d\n", gnutls_strerror(err), err); -+ } -+ -+ err = gnutls_x509_privkey_import_pkcs8(key, &data, -+ GNUTLS_X509_FMT_PEM, "password", 0); -+ if (err != 0) { -+ fail("Unexpected error code: %s\n", gnutls_strerror(err)); -+ } -+ -+ success("Loaded key\n%s", PRIVATE_KEY); -+ -+ gnutls_x509_privkey_deinit(key); -+ return 0; -+} -+ -+void doit(void) -+{ -+ test_decode(); -+} -diff --git a/tests/pkcs8-key-decode.c b/tests/pkcs8-key-decode.c -index 1c462ab..0f570ac 100644 ---- a/tests/pkcs8-key-decode.c -+++ b/tests/pkcs8-key-decode.c -@@ -26,6 +26,8 @@ - #include - #include - -+#include "utils.h" -+ - # define PRIVATE_KEY \ - "-----BEGIN PRIVATE KEY-----\n" \ - "MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALVcr\n" \ -@@ -46,8 +48,8 @@ - "dcrhrkJn2sa/+O8OKvdrPSeeu/N5WwYhJf61+CPoenMp7IFci\n" \ - "-----END PRIVATE KEY-----\n" - -- --int main(void) { -+static int test_load(void) -+{ - gnutls_x509_privkey_t key; - const gnutls_datum_t data = { - (unsigned char *)PRIVATE_KEY, -@@ -56,19 +58,23 @@ int main(void) { - int err; - - if ((err = gnutls_x509_privkey_init(&key)) < 0) { -- fprintf(stderr, "Failed to init key %s\n", gnutls_strerror(err)); -+ fail("Failed to init key %s\n", gnutls_strerror(err)); - exit(1); - } - - if ((err = gnutls_x509_privkey_import(key, &data, - GNUTLS_X509_FMT_PEM)) < 0) { -- fprintf(stderr, "Failed to import key %s\n", gnutls_strerror(err)); -+ fail("Failed to import key %s\n", gnutls_strerror(err)); - exit(1); - } - --#if 0 -- fprintf(stderr, "Loaded key\n%s", PRIVATE_KEY); --#endif -+ success("Loaded key\n%s", PRIVATE_KEY); -+ - gnutls_x509_privkey_deinit(key); - return 0; - } -+ -+void doit(void) -+{ -+ test_load(); -+} diff --git a/gnutls.spec b/gnutls.spec index 90ce88b..01527a8 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -2,8 +2,8 @@ %bcond_without guile Summary: A TLS protocol implementation Name: gnutls -Version: 3.5.7 -Release: 3%{?dist} +Version: 3.5.8 +Release: 1%{?dist} # The libraries are LGPLv2.1+, utilities are GPLv3+ License: GPLv3+ and LGPLv2+ Group: System Environment/Libraries @@ -34,9 +34,7 @@ URL: http://www.gnutls.org/ Source0: %{name}-%{version}-hobbled.tar.xz Source2: hobble-gnutls Patch1: gnutls-3.2.7-rpath.patch -Patch2: gnutls-3.5.1-default-policy.patch -Patch3: gnutls-3.4.2-no-now-guile.patch -Patch4: gnutls-3.5.7-load-pkcs8-keys.patch +Patch2: gnutls-3.4.2-no-now-guile.patch # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -137,9 +135,7 @@ This package contains Guile bindings for the library. %setup -q %patch1 -p1 -b .rpath -%patch2 -p1 -b .default-policy -%patch3 -p1 -b .guile -%patch4 -p1 -b .pkcs8-load +%patch2 -p1 -b .guile sed 's/gnutls_srp.c//g' -i lib/Makefile.in sed 's/gnutls_srp.lo//g' -i lib/Makefile.in @@ -148,6 +144,7 @@ rm -f lib/minitasn1/*.c lib/minitasn1/*.h rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h %{SOURCE2} -e +echo "SYSTEM=NORMAL" >> tests/system.prio %build %configure --with-libtasn1-prefix=%{_prefix} \ @@ -169,7 +166,8 @@ rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/ %else --disable-dane \ %endif - --disable-rpath + --disable-rpath \ + --with-default-priority-string="@SYSTEM" make %{?_smp_mflags} V=1 %install @@ -270,6 +268,9 @@ fi %endif %changelog +* Mon Jan 9 2017 Nikos Mavrogiannopoulos 3.5.8-1 +- New upstream release + * Tue Dec 13 2016 Nikos Mavrogiannopoulos 3.5.7-3 - Fix PKCS#8 file loading (#1404084) diff --git a/hobble-gnutls b/hobble-gnutls index 3302104..0989b6c 100755 --- a/hobble-gnutls +++ b/hobble-gnutls @@ -9,7 +9,7 @@ fi # SRP for f in auth/srp_sb64.c auth/srp_passwd.c auth/srp_rsa.c \ - gnutls_srp.c auth/srp.c ext/srp.c ; do + srp.c auth/srp.c ext/srp.c ; do eval "$CMD lib/$f" done diff --git a/sources b/sources index b4ae716..4267d04 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d4cca844e2f25fabd6414aa86f7c5d3f gnutls-3.5.7-hobbled.tar.xz +SHA512 (gnutls-3.5.8-hobbled.tar.xz) = 99eeccc960d9e496b24512ef8524205ac165fceae6b265908842bf59435793c89c87d70f22a77bf471082f7ea5f1c169b29d4e79bbd2f51fc38976b614d906aa