diff options
author | nia <nia@pkgsrc.org> | 2018-11-09 18:03:45 +0000 |
---|---|---|
committer | nia <nia@pkgsrc.org> | 2018-11-09 18:03:45 +0000 |
commit | f6687692a4a49fd6feca3d2c1fe91a08e2e1131f (patch) | |
tree | 767fd5c6413062525ae69fa3045bfff507ff8801 | |
parent | 95bcf00fd0d0b7f710fd7c837f994861c3ac198b (diff) | |
download | pkgsrc-f6687692a4a49fd6feca3d2c1fe91a08e2e1131f.tar.gz |
gnutls: update to 3.6.4.
* Version 3.6.4 (released 2018-09-24)
** libgnutls: Added the final (RFC8446) version numbering of the TLS1.3 protocol.
** libgnutls: Corrected regression since 3.6.3 in the callbacks set with
gnutls_certificate_set_retrieve_function() which could not handle the case where
no certificates were returned, or the callbacks were set to NULL (see #528).
** libgnutls: gnutls_handshake() on server returns early on handshake when no
certificate is presented by client and the gnutls_init() flag GNUTLS_ENABLE_EARLY_START
is specified.
** libgnutls: Added session ticket key rotation on server side with TOTP.
The key set with gnutls_session_ticket_enable_server() is used as a
master key to generate time-based keys for tickets. The rotation
relates to the gnutls_db_set_cache_expiration() period.
** libgnutls: The 'record size limit' extension is added and preferred to the
'max record size' extension when possible.
** libgnutls: Provide a more flexible PKCS#11 search of trust store certificates.
This addresses the problem where the CA certificate doesn't have a subject key
identifier whereas the end certificates have an authority key identifier (#569)
** libgnutls: gnutls_privkey_export_gost_raw2(), gnutls_privkey_import_gost_raw(),
gnutls_pubkey_export_gost_raw2(), gnutls_pubkey_import_gost_raw() import
and export GOST parameters in the "native" little endian format used for these
curves. This is an intentional incompatible change with 3.6.3.
** libgnutls: Added support for seperately negotiating client and server certificate types
as defined in RFC7250. This mechanism must be explicitly enabled via the
GNUTLS_ENABLE_CERT_TYPE_NEG flag in gnutls_init().
** gnutls-cli: enable CRL validation on startup (#564)
** API and ABI modifications:
GNUTLS_ENABLE_EARLY_START: Added
GNUTLS_ENABLE_CERT_TYPE_NEG: Added
GNUTLS_TL_FAIL_ON_INVALID_CRL: Added
GNUTLS_CERTIFICATE_VERIFY_CRLS: Added
gnutls_ctype_target_t: New enumeration
gnutls_record_set_max_early_data_size: Added
gnutls_certificate_type_get2: Added
gnutls_priority_certificate_type_list2: Added
gnutls_ffdhe_6144_group_prime: Added
gnutls_ffdhe_6144_group_generator: Added
gnutls_ffdhe_6144_key_bits: Added
-rw-r--r-- | security/gnutls/Makefile | 5 | ||||
-rw-r--r-- | security/gnutls/PLIST | 5 | ||||
-rw-r--r-- | security/gnutls/distinfo | 11 | ||||
-rw-r--r-- | security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c | 24 |
4 files changed, 11 insertions, 34 deletions
diff --git a/security/gnutls/Makefile b/security/gnutls/Makefile index 693593c16e0..0cda0274ffc 100644 --- a/security/gnutls/Makefile +++ b/security/gnutls/Makefile @@ -1,7 +1,6 @@ -# $NetBSD: Makefile,v 1.190 2018/09/27 18:32:35 tnn Exp $ +# $NetBSD: Makefile,v 1.191 2018/11/09 18:03:45 nia Exp $ -DISTNAME= gnutls-3.6.3 -PKGREVISION= 2 +DISTNAME= gnutls-3.6.4 CATEGORIES= security devel MASTER_SITES= ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/ EXTRACT_SUFX= .tar.xz diff --git a/security/gnutls/PLIST b/security/gnutls/PLIST index 14ea8f29f8a..313119b5967 100644 --- a/security/gnutls/PLIST +++ b/security/gnutls/PLIST @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST,v 1.60 2018/08/16 11:05:47 wiz Exp $ +@comment $NetBSD: PLIST,v 1.61 2018/11/09 18:03:45 nia Exp $ bin/certtool bin/gnutls-cli bin/gnutls-cli-debug @@ -148,6 +148,7 @@ man/man3/gnutls_certificate_set_x509_trust_dir.3 man/man3/gnutls_certificate_set_x509_trust_file.3 man/man3/gnutls_certificate_set_x509_trust_mem.3 man/man3/gnutls_certificate_type_get.3 +man/man3/gnutls_certificate_type_get2.3 man/man3/gnutls_certificate_type_get_id.3 man/man3/gnutls_certificate_type_get_name.3 man/man3/gnutls_certificate_type_list.3 @@ -514,6 +515,7 @@ man/man3/gnutls_prf.3 man/man3/gnutls_prf_raw.3 man/man3/gnutls_prf_rfc5705.3 man/man3/gnutls_priority_certificate_type_list.3 +man/man3/gnutls_priority_certificate_type_list2.3 man/man3/gnutls_priority_cipher_list.3 man/man3/gnutls_priority_compression_list.3 man/man3/gnutls_priority_deinit.3 @@ -656,6 +658,7 @@ man/man3/gnutls_record_recv_seq.3 man/man3/gnutls_record_send.3 man/man3/gnutls_record_send2.3 man/man3/gnutls_record_send_range.3 +man/man3/gnutls_record_set_max_early_data_size.3 man/man3/gnutls_record_set_max_size.3 man/man3/gnutls_record_set_state.3 man/man3/gnutls_record_set_timeout.3 diff --git a/security/gnutls/distinfo b/security/gnutls/distinfo index 1d135052874..31f395905aa 100644 --- a/security/gnutls/distinfo +++ b/security/gnutls/distinfo @@ -1,10 +1,9 @@ -$NetBSD: distinfo,v 1.130 2018/08/16 11:05:47 wiz Exp $ +$NetBSD: distinfo,v 1.131 2018/11/09 18:03:45 nia Exp $ -SHA1 (gnutls-3.6.3.tar.xz) = ac96787a7fbd550a2b201e64c0e752821e90fed7 -RMD160 (gnutls-3.6.3.tar.xz) = 108848d1b51e0d81ac1b2fdce596222d486fc737 -SHA512 (gnutls-3.6.3.tar.xz) = 6238502464d229a9777e3076f4c745d16deaada83c9da756ecdcd370947576e0446bda3a7f85d5a099b745bbf8c0134ebdf6632e4b26d61daf170792fb4f5abe -Size (gnutls-3.6.3.tar.xz) = 8010284 bytes -SHA1 (patch-doc_examples_tlsproxy_tlsproxy.c) = 42f2cfbf77cb6169d733a1f56c6f141f66e055cd +SHA1 (gnutls-3.6.4.tar.xz) = cb3e25d477a8821b05ba8e0596093ddb64c3f702 +RMD160 (gnutls-3.6.4.tar.xz) = fee56aaf3ecb6e7e7e18c804592dadac555ec517 +SHA512 (gnutls-3.6.4.tar.xz) = f39ac09b48ebf230653cbf82b29ded39a1403313067135495b23f428b35783f9ef073993157d1f284678abedd19e2cf1fd01af843001b88320ca17b346b219ab +Size (gnutls-3.6.4.tar.xz) = 8076364 bytes SHA1 (patch-lib_Makefile.in) = c9a6bbe6238ccd9de41c708012e36b202d2a86e7 SHA1 (patch-lib_accelerated_x86_x86-common.c) = eaf3c473b1ca83c5b15be26f8c06a82d7961420c SHA1 (patch-src_libopts_autoopts_options.h) = 9202c55314fe8764ac82c95bbfabfa1b031e9ba4 diff --git a/security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c b/security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c deleted file mode 100644 index 7e40af45ab9..00000000000 --- a/security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c +++ /dev/null @@ -1,24 +0,0 @@ -$NetBSD: patch-doc_examples_tlsproxy_tlsproxy.c,v 1.1 2018/08/16 11:05:47 wiz Exp $ - -Improve portability outside Linux. - ---- doc/examples/tlsproxy/tlsproxy.c.orig 2018-07-02 18:00:33.000000000 +0000 -+++ doc/examples/tlsproxy/tlsproxy.c -@@ -67,7 +67,7 @@ bindtoaddress (char *addrport) - hints.ai_socktype = SOCK_STREAM; /* Stream socket */ - hints.ai_protocol = 0; /* any protocol */ - -- char *addr = strdupa (addrport); -+ char *addr = strdup (addrport); - char *colon = strrchr (addr, ':'); - char *port = defaultport; - if (colon) -@@ -134,7 +134,7 @@ connecttoaddress (char *addrport) - hints.ai_socktype = SOCK_STREAM; /* Stream socket */ - hints.ai_protocol = 0; /* any protocol */ - -- char *addr = strdupa (addrport); -+ char *addr = strdup (addrport); - char *colon = strrchr (addr, ':'); - char *port = defaultport; - if (colon) |