gnutls: update to 3.6.4.

* Version 3.6.4 (released 2018-09-24)

** libgnutls: Added the final (RFC8446) version numbering of the TLS1.3 protocol.

** libgnutls: Corrected regression since 3.6.3 in the callbacks set with
   gnutls_certificate_set_retrieve_function() which could not handle the case where
   no certificates were returned, or the callbacks were set to NULL (see #528).

** libgnutls: gnutls_handshake() on server returns early on handshake when no
   certificate is presented by client and the gnutls_init() flag GNUTLS_ENABLE_EARLY_START
   is specified.

** libgnutls: Added session ticket key rotation on server side with TOTP.
   The key set with gnutls_session_ticket_enable_server() is used as a
   master key to generate time-based keys for tickets. The rotation
   relates to the gnutls_db_set_cache_expiration() period.

** libgnutls: The 'record size limit' extension is added and preferred to the
   'max record size' extension when possible.

** libgnutls: Provide a more flexible PKCS#11 search of trust store certificates.
   This addresses the problem where the CA certificate doesn't have a subject key
   identifier whereas the end certificates have an authority key identifier (#569)

** libgnutls: gnutls_privkey_export_gost_raw2(), gnutls_privkey_import_gost_raw(),
   gnutls_pubkey_export_gost_raw2(), gnutls_pubkey_import_gost_raw() import
   and export GOST parameters in the "native" little endian format used for these
   curves. This is an intentional incompatible change with 3.6.3.

** libgnutls: Added support for seperately negotiating client and server certificate types
   as defined in RFC7250. This mechanism must be explicitly enabled via the
   GNUTLS_ENABLE_CERT_TYPE_NEG flag in gnutls_init().

** gnutls-cli: enable CRL validation on startup (#564)

** API and ABI modifications:
GNUTLS_ENABLE_EARLY_START: Added
GNUTLS_ENABLE_CERT_TYPE_NEG: Added
GNUTLS_TL_FAIL_ON_INVALID_CRL: Added
GNUTLS_CERTIFICATE_VERIFY_CRLS: Added
gnutls_ctype_target_t: New enumeration
gnutls_record_set_max_early_data_size: Added
gnutls_certificate_type_get2: Added
gnutls_priority_certificate_type_list2: Added
gnutls_ffdhe_6144_group_prime: Added
gnutls_ffdhe_6144_group_generator: Added
gnutls_ffdhe_6144_key_bits: Added

4 files changed, 11 insertions, 34 deletions

diff --git a/security/gnutls/Makefile b/security/gnutls/Makefile
index 693593c16e0..0cda0274ffc 100644
--- a/security/gnutls/Makefile
+++ b/security/gnutls/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.190 2018/09/27 18:32:35 tnn Exp $
+# $NetBSD: Makefile,v 1.191 2018/11/09 18:03:45 nia Exp $
 
-DISTNAME=	gnutls-3.6.3
-PKGREVISION=	2
+DISTNAME=	gnutls-3.6.4
 CATEGORIES=	security devel
 MASTER_SITES=	ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/
 EXTRACT_SUFX=	.tar.xz
diff --git a/security/gnutls/PLIST b/security/gnutls/PLIST
index 14ea8f29f8a..313119b5967 100644
--- a/security/gnutls/PLIST
+++ b/security/gnutls/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.60 2018/08/16 11:05:47 wiz Exp $
+@comment $NetBSD: PLIST,v 1.61 2018/11/09 18:03:45 nia Exp $
 bin/certtool
 bin/gnutls-cli
 bin/gnutls-cli-debug
@@ -148,6 +148,7 @@ man/man3/gnutls_certificate_set_x509_trust_dir.3
 man/man3/gnutls_certificate_set_x509_trust_file.3
 man/man3/gnutls_certificate_set_x509_trust_mem.3
 man/man3/gnutls_certificate_type_get.3
+man/man3/gnutls_certificate_type_get2.3
 man/man3/gnutls_certificate_type_get_id.3
 man/man3/gnutls_certificate_type_get_name.3
 man/man3/gnutls_certificate_type_list.3
@@ -514,6 +515,7 @@ man/man3/gnutls_prf.3
 man/man3/gnutls_prf_raw.3
 man/man3/gnutls_prf_rfc5705.3
 man/man3/gnutls_priority_certificate_type_list.3
+man/man3/gnutls_priority_certificate_type_list2.3
 man/man3/gnutls_priority_cipher_list.3
 man/man3/gnutls_priority_compression_list.3
 man/man3/gnutls_priority_deinit.3
@@ -656,6 +658,7 @@ man/man3/gnutls_record_recv_seq.3
 man/man3/gnutls_record_send.3
 man/man3/gnutls_record_send2.3
 man/man3/gnutls_record_send_range.3
+man/man3/gnutls_record_set_max_early_data_size.3
 man/man3/gnutls_record_set_max_size.3
 man/man3/gnutls_record_set_state.3
 man/man3/gnutls_record_set_timeout.3
diff --git a/security/gnutls/distinfo b/security/gnutls/distinfo
index 1d135052874..31f395905aa 100644
--- a/security/gnutls/distinfo
+++ b/security/gnutls/distinfo
@@ -1,10 +1,9 @@
-$NetBSD: distinfo,v 1.130 2018/08/16 11:05:47 wiz Exp $
+$NetBSD: distinfo,v 1.131 2018/11/09 18:03:45 nia Exp $
 
-SHA1 (gnutls-3.6.3.tar.xz) = ac96787a7fbd550a2b201e64c0e752821e90fed7
-RMD160 (gnutls-3.6.3.tar.xz) = 108848d1b51e0d81ac1b2fdce596222d486fc737
-SHA512 (gnutls-3.6.3.tar.xz) = 6238502464d229a9777e3076f4c745d16deaada83c9da756ecdcd370947576e0446bda3a7f85d5a099b745bbf8c0134ebdf6632e4b26d61daf170792fb4f5abe
-Size (gnutls-3.6.3.tar.xz) = 8010284 bytes
-SHA1 (patch-doc_examples_tlsproxy_tlsproxy.c) = 42f2cfbf77cb6169d733a1f56c6f141f66e055cd
+SHA1 (gnutls-3.6.4.tar.xz) = cb3e25d477a8821b05ba8e0596093ddb64c3f702
+RMD160 (gnutls-3.6.4.tar.xz) = fee56aaf3ecb6e7e7e18c804592dadac555ec517
+SHA512 (gnutls-3.6.4.tar.xz) = f39ac09b48ebf230653cbf82b29ded39a1403313067135495b23f428b35783f9ef073993157d1f284678abedd19e2cf1fd01af843001b88320ca17b346b219ab
+Size (gnutls-3.6.4.tar.xz) = 8076364 bytes
 SHA1 (patch-lib_Makefile.in) = c9a6bbe6238ccd9de41c708012e36b202d2a86e7
 SHA1 (patch-lib_accelerated_x86_x86-common.c) = eaf3c473b1ca83c5b15be26f8c06a82d7961420c
 SHA1 (patch-src_libopts_autoopts_options.h) = 9202c55314fe8764ac82c95bbfabfa1b031e9ba4
diff --git a/security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c b/security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c
deleted file mode 100644
index 7e40af45ab9..00000000000
--- a/security/gnutls/patches/patch-doc_examples_tlsproxy_tlsproxy.c
+++ /dev/null
@@ -1,24 +0,0 @@
-$NetBSD: patch-doc_examples_tlsproxy_tlsproxy.c,v 1.1 2018/08/16 11:05:47 wiz Exp $
-
-Improve portability outside Linux.
-
---- doc/examples/tlsproxy/tlsproxy.c.orig	2018-07-02 18:00:33.000000000 +0000
-+++ doc/examples/tlsproxy/tlsproxy.c
-@@ -67,7 +67,7 @@ bindtoaddress (char *addrport)
-   hints.ai_socktype = SOCK_STREAM;	/* Stream socket */
-   hints.ai_protocol = 0;	/* any protocol */
- 
--  char *addr = strdupa (addrport);
-+  char *addr = strdup (addrport);
-   char *colon = strrchr (addr, ':');
-   char *port = defaultport;
-   if (colon)
-@@ -134,7 +134,7 @@ connecttoaddress (char *addrport)
-   hints.ai_socktype = SOCK_STREAM;	/* Stream socket */
-   hints.ai_protocol = 0;	/* any protocol */
- 
--  char *addr = strdupa (addrport);
-+  char *addr = strdup (addrport);
-   char *colon = strrchr (addr, ':');
-   char *port = defaultport;
-   if (colon)