aboutsummaryrefslogtreecommitdiff
path: root/libs/gnutls/Makefile
Commit message (Collapse)AuthorAge
* gnutls: Update to version 3.8.5Pascal Ernster2024-05-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All patches automatically refreshed. The most important changes are two "medium" CVEs fixed in GnuTLS 3.8.4: - CVE-2024-28834 / GNUTLS-SA-2023-12-04 A vulnerability was found that the deterministic ECDSA code leaks bit-length of random nonce which allows for full recovery of the private key used after observing a few hundreds to a few thousands of signatures on known messages, due to the application of lattice techniques. The issue was reported in the issue tracker as [#1516](https://gitlab.com/gnutls/gnutls/-/issues/1516). - CVE-2024-28835 / GNUTLS-SA-2024-01-23 When validating a certificate chain with more then 16 certificates GnuTLS applications crash with an assertion failure. The issue was reported in the issue tracker as [#1527](https://gitlab.com/gnutls/gnutls/-/issues/1527) and [#1525](https://gitlab.com/gnutls/gnutls/-/issues/1525). Augmented copy/extract from upstream's NEWS file since GnuTLS 3.8.3: - Version 3.8.5 (released 2024-04-04) - libgnutls: Due to majority of usages and implementations of RSA decryption with PKCS#1 v1.5 padding being incorrect, leaving them vulnerable to Marvin attack, the RSAES-PKCS1-v1_5 is being deprecated (encryption and decryption) and will be disabled in the future. A new option `allow-rsa-pkcs1-encrypt` has been added into the system-wide library configuration which allows to enable/disable the RSAES-PKCS1-v1_5. Currently, the RSAES-PKCS1-v1_5 is enabled by default. - libgnutls: Added support for RIPEMD160 and PBES1-DES-SHA1 for backward compatibility with GCR. - libgnutls: A couple of memory related issues have been fixed in RSA PKCS#1 v1.5 decryption error handling and deterministic ECDSA with earlier versions of GMP. These were a regression introduced in the 3.8.4 release. See [#1535](https://gitlab.com/gnutls/gnutls/-/issues/1535) and [!1827](https://gitlab.com/gnutls/gnutls/-/merge_requests/1827). - build: Fixed a bug where building gnutls statically failed due to a duplicate definition of `nettle_rsa_compute_root_tr()`. - API and ABI modifications: - `GNUTLS_PKCS_PBES1_DES_SHA1`: New enum member of `gnutls_pkcs_encrypt_flags_t`. - Version 3.8.4 (released 2024-03-18) - libgnutls: RSA-OAEP encryption scheme is now supported To use it with an unrestricted RSA private key, one would need to initialize a `gnutls_x509_spki_t` object with necessary parameters for RSA-OAEP and attach it to the private key. It is also possible to import restricted private keys if they are stored in PKCS#8 format. - libgnutls: Fix side-channel in the deterministic ECDSA. Reported by George Pantelakis ([#1516](https://gitlab.com/gnutls/gnutls/-/issues/1516)). [GNUTLS-SA-2023-12-04, CVSS: medium] [CVE-2024-28834] - libgnutls: Fixed a bug where certtool crashed when verifying a certificate chain with more than 16 certificates. Reported by William Woodruff ([#1525](https://gitlab.com/gnutls/gnutls/-/issues/1525)) and yixiangzhike ([#1527](https://gitlab.com/gnutls/gnutls/-/issues/1527)). [GNUTLS-SA-2024-01-23, CVSS: medium] [CVE-2024-28835] - libgnutls: Compression libraries are now loaded dynamically as needed instead of all being loaded during gnutls library initialization. As a result, the library initialization should be faster. - build: The gnutls library can now be linked with the static library of GMP. Note that in order for this to work libgmp.a needs to be compiled with -fPIC and libhogweed in Nettle also has to be linked to the static library of GMP. This can be used to prevent custom memory allocators from being overriden by other applications. - API and ABI modifications: - `gnutls_x509_spki_get_rsa_oaep_params`: New function. - `gnutls_x509_spki_set_rsa_oaep_params`: New function. - `GNUTLS_PK_RSA_OAEP`: New enum member of `gnutls_pk_algorithm_t`. Signed-off-by: Pascal Ernster <git@hardfalcon.net>
* gnutls: updated to 3.8.3Nikos Mavrogiannopoulos2024-01-24
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: fix build with zabbixTianling Shen2023-05-20
| | | | | | | | | | | | | | Zabbix verifies the version of gnutls by search in the header gnutls.h. This is done with 'cat' and 'egrep'. The problem here is now that the preprocess definition did changed in gnutls.h, so the regex does not match anymore. The following error message acourse in the log: > configure: error: GnuTLS library version requirement not met (>= 3.1.18) To fix this backport an upstream patch to let the regex work again. Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* gnutls: load libunistring-optional gnulib moduleSebastian Kemper2023-05-13
| | | | | | | | | | | | | | | Since a few days staging_dir/host/share/aclocal/ contains new m4 files (libunistring-base.m4, libunistring-optional.m4, libunistring.m4 etc.) that get applied during autoreconf. This changes the libunistring setup enough that we run into problem (builds fail). Load the libunistring-optional gnulib module in configure.ac to be able to add/use the new configure switch "--with-included-libunistring". This is at most a workaround. This should be followed up with gnutls upstream to clean this up. Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
* gnutls: update to v3.8.0Antonio Flores2023-05-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: https://github.com/openwrt/openwrt/issues/12542 The detailed list of changes follows: * Version 3.8.0 (released 2023-02-09) ** libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key exchange. Reported by Hubert Kario (#1050). Fix developed by Alexander Sosedkin. [GNUTLS-SA-2020-07-14, CVSS: medium] [CVE-2023-0361] ** libgnutls: C++ library is now header only. All definitions from gnutlsxx.c have been moved into gnutlsxx.h. Users of the C++ interface have two options: 1. include gnutlsxx.h in their application and link against the C library. (default) 2. include gnutlsxx.h in their application, compile with GNUTLS_GNUTLSXX_NO_HEADERONLY macro defined and link against the C++ library. ** libgnutls: GNUTLS_NO_STATUS_REQUEST flag and %NO_STATUS_REQUEST priority modifier have been added to allow disabling of the status_request TLS extension in the client side. ** libgnutls: TLS heartbeat is disabled by default. The heartbeat extension in TLS (RFC 6520) is not widely used given other implementations dropped support for it. To enable back support for it, supply --enable-heartbeat-support to configure script. ** libgnutls: SRP authentication is now disabled by default. It is disabled because the SRP authentication in TLS is not up to date with the latest TLS standards and its ciphersuites are based on the CBC mode and SHA-1. To enable it back, supply --enable-srp-authentication option to configure script. ** libgnutls: All code has been indented using "indent -ppi1 -linux". CI/CD has been adjusted to catch regressions. This is implemented through devel/indent-gnutls, devel/indent-maybe and .gitlab-ci.yml’s commit-check. You may run devel/indent-gnutls to fix any indentation issues if you make code modifications. ** guile: Guile-bindings removed. They have been extracted into a separate project to reduce complexity and to simplify maintenance, see <https://gitlab.com/gnutls/guile/>. ** minitasn1: Upgraded to libtasn1 version 4.19. ** API and ABI modifications: GNUTLS_NO_STATUS_REQUEST: New flag GNUTLS_SRTP_AEAD_AES_128_GCM: New gnutls_srtp_profile_t enum member GNUTLS_SRTP_AEAD_AES_256_GCM: New gnutls_srtp_profile_t enum member Signed-off-by: Antonio Flores <antflores627@gmail.com>
* treewide: remove AUTORELEASEPaul Fertser2023-04-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Automatically compute and substitute current values for all $(AUTORELEASE) instances as this feature is deprecated and shouldn't be used. The following temporary change was made to the core: diff --git a/rules.mk b/rules.mk index 57d7995d4fa8..f16367de87a8 100644 --- a/rules.mk +++ b/rules.mk @@ -429,7 +429,7 @@ endef abi_version_str = $(subst -,,$(subst _,,$(subst .,,$(1)))) COMMITCOUNT = $(if $(DUMP),0,$(call commitcount)) -AUTORELEASE = $(if $(DUMP),0,$(call commitcount,1)) +AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) all: FORCE: ; And this command used to fix affected packages: for i in $(cd feeds/packages; git grep -l PKG_RELEASE:=.*AUTORELEASE | \ sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/download done Signed-off-by: Paul Fertser <fercerpav@gmail.com>
* treewide: refactor to use PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-04-08
| | | | | | | See commit 5c545bdb "treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16" on the main repository. Signed-off-by: Andre Heider <a.heider@gmail.com>
* gnutls: update to 3.7.8Nick Hainke2022-10-09
| | | | | | | Release Notes: https://lists.gnupg.org/pipermail/gnutls-help/2022-September/004765.html Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: update to 3.7.7Nick Hainke2022-08-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - libgnutls: Fixed double free during verification of pkcs7 signatures. Reported by Jaak Ristioja (#1383). [GNUTLS-SA-2022-07-07, CVSS: medium] [CVE-2022-2509] - libgnutls: gnutls_hkdf_expand now only accepts LENGTH argument less than or equal to 255 times hash digest size, to comply with RFC 5869 2.3. - libgnutls: Length limit for TLS PSK usernames has been increased from 128 to 65535 characters (#1323). - libgnutls: AES-GCM encryption function now limits plaintext length to 2^39-256 bits, according to SP800-38D 5.2.1.1. - libgnutls: New block cipher functions have been added to transparently handle padding. gnutls_cipher_encrypt3 and gnutls_cipher_decrypt3 can be used in combination of GNUTLS_CIPHER_PADDING_PKCS7 flag to automatically add/remove padding if the length of the original plaintext is not a multiple of the block size. - libgnutls: New function for manual FIPS self-testing. API and ABI modifications: - gnutls_fips140_run_self_tests: New function - gnutls_cipher_encrypt3: New function - gnutls_cipher_decrypt3: New function - gnutls_cipher_padding_flags_t: New enum Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: Avoid building unused gnutls dependencyBoris Krasnovskiy2022-07-30
| | | | | | Avoid building unused gnutls dependency Signed-off-by: Boris Krasnovskiy <borkra@gmail.com>
* gnutls: disable brotliNick Hainke2022-07-05
| | | | | | | Disable the brotli library by default. It is not used and may prevent linking issues in the future. Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: fix disable zstdNick Hainke2022-07-05
| | | | | | | | | | | Configure.ac syntax changed to: Old: --without-libbrotli --without-libzstd (also --with-*) New: --without-brotli --without-zstd (also --with-*) https://github.com/gnutls/gnutls/commit/6b794e49d1a14e43f9e08023f958364712c3c89a Fixes: 6385813ddfb4 ("gnutls: update to 3.7.5") Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: update to 3.7.6Nick Hainke2022-07-04
| | | | Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: update to 3.7.5Nick Hainke2022-07-04
| | | | Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: cleanup MakefileNick Hainke2022-07-04
| | | | | | | | - Add PKG_LICENSE_FILES - Use SPDX - Rearrange Signed-off-by: Nick Hainke <vincent@systemli.org>
* gnutls: Update to 3.7.4John Audia2022-03-30
| | | | | | | | | | | | | | | | | | Bump to latest upstream release. Rebased existing patches. This version introduces certificate compression support, and with that, optional dependencies on zlib and zstd. When configure picks them up, build will fail due to missing dependencies: Package libgnutls is missing dependencies for the following libraries: libz.so.1 libzstd.so.1 Disable zlib and zstd support to avoid that. Signed-off-by: John Audia <graysky@archlinux.us> [disable zlib and zstd] Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* gnutls: update to 3.7.2Rosen Penev2022-03-30
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* gnutls: add build dependency on gettext-full/hostStijn Tintel2022-03-30
| | | | | | | | | | | | | | | | | | | | | | | | | | The gnutls package uses the gettext-version fixup, which is only available if gettext-full/host has been built. Add the missing build dependency to fix these errors: bash: line 1: /home/stijn/Development/OpenWrt/openwrt/staging_dir/hostpkg/bin/gettext: No such file or directory bash: line 1: /home/stijn/Development/OpenWrt/openwrt/staging_dir/hostpkg/bin/autopoint: No such file or directory It also prevents configure from using host gettext: checking for msgfmt... /usr/bin/msgfmt checking for gmsgfmt... /usr/bin/gmsgfmt checking for xgettext... /usr/bin/xgettext checking for msgmerge... /usr/bin/msgmerge vs: checking for msgfmt... /home/stijn/Development/OpenWrt/openwrt/staging_dir/hostpkg/bin/msgfmt checking for gmsgfmt... /home/stijn/Development/OpenWrt/openwrt/staging_dir/hostpkg/bin/gmsgfmt checking for xgettext... /home/stijn/Development/OpenWrt/openwrt/staging_dir/hostpkg/bin/xgettext checking for msgmerge... /home/stijn/Development/OpenWrt/openwrt/staging_dir/hostpkg/bin/msgmerge Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* gnutls: enable AUTORELEASEStijn Tintel2022-03-30
| | | | | | | Enable AUTORELEASE in a separate commit so that the next commit can be reverted without having to manually re-introduce it. Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
* gnutls: don't run aclocal --installEneas U de Queiroz2021-11-03
| | | | | | | | | | | | | | | | | | | | Remove the --install parameter when running aclocal. The --install argument is used to copy third-party files to the first -I directory. gnutls has -I m4 first, which would copy files to its local build directory. However, openwrt prepends the staging dir m4 directory, causing aclocal --install to copy an old definition of ax_code_coverage.m4 into the staging dir. If strace is built after gnutls, compilation will fail: Makefile:9303: *** missing separator. Stop. The version of ax_code_coverage.m4 that gets installed does not define @CODE_COVERAGE_RULES@. Removing the --install parameter in gnutls solves the issue. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* Revert "gnutls: update to 3.7.2"Stijn Tintel2021-08-05
| | | | | | Fixes #16083 This reverts commit 59a39d4c6fbe9c0179b16a714bf1a0c3afcbef5e.
* gnutls: update to 3.7.2Rosen Penev2021-06-01
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* gnutls: update to version 3.7.1Jan Pavlinec2021-03-25
| | | | | | | | Fixes CVE-2021-20231 CVE-2021-20232 Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* gnutls: package libdaneDaniel Golle2021-01-03
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* gnutls: update to 3.7.0Rosen Penev2020-12-22
| | | | | | | | Added autoreconf to fix bad linking under Arch Linux. Added patch to fix compilation with autoreconf. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* gnutls: update to version 3.6.15 (security fix)Jan Pavlinec2020-09-09
| | | | | | | Fixes: CVE-2020-24659 Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
* gnutls: updated to 3.6.14Nikos Mavrogiannopoulos2020-06-04
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: updated to 3.6.13Nikos Mavrogiannopoulos2020-03-31
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: updated to 3.6.12Nikos Mavrogiannopoulos2020-02-02
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: fixed pkg-hash to the right oneNikos Mavrogiannopoulos2019-12-02
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: updated to 3.6.11Nikos Mavrogiannopoulos2019-12-02
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* treewide: Change .*GPL.*+ licenses to SPDX compatible identifierSven Eckelmann2019-09-10
| | | | | | | | The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL licenses. But a lot of packages did use a different, non-SPDX style with a "+" at the end instead of "-or-later". Signed-off-by: Sven Eckelmann <sven@narfation.org>
* gnutls: updated to 3.6.9Nikos Mavrogiannopoulos2019-08-02
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: removed autogen patchNikos Mavrogiannopoulos2019-06-01
| | | | | | | It was causing regressions in systems without some particular development tools (see #8129) Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: removed FIXUPNikos Mavrogiannopoulos2019-05-30
| | | | | | This addresses regression discussed in #8129 Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: updated to 3.6.8Nikos Mavrogiannopoulos2019-05-29
| | | | Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
* gnutls: Update to 3.6.7Rosen Penev2019-03-27
| | | | | | | | | | | Cleaned up configure arguments (alphabetized and sorted) and added some new ones to help speed up compilation. Disabled SSL support by default. SSLv2 and 3 have long been deprecated as they are both insecure variants that currently hold less than 10% of total encrypted traffic on the web. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* gnutls: updated to 3.6.5Nikos Mavrogiannopoulos2018-12-10
| | | | | | Compile tested for: ar71xx Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls: updated to 3.5.19Nikos Mavrogiannopoulos2018-09-29
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls: Add PKG_CPE_ID for proper CVE trackingRosen Penev2018-08-21
| | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* gnutls: Use HTTPS instead of FTPRosen Penev2017-12-10
| | | | | | While recently building asterisk, the make system stalled on gnutls. On my install of Ubuntu 16.04 on WSL, it seems curl can't download from ftp and doesn't even time out properly. Easiest solution is to switch the gnutls Makefile to use HTTPS instead. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* gnutls: updated to 3.5.16Nikos Mavrogiannopoulos2017-10-21
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls: updated to 3.5.13Nikos Mavrogiannopoulos2017-06-18
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls: updated to 3.5.11Nikos Mavrogiannopoulos2017-05-08
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls: updated to 3.5.9Nikos Mavrogiannopoulos2017-02-12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* libs/gnutls: Don't link libidn unintentionallyDaniel Engberg2017-02-07
| | | | | Fixes compilation reported by by buildbots. Signed-off-by: Daniel Engberg <daniel.engberg.lists@pyret.net>
* gnutls: updated to 3.5.8Nikos Mavrogiannopoulos2017-01-15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls: updated to 3.5.6Nikos Mavrogiannopoulos2016-11-04
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* gnutls-utils/certtool: move to Encryption submenuAlberto Bursi2016-10-24
| | | | | Part of a wider housekeeping effort on the packages repository. Signed-off-by: Alberto Bursi <alberto.bursi@outlook.it>
* gnutls: remove C99 constructions rejected by compilerNikos Mavrogiannopoulos2016-09-27
|
Powered by cgit, Themed by Ted Yin.