Received: by mail.netbsd.org (Postfix, from userid 605) id 463DA84E3C; Tue, 28 Nov 2017 14:06:14 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id BCF8384E49 for ; Tue, 28 Nov 2017 14:06:13 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id EHBguOcnwZKG for ; Tue, 28 Nov 2017 14:06:12 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 7D02B84E3C for ; Tue, 28 Nov 2017 14:06:12 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 73758FB40; Tue, 28 Nov 2017 14:06:12 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_15118779723990" MIME-Version: 1.0 Date: Tue, 28 Nov 2017 14:06:12 +0000 From: "Thomas Klausner" Subject: CVS commit: pkgsrc/security/nettle To: pkgsrc-changes@NetBSD.org Reply-To: wiz@netbsd.org X-Mailer: log_accum Message-Id: <20171128140612.73758FB40@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_15118779723990 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: wiz Date: Tue Nov 28 14:06:12 UTC 2017 Modified Files: pkgsrc/security/nettle: Makefile PLIST distinfo Log Message: nettle: update to 3.4. NEWS for the Nettle 3.4 release This release fixes bugs and adds a few new features. It also addresses an ABI compatibility issue affecting Nettle-3.1 and later, see below. Bug fixes: * Fixed an improper use of GMP mpn_mul, breaking curve2559 and eddsa on certain platforms. Reported by Sergei Trofimovich. * Fixed memory leak when handling invalid signatures in ecdsa_verify. Fix contributed by Nikos Mavrogiannopoulos. * Fix compilation error with --enable-fat om ARM. Fix contributed by Andreas Schneider. * Reorganized the way certain data items are made available. Short version: Nettle header files now define the symbols nettle_hashes, nettle_ciphers, and nettle_aeads, as preprocessor macros invoking a corresponding accessor function. For backwards ABI compatibility, the symbols are still present in the compiled libraries, and with the same sizes as in nettle-3.3. New features: * Support for RSA-PSS signatures, contributed by Daiki Ueno. * Support for the HKDF key derivation function, defined by RFC 5869. Contributed by Nikos Mavrogiannopoulos. * Support for the Cipher Feedback Mode (CFB), contributed by Dmitry Eremin-Solenikov. * New accessor functions: nettle_get_hashes, nettle_get_ciphers, nettle_get_aeads, nettle_get_secp_192r1, nettle_get_secp_224r1, nettle_get_secp_256r1, nettle_get_secp_384r1, nettle_get_secp_521r1. For source-level compatibility with future versions, applications are encouraged to migrate to using these functions instead of referring to the corresponding data items directly. Miscellaneous: * The base16 and base64 functions now use the type char * for ascii data, rather than uint8_t *. This eliminates the last pointer-signedness warnings when building Nettle. This is a minor API change, and applications may need to be adjusted, but the ABI is unaffected on all platforms I'm aware of. * The contents of the header file nettle/version.h is now architecture independent, except in --enable-mini-gmp configurations. ABI issue: Since the breakage was a bit subtle, let me document it here. The nettle and hogweed libraries export a couple of data symbols, and for some of these, the size was never intended to be part of the ABI. E.g., extern const struct nettle_hash * const nettle_hashes[]; which is an NULL-terminated array. It turns out the sizes nevertheless may leak into the ABI, and that increasing the sizes can break old executables linked with a newer version of the library. When linking a classic non-PIE executable with a shared library, we get ELF relocations of type R_X86_64_COPY for references to data items. These mean that the linker allocates space for the data item in the data segment of executable, at a fixed address determined at link-time, and with size extracted from the version of the .so-file seen when linking. At load time, the run time linker then copies the contents of the symbol from the .so file to that location, and uses the copy instead of the version loaded with the .so-file. And if the data item in the .so file used at load time is larger than the data item seen at link time, it is silently truncated in the process. So when SHA3 hashes were was added to the nettle_hashes array in the nettle-3.3 release, this way of linking produces a truncated array at load time, no longer NULL-terminated. We will get similar problems for planned extensions of the internal struct ecc_curve, and exported data items like extern const struct ecc_curve nettle_secp_256r1; where the ecc_curve struct is only forward declared in the public headers. To prepare, applications should migrate to using the new function nettle_get_secp_256r1, and similarly for the other curves. In some future version, the plan is to add a leading underscore to the name of the actual data items. E.g., nettle_hashes --> _nettle_hashes, breaking the ABI, while keeping the nettle_get_hashes function and the nettle_hashes macro as the supported ways to access it. We will also rename nettle_secp_256r1 --> _nettle_secp_256r1, breaking both ABI and API. Note that data items like nettle_sha256 are *not* affected, since the size and layout of this struct is considered part of the ABI, and R_X86_64_COPY-relocations then work fine. To generate a diff of this commit: cvs rdiff -u -r1.18 -r1.19 pkgsrc/security/nettle/Makefile cvs rdiff -u -r1.7 -r1.8 pkgsrc/security/nettle/PLIST cvs rdiff -u -r1.15 -r1.16 pkgsrc/security/nettle/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_15118779723990 Content-Disposition: inline Content-Length: 2952 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/security/nettle/Makefile diff -u pkgsrc/security/nettle/Makefile:1.18 pkgsrc/security/nettle/Makefile:1.19 --- pkgsrc/security/nettle/Makefile:1.18 Thu Jan 19 18:52:24 2017 +++ pkgsrc/security/nettle/Makefile Tue Nov 28 14:06:12 2017 @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.18 2017/01/19 18:52:24 agc Exp $ +# $NetBSD: Makefile,v 1.19 2017/11/28 14:06:12 wiz Exp $ -DISTNAME= nettle-3.3 +DISTNAME= nettle-3.4 CATEGORIES= devel security MASTER_SITES= http://www.lysator.liu.se/~nisse/archive/ MASTER_SITES+= ftp://ftp.lysator.liu.se/pub/security/lsh/ Index: pkgsrc/security/nettle/PLIST diff -u pkgsrc/security/nettle/PLIST:1.7 pkgsrc/security/nettle/PLIST:1.8 --- pkgsrc/security/nettle/PLIST:1.7 Mon Oct 3 12:28:19 2016 +++ pkgsrc/security/nettle/PLIST Tue Nov 28 14:06:12 2017 @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST,v 1.7 2016/10/03 12:28:19 wiz Exp $ +@comment $NetBSD: PLIST,v 1.8 2017/11/28 14:06:12 wiz Exp $ bin/nettle-hash bin/nettle-lfib-stream bin/nettle-pbkdf2 @@ -17,6 +17,7 @@ include/nettle/camellia.h include/nettle/cast128.h include/nettle/cbc.h include/nettle/ccm.h +include/nettle/cfb.h include/nettle/chacha-poly1305.h include/nettle/chacha.h include/nettle/ctr.h @@ -32,6 +33,7 @@ include/nettle/ecdsa.h include/nettle/eddsa.h include/nettle/gcm.h include/nettle/gosthash94.h +include/nettle/hkdf.h include/nettle/hmac.h include/nettle/knuth-lfib.h include/nettle/macros.h @@ -48,6 +50,8 @@ include/nettle/pbkdf2.h include/nettle/pgp.h include/nettle/pkcs1.h include/nettle/poly1305.h +include/nettle/pss-mgf1.h +include/nettle/pss.h include/nettle/realloc.h include/nettle/ripemd160.h include/nettle/rsa.h Index: pkgsrc/security/nettle/distinfo diff -u pkgsrc/security/nettle/distinfo:1.15 pkgsrc/security/nettle/distinfo:1.16 --- pkgsrc/security/nettle/distinfo:1.15 Mon Oct 3 12:28:19 2016 +++ pkgsrc/security/nettle/distinfo Tue Nov 28 14:06:12 2017 @@ -1,9 +1,9 @@ -$NetBSD: distinfo,v 1.15 2016/10/03 12:28:19 wiz Exp $ +$NetBSD: distinfo,v 1.16 2017/11/28 14:06:12 wiz Exp $ -SHA1 (nettle-3.3.tar.gz) = bf2b4d3a41192ff6177936d7bc3bee4cebeb86c4 -RMD160 (nettle-3.3.tar.gz) = 7d535a12074b268f982ae111c07a0fcb6355909f -SHA512 (nettle-3.3.tar.gz) = 271981d89766f151af3cdc4e5fc43c438222f0f6f44475bad114f4209955b5235fced6526c7abca001cca223e8cfcd2a6bf389b160b305a499e7acf52425ec70 -Size (nettle-3.3.tar.gz) = 1887927 bytes +SHA1 (nettle-3.4.tar.gz) = f3c8495b7c43cba9cdd19503e7567095c680b490 +RMD160 (nettle-3.4.tar.gz) = 56c59906e4bec5c0859abdd96645d5d54a8f78c4 +SHA512 (nettle-3.4.tar.gz) = 3bea3aabd2c99cc42d084a94fd6b0b5dbdb24cd6c7020271a6ee87a81a904b21b21756f590cb1afdf2e85fd1cb59e5c3651c5c4032e30204e7ea6f8801d1ea3b +Size (nettle-3.4.tar.gz) = 1935069 bytes SHA1 (patch-Makefile.in) = 96771c1fb195603d108717970eb32767d2c26799 SHA1 (patch-aa) = 2332668b077a6e3a1add603c87f60167755554ec SHA1 (patch-config.make.in) = 708fb3cac9c44825e0d231541cbecade2239c850 --_----------=_15118779723990--