revision bump to fix security bug 245850 (CVE-2008-4989), straight to stable on alpha amd64 hppa ia64 sparc x86 as tested on the mentioned bug

(Portage version: 2.2_rc13/cvs/Linux 2.6.27-gentoo x86_64, RepoMan options: --force)

3 files changed, 123 insertions, 1 deletions

diff --git a/net-libs/gnutls/ChangeLog b/net-libs/gnutls/ChangeLog
index d1d1e9595da0..41265a123b31 100644
--- a/net-libs/gnutls/ChangeLog
+++ b/net-libs/gnutls/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for net-libs/gnutls
 # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-libs/gnutls/ChangeLog,v 1.167 2008/11/05 10:39:09 dragonheart Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-libs/gnutls/ChangeLog,v 1.168 2008/11/10 15:00:56 hoffie Exp $
+
+*gnutls-2.4.1-r1 (10 Nov 2008)
+
+  10 Nov 2008; Christian Hoffmann <hoffie@gentoo.org>
+  +files/gnutls-2.2.5-CVE-2008-4989.patch, +gnutls-2.4.1-r1.ebuild:
+  revision bump to fix security bug 245850 (CVE-2008-4989), straight to
+  stable on alpha amd64 hppa ia64 sparc x86 as tested on the mentioned bug
 
   05 Nov 2008; Daniel Black <dragonheart@gentoo.org> gnutls-2.6.0.ebuild:
   alternate and much better solution by loki_val
diff --git a/net-libs/gnutls/files/gnutls-2.2.5-CVE-2008-4989.patch b/net-libs/gnutls/files/gnutls-2.2.5-CVE-2008-4989.patch
new file mode 100644
index 000000000000..fc4d80f2544c
--- /dev/null
+++ b/net-libs/gnutls/files/gnutls-2.2.5-CVE-2008-4989.patch
@@ -0,0 +1,38 @@
+--- gnutls-2.4.1/lib/x509/verify.c.orig	2008-07-01 06:45:51.000000000 +1000
++++ gnutls-2.4.1/lib/x509/verify.c	2008-11-07 16:48:08.000000000 +1100
+@@ -376,6 +376,17 @@
+   int i = 0, ret;
+   unsigned int status = 0, output;
+ 
++  /* Check if the last certificate in the path is self signed.
++   * In that case ignore it (a certificate is trusted only if it
++   * leads to a trusted party by us, not the server's).
++   */
++  if (gnutls_x509_crt_check_issuer (certificate_list[clist_size - 1],
++                                   certificate_list[clist_size - 1]) > 0
++      && clist_size > 0)
++    {
++      clist_size--;
++    }
++
+   /* Verify the last certificate in the certificate path
+    * against the trusted CA certificate list.
+    *
+@@ -414,17 +425,6 @@
+     }
+ #endif
+ 
+-  /* Check if the last certificate in the path is self signed.
+-   * In that case ignore it (a certificate is trusted only if it
+-   * leads to a trusted party by us, not the server's).
+-   */
+-  if (gnutls_x509_crt_check_issuer (certificate_list[clist_size - 1],
+-				    certificate_list[clist_size - 1]) > 0
+-      && clist_size > 0)
+-    {
+-      clist_size--;
+-    }
+-
+   /* Verify the certificate path (chain) 
+    */
+   for (i = clist_size - 1; i > 0; i--)
diff --git a/net-libs/gnutls/gnutls-2.4.1-r1.ebuild b/net-libs/gnutls/gnutls-2.4.1-r1.ebuild
new file mode 100644
index 000000000000..23286a635b70
--- /dev/null
+++ b/net-libs/gnutls/gnutls-2.4.1-r1.ebuild
@@ -0,0 +1,77 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-libs/gnutls/gnutls-2.4.1-r1.ebuild,v 1.1 2008/11/10 15:00:56 hoffie Exp $
+
+inherit libtool eutils
+
+DESCRIPTION="A TLS 1.0 and SSL 3.0 implementation for the GNU project"
+HOMEPAGE="http://www.gnutls.org/"
+SRC_URI="http://www.gnu.org/software/gnutls/releases/${P}.tar.bz2"
+#SRC_URI="mirror://gnu/gnutls/${P}.tar.bz2"
+
+# GPL-3 for the gnutls-extras library and LGPL for the gnutls library.
+LICENSE="LGPL-2.1 GPL-3"
+SLOT="0"
+KEYWORDS="alpha amd64 ~arm hppa ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh sparc ~sparc-fbsd x86 ~x86-fbsd"
+IUSE="zlib lzo doc nls guile bindist"
+
+RDEPEND="dev-libs/libgpg-error
+	>=dev-libs/libgcrypt-1.2.4
+	>=dev-libs/libtasn1-0.3.4
+	nls? ( virtual/libintl )
+	guile? ( dev-scheme/guile )
+	zlib? ( >=sys-libs/zlib-1.1 )
+	!bindist? ( lzo? ( >=dev-libs/lzo-2 ) )"
+DEPEND="${RDEPEND}
+	sys-devel/libtool
+	doc? ( dev-util/gtk-doc )
+	nls? ( sys-devel/gettext )"
+
+pkg_setup() {
+	if use guile && ! built_with_use dev-scheme/guile networking; then
+		eerror "You are trying to compile ${PN} package with USE=\"guile\""
+		eerror "while dev-scheme/guile does not have USE=\"networking\""
+		die
+	fi
+	if use lzo && use bindist; then
+		ewarn "lzo support was disabled for binary distribution of gnutls"
+		ewarn "due to licensing issues. See Bug 202381 for details."
+		epause 5
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+
+	epatch "${FILESDIR}"/${PN}-2.3.11+gcc-4.3.patch
+	pwd
+	epatch "${FILESDIR}"/gnutls-2.2.5-CVE-2008-4989.patch
+
+	elibtoolize # for sane .so versioning on FreeBSD
+}
+
+src_compile() {
+	local myconf
+	use bindist && myconf="--without-lzo" || myconf="$(use_with lzo)"
+	econf  \
+		$(use_with zlib) \
+		$(use_enable nls) \
+		$(use_enable guile) \
+		$(use_enable doc gtk-doc) \
+		${myconf}
+	emake || die
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die
+
+	dodoc AUTHORS ChangeLog NEWS \
+		README THANKS doc/TODO
+
+	if use doc ; then
+		dodoc doc/README.autoconf doc/tex/gnutls.ps
+		docinto examples
+		dodoc doc/examples/*.c
+	fi
+}