Log Message:
Pullup ticket #4430 - requested by tron
security/gnutls: security update

Revisions pulled up:
- security/gnutls/Makefile                                      1.146
- security/gnutls/distinfo                                      1.106

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Fri May 30 13:20:23 UTC 2014

   Modified Files:
   	pkgsrc/security/gnutls: Makefile distinfo

   Log Message:
   Update to 3.2.15:

   * Version 3.2.15 (released 2014-05-30)

   ** libgnutls: Eliminated memory corruption issue in Server Hello parsing.
   Issue reported by Joonas Kuorilehto of Codenomicon.

   ** libgnutls: Several memory leaks caused by error conditions were
   fixed. The leaks were identified using valgrind and the Codenomicon
   TLS test suite.

   ** libgnutls: Increased the maximum certificate size buffer
   in the PKCS #11 subsystem.

   ** libgnutls: Check the return code of getpwuid_r() instead of relying
   on the result value. That avoids issue in certain systems, when using
   tofu authentication and the home path cannot be determined. Issue reported
   by Viktor Dukhovni.

   ** gnutls-cli: if dane is requested but not PKIX verification, then
   only do verify the end certificate.

   ** ocsptool: Include path in ocsp request. This resolves #108582
   (https://savannah.gnu.org/support/?108582), reported by Matt McCutchen.

   ** API and ABI modifications:
   No changes since last version.

   * Version 3.2.14 (released 2014-05-06)

   ** libgnutls: Fixed issue with the check of incoming data when two
   different recv and send pointers have been specified. Reported and
   investigated by JMRecio.

   ** libgnutls: Fixed issue in the RSA-PSK key exchange, which would
   result to illegal memory access if a server hint was provided.

   ** libgnutls: Fixed client memory leak in the PSK key exchange, if a
   server hint was provided.

   ** libgnutls: Several small bug fixes identified using valgrind and
   the Codenomicon TLS test suite.

   ** libgnutls: Several small bug fixes found by coverity.

   ** libgnutls-dane: Accept a certificate using DANE if there is at least one
   entry that matches the certificate. Patch by simon [at] arlott.org.

   ** configure: Added --with-nettle-mini option, which allows linking
   with a libnettle that contains gmp.

   ** certtool: The ECDSA keys generated by default use the SECP256R1 curve
   which is supported more widely than the previously used SECP224R1.

   ** API and ABI modifications:
   No changes since last version.

   * Version 3.2.13 (released 2014-04-07)

   ** libgnutls: gnutls_openpgp_keyring_import will no longer fail silently
   if there are no base64 data. Report and patch by Ramkumar Chinchani.

   ** libgnutls: gnutls_record_send is now safe to be called under DTLS when
   in corked mode.

   ** libgnutls: Ciphersuites that use the SHA256 or SHA384 MACs are
   only available in TLS 1.0 as SSL 3.0 doesn't specify parameters for
   these algorithms.

   ** libgnutls: Changed the behaviour in wildcard acceptance in certificates.
   Wildcards are only accepted when there are more than two domain components
   after the wildcard. This drops support for the permissive RFC2818 wildcards
   and adds more conservative support based on the suggestions in RFC6125. Suggested
   by Jeffrey Walton.

   ** certtool: When no password is provided to export a PKCS #8 keys, do
   not encrypt by default. This reverts to the certtool behavior of gnutls
   3.0. The previous behavior of encrypting using an empty password can be
   replicating using the new parameter --empty-password.

   ** p11tool: Avoid dual initialization of the PKCS #11 subsystem when
   the --provider option is given.

   ** API and ABI modifications:
   No changes since last version.