[bug#40475] [PATCH] gnu: GnuTLS: Fix CVE-2020-11501.

[Leo Famulari]

* gnu/packages/patches/gnutls-CVE-2020-11501.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/tls.scm (gnutls)[replacement]: New field.
(gnutls/fixed): New variable.
(gnutls/guile-2.0, gnutls/dane, gnutls-3.6.10, gnutls3.0-gnutls): Use
PACKAGE/INHERIT.
---
 gnu/local.mk                                  |  1 +
 .../patches/gnutls-CVE-2020-11501.patch       | 41 +++++++++++++++++++
 gnu/packages/tls.scm                          | 21 ++++++----
 3 files changed, 55 insertions(+), 8 deletions(-)
 create mode 100644 gnu/packages/patches/gnutls-CVE-2020-11501.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 77f9de2440..9953754398 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -983,6 +983,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/gnome-tweaks-search-paths.patch         \
   %D%/packages/patches/gnupg-default-pinentry.patch            \
   %D%/packages/patches/gnutls-skip-trust-store-test.patch      \
+  %D%/packages/patches/gnutls-CVE-2020-11501.patch             \
   %D%/packages/patches/gobject-introspection-absolute-shlib-path.patch \
   %D%/packages/patches/gobject-introspection-cc.patch          \
   %D%/packages/patches/gobject-introspection-girepository.patch        \
diff --git a/gnu/packages/patches/gnutls-CVE-2020-11501.patch 
b/gnu/packages/patches/gnutls-CVE-2020-11501.patch
new file mode 100644
index 0000000000..0d84b7d082
--- /dev/null
+++ b/gnu/packages/patches/gnutls-CVE-2020-11501.patch
@@ -0,0 +1,41 @@
+Fix CVE-2020-11501:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11501
+https://gitlab.com/gnutls/gnutls/issues/960
+
+Patch copied from upstream source repository:
+
+https://gitlab.com/gnutls/gnutls/commit/c01011c2d8533dbbbe754e49e256c109cb848d0d
+
+From c01011c2d8533dbbbe754e49e256c109cb848d0d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20B=C3=BChler?= <address@hidden>
+Date: Fri, 27 Mar 2020 17:17:57 +0100
+Subject: [PATCH] dtls client hello: fix zeroed random (fixes #960)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This broke with bcf4de03 "handshake: treat reply to HRR as a reply to
+hello verify request", which failed to "De Morgan" properly.
+
+Signed-off-by: Stefan Bühler <address@hidden>
+---
+ lib/handshake.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/handshake.c b/lib/handshake.c
+index 5739df213..84a0e5210 100644
+--- a/lib/handshake.c
++++ b/lib/handshake.c
+@@ -2167,7 +2167,7 @@ static int send_client_hello(gnutls_session_t session, 
int again)
+               /* Generate random data
+                */
+               if (!(session->internals.hsk_flags & HSK_HRR_RECEIVED) &&
+-                  !(IS_DTLS(session) && 
session->internals.dtls.hsk_hello_verify_requests == 0)) {
++                  !(IS_DTLS(session) && 
session->internals.dtls.hsk_hello_verify_requests != 0)) {
+                       ret = _gnutls_gen_client_random(session);
+                       if (ret < 0) {
+                               gnutls_assert();
+-- 
+2.26.0
+
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index bb80d86ba4..743d80a80f 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -162,6 +162,7 @@ living in the same process.")
 (define-public gnutls
   (package
     (name "gnutls")
+    (replacement gnutls/fixed)
     (version "3.6.9")
     (source (origin
              (method url-fetch)
@@ -244,10 +245,17 @@ required structures.")
     (properties '((ftp-server . "ftp.gnutls.org")
                   (ftp-directory . "/gcrypt/gnutls")))))
 
-(define-public gnutls/guile-2.0
-  ;; GnuTLS for Guile 2.0.
+(define gnutls/fixed
   (package
     (inherit gnutls)
+    (source (origin
+              (inherit (package-source gnutls))
+              (patches (append (origin-patches (package-source gnutls))
+                               (search-patches 
"gnutls-CVE-2020-11501.patch")))))))
+
+(define-public gnutls/guile-2.0
+  ;; GnuTLS for Guile 2.0.
+  (package/inherit gnutls
     (name "guile2.0-gnutls")
     (inputs `(("guile" ,guile-2.0)
               ,@(alist-delete "guile" (package-inputs gnutls))))))
@@ -257,8 +265,7 @@ required structures.")
   ;; Authentication of Named Entities.  This is required for GNS functionality
   ;; by GNUnet and gnURL.  This is done in an extra package definition
   ;; to have the choice between GnuTLS with Dane and without Dane.
-  (package
-    (inherit gnutls)
+  (package/inherit gnutls
     (name "gnutls-dane")
     (inputs `(("unbound" ,unbound)
               ,@(package-inputs gnutls)))))
@@ -266,8 +273,7 @@ required structures.")
 (define gnutls-3.6.10
   ;; This is for 'guile3.0-gnutls', below.  Version 3.6.10 is the first to
   ;; introduce Guile 2.9/3.0 support.
-  (package
-    (inherit gnutls)
+  (package/inherit gnutls
     (version "3.6.10")
     (source (origin
               (inherit (package-source gnutls))
@@ -286,8 +292,7 @@ required structures.")
        ("util-linux" ,util-linux)))))
 
 (define-public guile3.0-gnutls
-  (package
-    (inherit gnutls-3.6.10)
+  (package/inherit gnutls-3.6.10
     (name "guile3.0-gnutls")
     (arguments
      (substitute-keyword-arguments (package-arguments gnutls-3.6.10)
-- 
2.26.0