[openssl/f18] do not advertise ECC curves we do not support (#1022493)
Tomáš Mráz
tmraz at fedoraproject.org
Thu Oct 24 11:23:22 UTC 2013
commit d561e3fcd193a412c96b0f1ba88223d0f17bab51
Author: Tomas Mraz <tmraz at fedoraproject.org>
Date: Thu Oct 24 13:23:24 2013 +0200
do not advertise ECC curves we do not support (#1022493)
...suiteb.patch => openssl-1.0.1e-ecc-suiteb.patch | 41 ++++++++++++++++++-
openssl.spec | 7 ++-
2 files changed, 43 insertions(+), 5 deletions(-)
---
diff --git a/openssl-1.0.1e-speed-suiteb.patch b/openssl-1.0.1e-ecc-suiteb.patch
similarity index 72%
rename from openssl-1.0.1e-speed-suiteb.patch
rename to openssl-1.0.1e-ecc-suiteb.patch
index a5135d3..95b192a 100644
--- a/openssl-1.0.1e-speed-suiteb.patch
+++ b/openssl-1.0.1e-ecc-suiteb.patch
@@ -1,6 +1,6 @@
diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
---- openssl-1.0.1e/apps/speed.c.suiteb 2013-09-27 15:57:09.947894307 +0200
-+++ openssl-1.0.1e/apps/speed.c 2013-09-27 15:57:52.528852804 +0200
+--- openssl-1.0.1e/apps/speed.c.suiteb 2013-10-18 17:38:22.288870517 +0200
++++ openssl-1.0.1e/apps/speed.c 2013-10-18 17:38:22.336871572 +0200
@@ -966,49 +966,21 @@ int MAIN(int argc, char **argv)
else
#endif
@@ -73,7 +73,7 @@ diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
BIO_printf(bio_err,"ecdh\n");
#endif
-@@ -1181,11 +1149,11 @@ int MAIN(int argc, char **argv)
+@@ -1184,11 +1152,11 @@ int MAIN(int argc, char **argv)
if (!FIPS_mode() || i != R_DSA_512)
dsa_doit[i]=1;
#ifndef OPENSSL_NO_ECDSA
@@ -87,3 +87,38 @@ diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
ecdh_doit[i]=1;
#endif
}
+diff -up openssl-1.0.1e/ssl/t1_lib.c.suiteb openssl-1.0.1e/ssl/t1_lib.c
+--- openssl-1.0.1e/ssl/t1_lib.c.suiteb 2013-02-11 16:26:04.000000000 +0100
++++ openssl-1.0.1e/ssl/t1_lib.c 2013-10-24 09:41:11.892179845 +0200
+@@ -204,31 +204,8 @@ static int nid_list[] =
+
+ static int pref_list[] =
+ {
+- NID_sect571r1, /* sect571r1 (14) */
+- NID_sect571k1, /* sect571k1 (13) */
+- NID_secp521r1, /* secp521r1 (25) */
+- NID_sect409k1, /* sect409k1 (11) */
+- NID_sect409r1, /* sect409r1 (12) */
+ NID_secp384r1, /* secp384r1 (24) */
+- NID_sect283k1, /* sect283k1 (9) */
+- NID_sect283r1, /* sect283r1 (10) */
+- NID_secp256k1, /* secp256k1 (22) */
+ NID_X9_62_prime256v1, /* secp256r1 (23) */
+- NID_sect239k1, /* sect239k1 (8) */
+- NID_sect233k1, /* sect233k1 (6) */
+- NID_sect233r1, /* sect233r1 (7) */
+- NID_secp224k1, /* secp224k1 (20) */
+- NID_secp224r1, /* secp224r1 (21) */
+- NID_sect193r1, /* sect193r1 (4) */
+- NID_sect193r2, /* sect193r2 (5) */
+- NID_secp192k1, /* secp192k1 (18) */
+- NID_X9_62_prime192v1, /* secp192r1 (19) */
+- NID_sect163k1, /* sect163k1 (1) */
+- NID_sect163r1, /* sect163r1 (2) */
+- NID_sect163r2, /* sect163r2 (3) */
+- NID_secp160k1, /* secp160k1 (15) */
+- NID_secp160r1, /* secp160r1 (16) */
+- NID_secp160r2, /* secp160r2 (17) */
+ };
+
+ int tls1_ec_curve_id2nid(int curve_id)
diff --git a/openssl.spec b/openssl.spec
index bd655d2..a843a76 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -21,7 +21,7 @@
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 1.0.1e
-Release: 28%{?dist}
+Release: 29%{?dist}
Epoch: 1
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
@@ -73,7 +73,7 @@ Patch69: openssl-1.0.1c-dh-1024.patch
Patch70: openssl-1.0.1e-fips-ec.patch
Patch71: openssl-1.0.1e-manfix.patch
Patch72: openssl-1.0.1e-fips-ctor.patch
-Patch73: openssl-1.0.1e-speed-suiteb.patch
+Patch73: openssl-1.0.1e-ecc-suiteb.patch
# Backported fixes including security fixes
Patch81: openssl-1.0.1-beta2-padlock64.patch
Patch82: openssl-1.0.1e-backports.patch
@@ -456,6 +456,9 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
%postun libs -p /sbin/ldconfig
%changelog
+* Thu Oct 24 2013 Tomáš Mráz <tmraz at redhat.com> 1.0.1e-29
+- do not advertise ECC curves we do not support (#1022493)
+
* Wed Oct 16 2013 Tomáš Mráz <tmraz at redhat.com> 1.0.1e-28
- only ECC NIST Suite B curves support
- drop -fips subpackage
More information about the scm-commits
mailing list