gnutls/gnutls-2.12.21-fips-algorithms.patch

diff -up gnutls-2.12.21/lib/gcrypt/init.c.fips gnutls-2.12.21/lib/gcrypt/init.c
--- gnutls-2.12.21/lib/gcrypt/init.c.fips	2012-01-06 20:06:23.000000000 +0100
+++ gnutls-2.12.21/lib/gcrypt/init.c	2012-11-09 19:57:54.651624659 +0100
@@ -43,6 +43,8 @@ static struct gcry_thread_cbs gct = {
   .recvmsg = NULL,
 };
 
+int gnutls_gcrypt_fips;
+
 int
 gnutls_crypto_init (void)
 {
@@ -72,6 +74,8 @@ gnutls_crypto_init (void)
           return GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY;
         }
 
+      gnutls_gcrypt_fips = gcry_fips_mode_active();
+
       /* for gcrypt in order to be able to allocate memory */
       gcry_control (GCRYCTL_DISABLE_SECMEM, NULL, 0);
 
diff -up gnutls-2.12.21/lib/gnutls_algorithms.c.fips gnutls-2.12.21/lib/gnutls_algorithms.c
--- gnutls-2.12.21/lib/gnutls_algorithms.c.fips	2012-01-06 20:06:23.000000000 +0100
+++ gnutls-2.12.21/lib/gnutls_algorithms.c	2012-11-28 14:19:34.507948036 +0100
@@ -44,11 +44,11 @@ typedef struct
 } gnutls_sec_params_entry;
 
 static const gnutls_sec_params_entry sec_params[] = {
-  {"Weak", GNUTLS_SEC_PARAM_WEAK, 64, 816, 1024, 128, 128},
-  {"Low", GNUTLS_SEC_PARAM_LOW, 80, 1248, 2048, 160, 160},
-  {"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2432, 3072, 224, 224},
-  {"High", GNUTLS_SEC_PARAM_HIGH, 128, 3248, 3072, 256, 256},
-  {"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15424, 3072, 512, 512},
+  {"Weak", GNUTLS_SEC_PARAM_WEAK, 64, 1024, 1024, 128, 128},
+  {"Low", GNUTLS_SEC_PARAM_LOW, 80, 1280, 2048, 160, 160},
+  {"Normal", GNUTLS_SEC_PARAM_NORMAL, 112, 2560, 3072, 224, 224},
+  {"High", GNUTLS_SEC_PARAM_HIGH, 128, 3328, 3072, 256, 256},
+  {"Ultra", GNUTLS_SEC_PARAM_ULTRA, 256, 15616, 3072, 512, 512},
   {NULL, 0, 0, 0, 0, 0}
 };
 
diff -up gnutls-2.12.21/lib/gnutls_priority.c.fips gnutls-2.12.21/lib/gnutls_priority.c
--- gnutls-2.12.21/lib/gnutls_priority.c.fips	2012-11-08 17:11:11.000000000 +0100
+++ gnutls-2.12.21/lib/gnutls_priority.c	2012-11-09 19:57:54.651624659 +0100
@@ -30,6 +30,7 @@
 #include "gnutls_algorithms.h"
 #include "gnutls_errors.h"
 #include <gnutls_num.h>
+#include <gcrypt.h>
 
 static void
 break_comma_list (char *etag,
@@ -223,6 +224,13 @@ static const int protocol_priority[] = {
   0
 };
 
+static const int protocol_priority_fips[] = {
+  GNUTLS_TLS1_2,
+  GNUTLS_TLS1_1,
+  GNUTLS_TLS1_0,
+  0
+};
+
 static const int kx_priority_performance[] = {
   GNUTLS_KX_RSA,
   GNUTLS_KX_DHE_RSA,
@@ -269,6 +277,13 @@ static const int cipher_priority_perform
   0
 };
 
+static const int cipher_priority_performance_fips[] = {
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
+  GNUTLS_CIPHER_AES_256_CBC,
+  0
+};
+
 static const int cipher_priority_normal[] = {
   GNUTLS_CIPHER_AES_128_CBC,
 #ifdef	ENABLE_CAMELLIA
@@ -284,6 +299,13 @@ static const int cipher_priority_normal[
   0
 };
 
+static const int cipher_priority_normal_fips[] = {
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
+  0
+};
+
 static const int cipher_priority_secure128[] = {
   GNUTLS_CIPHER_AES_128_CBC,
 #ifdef	ENABLE_CAMELLIA
@@ -295,6 +317,11 @@ static const int cipher_priority_secure1
   0
 };
 
+static const int cipher_priority_secure128_fips[] = {
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
+  0
+};
 
 static const int cipher_priority_secure256[] = {
   GNUTLS_CIPHER_AES_256_CBC,
@@ -311,6 +338,13 @@ static const int cipher_priority_secure2
   0
 };
 
+static const int cipher_priority_secure256_fips[] = {
+  GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
+  0
+};
+
 /* The same as cipher_priority_security_normal + arcfour-40. */
 static const int cipher_priority_export[] = {
   GNUTLS_CIPHER_AES_128_CBC,
@@ -362,6 +396,12 @@ static const int mac_priority_normal[] =
   0
 };
 
+static const int mac_priority_normal_fips[] = {
+  GNUTLS_MAC_SHA1,
+  GNUTLS_MAC_SHA256,
+  0
+};
+
 
 static const int mac_priority_secure[] = {
   GNUTLS_MAC_SHA256,
@@ -462,6 +502,8 @@ gnutls_priority_set (gnutls_session_t se
 
 #define MAX_ELEMENTS 48
 
+extern int gnutls_gcrypt_fips;
+
 /**
  * gnutls_priority_init:
  * @priority_cache: is a #gnutls_prioritity_t structure.
@@ -561,7 +603,7 @@ gnutls_priority_init (gnutls_priority_t
    */
   if (strcasecmp (broken_list[0], "NONE") != 0)
     {
-      _set_priority (&(*priority_cache)->protocol, protocol_priority);
+      _set_priority (&(*priority_cache)->protocol, gnutls_gcrypt_fips?protocol_priority_fips:protocol_priority);
       _set_priority (&(*priority_cache)->compression, comp_priority);
       _set_priority (&(*priority_cache)->cert_type, cert_type_priority_default);
       _set_priority (&(*priority_cache)->sign_algo, sign_priority_default);
@@ -577,17 +619,17 @@ gnutls_priority_init (gnutls_priority_t
       if (strcasecmp (broken_list[i], "PERFORMANCE") == 0)
         {
           _set_priority (&(*priority_cache)->cipher,
-                         cipher_priority_performance);
+                         gnutls_gcrypt_fips?cipher_priority_performance_fips:cipher_priority_performance);
           _set_priority (&(*priority_cache)->kx, kx_priority_performance);
-          _set_priority (&(*priority_cache)->mac, mac_priority_normal);
+          _set_priority (&(*priority_cache)->mac, gnutls_gcrypt_fips?mac_priority_normal_fips:mac_priority_normal);
           _set_priority (&(*priority_cache)->sign_algo,
                          sign_priority_default);
         }
       else if (strcasecmp (broken_list[i], "NORMAL") == 0)
         {
-          _set_priority (&(*priority_cache)->cipher, cipher_priority_normal);
+          _set_priority (&(*priority_cache)->cipher, gnutls_gcrypt_fips?cipher_priority_normal_fips:cipher_priority_normal);
           _set_priority (&(*priority_cache)->kx, kx_priority_secure);
-          _set_priority (&(*priority_cache)->mac, mac_priority_normal);
+          _set_priority (&(*priority_cache)->mac, gnutls_gcrypt_fips?mac_priority_normal_fips:mac_priority_normal);
           _set_priority (&(*priority_cache)->sign_algo,
                          sign_priority_default);
         }
@@ -595,7 +637,7 @@ gnutls_priority_init (gnutls_priority_t
                || strcasecmp (broken_list[i], "SECURE") == 0)
         {
           _set_priority (&(*priority_cache)->cipher,
-                         cipher_priority_secure256);
+                         gnutls_gcrypt_fips?cipher_priority_secure256_fips:cipher_priority_secure256);
           _set_priority (&(*priority_cache)->kx, kx_priority_secure);
           _set_priority (&(*priority_cache)->mac, mac_priority_secure);
           _set_priority (&(*priority_cache)->sign_algo,
@@ -604,7 +646,7 @@ gnutls_priority_init (gnutls_priority_t
       else if (strcasecmp (broken_list[i], "SECURE128") == 0)
         {
           _set_priority (&(*priority_cache)->cipher,
-                         cipher_priority_secure128);
+                         gnutls_gcrypt_fips?cipher_priority_secure128_fips:cipher_priority_secure128);
           _set_priority (&(*priority_cache)->kx, kx_priority_secure);
           _set_priority (&(*priority_cache)->mac, mac_priority_secure);
           _set_priority (&(*priority_cache)->sign_algo,
@@ -646,7 +688,7 @@ gnutls_priority_init (gnutls_priority_t
               if (strncasecmp (&broken_list[i][1], "VERS-TLS-ALL", 12) == 0)
                 {
                   bulk_fn (&(*priority_cache)->protocol,
-                                 protocol_priority);
+                                 gnutls_gcrypt_fips?protocol_priority_fips:protocol_priority);
                 }
               else
                 {
@@ -718,7 +760,7 @@ gnutls_priority_init (gnutls_priority_t
           else if (strncasecmp (&broken_list[i][1], "CIPHER-ALL", 7) == 0)
             {
                   bulk_fn (&(*priority_cache)->cipher,
-                                cipher_priority_normal);
+                                gnutls_gcrypt_fips?cipher_priority_normal_fips:cipher_priority_normal);
             }
           else
             goto error;