rpms
/
openssl
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

drop weak ciphers from the default TLS ciphersuite list 

- add back some symbols that were dropped with update to 1.0.1 branch
- more FIPS validation requirement changes
This commit is contained in:
Tomas Mraz 2013-12-18 15:55:26 +01:00
parent ad237d19e6
commit dc728e2d8b
4 changed files with 264 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
openssl-1.0.1e-compat-symbols.patch Normal file
View File

@ -0,0 +1,46 @@
diff -up openssl-1.0.1e/crypto/dsa/dsa_key.c.compat openssl-1.0.1e/crypto/dsa/dsa_key.c
--- openssl-1.0.1e/crypto/dsa/dsa_key.c.compat 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/dsa/dsa_key.c 2013-12-11 16:34:58.638549687 +0100
@@ -68,6 +68,11 @@
#include <openssl/fips.h>
#include <openssl/evp.h>
+/* just a compatibility symbol - no-op */
+void FIPS_corrupt_dsa_keygen(void)
+ {
+ }
+
static int fips_check_dsa(DSA *dsa)
{
EVP_PKEY *pk;
diff -up openssl-1.0.1e/crypto/engine/eng_all.c.compat openssl-1.0.1e/crypto/engine/eng_all.c
--- openssl-1.0.1e/crypto/engine/eng_all.c.compat 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/engine/eng_all.c 2013-12-11 16:32:13.512820424 +0100
@@ -62,6 +62,11 @@
#include <openssl/fips.h>
#endif
+/* just backwards compatibility symbol - no-op */
+void ENGINE_load_aesni (void)
+{
+}
+
void ENGINE_load_builtin_engines(void)
{
/* Some ENGINEs need this */
diff -up openssl-1.0.1e/crypto/fips/fips.c.compat openssl-1.0.1e/crypto/fips/fips.c
--- openssl-1.0.1e/crypto/fips/fips.c.compat 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/fips/fips.c 2013-12-11 16:38:52.524831858 +0100
@@ -111,6 +111,12 @@ int FIPS_module_mode(void)
return ret;
}
+/* just a compat symbol - return NULL */
+const void *FIPS_rand_check(void)
+ {
+ return NULL;
+ }
+
int FIPS_selftest_failed(void)
{
int ret = 0;

208
openssl-1.0.1e-new-fips-reqs.patch
View File

@ -1,6 +1,131 @@
diff -up openssl-1.0.1e/crypto/bn/bn.h.fips-reqs openssl-1.0.1e/crypto/bn/bn.h
--- openssl-1.0.1e/crypto/bn/bn.h.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/bn/bn.h 2013-12-13 11:58:58.623821669 +0100
@@ -386,9 +386,11 @@ int BN_GENCB_call(BN_GENCB *cb, int a, i
* of Applied Cryptography [Menezes, van Oorschot, Vanstone; CRC Press 1996];
* original paper: Damgaard, Landrock, Pomerance: Average case error estimates
* for the strong probable prime test. -- Math. Comp. 61 (1993) 177-194) */
-#define BN_prime_checks_for_size(b) ((b) >= 1300 ? 2 : \
- (b) >= 850 ? 3 : \
- (b) >= 650 ? 4 : \
+/* FIPS 186-4 specifies error rate given the security strength of the
+ * resulting RSA key bit size. So the error rate is 2^-112 or 2^-128 for
+ * 1024 and 1536 bit keys.
+ */
+#define BN_prime_checks_for_size(b) ((b) >= 1300 ? 4 : \
(b) >= 550 ? 5 : \
(b) >= 450 ? 6 : \
(b) >= 400 ? 7 : \
diff -up openssl-1.0.1e/crypto/dh/dh_gen.c.fips-reqs openssl-1.0.1e/crypto/dh/dh_gen.c
--- openssl-1.0.1e/crypto/dh/dh_gen.c.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/dh/dh_gen.c 2013-12-11 16:50:54.181130000 +0100
@@ -125,7 +125,7 @@ static int dh_builtin_genparams(DH *ret,
return 0;
}
- if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+ if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN))
{
DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
goto err;
diff -up openssl-1.0.1e/crypto/dh/dh.h.fips-reqs openssl-1.0.1e/crypto/dh/dh.h
--- openssl-1.0.1e/crypto/dh/dh.h.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/dh/dh.h 2013-12-11 16:51:18.345675737 +0100
@@ -78,6 +78,7 @@
#endif
#define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024
+#define OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN 2048
#define DH_FLAG_CACHE_MONT_P 0x01
#define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH
diff -up openssl-1.0.1e/crypto/dh/dh_check.c.fips-reqs openssl-1.0.1e/crypto/dh/dh_check.c
--- openssl-1.0.1e/crypto/dh/dh_check.c.fips-reqs 2013-02-11 16:26:04.000000000 +0100
+++ openssl-1.0.1e/crypto/dh/dh_check.c 2013-12-11 18:02:26.759075219 +0100
@@ -134,7 +134,33 @@ int DH_check_pub_key(const DH *dh, const
BN_sub_word(q,1);
if (BN_cmp(pub_key,q)>=0)
*ret|=DH_CHECK_PUBKEY_TOO_LARGE;
+#ifdef OPENSSL_FIPS
+ if (FIPS_mode())
+ {
+ BN_CTX *ctx = NULL;
+ ctx = BN_CTX_new();
+ if (ctx == NULL)
+ goto err;
+
+ if (BN_mod_exp_mont(q, pub_key, dh->q, dh->p, ctx, NULL) <= 0)
+ {
+ BN_CTX_free(ctx);
+ goto err;
+ }
+ if (!BN_is_one(q))
+ {
+ /* it would be more correct to add new return flag
+ * for this test, but we do not want to do it
+ * so just error out
+ */
+ BN_CTX_free(ctx);
+ goto err;
+ }
+
+ BN_CTX_free(ctx);
+ }
+#endif
ok = 1;
err:
if (q != NULL) BN_free(q);
diff -up openssl-1.0.1e/crypto/dsa/dsa_gen.c.fips-reqs openssl-1.0.1e/crypto/dsa/dsa_gen.c
--- openssl-1.0.1e/crypto/dsa/dsa_gen.c.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/dsa/dsa_gen.c 2013-12-11 16:47:25.882425812 +0100
@@ -159,7 +159,6 @@ int dsa_builtin_paramgen(DSA *ret, size_
}
if (FIPS_module_mode() &&
- (bits != 1024 || qbits != 160) &&
(bits != 2048 || qbits != 224) &&
(bits != 2048 || qbits != 256) &&
(bits != 3072 || qbits != 256))
diff -up openssl-1.0.1e/crypto/dsa/dsa.h.fips-reqs openssl-1.0.1e/crypto/dsa/dsa.h
--- openssl-1.0.1e/crypto/dsa/dsa.h.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/dsa/dsa.h 2013-12-13 11:53:04.637827187 +0100
@@ -89,6 +89,7 @@
#endif
#define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS 1024
+#define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN 2048
#define DSA_FLAG_CACHE_MONT_P 0x01
#define DSA_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DSA
@@ -254,9 +255,9 @@ int DSAparams_print_fp(FILE *fp, const D
int DSA_print_fp(FILE *bp, const DSA *x, int off);
#endif
-#define DSS_prime_checks 50
-/* Primality test according to FIPS PUB 186[-1], Appendix 2.1:
- * 50 rounds of Rabin-Miller */
+#define DSS_prime_checks 64
+/* Primality test according to FIPS PUB 186[-4], Appendix 2.1:
+ * 64 rounds of Rabin-Miller */
#define DSA_is_prime(n, callback, cb_arg) \
BN_is_prime(n, DSS_prime_checks, callback, NULL, cb_arg)
diff -up openssl-1.0.1e/crypto/dsa/dsa_key.c.fips-reqs openssl-1.0.1e/crypto/dsa/dsa_key.c
--- openssl-1.0.1e/crypto/dsa/dsa_key.c.fips-reqs 2013-12-11 16:34:58.000000000 +0100
+++ openssl-1.0.1e/crypto/dsa/dsa_key.c 2013-12-11 16:47:57.815146894 +0100
@@ -127,7 +127,7 @@ static int dsa_builtin_keygen(DSA *dsa)
#ifdef OPENSSL_FIPS
if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
- && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
+ && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN))
{
DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);
goto err;
diff -up openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs openssl-1.0.1e/crypto/fips/fips_drbg_rand.c
--- openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs 2013-11-15 16:54:49.000000000 +0100
+++ openssl-1.0.1e/crypto/fips/fips_drbg_rand.c 2013-11-19 14:48:38.935251819 +0100
--- openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs 2013-11-26 14:36:35.551708593 +0100
+++ openssl-1.0.1e/crypto/fips/fips_drbg_rand.c 2013-11-26 14:36:35.601709689 +0100
@@ -77,7 +77,8 @@ static int fips_drbg_bytes(unsigned char
int rv = 0;
unsigned char *adin = NULL;
@ -50,8 +175,8 @@ diff -up openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs openssl-1.0.1e/cr
}
diff -up openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c
--- openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs 2013-11-15 16:54:49.390224209 +0100
+++ openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c 2013-11-15 16:54:49.427225021 +0100
--- openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs 2013-11-26 14:36:35.555708680 +0100
+++ openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c 2013-11-26 14:36:35.601709689 +0100
@@ -340,6 +340,42 @@ static const unsigned char kat_RSA_X931_
0x60, 0x83, 0x18, 0x88, 0xA3, 0xF5, 0x59, 0xC3
};
@ -123,7 +248,7 @@ diff -up openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs openssl-1.0.1e
}
diff -up openssl-1.0.1e/crypto/modes/gcm128.c.fips-reqs openssl-1.0.1e/crypto/modes/gcm128.c
--- openssl-1.0.1e/crypto/modes/gcm128.c.fips-reqs 2013-02-11 16:26:04.000000000 +0100
+++ openssl-1.0.1e/crypto/modes/gcm128.c 2013-11-15 16:54:49.427225021 +0100
+++ openssl-1.0.1e/crypto/modes/gcm128.c 2013-11-26 14:36:35.601709689 +0100
@@ -898,6 +898,10 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT
# endif
#endif
@ -147,8 +272,8 @@ diff -up openssl-1.0.1e/crypto/modes/gcm128.c.fips-reqs openssl-1.0.1e/crypto/mo
if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
return -1;
diff -up openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs openssl-1.0.1e/crypto/modes/modes_lcl.h
--- openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs 2013-11-15 16:54:48.995215544 +0100
+++ openssl-1.0.1e/crypto/modes/modes_lcl.h 2013-11-15 16:54:49.427225021 +0100
--- openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs 2013-11-26 14:36:35.089698458 +0100
+++ openssl-1.0.1e/crypto/modes/modes_lcl.h 2013-11-26 14:36:35.601709689 +0100
@@ -115,6 +115,7 @@ struct gcm128_context {
unsigned int mres, ares;
block128_f block;
@ -158,8 +283,8 @@ diff -up openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs openssl-1.0.1e/crypto
struct xts128_context {
diff -up openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs openssl-1.0.1e/crypto/rand/md_rand.c
--- openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs 2013-11-15 16:54:49.000000000 +0100
+++ openssl-1.0.1e/crypto/rand/md_rand.c 2013-11-19 14:43:00.592829775 +0100
--- openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs 2013-11-26 14:36:35.557708724 +0100
+++ openssl-1.0.1e/crypto/rand/md_rand.c 2013-11-26 14:36:35.602709711 +0100
@@ -143,12 +143,6 @@ static long md_count[2]={0,0};
static double entropy=0;
static int initialized=0;
@ -333,8 +458,8 @@ diff -up openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs openssl-1.0.1e/crypto/ra
return ret;
}
diff -up openssl-1.0.1e/crypto/rand/rand.h.fips-reqs openssl-1.0.1e/crypto/rand/rand.h
--- openssl-1.0.1e/crypto/rand/rand.h.fips-reqs 2013-11-19 14:32:25.182891113 +0100
+++ openssl-1.0.1e/crypto/rand/rand.h 2013-11-19 14:32:03.546416472 +0100
--- openssl-1.0.1e/crypto/rand/rand.h.fips-reqs 2013-11-26 14:36:35.558708746 +0100
+++ openssl-1.0.1e/crypto/rand/rand.h 2013-11-26 14:36:35.602709711 +0100
@@ -124,6 +124,8 @@ void RAND_set_fips_drbg_type(int type, i
int RAND_init_fips(void);
#endif
@ -345,8 +470,8 @@ diff -up openssl-1.0.1e/crypto/rand/rand.h.fips-reqs openssl-1.0.1e/crypto/rand/
/* The following lines are auto generated by the script mkerr.pl. Any changes
* made after this point may be overwritten when the script is next run.
diff -up openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs openssl-1.0.1e/crypto/rand/rand_lcl.h
--- openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs 2013-11-15 16:54:49.122218330 +0100
+++ openssl-1.0.1e/crypto/rand/rand_lcl.h 2013-11-15 16:54:49.427225021 +0100
--- openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs 2013-11-26 14:36:35.239701748 +0100
+++ openssl-1.0.1e/crypto/rand/rand_lcl.h 2013-11-26 14:36:35.602709711 +0100
@@ -112,7 +112,7 @@
#ifndef HEADER_RAND_LCL_H
#define HEADER_RAND_LCL_H
@ -358,7 +483,7 @@ diff -up openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs openssl-1.0.1e/crypto/r
#if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
diff -up openssl-1.0.1e/crypto/rand/rand_lib.c.fips-reqs openssl-1.0.1e/crypto/rand/rand_lib.c
--- openssl-1.0.1e/crypto/rand/rand_lib.c.fips-reqs 2013-02-11 16:26:04.000000000 +0100
+++ openssl-1.0.1e/crypto/rand/rand_lib.c 2013-11-19 14:44:22.422624833 +0100
+++ openssl-1.0.1e/crypto/rand/rand_lib.c 2013-11-26 14:36:35.602709711 +0100
@@ -181,6 +181,41 @@ int RAND_status(void)
return 0;
}
@ -416,3 +541,58 @@ diff -up openssl-1.0.1e/crypto/rand/rand_lib.c.fips-reqs openssl-1.0.1e/crypto/r
return 1;
}
diff -up openssl-1.0.1e/crypto/rsa/rsa_gen.c.fips-reqs openssl-1.0.1e/crypto/rsa/rsa_gen.c
--- openssl-1.0.1e/crypto/rsa/rsa_gen.c.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/rsa/rsa_gen.c 2013-12-11 16:45:18.661552527 +0100
@@ -182,7 +182,7 @@ static int rsa_builtin_keygen(RSA *rsa,
return 0;
}
- if (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)
+ if (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS_GEN)
{
FIPSerr(FIPS_F_RSA_BUILTIN_KEYGEN,FIPS_R_KEY_TOO_SHORT);
return 0;
diff -up openssl-1.0.1e/crypto/rsa/rsa.h.fips-reqs openssl-1.0.1e/crypto/rsa/rsa.h
--- openssl-1.0.1e/crypto/rsa/rsa.h.fips-reqs 2013-11-26 14:36:35.000000000 +0100
+++ openssl-1.0.1e/crypto/rsa/rsa.h 2013-12-11 16:45:05.937265150 +0100
@@ -166,6 +166,8 @@ struct rsa_st
#define OPENSSL_RSA_FIPS_MIN_MODULUS_BITS 1024
+#define OPENSSL_RSA_FIPS_MIN_MODULUS_BITS_GEN 2048
+
#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
# define OPENSSL_RSA_SMALL_MODULUS_BITS 3072
#endif
diff -up openssl-1.0.1e/ssl/t1_enc.c.fips-reqs openssl-1.0.1e/ssl/t1_enc.c
--- openssl-1.0.1e/ssl/t1_enc.c.fips-reqs 2013-02-11 16:26:04.000000000 +0100
+++ openssl-1.0.1e/ssl/t1_enc.c 2013-11-26 14:36:35.603709733 +0100
@@ -291,6 +291,27 @@ static int tls1_PRF(long digest_mask,
err:
return ret;
}
+
+int private_tls1_PRF(long digest_mask,
+ const void *seed1, int seed1_len,
+ const void *seed2, int seed2_len,
+ const void *seed3, int seed3_len,
+ const void *seed4, int seed4_len,
+ const void *seed5, int seed5_len,
+ const unsigned char *sec, int slen,
+ unsigned char *out1,
+ unsigned char *out2, int olen)
+ {
+ return tls1_PRF(digest_mask,
+ seed1, seed1_len,
+ seed2, seed2_len,
+ seed3, seed3_len,
+ seed4, seed4_len,
+ seed5, seed5_len,
+ sec, slen,
+ out1, out2, olen);
+ }
+
static int tls1_generate_key_block(SSL *s, unsigned char *km,
unsigned char *tmp, int num)
{

12
openssl-1.0.1e-weak-ciphers.patch Normal file
View File

@ -0,0 +1,12 @@
diff -up openssl-1.0.1e/ssl/ssl.h.weak-ciphers openssl-1.0.1e/ssl/ssl.h
--- openssl-1.0.1e/ssl/ssl.h.weak-ciphers 2013-12-18 15:50:40.881620314 +0100
+++ openssl-1.0.1e/ssl/ssl.h 2013-12-18 14:25:25.596566704 +0100
@@ -331,7 +331,7 @@ extern "C" {
/* The following cipher list is used by default.
* It also is substituted when an application-defined cipher list string
* starts with 'DEFAULT'. */
-#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2"
+#define SSL_DEFAULT_CIPHER_LIST "ALL:!aNULL:!eNULL:!SSLv2:!EXPORT:!RC2:!DES"
/* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
* starts with a reasonable order, and all we have to do for DEFAULT is
* throwing out anonymous and unencrypted ciphersuites!

15
openssl.spec
View File

@ -21,7 +21,7 @@
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 1.0.1e
Release: 34%{?dist}
Release: 35%{?dist}
Epoch: 1
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
@ -75,7 +75,9 @@ Patch71: openssl-1.0.1e-manfix.patch
Patch72: openssl-1.0.1e-fips-ctor.patch
Patch73: openssl-1.0.1e-ecc-suiteb.patch
Patch74: openssl-1.0.1e-no-md5-verify.patch
Patch75: openssl-1.0.1e-new-fips-reqs.patch
Patch75: openssl-1.0.1e-compat-symbols.patch
Patch76: openssl-1.0.1e-new-fips-reqs.patch
Patch77: openssl-1.0.1e-weak-ciphers.patch
# Backported fixes including security fixes
Patch81: openssl-1.0.1-beta2-padlock64.patch
Patch82: openssl-1.0.1e-backports.patch
@ -191,7 +193,9 @@ cp %{SOURCE12} %{SOURCE13} crypto/ec/
%patch72 -p1 -b .fips-ctor
%patch73 -p1 -b .suiteb
%patch74 -p1 -b .no-md5-verify
%patch75 -p1 -b .fips-reqs
%patch75 -p1 -b .compat
%patch76 -p1 -b .fips-reqs
%patch77 -p1 -b .weak-ciphers
%patch81 -p1 -b .padlock64
%patch82 -p1 -b .backports
@ -462,6 +466,11 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
%postun libs -p /sbin/ldconfig
%changelog
* Wed Dec 18 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
- drop weak ciphers from the default TLS ciphersuite list
- add back some symbols that were dropped with update to 1.0.1 branch
- more FIPS validation requirement changes
* Tue Nov 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
- fix locking and reseeding problems with FIPS drbg