Pedro Monreal Gonzalez
8c598ed63d
* Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
* Add openssl-3-fix-hmac-digest-detection-s390x.patch
* Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch
- Add hardware acceleration for full AES-XTS jsc#PED-10273
* Add openssl-3-hw-acceleration-aes-xts-s390x.patch
- Support MSA 12 SHA3 on s390x jsc#PED-10280
* Add openssl-3-add_EVP_DigestSqueeze_api.patch
* Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
* Add openssl-3-add-xof-state-handling-s3_absorb.patch
* Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
* Add openssl-3-fix-state-handling-sha3_final_s390x.patch
* Add openssl-3-fix-state-handling-shake_final_s390x.patch
* Add openssl-3-fix-state-handling-keccak_final_s390x.patch
* Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
* Add openssl-3-add-defines-CPACF-funcs.patch
* Add openssl-3-add-hw-acceleration-hmac.patch
* Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
* Add openssl-3-fix-s390x_sha3_absorb.patch
* Add openssl-3-fix-s390x_shake_squeeze.patch
- Update to 3.2.3:
* Changes between 3.2.2 and 3.2.3:
- Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
- Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
* Changes between 3.2.1 and 3.2.2:
- Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
- Fixed an issue where checking excessively long DSA keys or parameters may
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=121
86 lines
2.9 KiB
Diff
86 lines
2.9 KiB
Diff
From 42ed594a3a905830374fb65cced431748f8c639c Mon Sep 17 00:00:00 2001
|
|
From: Dmitry Belyavskiy <dbelyavs@redhat.com>
|
|
Date: Thu, 4 Apr 2024 11:50:58 +0200
|
|
Subject: [PATCH 45/50] 0115-skip-quic-pairwise.patch
|
|
|
|
Patch-name: 0115-skip-quic-pairwise.patch
|
|
Patch-id: 115
|
|
Patch-status: |
|
|
# Amend tests according to Fedora/RHEL code
|
|
---
|
|
test/quicapitest.c | 4 +++-
|
|
test/recipes/01-test_symbol_presence.t | 1 +
|
|
test/recipes/30-test_pairwise_fail.t | 13 +++++++++++--
|
|
3 files changed, 15 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/test/quicapitest.c b/test/quicapitest.c
|
|
index 41cf0fc7a8..0fb7492700 100644
|
|
--- a/test/quicapitest.c
|
|
+++ b/test/quicapitest.c
|
|
@@ -2139,7 +2139,9 @@ int setup_tests(void)
|
|
ADD_TEST(test_cipher_find);
|
|
ADD_TEST(test_version);
|
|
#if defined(DO_SSL_TRACE_TEST)
|
|
- ADD_TEST(test_ssl_trace);
|
|
+ if (is_fips == 0) {
|
|
+ ADD_TEST(test_ssl_trace);
|
|
+ }
|
|
#endif
|
|
ADD_TEST(test_quic_forbidden_apis_ctx);
|
|
ADD_TEST(test_quic_forbidden_apis);
|
|
diff --git a/test/recipes/30-test_pairwise_fail.t b/test/recipes/30-test_pairwise_fail.t
|
|
index c837d48fb4..f06ef04b1a 100644
|
|
--- a/test/recipes/30-test_pairwise_fail.t
|
|
+++ b/test/recipes/30-test_pairwise_fail.t
|
|
@@ -9,7 +9,7 @@
|
|
use strict;
|
|
use warnings;
|
|
|
|
-use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file);
|
|
+use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file with);
|
|
use OpenSSL::Test::Utils;
|
|
|
|
BEGIN {
|
|
@@ -31,28 +31,37 @@ run(test(["fips_version_test", "-config", $provconf, ">=3.1.0"]),
|
|
SKIP: {
|
|
skip "Skip RSA test because of no rsa in this build", 1
|
|
if disabled("rsa");
|
|
+ with({ exit_checker => sub {my $val = shift; return $val == 134; } },
|
|
+ sub {
|
|
ok(run(test(["pairwise_fail_test", "-config", $provconf,
|
|
"-pairwise", "rsa"])),
|
|
"fips provider rsa keygen pairwise failure test");
|
|
+ });
|
|
}
|
|
|
|
SKIP: {
|
|
skip "Skip EC test because of no ec in this build", 2
|
|
if disabled("ec");
|
|
+ with({ exit_checker => sub {my $val = shift; return $val == 134; } },
|
|
+ sub {
|
|
ok(run(test(["pairwise_fail_test", "-config", $provconf,
|
|
"-pairwise", "ec"])),
|
|
"fips provider ec keygen pairwise failure test");
|
|
+ });
|
|
|
|
skip "FIPS provider version is too old", 1
|
|
if !$fips_exit;
|
|
+ with({ exit_checker => sub {my $val = shift; return $val == 134; } },
|
|
+ sub {
|
|
ok(run(test(["pairwise_fail_test", "-config", $provconf,
|
|
"-pairwise", "eckat"])),
|
|
"fips provider ec keygen kat failure test");
|
|
+ });
|
|
}
|
|
|
|
SKIP: {
|
|
skip "Skip DSA tests because of no dsa in this build", 2
|
|
- if disabled("dsa");
|
|
+ if 1; #if disabled("dsa");
|
|
ok(run(test(["pairwise_fail_test", "-config", $provconf,
|
|
"-pairwise", "dsa", "-dsaparam", data_file("dsaparam.pem")])),
|
|
"fips provider dsa keygen pairwise failure test");
|
|
--
|
|
2.44.0
|
|
|